MySQL and MariaDB

Keel connects with MySqlConnector in a read-only session with max_execution_time (MariaDB: max_statement_time).

Read-only role script

-- Run as an administrator, then use keel_reader in Keel.
CREATE USER 'keel_reader'@'%' IDENTIFIED BY 'choose-a-strong-password';
GRANT SELECT, SHOW VIEW ON analytics.* TO 'keel_reader'@'%';
-- Optional, for usage-based inference: statement digests.
GRANT SELECT ON performance_schema.events_statements_summary_by_digest TO 'keel_reader'@'%';

Before you run it:

• Replace analytics with each database Keel should see (a MySQL schema is a database) — one GRANT line per database.
• Restrict the host part ('%') to the address Keel connects from if you can.
• The performance_schema grant is optional (statement digests, for usage-based inference). Privileges granted through MySQL roles are not seen by Keel's least-privilege check.

In Keel

Sources › Connect source › MySQL: Host, port (3306), default database, user and password; TLS require, verify-full or disable. Then Test: Keel checks the network, authentication, metadata access, least privilege and query-log access, and warns if the principal can write.

How this script is verified

Run against MySQL 8.4: the new user passes Test connection, harvests and profiles, and is refused an INSERT and a CREATE TABLE. See Connect sources.