Merge branch 'master' into rn-5.0.5

.github/workflows/dispatch.yml

@@ -20,10 +20,10 @@ jobs:
         echo "::set-output name=repo::$(cut -d'/' -f2 <<< ${{ github.repository }})"
         echo "::set-output name=sha::$(sha=${{ github.sha }}; echo ${sha:0:6})"
 
-    # - name: Repository Dispatch
-    #   uses: peter-evans/repository-dispatch@v1.1.1
-    #   with:
-    #       token: ${{ secrets.PR_TRIGGER_BUILD_TOKEN }}
-    #       repository: pingcap/website-docs/
-    #       event-type: ${{ steps.extract_info.outputs.repo }}/${{ steps.extract_info.outputs.branch }}-${{ steps.extract_info.outputs.sha }}
-    #       client-payload: '{"ref": "${{ github.ref }}", "sha": "${{ github.sha }}", "repo": "${{ github.repository }}"}'
+    - name: Repository Dispatch
+      uses: peter-evans/repository-dispatch@v1.1.1
+      with:
+          token: ${{ secrets.PR_TRIGGER_BUILD_TOKEN }}
+          repository: pingcap/website-docs/
+          event-type: ${{ steps.extract_info.outputs.repo }}/${{ steps.extract_info.outputs.branch }}-${{ steps.extract_info.outputs.sha }}
+          client-payload: '{"ref": "${{ github.ref }}", "sha": "${{ github.sha }}", "repo": "${{ github.repository }}"}'

TOC.md

@@ -3,7 +3,7 @@
 
 - About TiDB
   - [TiDB Introduction](/overview.md)
-  - [TiDB 5.2 Release Notes](/releases/release-5.2.0.md)
+  - [TiDB 5.3 Release Notes](/releases/release-5.3.0.md)
   - [Basic Features](/basic-features.md)
   - [Experimental Features](/experimental-features.md)
   - Benchmarks
@@ -577,6 +577,7 @@
   - v5.3
     - [5.3.0](/releases/release-5.3.0.md)
   - v5.2
+    - [5.2.3](/releases/release-5.2.3.md)
     - [5.2.2](/releases/release-5.2.2.md)
     - [5.2.1](/releases/release-5.2.1.md)
     - [5.2.0](/releases/release-5.2.0.md)

best-practices/haproxy-best-practices.md

@@ -14,7 +14,7 @@ This document describes best practices for configuration and usage of [HAProxy](
 
 HAProxy is free, open-source software written in C language that provides a high availability load balancer and proxy server for TCP and HTTP-based applications. Because of its fast and efficient use of CPU and memory, HAProxy is now widely used by many well-known websites such as GitHub, Bitbucket, Stack Overflow, Reddit, Tumblr, Twitter, Tuenti, and AWS (Amazon Web Services).
 
-HAProxy is written in the year 2000 by Willy Tarreau, the core contributor to the Linux kernel, who is still responsible for the maintenance of the project and provides free software updates in the open-source community. The latest stable version 2.0.0 was released on August 16, 2019, bringing more [excellent features](https://www.haproxy.com/blog/haproxy-2-0-and-beyond/).
+HAProxy is written in the year 2000 by Willy Tarreau, the core contributor to the Linux kernel, who is still responsible for the maintenance of the project and provides free software updates in the open-source community. In this guide, HAProxy [2.5.0](https://www.haproxy.com/blog/announcing-haproxy-2-5/) is used. It is recommended to use the latest stable version. See [the released version of HAProxy](http://www.haproxy.org/) for details.
 
 ## Basic features
 
@@ -72,28 +72,51 @@ yum -y install epel-release gcc systemd-devel
 
 ## Deploy HAProxy
 
-You can easily use HAProxy to configure and set up a load-balanced database environment. This section shows general deployment operations. You can customize the [configuration file](http://cbonte.github.io/haproxy-dconv/1.9/configuration.html) based on your actual scenario.
+You can easily use HAProxy to configure and set up a load-balanced database environment. This section shows general deployment operations. You can customize the [configuration file](http://cbonte.github.io/haproxy-dconv/2.5/configuration.html) based on your actual scenario.
 
 ### Install HAProxy
 
-1. Use yum to install HAProxy：
+1. Download the package of the HAProxy 2.5.0 source code:
 
     {{< copyable "shell-regular" >}}
 
     ```bash
-    yum -y install haproxy
+    wget https://github.com/haproxy/haproxy/archive/refs/tags/v2.5.0.zip
     ```
 
-2. Check whether the installation is successful：
+2. Unzip the package:
 
     {{< copyable "shell-regular" >}}
 
     ```bash
-    which haproxy
+    unzip v2.5.0.zip
     ```
 
+3. Compile the application from the source code:
+
+    {{< copyable "shell-regular" >}}
+
+    ```bash
+    cd haproxy-2.5.0
+    make clean
+    make -j 8 TARGET=linux-glibc USE_THREAD=1
+    make PREFIX=${/app/haproxy} SBINDIR=${/app/haproxy/bin} install  # Replace `${/app/haproxy}` and `${/app/haproxy/bin}` with your custom directories.
     ```
-    /usr/sbin/haproxy
+
+4. Reconfigure the profile:
+
+    {{< copyable "shell-regular" >}}
+
+    ```bash
+    echo 'export PATH=/app/haproxy/bin:$PATH' >> /etc/profile
+    ```
+
+5. Check whether the installation is successful:
+
+    {{< copyable "shell-regular" >}}
+
+    ```bash
+    which haproxy
     ```
 
 #### HAProxy commands
@@ -146,10 +169,10 @@ global                                     # Global configuration.
    log         127.0.0.1 local2            # Global syslog servers (up to two).
    chroot      /var/lib/haproxy            # Changes the current directory and sets superuser privileges for the startup process to improve security.
    pidfile     /var/run/haproxy.pid        # Writes the PIDs of HAProxy processes into this file.
-   maxconn     4000                        # The maximum number of concurrent connections for a single HAProxy process.
+   maxconn     256                         # The maximum number of concurrent connections per HAProxy thread.
+   nbthread    48                          # The maximum number of threads. (The upper limit is equal to the number of CPUs)
    user        haproxy                     # Same with the UID parameter.
    group       haproxy                     # Same with the GID parameter. A dedicated user group is recommended.
-   nbproc      40                          # The number of processes created when going daemon. When starting multiple processes to forward requests, make sure the value is large enough so that HAProxy does not block processes.
    daemon                                  # Makes the process fork into background. It is equivalent to the command line "-D" argument. It can be disabled by the command line "-db" argument.
    stats socket /var/lib/haproxy/stats     # The directory where statistics output is saved.
 
@@ -183,29 +206,17 @@ listen tidb-cluster                        # Database load balancing.
 
 ### Start HAProxy
 
-There are two methods to start HAProxy.
-
-Method 1: Execute `haproxy`. `/etc/haproxy/haproxy.cfg` is read by default (recommended).
+To start HAProxy, run `haproxy`. `/etc/haproxy/haproxy.cfg` is read by default (recommended).
 
 {{< copyable "shell-regular" >}}
 
 ```bash
 haproxy -f /etc/haproxy/haproxy.cfg
 ```
 
-Method 2: Use `systemd` to start HAProxy.
-
-{{< copyable "shell-regular" >}}
-
-```bash
-systemctl start haproxy.service
-```
-
 ### Stop HAProxy
 
-There are two methods to stop HAProxy.
-
-Method 1: Use `kill -9`.
+To stop HAProxy, use the `kill -9` command.
 
 1. Run the following command:
 
@@ -222,11 +233,3 @@ Method 1: Use `kill -9`.
     ```bash
     kill -9 ${haproxy.pid}
     ```
-
-Method 2: Use `systemd`.
-
-{{< copyable "shell-regular" >}}
-
-```bash
-systemctl stop haproxy.service
-```

experimental-features.md

@@ -47,9 +47,9 @@ This document introduces the experimental features of TiDB in different versions
 + [Titan Level Merge](/storage-engine/titan-configuration.md#level-merge-experimental) (Introduced in v4.0)
 + TiFlash supports distributing the new data of the storage engine on multiple hard drives to share the I/O pressure. (Introduced in v4.0)
 
-<!--## Data migration 
+## Data migration
 
-+ [DM OpenAPI](https://docs.pingcap.com/tidb-data-migration/stable/open-api) (Introduced in v5.3) -->
++ [DM OpenAPI](https://docs.pingcap.com/tidb-data-migration/stable/open-api) (Introduced in v5.3)
 
 ## Backup and restoration
 

explain-indexes.md

@@ -40,7 +40,6 @@ TiDB uses the `IndexLookup` operator when retrieving data from a secondary index
 EXPLAIN SELECT * FROM t1 WHERE intkey = 123;
 EXPLAIN SELECT * FROM t1 WHERE intkey < 10;
 EXPLAIN SELECT * FROM t1 WHERE intkey BETWEEN 300 AND 310;
-EXPLAIN SELECT * FROM t1 WHERE intkey BETWEEN 300 AND 310;
 EXPLAIN SELECT * FROM t1 WHERE intkey IN (123,29,98);
 EXPLAIN SELECT * FROM t1 WHERE intkey >= 99 AND intkey <= 103;
 ```

releases/release-5.2.3.md

@@ -0,0 +1,15 @@
+---
+title: TiDB 5.2.3 Release Note
+---
+
+# TiDB 5.2.3 Release Note
+
+Release date: December 3, 2021
+
+TiDB version: 5.2.3
+
+## Bug fix
+
++ TiKV
+
+    - Fix the issue that the `GcKeys` task does not work when it is called by multiple keys. Caused by this issue, compaction filer GC might not drop the MVCC deletion information. [#11217](https://github.com/tikv/tikv/issues/11217)

releases/release-5.3.0.md

@@ -102,7 +102,7 @@ In v5.3, the key new features or improvements are as follows:
         - Supports duplicated table names. You do not need to design complicated naming rules for your application.
         - Provides session-level data isolation, which enables you to design a simpler application logic. After the transaction finishes, the temporary tables are dropped.
 
-    [User document](/temporary-tables.md), [#24169](https://github.com/pingcap/tidb/issues/24169)
+        [User document](/temporary-tables.md), [#24169](https://github.com/pingcap/tidb/issues/24169)
 
 - **Support the `FOR UPDATE OF TABLES` syntax**
 
@@ -222,7 +222,7 @@ It is recommended that you create a least-privileged SQL user to access and sign
 
     TiCDC provides the eventually consistent replication capability in disaster scenarios. When a disaster occurs in the primary TiDB cluster and the service cannot be resumed in a short period of time, TiCDC needs to provide the ability to ensure the consistency of data in the secondary cluster. Meanwhile, TiCDC needs to allow the business to quickly switch the traffic to the secondary cluster to avoid the database being unavailable for a long time and affecting the business.
 
-    This feature supports TiCDC to replicate incremental data from a TiDB cluster to the secondary relational database TiDB/Aurora/MySQL/MariaDB. In case the primary cluster crashes, TiCDC can recover the secondary cluster to a certain snapshot in the primary cluster within 30 minutes, given the condition that before disaster the replication status of TiCDC is normal and replication lag is small. It allows data loss of less than 5 minutes, that is, RPO <= 30min, and RTO <= 5min.
+    This feature supports TiCDC to replicate incremental data from a TiDB cluster to the secondary relational database TiDB/Aurora/MySQL/MariaDB. In case the primary cluster crashes, TiCDC can recover the secondary cluster to a certain snapshot in the primary cluster within 5 minutes, given the condition that before disaster the replication status of TiCDC is normal and replication lag is small. It allows data loss of less than 30 minutes, that is, RTO <= 5min, and RPO <= 30min.
 
     [User Document](/ticdc/manage-ticdc.md)
 
@@ -242,16 +242,16 @@ It is recommended that you create a least-privileged SQL user to access and sign
 
     [User document](/dashboard/continuous-profiling.md)
 
-## Removed feature
-
-Starting from TiCDC v5.3.0, the cyclic replication feature between TiDB clusters (an experimental feature in v5.0.0) has been removed. If you have already used this feature to replicate data before upgrading TiCDC, the related data is not affected after the upgrade.
-
-### Telemetry
+## Telemetry
 
 TiDB adds the information to the telemetry report about whether or not the TEMPORARY TABLE feature is used. This does not include table names or table data.
 
 To learn more about telemetry and how to disable this behavior, refer to [Telemetry](/telemetry.md).
 
+## Removed feature
+
+Starting from TiCDC v5.3.0, the cyclic replication feature between TiDB clusters (an experimental feature in v5.0.0) has been removed. If you have already used this feature to replicate data before upgrading TiCDC, the related data is not affected after the upgrade.
+
 ## Improvements
 
 + TiDB

releases/release-notes.md

@@ -11,6 +11,7 @@ aliases: ['/docs/dev/releases/release-notes/','/docs/dev/releases/rn/']
 
 ## 5.2
 
+- [5.2.3](/releases/release-5.2.3.md)
 - [5.2.2](/releases/release-5.2.2.md)
 - [5.2.1](/releases/release-5.2.1.md)
 - [5.2.0](/releases/release-5.2.0.md)

releases/release-timeline.md

@@ -10,6 +10,7 @@ This document shows all the released TiDB versions in reverse chronological orde
 | Version | Release Date |
 | :--- | :--- |
 | [5.0.5](/releases/release-5.0.5.md) | 2021-12-03 |
+| [5.2.3](/releases/release-5.2.3.md) | 2021-12-03 |
 | [5.3.0](/releases/release-5.3.0.md) | 2021-11-30 |
 | [5.2.2](/releases/release-5.2.2.md) | 2021-10-29 |
 | [5.1.2](/releases/release-5.1.2.md) | 2021-09-27 |

ticdc/manage-ticdc.md

@@ -653,7 +653,7 @@ In the output of the above command, if the value of `sort-engine` is "unified",
 
 Starting from v5.3.0, TiCDC provides the eventually consistent replication capability in disaster scenarios. When a disaster occurs in the primary TiDB cluster and the service cannot be resumed in a short period of time, TiCDC needs to provide the ability to ensure the consistency of data in the secondary cluster. Meanwhile, TiCDC needs to allow the business to quickly switch the traffic to the secondary cluster to avoid the database being unavailable for a long time and affecting the business.
 
-This feature supports TiCDC to replicate incremental data from a TiDB cluster to the secondary relational database TiDB/Aurora/MySQL/MariaDB. In case the primary cluster crashes, TiCDC can recover the secondary cluster to a certain snapshot in the primary cluster within 30 minutes, given the condition that before disaster the replication status of TiCDC is normal and replication lag is small. It allows data loss of less than 5 minutes, that is, RPO <= 30min, and RTO <= 5min.
+This feature supports TiCDC to replicate incremental data from a TiDB cluster to the secondary relational database TiDB/Aurora/MySQL/MariaDB. In case the primary cluster crashes, TiCDC can recover the secondary cluster to a certain snapshot in the primary cluster within 5 minutes, given the condition that before disaster the replication status of TiCDC is normal and replication lag is small. It allows data loss of less than 30 minutes, that is, RTO <= 5min, and RPO <= 30min.
 
 ### Prerequisites 
 

tikv-configuration-file.md

@@ -1280,14 +1280,19 @@ Configuration items related to security
 
 ### `cert-path`
 
-+ The path of the Privacy Enhanced Mail (PEM) file that contains the X509 certificate
++ The path of the Privacy Enhanced Mail (PEM) file that contains the X.509 certificate
 + Default value: ""
 
 ### `key-path`
 
-+ The path of the PEM file that contains the X509 key
++ The path of the PEM file that contains the X.509 key
 + Default value: ""
 
+### `cert-allowed-cn`
+
++ A list of acceptable X.509 Common Names in certificates presented by clients. Requests are permitted only when the presented Common Name is an exact match with one of the entries in the list.
++ Default value: `[]`. This means that the client certificate CN check is disabled by default.
+
 ### `redact-info-log` <span class="version-mark">New in v4.0.8</span>
 
 + This configuration item enables or disables log redaction. If the configuration value is set to `true`, all user data in the log will be replaced by `?`.