All pages
Powered by GitBook
1 of 5

Loading...

Loading...

Loading...

Loading...

Loading...

Connecting to MaxScale using TLS with MaxCtrl

Learn how to secure your MaxCtrl connections using TLS. This guide details the necessary MaxScale configuration parameters and command-line flags to enable encrypted administrative sessions.

Overview

_MaxCtrl is a command-line utility that can perform administrative tasks using MaxScale's REST API. It is possible to connect to MaxScale using TLS with MaxCtrl.

Connecting to MaxScale using TLS

  1. or , depending on what kind of user you need:

Replace maxscale\_rest\_admin and maxscale\_rest\_admin\_password with the desired user and password.

  1. If you want to use MaxCtrl remotely, . Several global parameters must be configured in maxscale.cnf.

Parameter
Description

For example:

  1. Several global parameters must be configured in maxscale.cnf.

Parameter
Description

For example:

  1. Ensure that the client also has a TLS certificate, a private key, and the CA certificate.

  2. Use to connect with TLS:

Replace maxscale_rest_admin and maxscale_rest_admin_password with the actual user and password.

This page is: Copyright © 2025 MariaDB. All rights reserved.

admin_host

This parameter defines the network address that the REST API listens on. The default value is 127.0.0.1.

admin_port

This parameter defines the network port that the REST API listens on. The default value is 8989.

admin_ssl_key

* This parameter defines the private key used by the REST API.

admin_ssl_cert

* This parameter defines the certificate used by the REST API.

admin_ssl_ca_cert

*This parameter defines the CA certificate that signed the REST API's certificate.

Create a basic
admin user
configure the REST API for remote connections
Enable TLS for MaxScale's REST API
MaxCtrl
$ maxctrl create user "maxscale_rest_admin" "maxscale_rest_admin_password" --type=admin
[maxscale]
...
admin_host            = 0.0.0.0
admin_port            = 8443
[maxscale]
...
admin_ssl_key=/certs/server-key.pem
admin_ssl_cert=/certs/server-cert.pem
admin_ssl_ca_cert=/certs/ca-cert.pem
$ maxctrl --secure
   --user=maxscale_rest_admin
   --password=maxscale_rest_admin_password
   --hosts=192.0.2.100:8443
   --tls-key=/certs/client-key.pem
   --tls-cert=/certs/client-cert.pem
   --tls-ca-cert=/certs/ca.pem

MaxCtrl

Manage your MariaDB MaxScale instance using MaxCtrl, a command-line utility for the REST API. Monitor status, configure services, and handle administrative tasks efficiently.

Setting a Server to Maintenance Mode in MaxScale with MaxCtrl

Perform server maintenance safely. Learn how to use MaxCtrl to gracefully drain connections or force a server into maintenance mode, effectively removing it from the load balancing pool.

Overview

When using MaxScale, it is often necessary to temporarily remove a server from the load balancing pool without actually shutting down the server. This is usually needed to perform maintenance on the server, such as when upgrading the server's software or when performing schema upgrades.

MaxScale allows users to set servers to "maintenance mode", which prevents MaxScale from routing traffic to the server and prevents it from being elected as the new primary server during failover or switchover.

MaxCtrl is a command-line utility that can perform administrative tasks using MaxScale's REST API. It can be used to set a server to maintenance mode.

Setting a Server to Maintenance Mode

  1. Configure the REST API if the default configuration is not sufficient.

  2. Use MaxCtrl to execute the set server command with the maintenance option:

Replace server1 with the name of the specific server.

  1. If the specified server is a primary server, then MaxScale will allow open transactions to complete before closing any connections.

Forcing a Server to Maintenance Mode

  1. Use MaxCtrl to execute the set server command with the maintenance --force option:

  1. Replace server1 with the specific server name. When --force is used, MaxScale immediately closes all connections, even if the server is a primary server with open transactions.

This page is: Copyright © 2025 MariaDB. All rights reserved.

Deleting a REST API User for MaxScale with MaxCtrl

Remove unwanted or obsolete REST API users from your MariaDB MaxScale instance. This guide demonstrates how to safely delete user credentials using the MaxCtrl command-line utility.

Overview

MaxScale has a REST API, which can be configured to require authentication. When it is first installed, it has a single default admin user (admin) and password (mariadb). However, this user can be deleted, and other users can be created.

MaxCtrl is a command-line utility that can perform administrative tasks using MaxScale's REST API. It can be used to delete a user for the REST API.

Deleting a User

  1. if the default configuration is not sufficient.

  2. Use MaxCtrl to execute the command:

Replace admin with the actual user.

MaxScale will refuse to delete the last remaining admin user.

This page is: Copyright © 2025 MariaDB. All rights reserved.

$ maxctrl --secure 
   --user=maxscale_rest_admin 
   --password=maxscale_rest_admin_password 
   --hosts=192.0.2.100:8443
   --tls-key=/certs/client-key.pem 
   --tls-cert=/certs/client-cert.pem 
   --tls-ca-cert=/certs/ca.pem 
   set server server1 maintenance
$ maxctrl --secure 
   --user=maxscale_rest_admin 
   --password=maxscale_rest_admin_password 
   --hosts=192.0.2.100:8443
   --tls-key=/certs/client-key.pem 
   --tls-cert=/certs/client-cert.pem 
   --tls-ca-cert=/certs/ca.pem 
Configure the REST API
destroy user

Creating a REST API User for MaxScale with MaxCtrl

Create new users for the MaxScale REST API using MaxCtrl. This page explains the difference between basic and admin users and provides command examples for adding credentials to your system.

Overview

MaxScale has a REST API, which can be configured to require authentication. When first installed, it has a single default admin user (admin) and password (mariadb). However, this user can be deleted, and other users can be created.

MaxCtrl is a command-line utility that can perform administrative tasks using MaxScale's REST API. It can create a user for the REST API.

User Types

There are two types of users:

User Type
Description

Creating a Basic User

  1. Configure the if the default configuration is not sufficient.

  2. Use MaxCtrl to execute the create user command:

Replace maxscale_rest and maxscale_rest_password with the desired user and password.

Creating an Admin User

  1. Configure the if the default configuration is not sufficient.

  2. Use MaxCtrl to execute the create user command with the --type=admin option:

Replace maxscale_rest_admin and maxscale_rest_admin_password with the desired user and password.

This page is: Copyright © 2025 MariaDB. All rights reserved.

$ maxctrl --secure
   --user=maxscale_rest_admin
   --password=maxscale_rest_admin_password
   --hosts=192.0.2.100:8443
   --tls-key=/certs/client-key.pem
   --tls-cert=/certs/client-cert.pem
   --tls-ca-cert=/certs/ca.pem
   destroy user "admin"

Basic

The user has read-only access

Admin

The user can change global MaxScale parameters and reconfigure modules.

REST API
REST API
$ maxctrl --secure
   --user=admin
   --password=mariadb
   --hosts=192.0.2.100:8443
   --tls-key=/certs/client-key.pem
   --tls-cert=/certs/client-cert.pem
   --tls-ca-cert=/certs/ca.pem
   create user "maxscale_rest" "maxscale_rest_password"
$ maxctrl --secure
   --user=admin
   --password=mariadb
   --hosts=192.0.2.100:8443
   --tls-key=/certs/client-key.pem
   --tls-cert=/certs/client-cert.pem
   --tls-ca-cert=/certs/ca.pem
   create user "maxscale_rest_admin" "maxscale_rest_admin_password" --type=admin