zbx_srv, zbx_web, zbx_part, zbx_monitor, MySQL 8 users show subnet mask

Create an empty database:

CREATE DATABASE zabbix CHARACTER SET utf8mb4 COLLATE utf8mb4_bin;

For service 'zabbix-server' (AKA backend):

--create user
CREATE USER
'zbx_srv'@'192.168.99.101' IDENTIFIED WITH mysql_native_password BY 'zabBix0o123',
'zbx_srv'@'192.168.99.102' IDENTIFIED WITH mysql_native_password BY 'zabBix0o123'
REQUIRE SSL  
PASSWORD HISTORY 5;
 
--create a seperate role
CREATE ROLE 'zbx_srv_role';
 
--create bare minimum permissions
GRANT SELECT, UPDATE, DELETE, INSERT, CREATE, DROP, ALTER, INDEX, REFERENCES ON zabbix.* TO 'zbx_srv_role';
 
GRANT 'zbx_srv_role' TO 'zbx_srv'@'192.168.99.101';
GRANT 'zbx_srv_role' TO 'zbx_srv'@'192.168.99.102';
 
SET DEFAULT ROLE 'zbx_srv_role' TO 'zbx_srv'@'192.168.99.101';
SET DEFAULT ROLE 'zbx_srv_role' TO 'zbx_srv'@'192.168.99.102';

Monitoring user:

CREATE USER
'zbx_monitor'@'192.168.99.101' IDENTIFIED WITH mysql_native_password BY 'dDXn9PzDMx8YKtN1',
'zbx_monitor'@'192.168.99.102' IDENTIFIED WITH mysql_native_password BY 'dDXn9PzDMx8YKtN1'
PASSWORD HISTORY 5;
 
--create a seperate role
CREATE ROLE 'zbx_monitor_role';
 
--create bare minimum permissions
GRANT REPLICATION CLIENT,PROCESS,SHOW DATABASES,SHOW VIEW ON *.* TO 'zbx_monitor_role';
 
GRANT 'zbx_monitor_role' TO 'zbx_monitor'@'192.168.99.101';
GRANT 'zbx_monitor_role' TO 'zbx_monitor'@'192.168.99.102';
 
SET DEFAULT ROLE 'zbx_monitor_role' TO 'zbx_monitor'@'192.168.99.101';
SET DEFAULT ROLE 'zbx_monitor_role' TO 'zbx_monitor'@'192.168.99.102';

Create for frontend:

--create users for frontend pool
CREATE USER
'zbx_web'@'192.168.99.128/255.255.255.240' IDENTIFIED WITH mysql_native_password BY 'zabBix0o123',
'zbx_web'@'192.168.99.144/255.255.255.240' IDENTIFIED WITH mysql_native_password BY 'zabBix0o123'
REQUIRE SSL  
PASSWORD HISTORY 5;
 
--create a seperate role
CREATE ROLE 'zbx_web_role';
 
--set bare minumum permissions
GRANT SELECT, UPDATE, DELETE, INSERT ON zabbix.* TO 'zbx_web_role';
 
GRANT 'zbx_web_role' TO 'zbx_web'@'192.168.99.128/255.255.255.240';
GRANT 'zbx_web_role' TO 'zbx_web'@'192.168.99.144/255.255.255.240';
 
SET DEFAULT ROLE 'zbx_web_role' TO 'zbx_web'@'192.168.99.128/255.255.255.240';
SET DEFAULT ROLE 'zbx_web_role' TO 'zbx_web'@'192.168.99.144/255.255.255.240';

For partitioning script:

CREATE USER
'zbx_part'@'192.168.99.101' IDENTIFIED WITH mysql_native_password BY 'dDXn9PzDMx8YKtN1',
'zbx_part'@'192.168.99.102' IDENTIFIED WITH mysql_native_password BY 'dDXn9PzDMx8YKtN1'
PASSWORD HISTORY 5;
 
--create a seperate role
CREATE ROLE 'zbx_part_role';
 
--create bare minimum permissions
GRANT REPLICATION CLIENT,PROCESS,SHOW DATABASES,SHOW VIEW ON *.* TO 'zbx_part_role';
 
GRANT 'zbx_part_role' TO 'zbx_part'@'192.168.99.101';
GRANT 'zbx_part_role' TO 'zbx_part'@'192.168.99.102';
 
SET DEFAULT ROLE 'zbx_part_role' TO 'zbx_part'@'192.168.99.101';
SET DEFAULT ROLE 'zbx_part_role' TO 'zbx_part'@'192.168.99.102';

Flush and sumarize privileges:

FLUSH PRIVILEGES;
SELECT host,user FROM mysql.user;

Related:
https://www.zabbix.com/documentation/6.0/en/manual/appendix/install/db_encrypt/mysql
https://dev.mysql.com/doc/refman/8.0/en/account-names.html