Learn how to secure your MaxCtrl connections using TLS. This guide details the necessary MaxScale configuration parameters and command-line flags to enable encrypted administrative sessions.
_MaxCtrl is a command-line utility that can perform administrative tasks using MaxScale's REST API. It is possible to connect to MaxScale using TLS with MaxCtrl.
or , depending on what kind of user you need:
Replace maxscale\_rest\_admin and maxscale\_rest\_admin\_password with the desired user and password.
If you want to use MaxCtrl remotely, . Several global parameters must be configured in maxscale.cnf.
For example:
Several global parameters must be configured in maxscale.cnf.
For example:
Ensure that the client also has a TLS certificate, a private key, and the CA certificate.
Use to connect with TLS:
Replace maxscale_rest_admin and maxscale_rest_admin_password with the actual user and password.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This parameter defines the network address that the REST API listens on. The default value is 127.0.0.1.
This parameter defines the network port that the REST API listens on. The default value is 8989.
* This parameter defines the private key used by the REST API.
* This parameter defines the certificate used by the REST API.
*This parameter defines the CA certificate that signed the REST API's certificate.
$ maxctrl create user "maxscale_rest_admin" "maxscale_rest_admin_password" --type=admin[maxscale]
...
admin_host = 0.0.0.0
admin_port = 8443[maxscale]
...
admin_ssl_key=/certs/server-key.pem
admin_ssl_cert=/certs/server-cert.pem
admin_ssl_ca_cert=/certs/ca-cert.pem$ maxctrl --secure
--user=maxscale_rest_admin
--password=maxscale_rest_admin_password
--hosts=192.0.2.100:8443
--tls-key=/certs/client-key.pem
--tls-cert=/certs/client-cert.pem
--tls-ca-cert=/certs/ca.pemManage your MariaDB MaxScale instance using MaxCtrl, a command-line utility for the REST API. Monitor status, configure services, and handle administrative tasks efficiently.
Perform server maintenance safely. Learn how to use MaxCtrl to gracefully drain connections or force a server into maintenance mode, effectively removing it from the load balancing pool.
When using MaxScale, it is often necessary to temporarily remove a server from the load balancing pool without actually shutting down the server. This is usually needed to perform maintenance on the server, such as when upgrading the server's software or when performing schema upgrades.
MaxScale allows users to set servers to "maintenance mode", which prevents MaxScale from routing traffic to the server and prevents it from being elected as the new primary server during failover or switchover.
MaxCtrl is a command-line utility that can perform administrative tasks using MaxScale's REST API. It can be used to set a server to maintenance mode.
Configure the REST API if the default configuration is not sufficient.
Use MaxCtrl to execute the set server command with the maintenance option:
Replace server1 with the name of the specific server.
If the specified server is a primary server, then MaxScale will allow open transactions to complete before closing any connections.
Use MaxCtrl to execute the set server command with the maintenance --force option:
Replace server1 with the specific server name. When --force is used, MaxScale immediately closes all connections, even if the server is a primary server with open transactions.
This page is: Copyright © 2025 MariaDB. All rights reserved.
Remove unwanted or obsolete REST API users from your MariaDB MaxScale instance. This guide demonstrates how to safely delete user credentials using the MaxCtrl command-line utility.
MaxScale has a REST API, which can be configured to require authentication. When it is first installed, it has a single default admin user (admin) and password (mariadb). However, this user can be deleted, and other users can be created.
MaxCtrl is a command-line utility that can perform administrative tasks using MaxScale's REST API. It can be used to delete a user for the REST API.
if the default configuration is not sufficient.
Use MaxCtrl to execute the command:
Replace admin with the actual user.
This page is: Copyright © 2025 MariaDB. All rights reserved.
$ maxctrl --secure
--user=maxscale_rest_admin
--password=maxscale_rest_admin_password
--hosts=192.0.2.100:8443
--tls-key=/certs/client-key.pem
--tls-cert=/certs/client-cert.pem
--tls-ca-cert=/certs/ca.pem
set server server1 maintenance$ maxctrl --secure
--user=maxscale_rest_admin
--password=maxscale_rest_admin_password
--hosts=192.0.2.100:8443
--tls-key=/certs/client-key.pem
--tls-cert=/certs/client-cert.pem
--tls-ca-cert=/certs/ca.pem Create new users for the MaxScale REST API using MaxCtrl. This page explains the difference between basic and admin users and provides command examples for adding credentials to your system.
MaxScale has a REST API, which can be configured to require authentication. When first installed, it has a single default admin user (admin) and password (mariadb). However, this user can be deleted, and other users can be created.
MaxCtrl is a command-line utility that can perform administrative tasks using MaxScale's REST API. It can create a user for the REST API.
There are two types of users:
Configure the if the default configuration is not sufficient.
Use MaxCtrl to execute the create user command:
Replace maxscale_rest and maxscale_rest_password with the desired user and password.
Configure the if the default configuration is not sufficient.
Use MaxCtrl to execute the create user command with the --type=admin option:
Replace maxscale_rest_admin and maxscale_rest_admin_password with the desired user and password.
This page is: Copyright © 2025 MariaDB. All rights reserved.
$ maxctrl --secure
--user=maxscale_rest_admin
--password=maxscale_rest_admin_password
--hosts=192.0.2.100:8443
--tls-key=/certs/client-key.pem
--tls-cert=/certs/client-cert.pem
--tls-ca-cert=/certs/ca.pem
destroy user "admin"Basic
The user has read-only access
Admin
The user can change global MaxScale parameters and reconfigure modules.
$ maxctrl --secure
--user=admin
--password=mariadb
--hosts=192.0.2.100:8443
--tls-key=/certs/client-key.pem
--tls-cert=/certs/client-cert.pem
--tls-ca-cert=/certs/ca.pem
create user "maxscale_rest" "maxscale_rest_password"$ maxctrl --secure
--user=admin
--password=mariadb
--hosts=192.0.2.100:8443
--tls-key=/certs/client-key.pem
--tls-cert=/certs/client-cert.pem
--tls-ca-cert=/certs/ca.pem
create user "maxscale_rest_admin" "maxscale_rest_admin_password" --type=admin