Comments - Haproxy mysql-check user removal
Content reproduced on this site is the property of its respective owners,
and this content is not reviewed in advance by MariaDB. The views, information and opinions
expressed by this content do not necessarily represent those of MariaDB or any other party.
mysql-check requires a user. This is the answer given by the haproxy people too.
Per haproxy docs and other answers there is no password and setting one causes the check to fail. Because there is no password PASSWORD EXIRE options cannot be used. ACCOUNT LOCK I also checked isn't compatible with the haproxy mysql-check.
The user that haproxy uses does not need any access to anything. This is the default for a created user. Per the ha-proxy documentation it doesn't even execute a query and aborts very soon into the protocol.
What could be done is a constraint of the user to the network of the ha-proxy and apply resource constraints.
Any risk based assessment with a basic understanding of haproxy and mariadb and networking shouldn't have a problem here.
I'm looking at working with the haproxy development community to provide you an alternate solution. I hope these options are acceptable to you.