It does not enforce the tls parameter to be set to preferred or anything higher than than (like true). The default value is forced, meaning, it will not use TLS connections.
It's easily solveable by changing the value of tls parameter from the default false
Operator uses the below logic for connecting to MySQL:
queries.go
— https://github.com/percona/percona-xtradb-cluster-operator/blob/main/pkg/pxc/queries/queries.go#L56-L96
It does not enforce the tls parameter to be set to preferred or anything higher than than (like true). The default value is forced, meaning, it will not use TLS connections.
It's easily solveable by changing the value of tls parameter from the default
false— https://github.com/go-sql-driver/mysql#tls
A small example:
The below example will fail:
After allowing it:
it works fine: