Configuring MySQL server enforced with TLS to connect to Cloudera Data Explorer (Hue)

If your MySQL server is configured to use TLS version 1.2 or higher for an encrypted connection with Data Explorer, then you may not be able to start the Data Explorer server and the Kerberos ticket renewer. One solution to fix this problem is to upgrade the MySQL client to version 8.

One of the errors you may see while connecting to Data Explorer if your MySQL server is configured with TLS 1.2 or higher is: “The health test result for HUE_SERVER_SCM_HEALTH has become bad: This role's process failed to start.” The error occurs because the default MySQL Python library shipped with Cloudera uses an older libmysqlclient library that does not support TLS 1.2 and higher.

SSH into the Data Explorer server host as a root user.
Change directory to /etc/cloudera-scm-agent/ and take a backup of the config.ini file.
Run the following command to get a list of all the installed MySQL packages:
```
rpm -qa | grep -i mysql*
```
Save the list of all the installed MySQL packages for future reference.
Remove all MySQL Community RPM packages and the Cloudera Manager agent:
```
yum erase mysql-community*|cloudera-manager-agent
```
Uninstalling the Cloudera Manager agent also uninstalls the MySQL-python library. Save the list of all the MySQL packages that are uninstalled for future reference.

Reinstall the Cloudera Manager agent as follows:

yum -y install cloudera-manager-agent

This installs all the required packages:

============================================================================================================================
 Package                        Architecture   Version                             Repository                          Size
============================================================================================================================
Installing:
 cloudera-manager-agent         x86_64         7.13.2.10000-82107610.el9           cm                                 185 M
Installing dependencies:
 apr, apr-util, bind-libs, httpd, mod_ssl, openssl-devel, sqlite, etc. (RHEL 9 RHUI repositories)

Note: PYTHON VERSION is 3.11
...
Complete!

Install the mysql-devel (the development header files and libraries for MySQL database client applications):

yum install mysql-devel

============================================================================================================================
 Package                                    Architecture       Version                  Repository                     Size
============================================================================================================================
Installing:
 mysql-community-devel                      x86_64             8.0.46-1.el9             mysql80-community             7.0 M
Installing dependencies:
 mysql-community-client-plugins             x86_64             8.0.46-1.el9             mysql80-community             1.4 M
 mysql-community-common                     x86_64             8.0.46-1.el9             mysql80-community             558 k
 mysql-community-libs                       x86_64             8.0.46-1.el9             mysql80-community             1.5 M

Transaction Summary
============================================================================================================================
Complete!

Install the Python developer package:

yum install python3.11-devel

============================================================================================================================
 Package                          Architecture     Version                               Repository                    Size
============================================================================================================================
Installing:
 python3.11-devel                 x86_64           3.11.13-10.el9_8                      rhel-9-appstream-rhui-rpms   650 k
Transaction Summary
============================================================================================================================

Remove the existing _mysql.so file:

rm -rf /opt/cloudera/parcels/CDH-*/lib/hue/build/env/lib/python3.11/site-packages/_mysql.so

Verify or create the MySQL configuration header (my_config.h):
Check if my_config.h is present under /usr/include/mysql:
```
ls -l /usr/include/mysql/my_config.h
```
- If the my_config.h is present, proceed to the next step.
- If the my_config.h is missing, run the following commands to create the directory and populate the required header definitions:
```
mkdir -p /usr/include/mysql
cat << 'EOF' > /usr/include/mysql/my_config.h
#ifndef _my_config_h
#define _my_config_h

#define HAVE_LIBZ 1
#define HAVE_OPENSSL 1
#define HAVE_UCHAR 1
#define HAVE_UINT 1
#define HAVE_ULONG 1
#define HAVE_SIZE_T 1
#define HAVE_SSIZE_T 1

#endif
EOF
```

Install the MySQL Python library as follows:

/opt/cloudera/parcels/CDH/lib/hue/build/env/bin/python -m pip install mysqlclient --force-reinstall --ignore-installed

Copy the _mysql.so (MySQL client library) to Cloudera local parcel directory:
1. Locate the newly complied_mysql*.so file:
```
find /opt/cloudera/parcels/CDH/lib/hue/build/env/ -name "_mysql*.so"
```
  Output: /opt/cloudera/parcels/CDH/lib/hue/build/env/lib/python3.11/site-packages/MySQLdb/_mysql.cpython-311-x86_64-linux-gnu.so
2. Copy the _mysql.so file to Cloudera’s local parcel directory:
```
cp /opt/cloudera/parcels/CDH/lib/hue/build/env/lib/python3.11/site-packages/MySQLdb/_mysql.cpython-311-x86_64-linux-gnu.so /opt/cloudera/parcels/CDH/lib/hue/build/env/lib/python3.11/site-packages/_mysql.so
```
Log in to Cloudera Manager and restart the Data Explorer service.