MySQL

Deploy MySQL on Kubernetes using the official mysql image. The chart supports standalone and replication architectures, S3-compatible backups, Prometheus metrics, TLS, dual-stack Services, External Secrets Operator, and production hardening controls that can be enabled without changing the development-friendly defaults.

Key Features

• Standalone and source-replica - Single instance or source with read replicas.
• Official MySQL image - Uses docker.io/library/mysql:9.7.0 by default.
• Deterministic credentials - Inline values for development or existing Secrets/External Secrets for production.
• TLS - Server TLS, optional secure transport requirement, internal client TLS, and private-key permission normalization.
• NetworkPolicy - Optional ingress rules plus explicit egress for DNS, same-namespace MySQL, HTTPS, and custom targets.
• S3 backup - Scheduled mysqldump CronJobs with existing Secret support for object storage credentials.
• Observability - mysqld-exporter sidecar with optional ServiceMonitor.
• Dual-stack Services - Optional ipFamilyPolicy and ipFamilies across chart-managed Services.
• Least privilege - Non-root containers, dropped capabilities, and opt-in ServiceAccount token mounting.

Architecture

Installation

HTTPS repository:

helm repo add helmforge https://repo.helmforge.dev
helm repo update
helm install my-mysql helmforge/mysql -f values.yaml

OCI registry:

helm install my-mysql oci://ghcr.io/helmforgedev/helm/mysql -f values.yaml

Deployment Examples

# values.yaml - standalone development or small workload
architecture: standalone

auth:
  rootPassword: 'my-secret-password'
  database: myapp
  username: myuser
  password: 'user-password'

standalone:
  persistence:
    size: 20Gi

metrics:
  enabled: true
  serviceMonitor:
    enabled: true

# values.yaml - source with two read replicas
architecture: replication

auth:
  rootPassword: 'my-secret-password'
  database: myapp
  username: myuser
  password: 'user-password'
  replicationPassword: 'repl-password'

replication:
  source:
    persistence:
      size: 20Gi
  readReplicas:
    replicaCount: 2
    persistence:
      size: 20Gi

# values.yaml - backup credentials from an existing Secret
architecture: standalone

auth:
  existingSecret: mysql-auth
  database: myapp
  username: myapp

standalone:
  persistence:
    size: 20Gi

backup:
  enabled: true
  schedule: '0 3 * * *'
  s3:
    endpoint: https://s3.amazonaws.com
    bucket: my-mysql-backups
    prefix: mysql
    existingSecret: mysql-backup

# values.yaml - production baseline with replication, TLS, backup, and policies
architecture: replication

auth:
  existingSecret: mysql-auth
  database: myapp
  username: myapp

replication:
  source:
    persistence:
      size: 100Gi
    resources:
      requests:
        cpu: 500m
        memory: 1Gi
      limits:
        cpu: '2'
        memory: 2Gi
  readReplicas:
    replicaCount: 2
    persistence:
      size: 100Gi
    resources:
      requests:
        cpu: 250m
        memory: 768Mi
      limits:
        cpu: '1'
        memory: 1536Mi

tls:
  enabled: true
  existingSecret: mysql-tls
  requireSecureTransport: true
  volumePermissions:
    enabled: true
  client:
    enabled: true
    sslMode: REQUIRED

metrics:
  enabled: true
  serviceMonitor:
    enabled: true

networkPolicy:
  enabled: true
  egress:
    enabled: true
    allowDNS: true
    allowSameNamespaceMySQL: true
    allowHTTPS: true

serviceAccount:
  create: true
  automountServiceAccountToken: false

backup:
  enabled: true
  s3:
    endpoint: https://s3.example.com
    bucket: mysql-backups
    existingSecret: mysql-backup

# values.yaml - render ExternalSecret resources for existing ESO clusters
auth:
  existingSecret: mysql-auth

tls:
  enabled: true
  existingSecret: mysql-tls

backup:
  enabled: true
  s3:
    existingSecret: mysql-backup

externalSecrets:
  enabled: true
  apiVersion: external-secrets.io/v1
  secretStoreRef:
    name: platform-secrets
    kind: ClusterSecretStore
  auth:
    enabled: true
    targetName: mysql-auth
    rootPasswordRemoteRef:
      key: prod/mysql
      property: root-password
    userPasswordRemoteRef:
      key: prod/mysql
      property: user-password
    replicationPasswordRemoteRef:
      key: prod/mysql
      property: replication-password
  tls:
    enabled: true
    targetName: mysql-tls
    caRemoteRef:
      key: prod/mysql-tls
      property: ca.crt
    certRemoteRef:
      key: prod/mysql-tls
      property: tls.crt
    keyRemoteRef:
      key: prod/mysql-tls
      property: tls.key
  backup:
    enabled: true
    targetName: mysql-backup
    accessKeyRemoteRef:
      key: prod/mysql-backup
      property: access-key
    secretKeyRemoteRef:
      key: prod/mysql-backup
      property: secret-key

Production Path

Keep defaults for local development, CI smoke tests, and disposable environments. For production, make these decisions explicitly:

• Store auth.*Password, TLS material, and backup credentials in existing Secrets or External Secrets.
• Size replication.source.persistence, replication.readReplicas.persistence, and resources for the actual workload.
• Enable tls.requireSecureTransport when clients should be forced to use encrypted TCP connections.
• Enable metrics and backup before accepting durable workload traffic.
• Enable NetworkPolicy only after modelling required ingress and egress paths.

TLS private key permissions

Some MySQL versions reject private keys projected from Secrets when mode or ownership is too permissive for the runtime user. tls.volumePermissions.enabled copies TLS material into an emptyDir, normalizes ownership for UID/GID 999, and restricts the private key before mysqld starts.

NetworkPolicy egress

networkPolicy.egress.enabled=false preserves default CNI egress behavior. When enabled, use the structured switches for DNS, same-namespace MySQL replication/internal clients, HTTPS to object storage or external secret backends, and networkPolicy.egress.extraTo for platform-specific destinations.

ServiceAccount token mount

serviceAccount.automountServiceAccountToken defaults to false. Keep it disabled unless a sidecar, extension, or platform integration inside the pod needs Kubernetes API credentials.

Configuration Reference

Core and Image

Authentication

Replication, Persistence, and Backup

TLS, Services, Metrics, and Policies

External Secrets Operator

Dual-stack Networking

By default, service.ipFamilyPolicy and service.ipFamilies are unset and the cluster default remains authoritative. Set them only when your cluster supports the requested families.

service:
  ipFamilyPolicy: PreferDualStack
  ipFamilies:
    - IPv4
    - IPv6

Use PreferDualStack for mixed environments. RequireDualStack should be reserved for clusters where both IPv4 and IPv6 are guaranteed.

Upgrade Notes

• Switching from standalone to replication requires a planned migration or re-initialization.
• Backup CronJob changes take effect on the next scheduled run.
• Read replicas are read-only; write traffic must target the source/client Service.

Common Issues

More Information

• MySQL Official Documentation
• MySQL Docker Official Image
• HelmForge MySQL Chart Source