# Pmm3.5 & proxysql\_exporter error due to caching\_sha2\_password auth

**URL:** <https://forums.percona.com/t/pmm3-5-proxysql-exporter-error-due-to-caching-sha2-password-auth/40191>\
**Category:** PMM 3.x\
**Created:** [February 11, 2026, 9:08am UTC](https://forums.percona.com/t/pmm3-5-proxysql-exporter-error-due-to-caching-sha2-password-auth/40191 "2026-02-11T09:08:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lalit\_Choudhary](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/lalit_choudhary/32/22892_2.png) [@Lalit\_Choudhary](https://forums.percona.com/u/Lalit_Choudhary)\
**Post date:** [February 11, 2026, 9:08am UTC](https://forums.percona.com/t/pmm3-5-proxysql-exporter-error-due-to-caching-sha2-password-auth/40191/1 "2026-02-11T09:08:28Z")

</div>

Issue: PMM proxysql\_exporter monitoring not working with pxc operator proxysql scheduler.

Using pxc-operator 1.19 with ProxySQL , pxc 8.4 , monitor use auth\_plugin “caching\_sha2\_password”  
proxysql version:

 ![image](https://us1.discourse-cdn.com/flex019/uploads/percona1/original/3X/2/e/2e98c9067047f60e13d31066e50d0f3563a27ee3.png)

pmm 3.5 client and server:

 ![image](https://us1.discourse-cdn.com/flex019/uploads/percona1/original/3X/d/8/d846991f13be6fa5b865c4e5f09cbcb1b129ae8d.png)

We are using [proxysql scheduler](https://docs.percona.com/percona-operator-for-mysql/pxc/ReleaseNotes/Kubernetes-Operator-for-PXC-RN1.19.0.html?h=proxysql#improved-load-balancing-with-proxysql-scheduler-tech-preview) and looks like the error when connecting to **proxyadmin** user.

pmm-client proxysql\_exporter error:  
**level=ERROR source=exporter.go:169 msg="Error opening connection to ProxySQL" error="unexpected resp from server for caching\_sha2\_password, perform full authentication"" agentID=60206561-b165-4a9c-a6b1-8cc5fdd4645a component=agent-process type=proxysql\_exporter**

---

<div class="post-metadata">

**Author:** ![Lalit\_Choudhary](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/lalit_choudhary/32/22892_2.png) [@Lalit\_Choudhary](https://forums.percona.com/u/Lalit_Choudhary)\
**Post date:** [February 11, 2026, 1:31pm UTC](https://forums.percona.com/t/pmm3-5-proxysql-exporter-error-due-to-caching-sha2-password-auth/40191/2 "2026-02-11T13:31:41Z")

</div>

Using this doc to update admin-admin\_credentials but changes not persistent on pods

> **[Managing ProxySQL Admin Credentials: A Guide to admin-admin\_credentials -...](https://proxysql.com/blog/managing-proxysql-admin-credentials-a-guide-to-admin-admin_credentials/)**
>
> Learn how to manage ProxySQL admin credentials securely using the admin-admin\_credentials feature. Protect your configuration from unauthorized access with our detailed guide.

 ![image](https://us1.discourse-cdn.com/flex019/uploads/percona1/original/3X/c/d/cd2141569f1cab6e5a75740db19f1615512153a3.png)

---

<div class="post-metadata">

**Author:** ![anderson.nogueira](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/anderson.nogueira/32/23141_2.png) [@anderson.nogueira](https://forums.percona.com/u/anderson.nogueira)\
**Post date:** [February 22, 2026, 9:43am UTC](https://forums.percona.com/t/pmm3-5-proxysql-exporter-error-due-to-caching-sha2-password-auth/40191/3 "2026-02-22T09:43:03Z")

</div>

Hi @Lalit_Choudhary,

This is a known compatibility gap in pxc-operator 1.19. The operator now sets `default_authentication_plugin="caching_sha2_password"` in ProxySQL’s `mysql_variables` ([commit 3e65dbaa](https://github.com/percona/percona-xtradb-cluster-operator/commit/3e65dbaa920e3b8e557d9bfe6fe74bac0e02d49d), [K8SPXC-1470](https://perconadev.atlassian.net/browse/K8SPXC-1470)), aligning with MySQL 8.4’s default. However, ProxySQL doesn’t support caching\_sha2’s RSA key exchange for non-TLS connections, so the scramble-based fast auth fails, the server requests full RSA auth, and go-sql-driver gets the “unexpected resp” error. In operator 1.18.0 this was masked because ProxySQL defaulted to `mysql_native_password` and the operator forced PXC to use it when ProxySQL was enabled; both safeguards were removed in 1.19.0. I reproduced this with proxysql:2.7.1 in Docker. Switching back to `mysql_native_password` resolves it immediately.

**Workaround:** override the ProxySQL config to switch back to `mysql_native_password`. You need to copy the [default proxysql.cnf from the operator repo](https://github.com/percona/percona-xtradb-cluster-operator/blob/v1.19.0/build/proxysql.cnf) and change one line in `mysql_variables`. The operator requires the full ProxySQL configuration, not just the changed variable.

**If you deployed via Helm** (`helm install percona/pxc-db`), add `proxysql.configuration` to your values file:

```yaml
proxysql:
  enabled: true
  configuration: |
    datadir="/var/lib/proxysql"

    admin_variables =
    {
        # ... keep all existing admin_variables from the default proxysql.cnf
    }

    mysql_variables=
    {
        # ... keep all existing mysql_variables, but change this line:
        default_authentication_plugin="mysql_native_password"
    }

```

Then upgrade: `helm upgrade <release> percona/pxc-db -f values.yaml`

**If you applied the CR directly** (`kubectl apply`), add the same block under `spec.proxysql.configuration` in your PerconaXtraDBCluster manifest:

```yaml
spec:
  proxysql:
    configuration: |
      datadir="/var/lib/proxysql"

      admin_variables =
      {
          # ... keep all existing admin_variables from the default proxysql.cnf
      }

      mysql_variables=
      {
          # ... keep all existing mysql_variables, but change this line:
          default_authentication_plugin="mysql_native_password"
      }

```

For the credential persistence issue: the operator reconciles ProxySQL configuration on pod restarts, so any changes made directly through the admin interface are overwritten. All persistent changes must go through the CR, Helm values, or Kubernetes Secrets.

References:

- [Operator ProxySQL configuration docs](https://docs.percona.com/percona-operator-for-mysql/pxc/proxysql-conf.html)