vitessio/vitess · error

timed out after %v waiting for the dba user to have the requ

Error message

timed out after %v waiting for the dba user to have the required permissions

What it means

WaitForDBAGrants polls until the dba user has the grants vitess requires (checked via the app config); if the waitTime timer fires first it gives up with this timeout error. It is thrown because a grant operation external to vitess (e.g. init db sql or an operator script) hasn't taken effect in time.

Source

Thrown at go/vt/mysqlctl/mysqld.go:709

		conn, connErr := mysql.Connect(ctx, params)
		if connErr == nil {
			res, fetchErr := conn.ExecuteFetch("SHOW GRANTS", 1000, false)
			conn.Close()
			if fetchErr != nil {
				log.Error(fmt.Sprintf("Error running SHOW GRANTS - %v", fetchErr))
			}
			if fetchErr == nil && res != nil && len(res.Rows) > 0 && len(res.Rows[0]) > 0 {
				privileges := res.Rows[0][0].ToString()
				// In MySQL 8.0, all the privileges are listed out explicitly, so we can search for SUPER in the output.
				// In MySQL 5.7, all the privileges are not listed explicitly, instead ALL PRIVILEGES is written, so we search for that too.
				if strings.Contains(privileges, "SUPER") || strings.Contains(privileges, "ALL PRIVILEGES") {
					return nil
				}
			}
		}
		select {
		case <-timer.C:
			return fmt.Errorf("timed out after %v waiting for the dba user to have the required permissions", waitTime)
		default:
			time.Sleep(100 * time.Millisecond)
		}
	}
}

// wait is the internal version of Wait, that takes credentials.
func (mysqld *Mysqld) wait(ctx context.Context, cnf *Mycnf, params *mysql.ConnParams) error {
	log.Info(fmt.Sprintf("Waiting for mysqld socket file (%v) to be ready...", cnf.SocketFile))

	for {
		select {
		case <-ctx.Done():
			return errors.New("deadline exceeded waiting for mysqld socket file to appear: " + cnf.SocketFile)
		default:
		}

		_, statErr := os.Stat(cnf.SocketFile)

View on GitHub (pinned to 01a25a7d17)

Solutions

1. Connect as root and run `SHOW GRANTS FOR CURRENT_USER()` as the dba user to see what's missing
2. Apply the required GRANT statements manually or fix the init_db.sql script
3. Increase the wait timeout flag if mysqld startup is legitimately slow
4. Verify the dba user host pattern matches how vitess connects (localhost vs %)

Example fix

// before: dba user without proper grants
CREATE USER 'vt_dba'@'localhost';
// after
CREATE USER 'vt_dba'@'localhost';
GRANT ALL ON *.* TO 'vt_dba'@'localhost' WITH GRANT OPTION;
FLUSH PRIVILEGES;

// Verify grants before waiting
out, err := runSQL("SHOW GRANTS FOR 'vt_dba'@'localhost'")
if err != nil || !strings.Contains(out, "ALL PRIVILEGES") {
    return errors.New("dba user lacks required grants; fix init_db.sql first")
}

if err := mysqld.WaitForDBAGrants(ctx); err != nil && strings.Contains(err.Error(), "timed out") {
    // re-apply grants then retry once with a longer window
}

When it happens

Trigger: Calling Mysqld.WaitForDBAGrants after startup/init when SHOW GRANTS for the dba user still lacks required privileges after waitTime elapses (default from -wait_for_dba_grants / 30s-style defaults).

Common situations: Init DB SQL granting permissions runs slowly or failed; replication-lag or slow cold-start mysqld; dba user created with wrong host pattern (`dba'@'localhost` vs `%`) so grants don't match; misconfigured dba user credentials in my.cnf.

Understand the failure class

• Timeouts: ETIMEDOUT, deadlines, and hung requests — what actually expires when a request times out.

Related errors

• deadline exceeded waiting for mysqld socket file to appear:
• gave up waiting for mysqld to stop
• no port variable in mysql
• no read_only variable in mysql
• clone execution failed: %v

AI-assisted analysis of vitessio/vitess@01a25a7d17 (2026-09-01). Data as JSON: /api/errors/1c5c7738c918287e. Report an issue: GitHub.