From 003ee866b3be88544b87c5636efa7b5cec0f1256 Mon Sep 17 00:00:00 2001
From: Daniel Black <daniel@mariadb.org>
Date: Mon, 9 May 2022 15:47:51 +1000
Subject: [PATCH] healthcheck.sh --connect large noise in error log

The --connect test does a tcp connection. There is no
mysql@::1 or mysql@127.0.0.1 user created so the access
is denied, but the healtcheck is correct.

The entries in the error log because of the default
log_warnings=2.

To avoid hitting max_connect_errors (default 100), a non-connection
way is to look at the proc status for listening sockets.

While normally not a direct correlation to a connection, mariadb
listens and is followed by accepting connections immedately without
anything that can fail inbetween.

We move the previous connect to mariadb_connect for compatibility
if users want to continue with that mechanism. We pre-emtively create
tcp listen as a mechanism and redirect connect to that.

Closes #430
---
 10.6/Dockerfile     |  2 +-
 10.6/healthcheck.sh | 25 ++++++++++++++++++++++++-
 healthcheck.sh      | 25 ++++++++++++++++++++++++-
 3 files changed, 49 insertions(+), 3 deletions(-)

diff --git a/10.6/Dockerfile b/10.6/Dockerfile
index 154579d6..735f0fe4 100644
--- a/10.6/Dockerfile
+++ b/10.6/Dockerfile
@@ -80,7 +80,7 @@ ARG MARIADB_MAJOR=10.6
 ENV MARIADB_MAJOR $MARIADB_MAJOR
 ARG MARIADB_VERSION=1:10.6.7+maria~focal
 ENV MARIADB_VERSION $MARIADB_VERSION
-# release-status:Stable
+# release-status:Old Stable
 # (https://downloads.mariadb.org/rest-api/mariadb/)
 
 # Allowing overriding of REPOSITORY, a URL that includes suite and component for testing and Enterprise Versions
diff --git a/10.6/healthcheck.sh b/10.6/healthcheck.sh
index f6be6f07..6aa8f85d 100755
--- a/10.6/healthcheck.sh
+++ b/10.6/healthcheck.sh
@@ -18,7 +18,9 @@
 # Some tests require SQL privileges.
 #
 # TEST                      MINIMUM GRANTS REQUIRED
-# connect                   none*
+# tcp_connect               none
+# connect                   none
+# mariadb_connect           none*
 # innodb_initialized        USAGE
 # innodb_buffer_pool_loaded USAGE
 # galera_online             USAGE
@@ -46,6 +48,17 @@ _process_sql()
 
 # TESTS
 
+# TCP_LISTENING
+#
+# Test if the pid 1, the final mariadbd process, has any TCP ports
+# listening. The listening occurs immediately before the accepting of
+# connections in the MariaDB server so be adequate as a healthcheck.
+# The exception to this if the MariaDB container is started by some form of
+# socket activation.
+tcp_listening()
+{
+	[ "$(lsof -t -p 1 -a -iTCP -sTCP:LISTEN)" = 1 ]
+}
 
 # CONNECT
 #
@@ -53,6 +66,16 @@ _process_sql()
 # of the entrypoint and is listening. The authentication used
 # isn't tested.
 connect()
+{
+	tcp_listening
+}
+
+# MARIADB_CONNECT
+#
+# Test that the connection isn't refused by the server using the mariadb client.
+# Note: this was formerly connect, but generated frequent Access Denied errors
+# in the container log.
+mariadb_connect()
 {
 	set +e +o pipefail
 	mariadb ${nodefaults:+--no-defaults} \
diff --git a/healthcheck.sh b/healthcheck.sh
index 3457f439..f6953263 100755
--- a/healthcheck.sh
+++ b/healthcheck.sh
@@ -18,7 +18,9 @@
 # Some tests require SQL privileges.
 #
 # TEST                      MINIMUM GRANTS REQUIRED
-# connect                   none*
+# tcp_connect               none
+# connect                   none
+# mariadb_connect           none*
 # innodb_initialized        USAGE
 # innodb_buffer_pool_loaded USAGE
 # galera_online             USAGE
@@ -46,6 +48,17 @@ _process_sql()
 
 # TESTS
 
+# TCP_LISTENING
+#
+# Test if the pid 1, the final mariadbd process, has any TCP ports
+# listening. The listening occurs immediately before the accepting of
+# connections in the MariaDB server so be adequate as a healthcheck.
+# The exception to this if the MariaDB container is started by some form of
+# socket activation.
+tcp_listening()
+{
+	[ "$(lsof -t -p 1 -a -iTCP -sTCP:LISTEN)" = 1 ]
+}
 
 # CONNECT
 #
@@ -53,6 +66,16 @@ _process_sql()
 # of the entrypoint and is listening. The authentication used
 # isn't tested.
 connect()
+{
+	tcp_listening
+}
+
+# MARIADB_CONNECT
+#
+# Test that the connection isn't refused by the server using the mariadb client.
+# Note: this was formerly connect, but generated frequent Access Denied errors
+# in the container log.
+mariadb_connect()
 {
 	set +e +o pipefail
 	mysql ${nodefaults:+--no-defaults} \