feat: ONPREM-177- Replace Oracle with Moco

[collinol]

NOT A WALL OF AI TEXT - Genuine questions that I'm not sure of the answer to

Swapping Oracle Mysql Operator for Moco

Some concerns to call out

1. No in-place migration from Oracle to Moco. Existing installs need to mysqldump from the Oracle-backed instance, apply this version, and restore into the new Moco-backed instance.

2. Connection user changes from root to moco-writable. App pods and any monitoring/backup integrations that hard-code root will need updating.

3. No client-side TLS by default. Oracle's operator shipped self-signed TLS for MySQL client traffic automatically. Moco doesn't. Not sure to what effect this influences rollout

4. Replica count is restricted to odd values (1, 3, 5). Moco enforces quorum-based replication. CRs with spec.MySQL.ManagedMysql.Replicas set to 2 or 4 will fail CRD validation.**
   ---- ^ no concern

5. Service DNS changes from {name}-mysql.{ns}.svc to moco-{name}-primary.{ns}.svc. Don't know if this lends itself to any monitoring changes? Datadog? Metrics?
   --- ^ maybe?

6. PVC cascade-delete on onDelete: purge. Moco's PVCs are owned by the MySQLCluster CR so deleting the CR cascade-deletes PVCs. Oracle's operator didn't delete PVCs. Not sure if this matters?
   ^ need solution for this

Architectural differences

7. Single primary, not multi-primary. Moco uses GTID + lossless semi-sync replication with one writable primary. Oracle's InnoDB Cluster supports multi-primary mode. If anyone was relying on multi-primary writes, that's gone.
8. No SQL-aware proxy. Oracle ships MySQL Router as a sidecar. Moco doesn't, clients connect directly to a Kubernetes Service that points at the current primary.
   ---- ^ fine
9. MySQL image must be a Cybozu-built tag. Moco doesn't work with arbitrary mysql/mysql-server images. Only ghcr.io/cybozu-go/moco/mysql:. Customers with strict image-pull allowlists need to add ghcr.io/cybozu-go (or mirror to their internal registry).
   ^ we could build our own images based off theirs if customers have issue with it

Operator changes

10. wandb-mysql-init Job retargeted. Previously created wandb_local database, wandb_local user, and granted privileges using Oracle's root credentials. Now uses the operator-generated {name}-connection secret with moco-writable and only creates the database

11. Operator watches MySQLClusters via Owns(). The controller now reconciles when Moco updates the cluster's status, instead of waiting for the next periodic resync.
    ^ double check

12. Cert-manager added as a hard dependency, needs to be set to enabled=True in chart for use, I disabled it when testing because it conflicted with local tilt settings

Tested Locally with App, ran sample weave, saw data populated in moco mysql tables

kubectl moco mysql -u moco-admin wandb-mysql -n wandb -- -e "USE wandb_local; SELECT * FROM projects;"

created_at      updated_at      id      entity_id       user_id name    access  repo    views   description     group_path      sub_group_path  featured        analytics      docker_image    is_benchmark    benchmark_id    github_submission_repo  storage_key     is_published    deleted_at      config  rate_limits     last_active_at
2026-05-15 18:33:21     2026-05-15 18:33:21     1       5       4       intro-example   PRIVATE NULL    {}      NULL    NULL    NULL    NULL    NULL    NULL    0     NULL     NULL    intro-example   0       NULL    {"readFlatRuns": true, "writeFlatRuns": true, "containsAggregates": true}       {}      NULL

[w-b-hivemind]

HiveMind Sessions

2 sessions · 1h 52m · $73

Session	Agent	Duration	Tokens	Cost	Lines
Go Spawn Helper and MySQLCluster Testing 6f5038a8-58c1-4d03-b5de-5eb757875af8	claude	1m	2.2K	$0.26	+0 -0
Replace Oracle MySQL Operator with Moco 1f1b347b-dec7-45c5-8e8d-4e974f3358bd	claude	1h 51m	405.7K	$73	+196 -89
Total		1h 52m	407.9K	$73	+196 -89

View all sessions in HiveMind →

Run claude --resume 6f5038a8-58c1-4d03-b5de-5eb757875af8 to pickup where you left off.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 19c6c145-8d5b-469b-9288-0b912d3dabde

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ONPREM-177-Moco

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	k8s.io/​apiextensions-apiserver@​v0.34.2 ⏵ v0.35.3	+1
	k8s.io/​apimachinery@​v0.35.1 ⏵ v0.35.3
	k8s.io/​client-go@​v0.35.1 ⏵ v0.35.3
	k8s.io/​api@​v0.35.1 ⏵ v0.35.3
	golang.org/​x/​text@​v0.33.0 ⏵ v0.35.0
	github.com/​onsi/​ginkgo/​v2@​v2.28.0 ⏵ v2.28.1	+1
	github.com/​cybozu-go/​moco@​v0.34.0
	k8s.io/​utils@​v0.0.0-20260108192941-914a6e750570 ⏵ v0.0.0-20260319190234-28399d86e0b5	+1
	k8s.io/​klog/​v2@​v2.130.1 ⏵ v2.140.0	+1

View full report