# See https://doc.traefik.io/traefik/v3.0/migration/v2-to-v3/#new-v3-syntax-notable-changes
defaultRuleSyntax:""
# Traefik experimental features
experimental:
# -- Enable traefik experimental plugins
plugins: {}
# demo:
# moduleName: github.com/traefik/plugindemo
# version: v0.2.1
kubernetesGateway:
# -- Enable traefik experimental GatewayClass CRD
enabled:false
gateway:
# -- When providers.kubernetesGateway.enabled, deploy a default gateway
enabled:true
# -- Set a custom name to gateway
name:""
# -- By default, Gateway is created in the same `Namespace` than Traefik.
namespace:""
# -- Additional gateway annotations (e.g. for cert-manager.io/issuer)
annotations: {}
# -- Define listeners
listeners:
web:
# -- Port is the network port. Multiple listeners may use the same port, subject to the Listener compatibility rules.
# The port must match a port declared in ports section.
port:8000
# -- Optional hostname. See [Hostname](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Hostname)
hostname:""
# Specify expected protocol on this listener. See [ProtocolType](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.ProtocolType)
protocol:HTTP
# -- Routes are restricted to namespace of the gateway [by default](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.FromNamespaces
namespacePolicy:# @schema type:[string, null]
# websecure listener is disabled by default because certificateRefs needs to be added,
# or you may specify TLS protocol with Passthrough mode and add "--providers.kubernetesGateway.experimentalChannel=true" in additionalArguments section.
# websecure:
# # -- Port is the network port. Multiple listeners may use the same port, subject to the Listener compatibility rules.
# # The port must match a port declared in ports section.
# port: 8443
# # -- Optional hostname. See [Hostname](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Hostname)
# hostname:
# # Specify expected protocol on this listener See [ProtocolType](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.ProtocolType)
# protocol: HTTPS
# # -- Routes are restricted to namespace of the gateway [by default](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.FromNamespaces)
# namespacePolicy:
# # -- Add certificates for TLS or HTTPS protocols. See [GatewayTLSConfig](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io%2fv1.GatewayTLSConfig)
# certificateRefs:
# # -- TLS behavior for the TLS session initiated by the client. See [TLSModeType](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.TLSModeType).
# -- Allows IngressRoute to reference resources in namespace other than theirs
allowCrossNamespace:false
# -- Allows to reference ExternalName services in IngressRoute
allowExternalNameServices:false
# -- Allows to return 503 when there is no endpoints available
allowEmptyServices:true
# -- When the parameter is set, only resources containing an annotation with the same value are processed. Otherwise, resources missing the annotation, having an empty value, or the value traefik are processed. It will also set required annotation on Dashboard and Healthcheck IngressRoute when enabled.
# -- Array of namespaces to watch. If left empty, Traefik watches all namespaces.
namespaces: []
# -- Defines whether to use Native Kubernetes load-balancing mode by default.
nativeLBByDefault:false
kubernetesIngress:
# -- Load Kubernetes Ingress provider
enabled:true
# -- Allows to reference ExternalName services in Ingress
allowExternalNameServices:false
# -- Allows to return 503 when there is no endpoints available
allowEmptyServices:true
# -- When ingressClass is set, only Ingresses containing an annotation with the same value are processed. Otherwise, Ingresses missing the annotation, having an empty value, or the value traefik are processed.
# -- Allows reporter to send metrics to the OpenTelemetry Collector without using a secured protocol.
insecure:false
## Defines the TLS configuration used by the reporter to send metrics to the OpenTelemetry Collector.
tls:
# -- The path to the certificate authority, it defaults to the system bundle.
ca:""
# -- The path to the public certificate. When using this option, setting the key option is required.
cert:""
# -- The path to the private key. When using this option, setting the cert option is required.
key:""
# -- When set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers.
insecureSkipVerify:false
# -- Global command arguments to be passed to all traefik's pods
globalArguments:
-"--global.checknewversion"
-"--global.sendanonymoususage"
# -- Additional arguments to be passed at Traefik's binary
# See [CLI Reference](https://docs.traefik.io/reference/static-configuration/cli/)
# Use curly braces to pass values: `helm install --set="additionalArguments={--providers.kubernetesingress.ingressclass=traefik-internal,--log.level=DEBUG}"`
# -- You may not want to expose the metrics port on production deployments.
# If you want to access it from outside your cluster,
# use `kubectl port-forward` or create a secure ingress
expose:
default:false
# -- The exposed port for this service
exposedPort:9100
# -- The port protocol (TCP/UDP)
protocol:TCP
# -- TLS Options are created as [TLSOption CRDs](https://doc.traefik.io/traefik/https/tls/#tls-options)
# When using `labelSelector`, you'll need to set labels on tlsOption accordingly.
# See EXAMPLE.md for details.
tlsOptions: {}
# -- TLS Store are created as [TLSStore CRDs](https://doc.traefik.io/traefik/https/tls/#default-certificate). This is useful if you want to set a default certificate. See EXAMPLE.md for details.
tlsStore: {}
service:
enabled:true
## -- Single service is using `MixedProtocolLBService` feature gate.
## -- When set to false, it will create two Service, one for TCP and one for UDP.
single:true
type:LoadBalancer
# -- Additional annotations applied to both TCP and UDP services (e.g. for cloud provider specific config)
annotations: {}
# -- Additional annotations for TCP service only
annotationsTCP: {}
# -- Additional annotations for UDP service only
annotationsUDP: {}
# -- Additional service labels (e.g. for filtering Service by custom labels)
labels: {}
# -- Additional entries here will be added to the service spec.
# -- Cannot contain type, selector or ports entries.
spec: {}
# externalTrafficPolicy: Cluster
# loadBalancerIP: "1.2.3.4"
# clusterIP: "2.3.4.5"
loadBalancerSourceRanges: []
# - 192.168.0.1/32
# - 172.16.0.0/16
## -- Class of the load balancer implementation
# loadBalancerClass: service.k8s.aws/nlb
externalIPs: []
# - 1.2.3.4
## One of SingleStack, PreferDualStack, or RequireDualStack.
配置文件 my.ini 通常位于 C:\ProgramData\MySQL\MySQL Server X.X\ 目录下。
此时，当前窗口会挂起，显示 MySQL 已启动。请勿关闭此窗口。
2.3 第三步：连接数据库并清空 root 密码
打开另一个新的命令提示符窗口（管理员身份）。
同样切换到 MySQL 的 bin 目录。
无密码连接 MySQL：
1
mysql -u root
成功连接后，会看到 mysql> 提示符。
切换到 mysql 系统数据库并清空 root 密码：
1 2 3 4 5
USE mysql; -- 对于 MySQL 5.7+，密码存储在 `authentication_string` 字段 UPDATEuserSET authentication_string=’’ WHEREuser=’root’; -- 对于 MySQL 5.6 及更早版本，使用 `password` 字段 -- UPDATE user SET password=’’ WHERE user=’root’;
执行成功后，会提示 Query OK, 1 row affected。
刷新权限并退出：
1 2
FLUSH PRIVILEGES; QUIT;
2.4 第四步：重启 MySQL 服务
返回到运行 mysqld --skip-grant-tables 的命令窗口，按 Ctrl + C 终止进程。
或者，打开任务管理器，结束 mysqld.exe 进程。
重新启动 MySQL 服务：
1
netstart mysql
（同样，请使用您的实际服务名）
至此，root 密码已被清空。您可以使用 mysql -u root 直接登录，无需密码。
三、为 root 账户设置新密码（安全加固）
出于安全考虑，必须为 root 账户设置一个强密码。登录后，可选择以下任一方法。
3.1 方法一：使用 SET PASSWORD 命令（推荐）
1 2 3 4 5 6 7 8
-- 登录 MySQL mysql -u root
-- 修改密码（MySQL 5.7+ 语法） ALTERUSER ‘root’@’localhost’ IDENTIFIED BY ‘您的新密码’;
-- 或使用传统语法（某些版本支持） SET PASSWORD FOR ‘root’@’localhost’ = PASSWORD(‘您的新密码’);
USE mysql; -- 对于 MySQL 5.7+ UPDATEuserSET authentication_string = PASSWORD(‘您的新密码’) WHEREuser= ‘root’; -- 对于旧版本 -- UPDATE user SET password = PASSWORD(‘您的新密码’) WHERE user = ‘root’;
FLUSH PRIVILEGES;
无论使用哪种方法，修改密码后都必须执行 FLUSH PRIVILEGES; 使更改立即生效。
四、故障排除与注意事项
4.1 常见错误与解决
错误：mysqld: [ERROR] Found option without preceding group in config file 原因：my.ini 配置文件编码或格式错误（例如保存为 UTF-8 with BOM）。 解决：使用记事本打开 my.ini，另存为 ANSI 编码。
错误：No such file or directory 原因：未指定正确的 my.ini 路径，或数据目录不存在。 解决：使用 --defaults-file 参数明确指定配置文件完整路径。
服务无法启动 解决：检查事件查看器（eventvwr.msc）中 “应用程序” 日志的 MySQL 错误信息。
4.2 安全建议
立即修改密码：重置后，务必立即设置一个强密码。
检查用户：登录后，执行 SELECT user, host FROM mysql.user;，检查是否有未知或可疑账户。
