Sherry Yin

新加坡从零考驾照全记录（2026）：BTT、PDL 到路考

2026-10-09T00:00:00+08:00

我在新加坡从零开始考驾照，报的是 CDC（ComfortDelGro Driving Centre）的 Class 3A，也就是自动挡小汽车。从报名到通过 BTT、拿到 PDL，一共用了 11 天。

这篇先记录到 PDL 为止，后面的实践课、FTT 和路考，考完再更新。如果你有中国驾照、打算直接转换，文末有一条容易被忽略的规定。

规定部分我都对照了新加坡警察部队（Traffic Police）的官方页面，链接放在文末。规定会调整，办理前请以官网为准。

先选路线：从零考还是转换

	从零考	中国驾照转换
适合谁	没有驾照，或者手上的驾照不符合转换条件	持有有效的中国驾照
要考什么	BTT、FTT、路考	只需要 BTT
主要麻烦	步骤多，每一步都要抢预约	材料要齐，非英文驾照要找新加坡注册的翻译公司翻译

外国人在新加坡居住不满 12 个月，可以直接用有效的外国驾照开车。住满 12 个月后，就需要换成新加坡驾照。

名词解释

名词	全称	说明
TP	Traffic Police	新加坡警察部队下的交通警察，负责驾照考试和发证
SPF	Singapore Police Force	新加坡警察部队，PDL 在它的 e-Services 网站申请
CDC、BBDC、SSDC	ComfortDelGro Driving Centre、Bukit Batok Driving Centre、Singapore Safety Driving Centre	新加坡的三家驾校，可以学车，也设有理论考试考点
BTT	Basic Theory Test	基础理论考试，学车的第一关；用中国驾照转换也要考
FTT	Final Theory Test	终极理论考试，考 Class 3 或 3A 要先通过它才能路考
IE	Internal Evaluation	CDC 的内部模拟考，第一次学车的驾校学员要先通过它才能约 BTT
Induction Programme		CDC 的入学介绍课，讲整个学车流程，不能取消或改期
PDL	Provisional Driving Licence	学习驾照，电子版，有效期 2 年，有了它才能上实践课
实践课	Practical Lesson	跟教练上路练车，CDC 每节 100 分钟
路考	Practical Driving Test	实际驾驶考试，由 TP 指派的考官主考
Class 3、3A		Class 3 是手动挡；Class 3A 是自动挡，只能开自动挡车
Standard、One Team、Elite Team		CDC 的三种班型，区别见”选哪种班”
PRM	Premium fee	One Team 和 Elite Team 每节实践课的附加费
Stored Value		CDC 的预付储值账户，各项费用从这里扣
VPC	Vehicular Pre-operative Check	实践课阶段的一个项目，CDC 价目表里单独收费
LDCS	Learner Driver Competency Screening	实践课阶段的一个项目，CDC 价目表里单独收费
Booking Portal		CDC 的网上预约系统，网页版和手机 App 都能用
My Learning Journey		CDC App 里的学车进度，显示已经完成和下一步要做的环节
Slot		可预约的时段，视力测试、IE、BTT、实践课都要抢
Singpass		新加坡政府的数字身份，申请 PDL 时用来登录
GST	Goods and Services Tax	新加坡的消费税，目前是 9%

从零考的整体流程

报名驾校
视力测试（包括色盲测试）
Induction Programme 和 IE（Internal Evaluation，驾校内部模拟考），驾校学员才有
BTT（Basic Theory Test，基础理论考试）
拍照，申请 PDL（Provisional Driving Licence，学习驾照）
上实践课
FTT（Final Theory Test，终极理论考试）
路考
拿到驾照

我的时间线：11 天从报名到 PDL

日期	进度	距报名
9 月 28 日	在 CDC 网上报名 Class 3A	第 0 天
10 月 2 日	现场视力测试，通过	第 4 天
10 月 3 日	Zoom 参加 Induction Programme，然后现场考 IE，通过	第 5 天
10 月 7 日	预约实践课：10 月 3 日起每天刷 slot，第 4 天才约到，最早的空位在 11 月 24 日	第 9 天
10 月 9 日	现场考 BTT，通过；在 CDC 拍照，在线申请 PDL	第 11 天

能这么快，主要是每一步都抢到了比较早的 slot。

选哪种班

CDC 的 Class 3A 在 Ubi 有三种班型，区别在于训练车和教练是否固定，每节实践课的加价也不同（含 GST）：

班型	每节实践课加价	训练车	教练
Standard	0	不固定	不固定
One Team	13.08 新元	固定	最多 6 位教练组成的团队
Elite Team	16.35 新元	固定	最多 4 位资深教练组成的团队

报名费方面，Standard 是 185.30 新元，One Team 和 Elite Team 是 201.65 新元，都包含 1 年会籍，另外收 10 新元可退押金。我报的是 Elite Team 的电动车（EV）课程，EV 课程只在 Ubi 开。

预约工具：CDC 网页版和 App

在 CDC 学车，预约、取消、充值、查收据都在它的网上预约系统（Booking Portal）里完成。网页版首页有十个入口，我最常用的是这三个：

My Bookings：查看已经约好的课和考试。
Lesson Booking：约课，比如 Induction Programme、理论课和实践课。
Test Bookings：约 IE、BTT 这类考试。

CDC 网上预约系统首页，红框是最常用的三个入口。

其他几个也会用到：Top-Up Store Value 给储值账户充值，Cancel Booking 取消预约，Account Statement / Receipt 查流水和收据（下面的费用明细就是从这里整理的），Online Learning 是在线学习资源。

建议把 CDC 的手机 App 也装上，随时可以查看 My Learning Journey，也就是自己的学车进度到了哪一步、下一步要做什么，预约也很方便。

报名和视力测试

在 CDC 网上报名后，会收到一封邮件，按邮件里的方式预约视力测试。邮件可能被归到垃圾邮件，记得检查。

视力测试包括视力和色觉两部分。按照新加坡《Road Traffic (Motor Vehicles, Driving Licences) Rules》的规定，要求是：

在 25 米的距离，能读出黑底白字、和车牌一样大小和排列的 6 个字母与数字。平时戴眼镜的，可以戴着眼镜看。
在 25 米的距离，能分辨出红色、橙色和绿色。

视力测试的 slot 很紧张，要靠刷。我的观察是，每天大约早上 9 点半开放预约，晚上 6 点半左右关闭，开放期间可以不停刷新。我的做法是先约一个能约到的时间，然后继续刷，看到更早的就改期。

要注意顺序：视力测试通过后才能约 IE，IE 通过后才能约 BTT。这三项都要到现场，都要抢 slot，所以每过一项就马上约下一项。

Induction Programme 和 IE（内部模拟考）

IE（Internal Evaluation）是 CDC 的内部模拟考，形式和 Traffic Police 的正式考试一样。第一次学车的驾校学员必须到现场通过 IE，才能预约正式的 BTT。

Induction Programme 是 CDC 的入学介绍，讲后面整个学车流程，我约的是 Zoom 的场次。CDC 官网写明，Induction Programme 不可以取消，也不可以改期。

我把两项约在了同一天：先在线上参加 Induction Programme，然后去考 IE。结果 IE 开考时 Induction Programme 还没结束，我只好提前退出。最后系统还是算我完成了，算是有惊无险。不建议照着这样约，两项之间最好留出足够的时间。

BTT 正式考试

IE 和正式 BTT 的题型一样，都是 50 道选择题，答对 45 道及格，限时 50 分钟。BTT 可以选英文、中文、马来文或淡米尔文作答，我用的是英文。

两套系统的界面风格差别很大。IE 是 CDC 自己的系统，界面明显更现代；正式 BTT 用的系统界面还很旧，像早年的 VB 程序，第一次用要花点时间适应。BTT 的系统最近在做升级，希望升级后能好用一些。

考试时一定要看清楚再点按钮。有学员做完一道题就不小心点了 End Test，考试直接结束，好不容易约到的 slot 也就作废了。

备考资料我只用了两样：

SPF 官方的 Basic Theory of Driving 手册：中文版和英文版对照着看。用英文考的话，看中文版帮助理解，看英文版熟悉题目里的说法。
刷题 App “BTT, FTT, RTT - Theory Test SG”：模拟题很多，适合反复练。但我发现模拟测试里有个别题目的答案是错的，遇到和手册说法不一样的，以官方手册为准。

CDC 有免费的在线理论课，用 Zoom 上，老师会讲考试重点和容易出错的题目，推荐参加。

IE 通过、约好正式 BTT 之后，我就开始刷实践课的 slot。连着刷了 4 天都没有合适的空位，到 10 月 7 日才约到，而最早的空位已经排到 11 月 24 日，要等 7 周左右。所以 IE 一过就可以开始约实践课，不用等 BTT 考完。

实践课的空位没有固定的开放时间。CDC 官网写明，Ubi 的各个班型都”没有固定的放课日期”，要自己经常上网查看。我约到的两节都是早上刷到的，听说空位是不定期释放的。另外，CDC 在 2024 年 7 月公布过预约上限：Ubi 的自动挡学员每月最多约 5 节实践课，手动挡 8 节。

拍照和申请 PDL

BTT 通过后，我直接在 CDC 拍了证件照，工作人员会把数码照片发到邮箱。拍照和考 BTT 安排在同一趟，就不用为了拍照再跑一次。

然后到新加坡警察部队的 e-Services 网站，用 Singpass 登录申请 PDL。费用是 25 新元，缴费后就通过了。PDL 是电子驾照，有效期 2 年，可以续期，驾驶教练能在线查到。没有有效的 PDL 去上实践课是违法的。

费用明细

到拿 PDL 为止，我实际花的钱如下（新元，含 9% GST）：

项目	费用
CDC 报名费（Elite Team，含 1 年会籍）	201.65
押金（可退）	10.00
视力测试	1.96
Induction Programme	23.98
IE（Internal Evaluation）	7.63
BTT 考试费	7.20
BTT 行政费	2.94
CDC 在线理论课（2 节）	0
数码证件照	7.09
PDL 申请费（交给 SPF）	25.00
合计	287.45

不算报名费和押金，从视力测试到拿 PDL 一共是 75.80 新元。

后面的费用按 CDC 官网目前的价格：

实践课：每节 100 分钟。工作日 8:30–10:10 和 12:45–4:15 是非高峰时段，79.57 新元；其他时段和周末是 89.38 新元。再加上班型的附加费。我约的两节都在高峰时段，Elite Team 每节是 89.38 + 16.35 = 105.73 新元。
FTT：考试费 7.20 + 行政费 2.94 = 10.14 新元。
路考：考试费 40.00 + 行政费 2.94 + 考试用车和热身费 317.19 = 360.13 新元。
会籍：1 年到期后，续 6 个月是 65.40 新元。

CDC 的费用都从预付的储值账户里扣，要先充值才能预约。

我的建议

报名后就装上 CDC 的手机 App，随时看学车进度和预约。
报名 CDC 后先上它的免费在线理论课，再去考 IE 和 BTT。
视力测试、IE、BTT 都要到现场，而且只有前一项通过才能约下一项。每过一项就立刻约下一项。
约 slot 时先占一个，再继续刷更早的，有就改期。
考 IE 和 BTT 时看清楚按钮，别误点 End Test，否则考试直接结束，slot 作废。
去考 BTT 那天顺便在 CDC 拍照，省一趟。
IE 通过后就开始约实践课，空位可能要排一个多月。空位不定期释放，没有固定时间，要经常刷，我是早上刷到的。
时间允许的话约非高峰时段的实践课，每节便宜将近 10 新元。
Induction Programme 不能取消或改期，别和 IE 约得太近。

接下来：实践课、FTT 和路考

这部分正在进行中，考完后会更新到这篇文章里。

从 App 的 My Learning Journey 可以看到后面还有这些环节：Traffic Police 模拟器培训（3 个模块）；实践课的 3 个模块，其中包括 VPC、LDCS、ATC 等项目；最后是路考前的热身课（Warm Up Lesson）和 Traffic Police 路考。另外，App 里 BTT 的有效期显示为 Lifetime，通过后长期有效。

如果你有中国驾照

用中国驾照转换只需要通过 BTT，不用考 FTT 和路考。流程和材料网上已经有很多攻略，办理时以 Traffic Police 的官方材料清单为准。

有一条规定容易被忽略：如果你的中国驾照是在拿到第一张新加坡准证（WP、EP、学生准证等）或 PR 之后才考的，需要额外证明在中国住满 1 年，而且实际在中国居住至少 6 个月。可以用护照出入境记录、在中国的工作证明、学历证明或纳税记录来证明。来新加坡之前就考好的驾照，不需要这项证明。

另外，非英文驾照要由新加坡注册的翻译公司出具英文翻译件，自己翻译的不收。

常见问题

BTT 可以用中文考吗？

可以，BTT 提供英文、中文、马来文和淡米尔文。

PDL 有效期多久？

2 年，可以在网上续期。

官方链接

费用按 2026 年 10 月 CDC 官网价格。最后更新：2026 年 10 月 9 日。

新加坡从零考驾照全记录（2026）：BTT、PDL 到路考 was originally published by Sherry Yin at Sherry Yin on October 09, 2026.

Getting a Singapore Driving Licence from Scratch (2026): BTT to PDL in 11 Days

2026-10-09T00:00:00+08:00

I’m learning to drive in Singapore from scratch. I enrolled for Class 3A (automatic) at CDC, the ComfortDelGro Driving Centre, and it took 11 days to go from enrolment to passing the Basic Theory Test and getting my Provisional Driving Licence.

This post covers everything up to the PDL. I’ll add the practical lessons, the Final Theory Test and the driving test once I’ve done them. If you already hold a licence from another country and want to convert it instead, there’s a short section on that near the end.

The rules here are checked against the Traffic Police pages, linked at the bottom. Rules change, so check the official pages before you apply.

Two routes: from scratch or converting a foreign licence

	From scratch	Converting a foreign licence
Who it’s for	No licence yet, or a foreign licence that can’t be converted	A valid licence issued in another country
Tests	BTT, FTT and the practical driving test	BTT only
What takes effort	Many steps, and every one needs a booking slot	Getting the documents right, including an official translation if the licence isn’t in English

Foreigners who have lived in Singapore for less than 12 months can drive on a valid foreign licence. After 12 months, you need a Singapore licence.

Glossary

Term	Stands for	What it means
TP	Traffic Police	The part of the Singapore Police Force that runs driving tests and issues licences
SPF	Singapore Police Force	You apply for the PDL on its e-Services website
CDC, BBDC, SSDC	ComfortDelGro Driving Centre, Bukit Batok Driving Centre, Singapore Safety Driving Centre	Singapore’s three driving centres. You can learn to drive at any of them, and they also host theory tests
BTT	Basic Theory Test	The first theory test. Everyone takes it, including people converting a foreign licence
FTT	Final Theory Test	The second theory test. For Class 3 or 3A you must pass it before the practical driving test
IE	Internal Evaluation	CDC’s in-house mock test. First-time learners at CDC must pass it before they can book the BTT
Induction Programme		CDC’s introduction session covering the whole learning journey. It can’t be cancelled or rescheduled
PDL	Provisional Driving Licence	The learner’s licence. It’s digital, valid for 2 years, and required for practical lessons
Practical lesson		Driving on the road with an instructor. A CDC lesson is 100 minutes
Practical driving test		The on-road test, conducted by a TP-appointed examiner
Class 3, 3A		Class 3 is manual; Class 3A is automatic and only covers cars without a clutch pedal
Standard, One Team, Elite Team		CDC’s coaching schemes, compared below
PRM	Premium fee	The per-lesson surcharge for One Team and Elite Team
Stored Value		Your prepaid CDC account. All CDC fees are deducted from it
VPC	Vehicular Pre-operative Check	An item in the practical lesson stage, charged separately in CDC’s fee list
LDCS	Learner Driver Competency Screening	An item in the practical lesson stage, charged separately in CDC’s fee list
Slot		A bookable time. Eyesight tests, IEs, BTTs and lessons all need one, and they go fast
Booking Portal		CDC’s online booking system, on the web and in the mobile app
My Learning Journey		Your progress in the CDC app: what you’ve completed and what comes next
Singpass		Singapore’s government digital identity, used to log in when applying for the PDL
GST	Goods and Services Tax	Singapore’s consumption tax, currently 9%

The process from scratch

Enrol at a driving centre
Eyesight and colour-vision test
Induction Programme and IE (for CDC learners)
BTT
Photo and PDL application
Practical lessons
FTT
Practical driving test
Get your licence

My timeline: 11 days from enrolment to PDL

Date	Step	Day
28 Sep	Enrolled online at CDC for Class 3A	0
2 Oct	Eyesight test on site, passed	4
3 Oct	Induction Programme on Zoom, then the IE on site, passed	5
7 Oct	Booked practical lessons after refreshing for slots every day since 3 Oct; the earliest slot was 24 Nov	9
9 Oct	BTT on site, passed; photo taken at CDC; applied for the PDL online	11

The main reason it went this fast is that I kept getting early slots for each step.

Choosing a coaching scheme

At Ubi, CDC offers three coaching schemes for Class 3A. They differ in whether you keep the same car and instructors, and in the surcharge per practical lesson (GST included):

Scheme	Extra per lesson	Training car	Instructors
Standard	S$0	Not fixed	Not fixed
One Team	S$13.08	Same car	A team of up to 6 instructors
Elite Team	S$16.35	Same car	A team of up to 4 senior instructors

The enrolment fee is S$185.30 for Standard and S$201.65 for One Team and Elite Team, each including a one-year membership, plus a refundable S$10 deposit. I chose Elite Team on an electric vehicle (EV). The EV course is only available at Ubi.

Booking tools: CDC web portal and app

Everything at CDC, from booking and cancelling to topping up and finding receipts, happens in its online Booking Portal. The web home page has ten sections. These are the three I use most:

My Bookings: lessons and tests you’ve already booked.
Lesson Booking: book the Induction Programme, theory lessons and practical lessons.
Test Bookings: book tests such as the IE and the BTT.

The CDC Booking Portal home page. The three sections outlined in red are the ones I use most.

The others come up too: Top-Up Store Value to add money to your account, Cancel Booking, Account Statement / Receipt for your transaction history (the costs below come from there), and Online Learning.

Install the CDC mobile app as well. It shows My Learning Journey, so you can see at a glance which step you’re on and what’s next, and booking from it is easy.

Enrolment and the eyesight test

After enrolling online, you’ll get an email telling you how to book the eyesight test. Check your spam folder if you don’t see it.

The test covers eyesight and colour vision. Under Singapore’s Road Traffic (Motor Vehicles, Driving Licences) Rules, you must be able to:

read, at 25 metres, a series of six white letters and numbers on a black background, the same size and layout as a vehicle number plate. If you wear glasses, you can wear them for the test.
tell red, amber and green apart at 25 metres.

Eyesight test slots are hard to get. From what I saw, bookings open at around 9:30 am each day and close at around 6:30 pm, and you can keep refreshing while it’s open. I booked whatever I could get first, then kept checking and rescheduled whenever an earlier slot appeared.

The order matters: you can only book the IE after passing the eyesight test, and only book the BTT after passing the IE. All three are on site and need a slot, so book the next one as soon as you pass.

Induction Programme and IE (Internal Evaluation)

The IE is CDC’s in-house mock test, in the same format as the Traffic Police test. First-time learners at CDC have to pass it in person before they can book the real BTT.

The Induction Programme introduces CDC’s learning journey. I took it on Zoom. CDC says it can’t be cancelled or rescheduled.

I booked both on the same day: the Induction Programme online first, then the IE on site. The IE started before the Induction Programme ended, so I had to leave early. It still counted as completed, but I wouldn’t plan it that way. Leave a proper gap between the two.

The BTT

The IE and the BTT have the same format: 50 multiple-choice questions, 45 correct answers to pass, 50 minutes. The BTT is available in English, Chinese, Malay and Tamil. I took it in English.

The two systems look very different. The IE runs on CDC’s own system, which feels modern. The BTT system looks like an old Visual Basic application and takes a moment to get used to. It’s being upgraded, so hopefully it’ll be friendlier soon.

Read the buttons carefully during the test. Some learners have clicked End Test after a single question, which ends the test on the spot and wastes a slot that was hard to get.

I used two things to prepare:

The official Basic Theory of Driving handbook from SPF. I read the English and Chinese editions side by side.
The app “BTT, FTT, RTT - Theory Test SG”. It has plenty of practice questions, but a few answers in its mock tests are wrong. When it disagrees with the handbook, trust the handbook.

CDC also runs free online theory classes on Zoom, where the instructor goes through the key topics and the questions people often get wrong. They’re worth joining.

After passing the IE and booking the BTT, I started refreshing for practical lesson slots. It took four days of checking before I got any, on 7 October, and the earliest slot was already 24 November, about seven weeks away. So you can start booking lessons as soon as you pass the IE; there’s no need to wait for the BTT.

There’s no fixed time when lesson slots open. CDC’s website says there is “no session opening date” for any of its Ubi schemes and asks learners to check online regularly. I got both of my slots by refreshing in the morning, and I’ve heard that slots are released at irregular times. CDC also announced a booking limit in July 2024: at Ubi, automatic-car learners can book at most 5 practical lessons per month, and manual-car learners 8.

Photo and PDL

Right after passing the BTT, I had my photo taken at CDC, and the staff emailed me the digital photo. Doing this on the day of the BTT saves a separate trip.

Then I applied for the PDL on the SPF e-Services website, logging in with Singpass. It costs S$25, and it was approved as soon as I paid. The PDL is digital, valid for two years and renewable, and instructors can verify it online. Taking practical lessons without a valid PDL is an offence.

Costs

Here’s what I actually paid up to the PDL (S$, CDC fees include 9% GST):

Item	Cost
CDC enrolment fee (Elite Team, one-year membership)	201.65
Deposit (refundable)	10.00
Eyesight test	1.96
Induction Programme	23.98
IE (Internal Evaluation)	7.63
BTT test fee	7.20
BTT administrative fee	2.94
CDC online theory classes (2 sessions)	0
Digital photo	7.09
PDL application fee (paid to SPF)	25.00
Total	287.45

Excluding the enrolment fee and deposit, everything from the eyesight test to the PDL came to S$75.80.

Later costs, at CDC’s current prices:

Practical lessons: 100 minutes each. Weekdays 8:30–10:10 am and 12:45–4:15 pm are off-peak at S$79.57; other times and weekends are S$89.38. Add your scheme’s surcharge. Both of my lessons are at peak times, so each costs 89.38 + 16.35 = S$105.73 on Elite Team.
FTT: S$7.20 test fee + S$2.94 administrative fee = S$10.14.
Practical driving test: S$40.00 test fee + S$2.94 administrative fee + S$317.19 for the test vehicle and warm-up = S$360.13.
Membership: after the first year, a six-month extension costs S$65.40.

All CDC fees come out of your prepaid Stored Value account, so you need to top up before you can book.

Tips

Install the CDC app as soon as you enrol.
Join CDC’s free online theory classes before you sit the IE and the BTT.
The eyesight test, IE and BTT are all on site, and each unlocks the next. Book the next one the moment you pass.
Grab any slot first, then keep checking for earlier ones and reschedule.
Read the buttons carefully in the IE and the BTT. Clicking End Test by mistake ends the test and wastes the slot.
Get your photo taken at CDC on the day of your BTT.
Start booking practical lessons once you pass the IE. Slots can be more than a month out, and they’re released at no fixed time, so keep checking. I got mine in the morning.
If your schedule allows, book off-peak lessons. Each one is almost S$10 cheaper.
The Induction Programme can’t be cancelled or rescheduled, so don’t book it too close to your IE.

What’s next: lessons, FTT and the driving test

I’m in this stage now. I’ll update this post after the test.

My Learning Journey in the app shows what’s still ahead: Traffic Police simulator training (3 modules); three practical lesson modules, which include items such as VPC, LDCS and ATC; and finally a warm-up lesson and the Traffic Police practical test. The app also lists the BTT’s expiry as Lifetime, so a pass doesn’t run out.

Converting a foreign licence

If you hold a valid licence from another country, you only need to pass the BTT in Singapore; the FTT and the practical test aren’t required. Foreigners need to convert after living in Singapore for 12 months. New citizens and PRs have three months from the change in status. Work Permit and S Pass holders receive a Class 3C licence after converting.

The Traffic Police publishes document checklists, one for China licences and one for all other foreign licences. The main items are a recent passport-size photo, your identity documents and passes, and your licence. A few points are easy to miss:

If your licence isn’t in English, you need an official translation from a translation company registered in Singapore. Your own translation won’t be accepted.
If your licence doesn’t show the date it was first issued, bring an extract of your driving record.
If you got your foreign licence after receiving your first Singapore pass (WP, EP, student pass and so on) or PR, or you’re a Singapore citizen applying with a foreign licence, you must also prove you lived in the issuing country for one year, with at least six months of physical residence. Passports, employment documents, education certificates or tax documents can be used. This is to show you didn’t go abroad just to get a licence.
The Traffic Police page lists extra documents for some countries. For example, Malaysian licences need a letter from the Road Transport Department showing the licence classes, and Indian licences need an endorsement letter of validity from the Indian embassy.

To apply, fill in the online pre-assessment form, book an appointment at Traffic Police Headquarters yourself, and bring the originals and photocopies of your documents. The counter decides on the spot whether you’re eligible, and the Traffic Police may ask for more documents.

FAQ

Can I take the BTT in a language other than English?

Yes. It’s available in English, Chinese, Malay and Tamil.

How long is the PDL valid?

Two years. You can renew it online.

How long does it take to get from enrolment to the PDL?

It took me 11 days, but it depends on how quickly you get slots for the eyesight test, the IE and the BTT.

Official links

Costs are based on CDC’s published prices in October 2026. Last updated: 9 October 2026.

Getting a Singapore Driving Licence from Scratch (2026): BTT to PDL in 11 Days was originally published by Sherry Yin at Sherry Yin on October 09, 2026.

Building a Global Multi-Write MongoDB Cluster with Zone Sharding

2026-09-26T00:00:00+08:00

Say an application has users in China and in North America. With a single replica set, the primary lives in one of the two regions, so users in the other region pay a trans-Pacific round trip, usually well over 100 ms, on every write. If the write concern waits for replication, it’s more.

MongoDB has no multi-master replication. Each replica set has exactly one primary, which is also why MongoDB never has to resolve write conflicts. Zone sharding gets close to multi-region writes without giving that up. This post covers how to set it up, and what happens when a region goes down, which matters more in operations.

How it works

A sharded cluster is made of several replica sets (shards), each with its own primary. Zone sharding pins ranges of the shard key to specific shards. Combine that with where you place replica set members:

Put a region field such as homeRegion at the front of the shard key.
Assign each shard to a zone, and map each region’s key range to that zone.
Keep each shard’s primary in its own region, with secondaries in the other region.

A Chinese player’s documents then live on a shard whose primary is in China, and an American player’s documents on a shard whose primary is in North America. Both regions write locally into the same cluster, but any single document still has exactly one primary. Most of the limitations later in this post follow from that.

Topology

Each region writes to the shard whose primary is local. Secondaries in the other region hold a copy for disaster recovery and local reads. Every mongos gets its routing metadata from the config server replica set.

A minimal two-region layout:

Component	China	North America
Application servers	✔	✔
`mongos` routers	2 or more	2 or more
shard0 (zone `APAC`)	Primary + Secondary	Secondary
shard1 (zone `NA`)	Secondary	Primary + Secondary
Config server replica set	Primary + Secondary	Secondary (see config servers)

Applications connect to the mongos routers in their own region. Run at least two per region so a router restart doesn’t take the region’s traffic down. mongos routes by shard key using metadata it caches from the config servers, so a write for a "CN" document goes to shard0’s primary in China and never leaves the region.

Setup

There are three parts: the data model, shard zones, and zone ranges. The commands below use the current names; sh.addShardTag() and sh.addTagRange() are the older names for the same operations. Run them through mongos as a user with the clusterManager role.

1. Data model and shard key

The example is player profiles in a game, stored in game.players. The application sets homeRegion when the player signs up, based on the region they pick:

{
  _id: ObjectId("..."),
  homeRegion: "CN",            // set by the application at sign-up
  playerId: 100234,
  nickname: "lotus",
  level: 42,
  lastLoginAt: ISODate("2026-09-26T08:00:00Z"),
  inventory: [ /* ... */ ]
}

Zone ranges can only be defined on a prefix of the shard key, so homeRegion has to come first. The second field should have high cardinality and appear in your queries, so chunks can still be split within a zone:

{ homeRegion: 1, playerId: 1 }

A document inserted without homeRegion won’t end up where you expect. Schema validation is a cheap way to prevent that:

db.createCollection("players", {
  validator: {
    $jsonSchema: {
      required: ["homeRegion", "playerId"],
      properties: { homeRegion: { enum: ["CN", "US"] } }
    }
  }
})

2. Add shards to zones

sh.addShardToZone("shard0", "APAC")
sh.addShardToZone("shard1", "NA")

A shard can be in several zones, and a zone can have several shards. One shard per zone is enough to start with. Add shards to a zone when it runs out of capacity.

3. Define zone ranges

The lower bound is inclusive and the upper bound is exclusive. With MinKey and MaxKey on playerId, each range covers a whole region:

sh.updateZoneKeyRange(
  "game.players",
  { homeRegion: "CN", playerId: MinKey },
  { homeRegion: "CN", playerId: MaxKey },
  "APAC"
)

sh.updateZoneKeyRange(
  "game.players",
  { homeRegion: "US", playerId: MinKey },
  { homeRegion: "US", playerId: MaxKey },
  "NA"
)

If you can, create the zones and ranges before you shard the collection. For an empty or non-existent collection, shardCollection then creates chunks on the zone boundaries and puts them on the right shards straight away, so the balancer doesn’t have to move data across the Pacific later:

sh.enableSharding("game")
sh.shardCollection("game.players", { homeRegion: 1, playerId: 1 })

For an existing collection, the balancer migrates every chunk that sits in the wrong zone. Across regions that’s a lot of traffic, so run it inside a balancing window.

4. Keep each primary in its home region

Zones decide which shard owns a document. Replica set configuration decides where that shard’s primary runs. Set priorities and tags so the primary is elected in the home region:

// on shard0 (home: China)
cfg = rs.conf()
cfg.members[0].priority = 2;   cfg.members[0].tags = { region: "cn" }
cfg.members[1].priority = 1;   cfg.members[1].tags = { region: "cn" }
cfg.members[2].priority = 0.5; cfg.members[2].tags = { region: "us" }
rs.reconfig(cfg)

Don’t set the remote member’s priority to 0. A priority-0 member can never become primary, so it couldn’t take over if the home region went down.

5. Check routing

sh.status()                                   // zones, ranges, chunk placement
db.players.getShardDistribution()             // data per shard
db.players.find({ homeRegion: "CN", playerId: 100234 }).explain()
                                              // should target only shard0

Reads

Reads of a region’s own data go to the local primary, which covers most traffic.

For data that belongs to the other region, there are two options. Reading from the primary is consistent, but it crosses the ocean. Reading from a local secondary is fast but may be stale: use readPreference: "nearest" (or "secondaryPreferred") with a region tag such as readPreferenceTags=region:cn. Set maxStalenessSeconds (at least 90) so the driver skips secondaries that have fallen too far behind.

A query without homeRegion can’t be targeted, so mongos sends it to every shard in both regions. A support tool that looks up player 100234 by playerId alone runs a global query every time. Keep homeRegion in the filter of every frequent query.

Write concern and region failure

Zone sharding makes writes local. Whether those writes survive the loss of a region depends on where the write concern’s majority comes from. You can’t have local writes, zero data loss, and automatic failover at the same time. There are two common layouts.

Layout A: 2 members at home, 1 remote

w: "majority" needs 2 of 3 acknowledgements, and both can come from the home region, so writes stay local.

If the home region goes down, the remote member is 1 of 3 and can’t be elected. Someone has to force a reconfiguration by hand, and whatever hadn’t replicated across the ocean yet is lost. That replication lag is your RPO.

Layout B: 5 members across 3 regions (2 + 2 + 1)

A majority is 3, so at least one acknowledgement has to come from outside the home region. Every majority write pays at least one cross-region round trip. Putting the fifth member in a region close to home keeps that cost small.

If the home region goes down, the other 3 members still form a majority and elect a new primary on their own. No acknowledged majority write is lost.

	Layout A (2 + 1)	Layout B (2 + 2 + 1)
Write latency with `w: "majority"`	local	at least one cross-region round trip
Home region lost: automatic failover	✘ manual forced reconfig	✔
Home region lost: acknowledged writes lost	possible (replication lag)	none
Cost	3 nodes per shard	5 nodes per shard, 3 regions

A common split is layout A for most data, accepting a small RPO, and layout B for data where losing a write isn’t acceptable. Either is fine, as long as your runbook matches the layout you actually deployed.

Config servers

The config server replica set stores chunk ownership, zones, and ranges. If it loses its primary, reads and writes keep working with the routing table mongos already has, but chunk migrations, splits, and shardCollection stop until a primary is back.

With two regions, one of them has to hold the config servers’ majority. In the diagram that’s China, with two of the three members, so losing China freezes metadata changes. That’s usually acceptable during an incident. A small third region fixes it for the config servers, and it’s also where layout B’s fifth member lives.

Failure scenarios

Scenario	What happens	What to plan
Cross-region link down	Each region keeps writing its own shard locally. Replication to remote secondaries lags, and remote reads get staler.	Alert on replication lag, and watch oplog window size so secondaries can catch up without a full resync.
One member in the home region down	The other members still form a majority, and writes continue.	Normal replica set operations.
Whole home region down (layout A)	That zone’s data is read-only elsewhere, and it has no primary.	A runbook for forced reconfiguration, with the RPO it implies written down in advance.
Whole home region down (layout B)	A new primary is elected in another region, and writes continue with higher latency.	Capacity in the surviving regions to absorb the extra load.
Player travels temporarily	Requests route from the local `mongos` to the home shard’s primary across the ocean: slower, but correct.	Nothing. Travel is rare, so accept the latency.
Player moves to another region	Their documents stay pinned to the old zone until the shard key changes.	Update `homeRegion` (see below).

Players who travel

Most region changes are trips. A North American player visiting China keeps homeRegion: "US". Their app connects to the mongos in China, which sends every read and write to shard1’s primary in North America. Each request crosses the Pacific, so it’s slower, but it’s correct and no data moves.

This doesn’t happen often, so I’d accept the latency rather than build anything for it. Reads that can tolerate some staleness can use readPreference: "nearest". Writes still go to the home primary.

Players who move

Only a permanent move is worth moving data for. Changing a shard key value moves the document to another shard. MongoDB allows it under a few conditions: the update runs through mongos, as a retryable write or inside a transaction, with an equality match on the full shard key, one document at a time (updateOne, not updateMany):

session.withTransaction(() => {
  players.updateOne(
    { homeRegion: "CN", playerId: 100234 },
    { $set: { homeRegion: "US" } }
  )
})

If the player also has documents in other zoned collections, like match history or friend lists, it becomes a small migration job. Decide whether old data needs to move at all, or only new data.

Limitations

There’s no global uniqueness. On a sharded collection, a unique index has to be prefixed by the shard key, so you can make an email unique per region but not worldwide. A global registry needs a separate design, for example a small unzoned collection or an external service.
A transaction that touches both zones is a distributed transaction across the Pacific. Keep transactions within one region.
Chunks outside every zone range can end up on any shard. Make sure every homeRegion value is covered by a range.
Remote secondaries are full copies of the other region’s data. If the reason for pinning data is data residency rather than latency, this layout breaks it, and DR members would have to stay inside the allowed jurisdiction.
Zone sharding doesn’t apply to time series collections. The balancer always spreads them evenly across all shards.
Dropping a collection also drops its zone ranges. Recreate them, ideally before sharding the collection again.

Alternative: independent clusters with two-way sync

The other common approach skips the shared cluster. Each region runs its own independent MongoDB deployment, a replica set or a sharded cluster, and a tool such as MongoShake replicates changes in both directions.

Two MongoShake instances, one per direction. Component names follow MongoShake's architecture overview.

MongoShake replicates in one direction, so two-way sync means two instances: one for China → North America and one for North America → China. Each instance fetches the source oplog with its Collector. For a sharded source, it connects to every shard, preferably reading from secondaries. It filters namespaces with whitelists and blacklists, and replays the changes into the target mongos through the Direct tunnel. It saves a checkpoint, by default in the source database, so it can resume after a restart, and it exposes metrics through a REST API and Prometheus.

Every region can write every document and holds a full copy of the data.

Pros

The regions are isolated from each other. They share no config servers, elections, or balancer, so an outage or network partition in one region never blocks writes in the other.
Every document can be read and written locally in every region. There’s no region field in the shard key, no zone ranges, no relocation, and no queries broadcast across regions.
Each side can run a different topology, version, or hardware, and filters can keep some data out of a region.
It’s easy to add to an existing single-region deployment: stand up a second cluster and start syncing, the same way many migrations are done.

Cons

Conflicts. If a document is updated in both regions within the sync lag, each side applies the other’s change after its own, and the two copies can end up permanently different. MongoShake doesn’t resolve conflicts, so the application has to make sure each document is only written in one region. That’s the same rule zone sharding enforces, except here nothing enforces it.
Duplicate keys. Two players registering the same email in both regions at once both succeed locally. Replaying one of them then hits a duplicate key error, and the sync either stalls or drops the change, depending on configuration.
It’s asynchronous only. There’s no cross-region write concern, so a region failure loses whatever was inside the sync lag, and cross-region reads are eventually consistent.
Loops. Each instance has to tell local writes from replicated ones, or changes bounce back and forth. MongoShake does this with a gid, but its README says gid is only available in Alibaba Cloud’s internal version, because it needs MongoDB kernel changes. The open-source version can’t filter loops that way, and the FAQ describes workarounds.
Transactions and DDL. Multi-document transactions can be replayed as individual writes, so the target briefly sees half a transaction. MongoShake only syncs DDL when the source is a replica set.
More to operate. The sync instances need their own high availability, monitoring, upgrades, and checkpoint handling. If one falls behind past the oplog window, you have to do a full resync. You also need a regular way to check the two sides for drift.
Every region stores all the data: double the storage, and the same data residency problem as remote secondaries.
No vendor support. MongoShake is a third-party tool, and MongoDB’s own Cluster-to-Cluster Sync (mongosync) only does one-way replication.

Comparison

	Zone sharding (one cluster)	Independent clusters + two-way sync
Who can write a document	only its home shard’s primary	any region
Write conflicts	impossible by design	possible; the application must avoid them
Cross-region durability	tunable with write concern (layout A / B)	async only; RPO = sync lag
Region failure	depends on member placement	other region unaffected
Global unique indexes	not possible (shard key prefix rule)	not possible; cross-region duplicates break sync
Data per region	own zone + remote replicas	full copy
Operational burden	sharding, balancer, config servers	two clusters plus a sync pipeline
Support	built into MongoDB	third-party tools

Zone sharding enforces single ownership in the database, so you can’t break it by accident. Two-way sync isolates the regions better and is more flexible, but it moves conflict avoidance and consistency checks into the application and into operations. If the data already has a natural home region, I’d choose zone sharding. Two-way sync makes more sense when regional isolation is the top priority and the application can guarantee that each document is only written in one region.

When zone sharding fits

It works well when data has a natural home region, most traffic stays in that region, and you can accept either a small RPO (layout A) or slower writes (layout B) when a region fails.

It works badly for documents written from several regions at once, like a global counter or a shared document. Every write still goes to one primary, so for most users that document is remote no matter how you zone it. Global uniqueness or cross-region transactions on the hot path are also a bad fit.

On Atlas, Global Clusters provide the same setup as a managed feature. It’s still zone sharding underneath, and the same write concern trade-offs apply.

References

Building a Global Multi-Write MongoDB Cluster with Zone Sharding was originally published by Sherry Yin at Sherry Yin on September 26, 2026.

How to ensure TiDB cluster can use TiCDC to synchronize data?

2024-08-03T00:00:00+08:00

This article focuses on the more difficult to determine parts of the TiCDC’s limitations.

Currently, TiCDC unsupported scenarios and limitations as below:

A TiKV cluster that uses RawKV alone.
The CREATE SEQUENCE DDL operation and the SEQUENCE function in TiDB. When the upstream TiDB uses SEQUENCE, TiCDC ignores SEQUENCE DDL operations/functions performed upstream. However, DML operations using SEQUENCE functions can be correctly replicated.
Currently, performing BR data recovery and TiDB Lightning physical import imports on tables and databases that are being replicated by TiCDC is not supported. For more information, see Why does replication using TiCDC stall or even stop after data restore using TiDB Lightning and BR from upstream.
TiCDC only replicates tables that have at least one valid index

For details, refer to the official documentation unsupported scenarios and best practices.

The most difficult part of these limitations to be identified is the valid index:

TiCDC only replicates tables that have at least one valid index. A valid index is defined as follows:

A primary key (PRIMARY KEY) is a valid index.

A unique index (UNIQUE INDEX) is valid if every column of the index is explicitly defined as non-nullable (NOT NULL) and the index does not have a virtual generated column (VIRTUAL GENERATED COLUMNS).

If there are tables in the TiDB cluster without at least one valid index, then these tables cannot use TiCDC to synchronize data. How to find out which tables in the cluster do not have any valid index?

1.Find tables that have primary key

select distinct table_schema,table_name from information_schema.tidb_indexes where KEY_NAME='PRIMARY' and table_schema not in ('METRICS_SCHEMA','mysql','PERFORMANCE_SCHEMA','INFORMATION_SCHEMA','sys');

2.Find tables have unique index and every column of the index is explicitly defined as non-nullable (NOT NULL) and the index does not have a virtual generated column

select distinct a.table_schema, a.table_name from (select table_schema,table_name,column_name from information_schema.tidb_indexes where KEY_NAME<>'PRIMARY' and NON_UNIQUE=0 and table_schema not in ('METRICS_SCHEMA','mysql','PERFORMANCE_SCHEMA','INFORMATION_SCHEMA','sys')) a left join (select TABLE_SCHEMA,TABLE_NAME,COLUMN_NAME,IS_NULLABLE,GENERATION_EXPRESSION from information_schema.columns where table_schema not in ('METRICS_SCHEMA','mysql','PERFORMANCE_SCHEMA','INFORMATION_SCHEMA','sys')) b on a.table_schema=b.table_schema and a.table_name=b.table_name and a.column_name=b.column_name where (b.IS_NULLABLE='NO' and b.GENERATION_EXPRESSION='');

3.Combine the result of the above two sets are the tables have valid index

select distinct table_schema,table_name from information_schema.tidb_indexes where KEY_NAME='PRIMARY' and table_schema not in ('METRICS_SCHEMA','mysql','PERFORMANCE_SCHEMA','INFORMATION_SCHEMA','sys')
union all
select distinct a.table_schema, a.table_name from (select table_schema,table_name,column_name from information_schema.tidb_indexes where KEY_NAME<>'PRIMARY' and NON_UNIQUE=0 and table_schema not in ('METRICS_SCHEMA','mysql','PERFORMANCE_SCHEMA','INFORMATION_SCHEMA','sys')) a left join (select TABLE_SCHEMA,TABLE_NAME,COLUMN_NAME,IS_NULLABLE,GENERATION_EXPRESSION from information_schema.columns where table_schema not in ('METRICS_SCHEMA','mysql','PERFORMANCE_SCHEMA','INFORMATION_SCHEMA','sys')) b on a.table_schema=b.table_schema and a.table_name=b.table_name and a.column_name=b.column_name where (b.IS_NULLABLE='NO' and b.GENERATION_EXPRESSION='');

Conclusion

Tables Without Valid Index = All Tables - Tables With Valid Index, if the result set of the follow SQL is not empty, means the TiDB cluster contains tables can not be replicated by TiCDC.

select table_schema, table_name from information_schema.tables where table_schema not in ('METRICS_SCHEMA','mysql','PERFORMANCE_SCHEMA','INFORMATION_SCHEMA','sys') and table_type='BASE TABLE' and (table_schema, table_name) not in (select distinct table_schema,table_name from information_schema.tidb_indexes where KEY_NAME='PRIMARY' and table_schema not in ('METRICS_SCHEMA','mysql','PERFORMANCE_SCHEMA','INFORMATION_SCHEMA','sys') union all select distinct a.table_schema, a.table_name from (select table_schema,table_name,column_name from information_schema.tidb_indexes where KEY_NAME<>'PRIMARY' and NON_UNIQUE=0 and table_schema not in ('METRICS_SCHEMA','mysql','PERFORMANCE_SCHEMA','INFORMATION_SCHEMA','sys')) a left join (select TABLE_SCHEMA,TABLE_NAME,COLUMN_NAME,IS_NULLABLE,GENERATION_EXPRESSION from information_schema.columns where table_schema not in ('METRICS_SCHEMA','mysql','PERFORMANCE_SCHEMA','INFORMATION_SCHEMA','sys')) b on a.table_schema=b.table_schema and a.table_name=b.table_name and a.column_name=b.column_name where (b.IS_NULLABLE='NO' and b.GENERATION_EXPRESSION=''));

Others

About another limitation not supporting SEQUENCE related operations. It is very simple to find out whether SEQUENCE is used in the cluster. The SQL is as follows. If the query result is not empty, it means that SEQUENCE is used:

SELECT table_schema, table_name, table_type from information_schema.tables where table_type='SEQUENCE';

中文版

本文主要围绕 TiCDC 的限制中比较难确定的部分内容，TiCDC 官方文档中已经清楚的描述了不支持的场景以及必须满足的条件。

目前 TiCDC 暂不支持的场景和限制如下：

暂不支持单独使用 RawKV 的 TiKV 集群。
暂不支持在 TiDB 中创建 SEQUENCE 的 DDL 操作和 SEQUENCE 函数。在上游 TiDB 使用 SEQUENCE 时，TiCDC 将会忽略掉上游执行的 SEQUENCE DDL 操作/函数，但是使用 SEQUENCE 函数的 DML 操作可以正确地同步。
暂不支持在同步的过程中对 TiCDC 正在同步的表和库进行 BR 数据恢复和 TiDB Lightning 物理导入。详情请参考为什么在上游使用了 TiDB Lightning 和 BR 恢复了数据之后，TiCDC 同步会出现卡顿甚至卡住。
TiCDC 同步的表需要至少存在一个有效索引的表。

详见官方文档中暂不支持的场景和最佳实践。

这些限制中最不好判断的是有效索引这一条：

TiCDC同步的表需要至少存在一个有效索引的表，有效索引的定义如下：

主键 (PRIMARY KEY) 为有效索引。

唯一索引 (UNIQUE INDEX) 中每一列在表结构中明确定义非空 (NOT NULL) 且不存在虚拟生成列 (VIRTUAL GENERATED COLUMNS)。

如果 TiDB 集群中有表没有有效索引，那么这些表是不能利用 TiCDC 来同步数据的，如何集群中哪些表没有有效索引呢？推导如下：

1.找出有主键的表

select distinct table_schema,table_name from information_schema.tidb_indexes where KEY_NAME='PRIMARY' and table_schema not in ('METRICS_SCHEMA','mysql','PERFORMANCE_SCHEMA','INFORMATION_SCHEMA','sys');

2.找出有唯一索引并且索引中每一列在表结构中明确定义非空 (NOT NULL) 且不存在虚拟生成列的表

select distinct a.table_schema, a.table_name from (select table_schema,table_name,column_name from information_schema.tidb_indexes where KEY_NAME<>'PRIMARY' and NON_UNIQUE=0 and table_schema not in ('METRICS_SCHEMA','mysql','PERFORMANCE_SCHEMA','INFORMATION_SCHEMA','sys')) a left join (select TABLE_SCHEMA,TABLE_NAME,COLUMN_NAME,IS_NULLABLE,GENERATION_EXPRESSION from information_schema.columns where table_schema not in ('METRICS_SCHEMA','mysql','PERFORMANCE_SCHEMA','INFORMATION_SCHEMA','sys')) b on a.table_schema=b.table_schema and a.table_name=b.table_name and a.column_name=b.column_name where (b.IS_NULLABLE='NO' and b.GENERATION_EXPRESSION='');

3.以上两种表的并集就是含有有效索引的表。

select distinct table_schema,table_name from information_schema.tidb_indexes where KEY_NAME='PRIMARY' and table_schema not in ('METRICS_SCHEMA','mysql','PERFORMANCE_SCHEMA','INFORMATION_SCHEMA','sys') 
union all 
select distinct a.table_schema, a.table_name from (select table_schema,table_name,column_name from information_schema.tidb_indexes where KEY_NAME<>'PRIMARY' and NON_UNIQUE=0 and table_schema not in ('METRICS_SCHEMA','mysql','PERFORMANCE_SCHEMA','INFORMATION_SCHEMA','sys')) a left join (select TABLE_SCHEMA,TABLE_NAME,COLUMN_NAME,IS_NULLABLE,GENERATION_EXPRESSION from information_schema.columns where table_schema not in ('METRICS_SCHEMA','mysql','PERFORMANCE_SCHEMA','INFORMATION_SCHEMA','sys')) b on a.table_schema=b.table_schema and a.table_name=b.table_name and a.column_name=b.column_name where (b.IS_NULLABLE='NO' and b.GENERATION_EXPRESSION='');

总结

没有有效索引的表 = 所有的表 - 含有有效索引的表，如果以下 SQL 的查询结果为非空，则表示 TiDB 集群中包含有不能使用 TiCDC 来同步数据的表：

select table_schema, table_name from information_schema.tables where table_schema not in ('METRICS_SCHEMA','mysql','PERFORMANCE_SCHEMA','INFORMATION_SCHEMA','sys') and table_type='BASE TABLE' and (table_schema, table_name) not in (select distinct table_schema,table_name from information_schema.tidb_indexes where KEY_NAME='PRIMARY' and table_schema not in ('METRICS_SCHEMA','mysql','PERFORMANCE_SCHEMA','INFORMATION_SCHEMA','sys') union all select distinct a.table_schema, a.table_name from (select table_schema,table_name,column_name from information_schema.tidb_indexes where KEY_NAME<>'PRIMARY' and NON_UNIQUE=0 and table_schema not in ('METRICS_SCHEMA','mysql','PERFORMANCE_SCHEMA','INFORMATION_SCHEMA','sys')) a left join (select TABLE_SCHEMA,TABLE_NAME,COLUMN_NAME,IS_NULLABLE,GENERATION_EXPRESSION from information_schema.columns where table_schema not in ('METRICS_SCHEMA','mysql','PERFORMANCE_SCHEMA','INFORMATION_SCHEMA','sys')) b on a.table_schema=b.table_schema and a.table_name=b.table_name and a.column_name=b.column_name where (b.IS_NULLABLE='NO' and b.GENERATION_EXPRESSION=''));

其他

还有一个关于不支持 SEQUENCE 相关操作的限制，找出集群中是否使用了 SEQUENCE 是很简单的，SQL 如下，如果查询结果为非空，则说明使用了 SEQUENCE：

SELECT table_schema, table_name, table_type from information_schema.tables where table_type='SEQUENCE';

How to ensure TiDB cluster can use TiCDC to synchronize data? was originally published by Sherry Yin at Sherry Yin on August 03, 2024.

TiDB Operator Enable TLS For MySQL Client With cert-manager

2024-06-06T00:00:00+08:00

TiDB Operatior supports enable and disable TLS for MySQL client for an existing TiDB cluster. This article will show you how to enable it. Certificates can be issued by cfssl and cert-manager, here I will choose the cloud native way cert-manager.

We need a self-signed CA
Use the CA to sign certificate for TiDB cluster

Prepare CA

Install cert-manager

helm repo add jetstack https://charts.jetstack.io --force-update
helm install cert-manager jetstack/cert-manager --namespace cert-manager --create-namespace --version v1.15.2 --set crds.enabled=true

It will take some time, be patient.

Prepare Issuers

TiDB is not a internet facing public services, self-signed issuer and CA is enough. There’s no naming restrictions for the issuers for TiDB Operator.
1.Create tidb-server-issuer.yaml

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: tidb-selfsigned-ca-issuer
  namespace: tidb-cluster 
spec:
  selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: tidb-ca
  namespace: tidb-cluster
spec:
  secretName: tidb-ca-secret                  # specify a secret to store the CA certificate and private key
  commonName: "TiDB CA"
  isCA: true                                  # Make this certificate is valid for certificate signing
  duration: 87600h # 10yrs
  renewBefore: 720h # 30d
  issuerRef:
    name: tidb-selfsigned-ca-issuer           # Must specify an issuer for the certificate, we want a CA certificate, the issuer should be self-signed issuer
    kind: Issuer
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: tidb-issuer                           # This is the issuer issues TLS certificates for the TiDB cluster
  namespace: tidb-cluster
spec:
  ca:
    secretName: tidb-ca-secret

2.Create Issuers

kubectl apply -f tidb-server-issuer.yaml

kubectl get issuer -n tidb-cluster

Output:

NAMESPACE      NAME                        READY   AGE
tidb-cluster   tidb-issuer                 True    18s
tidb-cluster   tidb-selfsigned-ca-issuer   True    18s

Enable TiDB Cluster TLS for Client

Perpare Server Certificates

We need to issue two sets of certificates:

A set of server-side certificates for TiDB server
A set of client-side certificates for MySQL client.

Certificate and keys will be stored in secrets, ${cluster_name}-tidb-server-secret and ${cluster_name}-tidb-client-secrete.

The Secret objects you created must follow the above naming convention. Otherwise, the deployment of the TiDB cluster will fail.

1.Create tidb-server-cert.yaml

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: advanced-test-tidb-server-secret
  namespace: tidb-cluster
spec:
  secretName: advanced-test-tidb-server-secret
  duration: 8760h # 365d
  renewBefore: 360h # 15d
  subject:
    organizations:
    - Sherry Yin Xi
  commonName: "TiDB Server"
  usages:
    - server auth
  dnsNames:
    - "advanced-test-tidb"
    - "advanced-test-tidb.tidb-cluster"
    - "advanced-test-tidb.tidb-cluster.svc"
    - "*.advanced-test-tidb"
    - "*.advanced-test-tidb.tidb-cluster"
    - "*.advanced-test-tidb.tidb-cluster.svc"
    - "*.advanced-test-tidb-peer"
    - "*.advanced-test-tidb-peer.tidb-cluster"
    - "*.advanced-test-tidb-peer.tidb-clsuter.svc"
  ipAddresses:
    - 127.0.0.1
    - ::1
  issuerRef:
    name: tidb-issuer
    kind: Issuer
    group: cert-manager.io

2.Issue Certificate for TiDB Server

kubectl apply -f tidb-server-cert.yaml

Perpare Client Certificates

1.Create tidb-client-cert.yaml

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: advanced-test-tidb-client-secret
  namespace: tidb-cluster
spec:
  secretName: advanced-test-tidb-client-secret
  duration: 8760h # 365d
  renewBefore: 360h # 15d
  subject:
    organizations:
    - Sherry Yin Xi
  commonName: "TiDB Client"
  usages:
    - client auth
  issuerRef:
    name: tidb-issuer
    kind: Issuer
    group: cert-manager.io

2.Issue Cerficate for MySQL Client

kubectl apply -f tidb-client-cert.yaml

3.Other Client Components Please refer to official documentaiton.

Enable TLS for Client

For an existing TiDB cluster, just update your tidb cluster manifest set .spec.tidb.tlsClient.enabled to true as below.

spec:
...
  tidb:
    ...
    tlsClient:                  
      enabled: true             
  ...

After apply the above changes, the tidb and pd pods of your TiDB cluster will rolling restart.

Check the logs of PD and TiDB pods

kubectl logs advanced-test-pd-0 -n tidb-cluster |grep -i tls
[2024/06/06 02:37:20.061 +00:00] [INFO] [server.go:249] ["PD config"] [config="{\"client-urls\":\"http://0.0.0.0:2379\",\"peer-urls\":\"http://0.0.0.0:2380\",\"advertise-client-urls\":\"http://advanced-test-pd-0.advanced-test-pd-peer.tidb-cluster.svc:2379\",\"advertise-peer-urls\":\"http://advanced-test-pd-0.advanced-test-pd-peer.tidb-cluster.svc:2380\",\"name\":\"advanced-test-pd-0\",\"data-dir\":\"/var/lib/pd\",\"force-new-cluster\":false,\"enable-grpc-gateway\":true,\"initial-cluster\":\"advanced-test-pd-0=http://advanced-test-pd-0.advanced-test-pd-peer.tidb-cluster.svc:2380\",\"initial-cluster-state\":\"new\",\"initial-cluster-token\":\"pd-cluster\",\"join\":\"\",\"lease\":3,\"log\":{\"level\":\"info\",\"format\":\"text\",\"disable-timestamp\":false,\"file\":{\"filename\":\"\",\"max-size\":0,\"max-days\":0,\"max-backups\":0},\"development\":false,\"disable-caller\":false,\"disable-stacktrace\":false,\"disable-error-verbose\":true,\"sampling\":null,\"error-output-path\":\"\"},\"max-concurrent-tso-proxy-streamings\":5000,\"tso-proxy-recv-from-client-timeout\":\"1h0m0s\",\"tso-save-interval\":\"3s\",\"tso-update-physical-interval\":\"50ms\",\"enable-local-tso\":false,\"metric\":{\"job\":\"advanced-test-pd-0\",\"address\":\"\",\"interval\":\"15s\"},\"schedule\":{\"max-snapshot-count\":64,\"max-pending-peer-count\":64,\"max-merge-region-size\":20,\"max-merge-region-keys\":0,\"split-merge-interval\":\"1h0m0s\",\"switch-witness-interval\":\"1h0m0s\",\"enable-one-way-merge\":\"false\",\"enable-cross-table-merge\":\"true\",\"patrol-region-interval\":\"10ms\",\"max-store-down-time\":\"30m0s\",\"max-store-preparing-time\":\"48h0m0s\",\"leader-schedule-limit\":4,\"leader-schedule-policy\":\"count\",\"region-schedule-limit\":2048,\"witness-schedule-limit\":4,\"replica-schedule-limit\":64,\"merge-schedule-limit\":8,\"hot-region-schedule-limit\":4,\"hot-region-cache-hits-threshold\":3,\"store-limit\":{},\"tolerant-size-ratio\":0,\"low-space-ratio\":0.8,\"high-space-ratio\":0.7,\"region-score-formula-version\":\"v2\",\"scheduler-max-waiting-operator\":5,\"enable-remove-down-replica\":\"true\",\"enable-replace-offline-replica\":\"true\",\"enable-make-up-replica\":\"true\",\"enable-remove-extra-replica\":\"true\",\"enable-location-replacement\":\"true\",\"enable-debug-metrics\":\"false\",\"enable-joint-consensus\":\"true\",\"enable-tikv-split-region\":\"true\",\"schedulers-v2\":[{\"type\":\"balance-region\",\"args\":null,\"disable\":false,\"args-payload\":\"\"},{\"type\":\"balance-leader\",\"args\":null,\"disable\":false,\"args-payload\":\"\"},{\"type\":\"balance-witness\",\"args\":null,\"disable\":false,\"args-payload\":\"\"},{\"type\":\"hot-region\",\"args\":null,\"disable\":false,\"args-payload\":\"\"},{\"type\":\"transfer-witness-leader\",\"args\":null,\"disable\":false,\"args-payload\":\"\"}],\"schedulers-payload\":null,\"hot-regions-write-interval\":\"10m0s\",\"hot-regions-reserved-days\":7,\"max-movable-hot-peer-size\":512,\"enable-diagnostic\":\"true\",\"enable-witness\":\"false\",\"slow-store-evicting-affected-store-ratio-threshold\":0.3,\"store-limit-version\":\"v1\"},\"replication\":{\"max-replicas\":3,\"location-labels\":\"\",\"strictly-match-label\":\"false\",\"enable-placement-rules\":\"true\",\"enable-placement-rules-cache\":\"false\",\"isolation-level\":\"\"},\"pd-server\":{\"use-region-storage\":\"true\",\"max-gap-reset-ts\":\"24h0m0s\",\"key-type\":\"table\",\"runtime-services\":\"\",\"metric-storage\":\"\",\"dashboard-address\":\"auto\",\"trace-region-flow\":\"true\",\"flow-round-by-digit\":3,\"min-resolved-ts-persistence-interval\":\"1s\",\"server-memory-limit\":0,\"server-memory-limit-gc-trigger\":0.7,\"enable-gogc-tuner\":\"false\",\"gc-tuner-threshold\":0.6,\"block-safe-point-v1\":\"false\"},\"cluster-version\":\"0.0.0\",\"labels\":{},\"quota-backend-bytes\":\"8GiB\",\"auto-compaction-mode\":\"periodic\",\"auto-compaction-retention-v2\":\"1h\",\"TickInterval\":\"500ms\",\"ElectionInterval\":\"3s\",\"PreVote\":true,\"max-request-bytes\":157286400,\"security\":{\"cacert-path\":\"\",\"cert-path\":\"\",\"key-path\":\"\",\"cert-allowed-cn\":null,\"SSLCABytes\":null,\"SSLCertBytes\":null,\"SSLKEYBytes\":null,\"redact-info-log\":false,\"encryption\":{\"data-encryption-method\":\"plaintext\",\"data-key-rotation-period\":\"168h0m0s\",\"master-key\":{\"type\":\"plaintext\",\"key-id\":\"\",\"region\":\"\",\"endpoint\":\"\",\"path\":\"\"}}},\"label-property\":null,\"WarningMsgs\":null,\"DisableStrictReconfigCheck\":false,\"HeartbeatStreamBindInterval\":\"1m0s\",\"LeaderPriorityCheckInterval\":\"1m0s\",\"dashboard\":{\"tidb-cacert-path\":\"/var/lib/tidb-client-tls/ca.crt\",\"tidb-cert-path\":\"/var/lib/tidb-client-tls/tls.crt\",\"tidb-key-path\":\"/var/lib/tidb-client-tls/tls.key\",\"public-path-prefix\":\"\",\"internal-proxy\":true,\"enable-telemetry\":false,\"enable-experimental\":false},\"replication-mode\":{\"replication-mode\":\"majority\",\"dr-auto-sync\":{\"label-key\":\"\",\"primary\":\"\",\"dr\":\"\",\"primary-replicas\":0,\"dr-replicas\":0,\"wait-store-timeout\":\"1m0s\",\"pause-region-split\":\"false\"}},\"keyspace\":{\"pre-alloc\":null,\"wait-region-split\":true,\"wait-region-split-timeout\":\"30s\",\"check-region-split-interval\":\"50ms\"},\"controller\":{\"degraded-mode-wait-duration\":\"0s\",\"ltb-max-wait-duration\":\"30s\",\"request-unit\":{\"read-base-cost\":0.125,\"read-per-batch-base-cost\":0.5,\"read-cost-per-byte\":0.0000152587890625,\"write-base-cost\":1,\"write-per-batch-base-cost\":1,\"write-cost-per-byte\":0.0009765625,\"read-cpu-ms-cost\":0.3333333333333333}}}"]

kubectl logs advanced-test-tidb-0 -c tidb -n tidb-cluster |grep tidb-server-tls
[2024/06/06 03:38:53.325 +00:00] [INFO] [printer.go:52] ["loaded config"] [config="{\"host\":\"0.0.0.0\",\"advertise-address\":\"advanced-test-tidb-0.advanced-test-tidb-peer.tidb-cluster.svc\",\"port\":4000,\"cors\":\"\",\"store\":\"tikv\",\"path\":\"advanced-test-pd:2379\",\"socket\":\"/tmp/tidb-4000.sock\",\"lease\":\"45s\",\"split-table\":true,\"token-limit\":1000,\"temp-dir\":\"/tmp/tidb\",\"tmp-storage-path\":\"/tmp/0_tidb/MC4wLjAuMDo0MDAwLzAuMC4wLjA6MTAwODA=/tmp-storage\",\"tmp-storage-quota\":-1,\"server-version\":\"\",\"version-comment\":\"\",\"tidb-edition\":\"\",\"tidb-release-version\":\"\",\"keyspace-name\":\"\",\"log\":{\"level\":\"info\",\"format\":\"text\",\"disable-timestamp\":null,\"enable-timestamp\":null,\"disable-error-stack\":null,\"enable-error-stack\":null,\"file\":{\"filename\":\"\",\"max-size\":300,\"max-days\":0,\"max-backups\":3},\"slow-query-file\":\"/var/log/tidb/slowlog\",\"expensive-threshold\":10000,\"query-log-max-len\":4096,\"enable-slow-log\":true,\"slow-threshold\":0,\"record-plan-in-slow-log\":1,\"timeout\":0},\"instance\":{\"tidb_general_log\":false,\"tidb_pprof_sql_cpu\":false,\"ddl_slow_threshold\":300,\"tidb_expensive_query_time_threshold\":60,\"tidb_expensive_txn_time_threshold\":600,\"tidb_stmt_summary_enable_persistent\":false,\"tidb_stmt_summary_filename\":\"tidb-statements.log\",\"tidb_stmt_summary_file_max_days\":3,\"tidb_stmt_summary_file_max_size\":64,\"tidb_stmt_summary_file_max_backups\":0,\"tidb_enable_slow_log\":true,\"tidb_slow_log_threshold\":0,\"tidb_record_plan_in_slow_log\":1,\"tidb_check_mb4_value_in_utf8\":true,\"tidb_force_priority\":\"NO_PRIORITY\",\"tidb_memory_usage_alarm_ratio\":0.8,\"tidb_enable_collect_execution_info\":true,\"plugin_dir\":\"/data/deploy/plugin\",\"plugin_load\":\"\",\"max_connections\":0,\"tidb_enable_ddl\":true,\"tidb_rc_read_check_ts\":false,\"tidb_service_scope\":\"\"},\"security\":{\"skip-grant-table\":false,\"ssl-ca\":\"/var/lib/tidb-server-tls/ca.crt\",\"ssl-cert\":\"/var/lib/tidb-server-tls/tls.crt\",\"ssl-key\":\"/var/lib/tidb-server-tls/tls.key\",\"cluster-ssl-ca\":\"\",\"cluster-ssl-cert\":\"\",\"cluster-ssl-key\":\"\",\"cluster-verify-cn\":null,\"session-token-signing-cert\":\"\",\"session-token-signing-key\":\"\",\"spilled-file-encryption-method\":\"plaintext\",\"enable-sem\":false,\"auto-tls\":false,\"tls-version\":\"\",\"rsa-key-size\":4096,\"secure-bootstrap\":false,\"auth-token-jwks\":\"\",\"auth-token-refresh-interval\":\"1h0m0s\",\"disconnect-on-expired-password\":true},\"status\":{\"status-host\":\"0.0.0.0\",\"metrics-addr\":\"\",\"status-port\":10080,\"metrics-interval\":15,\"report-status\":true,\"record-db-qps\":false,\"record-db-label\":false,\"grpc-keepalive-time\":10,\"grpc-keepalive-timeout\":3,\"grpc-concurrent-streams\":1024,\"grpc-initial-window-size\":2097152,\"grpc-max-send-msg-size\":2147483647},\"performance\":{\"max-procs\":0,\"max-memory\":0,\"server-memory-quota\":0,\"stats-lease\":\"3s\",\"stmt-count-limit\":5000,\"pseudo-estimate-ratio\":0.8,\"bind-info-lease\":\"3s\",\"txn-entry-size-limit\":6291456,\"txn-total-size-limit\":104857600,\"tcp-keep-alive\":true,\"tcp-no-delay\":true,\"cross-join\":true,\"distinct-agg-push-down\":false,\"projection-push-down\":false,\"max-txn-ttl\":3600000,\"index-usage-sync-lease\":\"0s\",\"plan-replayer-gc-lease\":\"10m\",\"gogc\":100,\"enforce-mpp\":false,\"stats-load-concurrency\":5,\"stats-load-queue-size\":1000,\"analyze-partition-concurrency-quota\":16,\"plan-replayer-dump-worker-concurrency\":1,\"enable-stats-cache-mem-quota\":true,\"committer-concurrency\":128,\"run-auto-analyze\":true,\"force-priority\":\"NO_PRIORITY\",\"memory-usage-alarm-ratio\":0.8,\"enable-load-fmsketch\":false,\"lite-init-stats\":true,\"force-init-stats\":true},\"prepared-plan-cache\":{\"enabled\":true,\"capacity\":100,\"memory-guard-ratio\":0.1},\"opentracing\":{\"enable\":false,\"rpc-metrics\":false,\"sampler\":{\"type\":\"const\",\"param\":1,\"sampling-server-url\":\"\",\"max-operations\":0,\"sampling-refresh-interval\":0},\"reporter\":{\"queue-size\":0,\"buffer-flush-interval\":0,\"log-spans\":false,\"local-agent-host-port\":\"\"}},\"proxy-protocol\":{\"networks\":\"\",\"header-timeout\":5,\"fallbackable\":false},\"pd-client\":{\"pd-server-timeout\":3},\"tikv-client\":{\"grpc-connection-count\":4,\"grpc-keepalive-time\":10,\"grpc-keepalive-timeout\":3,\"grpc-compression-type\":\"none\",\"commit-timeout\":\"41s\",\"async-commit\":{\"keys-limit\":256,\"total-key-size-limit\":4096,\"safe-window\":2000000000,\"allowed-clock-drift\":500000000},\"max-batch-size\":128,\"overload-threshold\":200,\"max-batch-wait-time\":0,\"batch-wait-size\":8,\"enable-chunk-rpc\":true,\"region-cache-ttl\":600,\"store-limit\":0,\"store-liveness-timeout\":\"1s\",\"copr-cache\":{\"capacity-mb\":1000},\"copr-req-timeout\":60000000000,\"ttl-refreshed-txn-size\":33554432,\"resolve-lock-lite-threshold\":16},\"binlog\":{\"enable\":false,\"ignore-error\":false,\"write-timeout\":\"15s\",\"binlog-socket\":\"\",\"strategy\":\"range\"},\"compatible-kill-query\":false,\"pessimistic-txn\":{\"max-retry-count\":256,\"deadlock-history-capacity\":10,\"deadlock-history-collect-retryable\":false,\"pessimistic-auto-commit\":false,\"constraint-check-in-place-pessimistic\":true},\"max-index-length\":3072,\"index-limit\":64,\"table-column-count-limit\":1017,\"graceful-wait-before-shutdown\":0,\"alter-primary-key\":false,\"treat-old-version-utf8-as-utf8mb4\":true,\"enable-table-lock\":false,\"delay-clean-table-lock\":0,\"split-region-max-num\":1000,\"top-sql\":{\"receiver-address\":\"\"},\"repair-mode\":false,\"repair-table-list\":[],\"isolation-read\":{\"engines\":[\"tikv\",\"tiflash\",\"tidb\"]},\"new_collations_enabled_on_first_bootstrap\":true,\"experimental\":{\"allow-expression-index\":false},\"skip-register-to-dashboard\":false,\"enable-telemetry\":false,\"labels\":{},\"enable-global-index\":false,\"deprecate-integer-display-length\":false,\"enable-enum-length-limit\":true,\"stores-refresh-interval\":60,\"enable-tcp4-only\":false,\"enable-forwarding\":false,\"max-ballast-object-size\":0,\"ballast-object-size\":0,\"transaction-summary\":{\"transaction-summary-capacity\":500,\"transaction-id-digest-min-duration\":2147483647},\"enable-global-kill\":true,\"enable-32bits-connection-id\":true,\"initialize-sql-file\":\"\",\"enable-batch-dml\":false,\"mem-quota-query\":1073741824,\"oom-action\":\"cancel\",\"oom-use-tmp-storage\":true,\"check-mb4-value-in-utf8\":true,\"enable-collect-execution-info\":true,\"plugin\":{\"dir\":\"/data/deploy/plugin\",\"load\":\"\"},\"max-server-connections\":0,\"run-ddl\":true,\"disaggregated-tiflash\":false,\"autoscaler-type\":\"aws\",\"autoscaler-addr\":\"tiflash-autoscale-lb.tiflash-autoscale.svc.cluster.local:8081\",\"is-tiflashcompute-fixed-pool\":false,\"autoscaler-cluster-id\":\"\",\"use-autoscaler\":false,\"tidb-max-reuse-chunk\":64,\"tidb-max-reuse-column\":256,\"tidb-enable-exit-check\":false,\"in-mem-slow-query-topn-num\":30,\"in-mem-slow-query-recent-num\":500}"]

MySQL Client Connect to TiDB Cluster with TLS

Save CA/Client Certificate/Private Key

kubectl get secret -n tidb-cluster advanced-test-tidb-client-secret  -ojsonpath='{.data.tls\.crt}' | base64 --decode > client-tls.crt
kubectl get secret -n tidb-cluster advanced-test-tidb-client-secret  -ojsonpath='{.data.tls\.key}' | base64 --decode > client-tls.key
kubectl get secret -n tidb-cluster advanced-test-tidb-client-secret  -ojsonpath='{.data.ca\.crt}'  | base64 --decode > client-ca.crt

Connect with MySQL Client

mysql --comments -uroot -p -P 4000 -h ${tidb_host} --ssl-cert=client-tls.crt --ssl-key=client-tls.key --ssl-ca=client-ca.crt

mysql> SHOW STATUS LIKE "Ssl%";
+-----------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Variable_name         | Value                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+-----------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Ssl_cipher            | TLS_AES_128_GCM_SHA256                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| Ssl_cipher_list       | RC4-SHA:DES-CBC3-SHA:AES128-SHA:AES256-SHA:AES128-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-ECDSA-RC4-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-RC4-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-CHACHA20-POLY1305:TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256: |
| Ssl_server_not_after  | Jun  6 02:22:01 2025 UTC                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| Ssl_server_not_before | Jun  6 02:22:01 2024 UTC                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| Ssl_verify_mode       | 5                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| Ssl_version           | TLSv1.3                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+-----------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
6 rows in set (0.10 sec)

TiDB Operator Enable TLS For MySQL Client With cert-manager was originally published by Sherry Yin at Sherry Yin on June 06, 2024.

S3 Compatible MinIO Operator Deployment

2024-04-12T00:00:00+08:00

Object store service is a common service nowdays, especially S3 compatible. The introduction of MinIO can be found here.

This article will demostrate how to setup MinIO Operator for testing purpose, this is NOT a comprehensive guide for production scenario.

Deploy MinIO Operator
Deploy MinIO Tenant
Create bucket in MinIO Console

Depoly MinIO Operator

We use Helm to deploy the operator.

helm repo add minio-operator https://operator.min.io
helm install --namespace minio-operator  --create-namespace operator minio-operator/operator

Deploy MinIO Tenant

1.Download tenant CR file tenant-values.yaml

curl -sLo tenant-values.yaml https://raw.githubusercontent.com/minio/operator/master/helm/tenant/values.yaml

2.Configure Tenant Update tenant-values.yaml

tenant:
  name: myminio
  image:
    repository: quay.io/minio/minio
    tag: RELEASE.2024-07-16T23-46-41Z
    pullPolicy: IfNotPresent
  imagePullSecret: { }
  scheduler: { }
  configuration:
    name: myminio-env-configuration
    configSecret:
      name: myminio-env-configuration
      accessKey: minio
      secretKey: minio123
  pools:
    - servers: 1
      name: pool-0
      volumesPerServer: 1
      size: 10Gi
      storageAnnotations: { }
      annotations: { }
      labels: { }
      tolerations: [ ]
      nodeSelector: { }
      affinity: { }
      resources: { }
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        fsGroupChangePolicy: "OnRootMismatch"
        runAsNonRoot: true
      containerSecurityContext:
        runAsUser: 1000
        runAsGroup: 1000
        runAsNonRoot: true
        allowPrivilegeEscalation: false
        capabilities:
          drop:
            - ALL
        seccompProfile:
          type: RuntimeDefault
      topologySpreadConstraints: [ ]
  mountPath: /export
  subPath: /data
  metrics:
    enabled: false
    port: 9000
    protocol: http
  certificate:
    externalCaCertSecret: [ ]
    externalCertSecret: [ ]
    requestAutoCert: true
    certConfig: { }
  features:
    bucketDNS: false
    domains: { }
    enableSFTP: false
  buckets: [ ]
  users: [ ]
  podManagementPolicy: Parallel
  liveness: { }
  readiness: { }
  startup: { }
  lifecycle: { }
  exposeServices: { }
  serviceAccountName: ""
  prometheusOperator: false
  logging: { }
  serviceMetadata: { }
  env: [ ]
  priorityClassName: ""
  additionalVolumes: [ ]
  additionalVolumeMounts: [ ]

ingress:
  api:
    enabled: false
    ingressClassName: ""
    labels: { }
    annotations: { }
    tls: [ ]
    host: minio.local
    path: /
    pathType: Prefix
  console:
    enabled: true
    ingressClassName: ""
    labels: { }
    annotations: { }
    tls: [ ]
    host: minio-console.local
    path: /
    pathType: Prefix

3.Deploy tenant

helm install  --namespace myminio --create-namespace --values tenant-values.yaml myminio minio-operator/tenant

4.Expose console service

kubectl port-forward svc/myminio-console 9443 -n myminio --address=0.0.0.0

5.Access MinIO console and create bucket

Username: minio (accessKey)
Password: minio123 (secretKey)

S3 Compatible MinIO Operator Deployment was originally published by Sherry Yin at Sherry Yin on April 12, 2024.

TiDB Operator Logging EFK Integration

2024-04-07T00:00:00+08:00

❗ This is not a production setup, it’s only for testing and demo purpose

Introduction

Since TiDB components deployed by TiDB Operator output the logs in the stdout and stderr of the container by default, as long as you have EFK deployed in your Kubernetes cluster, all the TiDB components logs will be collected by Fluentd running on each Kubernetes node, you can find TiDB logs same as other Kubernetes serviceslogs.

This article demonstrates how to collect TiDB logs using Fluent-bit in Kubernetes based on EFK, especially for slow logs which need to be properly formated before streaming to EFK, for the EFK deployment please refer to my previous blog Kubernetes Logging EFK Deployment

Enviornments

Fluent-bit v1.8 (needed by multiline parser)
TiDB operator v1.5.2
TiDB v7.5

Step by Step Setup

1. Deploy TiDB Operator

kubectl create -f https://raw.githubusercontent.com/pingcap/tidb-operator/v1.5.2/manifests/crd.yaml
kubectl create namespace tidb-admin
helm repo add pingcap https://charts.pingcap.org/
helm install --namespace tidb-admin tidb-operator pingcap/tidb-operator --version v1.5.2

2. Deploy TiDB Cluster with Fluent-bit

Fluent bit running as sidecar in TiDB pod, you can use Fluentd as well. I choose fluent-bit as it’s light weight.

2.1 Prepare Fluent bit config

For demo purpose, I will manually mount Fluent-bit config. You may customize your image for a clean deployment, as slow query log is multiline format, we need to handle it properly, mutiline format parser is included in the config.

1.Create fluent-bit ConfigMap

kubectl apply -f tidb-fluentbit-cm-slowlog.yaml

tidb-fluentbit-cm-slowlog.yaml can be found here.

2.2 Deploy TiDB Cluster with fluent-bit as sidecar container

Option 1: fluent-bit in additional container

This deployment will keep the default slowlog container, fluent-bit as an additional container, tidb pod in total 3 containers.

kubectl apply -f tidb-advanced-cluster-additional-container.yaml

tidb-advanced-cluster-additional-container.yaml can be found here.

Option2: Fluent-bit Merged with default slowlog container

We customize the default slowlog container to run Fluent bit by merging the default slowlog container and additional container. tidb pod only 2 containers

kubectl apply -f tidb-advanced-cluster-fluentbit-merged-with-slowlog.yaml

tidb-advanced-cluster-fluentbit-merged-with-slowlog.yaml can be found here.

3. View TiDB Slow Query Logs in Kibana

1.You will find tidb-yyyy.mm.dd index

2.Create data view for tidb index

3.View TiDB Slow Logs

4.Formated TiDB Slow Log

TiDB Operator Logging EFK Integration was originally published by Sherry Yin at Sherry Yin on April 07, 2024.

Kubernetes Logging EFK Deployment

2024-04-02T00:00:00+08:00

❗ This is not a production setup, it’s only for testing and demo purpose

Envrionments

minikube v1.32.0
Kubernetes v1.24
ECK v2.12
Elasticsearch + Kibana v8.13.0
Fluentd v1.16

Introduction

This is a simple infra level logging system setup, Fluentd as a daemonset running on each Kubernetes node as an agent to collect all containers’ logs to elasticseach. Again, this is not for production setup, just meet basic log collection requirement, production setup colud be more conprehensive.

A glance of the architecture

Step By Step Setup

1. Prepare Kubernetes

minikube start --cpus=3 --memory=6G --disk-size=25G --kubernetes-version=v1.24

2. Deploy ECK

Refer to official documentation Deploy ECK in your Kubernetes cluster

2.1 Deploy Elastic Operator

1.Create CRD

kubectl create -f https://download.elastic.co/downloads/eck/2.12.1/crds.yaml

2.Create Operator

kubectl apply -f https://download.elastic.co/downloads/eck/2.12.1/operator.yaml

2.2 Deploy Elasticsearch

1.Create namespace eck for ECK

2.Deploy Elaisticsearch

kubectl apply -f elasticsearch.yaml

elasticsearch.yaml can be found here.

Make sure HEALTH is green, and PHASE is Ready.

2.3 Deploy Kibana

kubectl apply -f kibana.yaml

kibana.yaml can be found here.

2.4 Access Kibana

1.Get password

kubectl get secret quickstart-es-elastic-user -n eck -o go-template='{{.data.elastic | base64decode}}'

2.Expose kibana service access from outside Kubernetes

kubectl port-forward service/quickstart-kb-http -n eck 5601 --address=0.0.0.0

3.Login Access Kibana URL https://{your host}:5601/

3. Deploy Fluentd

kubectl apply -f fluentd-daemonset-elasticsearch-rbac.yaml

fluentd-daemonset-elasticsearch-rbac.yaml can be found here.

Replace the environment varibles accordingly, especically FLUENT_ELASTICSEARCH_PASSWORD

4. Create Data View in Kibana

5. View K8S Logs in Kibana

Enjoy EFK!!!

Kubernetes Logging EFK Deployment was originally published by Sherry Yin at Sherry Yin on April 02, 2024.

Rust Begin Here

2023-08-15T00:00:00+08:00

Local Rust Installation

Install

curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh

More details refer to the guide.

Components installed

cargo: the Rust’s build system and package manager.
rustfmt: a tool for formatting Rust code according to style guidelines.

Hello World!

New

Create a new project with Cargo

cargo new hello_world

Output: “Created binary (application) hello_world package”

A quick glance

cat hello_world/src/main.rs

Output:

fn main() {
    println!("Hello, world!");
}

Build

cd hello_world
cargo build

Output: “binary hello_world was created under target/debug”

Run

target/debug/hello_world

output: “Hello, world!”

cargo run

output:

    Finished dev [unoptimized + debuginfo] target(s) in 0.03s
     Running `target/debug/hello_world`
Hello, world!

Project Directory

tree
.
├── Cargo.lock
├── Cargo.toml
├── src
│   └── main.rs
└── target
    ├── CACHEDIR.TAG
    └── debug
        ├── build
        ├── deps
        │   ├── hello_world-a65d4c6029deb9db
        │   ├── hello_world-a65d4c6029deb9db.2m06qpscokrdldr2.rcgu.o
        │   ├── hello_world-a65d4c6029deb9db.337tnzf71uan4bv8.rcgu.o
        │   ├── hello_world-a65d4c6029deb9db.3lakkzjgkq4s2ufz.rcgu.o
        │   ├── hello_world-a65d4c6029deb9db.3nyq6f5mboo59omw.rcgu.o
        │   ├── hello_world-a65d4c6029deb9db.3txvt6tt1wrkqp6g.rcgu.o
        │   ├── hello_world-a65d4c6029deb9db.d
        │   └── hello_world-a65d4c6029deb9db.okmjk6ajfymokvw.rcgu.o
        ├── examples
        ├── hello_world
        ├── hello_world.d
        └── incremental
            └── hello_world-27bxg3u8cn054
                ├── s-gq9ubsyjer-cu1tnq-8pp2iqcnvjen9b1yyqrks0gg0
                │   ├── 2m06qpscokrdldr2.o
                │   ├── 337tnzf71uan4bv8.o
                │   ├── 3lakkzjgkq4s2ufz.o
                │   ├── 3nyq6f5mboo59omw.o
                │   ├── 3txvt6tt1wrkqp6g.o
                │   ├── dep-graph.bin
                │   ├── okmjk6ajfymokvw.o
                │   ├── query-cache.bin
                │   └── work-products.bin
                └── s-gq9ubsyjer-cu1tnq.lock

10 directories, 24 files

IDE Recommendation

VSCode

Some plugins to recommend:

Rust Syntax: provides a TextMate grammar for Rust.
rust-analyzer: an implementation of Language Server Protocol for the Rust programming language. It provides features like completion and goto definition for many code editors, including VS Code, Emacs and Vim.
crates: helps Rust developers managing dependencies with Cargo.toml.
Even Better Toml: a TOML language support extension.
Rust Test Lens: adds a code lens to quickly run or debug a single test for your Rust code.

RustRover

From JetBrains, currently RustRover is free to use during the public preview, download.

Rust Begin Here was originally published by Sherry Yin at Sherry Yin on August 15, 2023.