arrow-left

All pages
gitbookPowered by GitBook
1 of 6

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Deleting a REST API User for MaxScale with MaxCtrl

Remove unwanted or obsolete REST API users from your MariaDB MaxScale instance. This guide demonstrates how to safely delete user credentials using the MaxCtrl command-line utility.

hashtag
Overview

MaxScale has a REST API, which can be configured to require authentication. When it is first installed, it has a single default admin user (admin) and password (mariadb). However, this user can be deleted, and other users can be created.

MaxCtrl is a command-line utility that can perform administrative tasks using MaxScale's REST API. It can be used to delete a user for the REST API.

hashtag
Deleting a User

  1. if the default configuration is not sufficient.

  2. Use MaxCtrl to execute the command:

Replace admin with the actual user.

circle-info

MaxScale will refuse to delete the last remaining admin user.

This page is: Copyright © 2025 MariaDB. All rights reserved.

Connecting to MaxScale using TLS with MaxCtrl

Learn how to secure your MaxCtrl connections using TLS. This guide details the necessary MaxScale configuration parameters and command-line flags to enable encrypted administrative sessions.

hashtag
Overview

_MaxCtrl is a command-line utility that can perform administrative tasks using . It is possible to connect to MaxScale using TLS with MaxCtrl.

Setting a Server to Maintenance Mode in MaxScale with MaxCtrl

Perform server maintenance safely. Learn how to use MaxCtrl to gracefully drain connections or force a server into maintenance mode, effectively removing it from the load balancing pool.

hashtag
Overview

When using MaxScale, it is often necessary to temporarily remove a server from the load balancing pool without actually shutting down the server. This is usually needed to perform maintenance on the server, such as when upgrading the server's software or when performing schema upgrades.

MaxScale allows users to set servers to "maintenance mode", which prevents MaxScale from routing traffic to the server and prevents it from being elected as the new primary server during failover or switchover.

MaxCtrl

Manage your MariaDB MaxScale instance using MaxCtrl, a command-line utility for the REST API. Monitor status, configure services, and handle administrative tasks efficiently.

hashtag
Connecting to MaxScale using TLS
  1. Create a basic or admin user, depending on what kind of user you need:

Replace maxscale\_rest\_admin and maxscale\_rest\_admin\_password with the desired user and password.

  1. If you want to use MaxCtrl remotely, configure the REST API for remote connections. Several global parameters must be configured in maxscale.cnf.

Parameter
Description

This parameter defines the network address that the REST API listens on. The default value is 127.0.0.1.

This parameter defines the network port that the REST API listens on. The default value is 8989.

For example:

  1. Enable TLS for MaxScale's REST API Several global parameters must be configured in maxscale.cnf.

Parameter
Description

* This parameter defines the private key used by the REST API.

* This parameter defines the certificate used by the REST API.

*This parameter defines the CA certificate that signed the REST API's certificate.

For example:

  1. Ensure that the client also has a TLS certificate, a private key, and the CA certificate.

  2. Use MaxCtrl to connect with TLS:

Replace maxscale_rest_admin and maxscale_rest_admin_password with the actual user and password.

This page is: Copyright © 2025 MariaDB. All rights reserved.

MaxScale's REST API
MaxCtrl is a command-line utility that can perform administrative tasks using MaxScale's REST API. It can be used to set a server to maintenance mode.

hashtag
Setting a Server to Maintenance Mode

  1. Configure the REST API if the default configuration is not sufficient.

  2. Use MaxCtrl to execute the set server command with the maintenance option:

Replace server1 with the name of the specific server.

  1. If the specified server is a primary server, then MaxScale will allow open transactions to complete before closing any connections.

hashtag
Forcing a Server to Maintenance Mode

  1. Use MaxCtrl to execute the set server command with the maintenance --force option:

  1. Replace server1 with the specific server name. When --force is used, MaxScale immediately closes all connections, even if the server is a primary server with open transactions.

This page is: Copyright © 2025 MariaDB. All rights reserved.

Configure the REST API
destroy user

Removing a Server using MaxCtrl

When operating MariaDB MaxScale in dynamic environments—such as Kubernetes, where nodes are frequently provisioned and deleted—it is critical to cleanly remove decommissioned servers from your MaxScale configuration. To delete a server using maxctrl, one has to unlink the server from any services or monitors beforehand. This step-by-step guide walks you through the safe removal process, following the recommended teardown sequence: Listener ➔ Service ➔ Monitor ➔ Server.

triangle-exclamation

Fast Track - Force Server Removal

$ maxctrl create user "maxscale_rest_admin" "maxscale_rest_admin_password" --type=admin
[maxscale]
...
admin_host            = 0.0.0.0
admin_port            = 8443
[maxscale]
...
admin_ssl_key=/certs/server-key.pem
admin_ssl_cert=/certs/server-cert.pem
admin_ssl_ca_cert=/certs/ca-cert.pem
$ maxctrl --secure
   --user=maxscale_rest_admin
   --password=maxscale_rest_admin_password
   --hosts=192.0.2.100:8443
   --tls-key=/certs/client-key.pem
   --tls-cert=/certs/client-cert.pem
   --tls-ca-cert=/certs/ca.pem
$ maxctrl --secure 
   --user=maxscale_rest_admin 
   --password=maxscale_rest_admin_password 
   --hosts=192.0.2.100:8443
   --tls-key=/certs/client-key.pem 
   --tls-cert=/certs/client-cert.pem 
   --tls-ca-cert=/certs/ca.pem 
   set server server1 maintenance
$ maxctrl --secure 
   --user=maxscale_rest_admin 
   --password=maxscale_rest_admin_password 
   --hosts=192.0.2.100:8443
   --tls-key=/certs/client-key.pem 
   --tls-cert=/certs/client-cert.pem 
   --tls-ca-cert=/certs/ca.pem 
$ maxctrl --secure
   --user=maxscale_rest_admin
   --password=maxscale_rest_admin_password
   --hosts=192.0.2.100:8443
   --tls-key=/certs/client-key.pem
   --tls-cert=/certs/client-cert.pem
   --tls-ca-cert=/certs/ca.pem
   destroy user "admin"
While we may remove a server with the
--force
method, please use this approach with caution. If you are scripting this for Kubernetes or need to quickly remove a node, you can bypass the manual unlinking steps by using the
--force
option.

The --force option will automatically remove the server from monitors and services before destroying it.

Bypassing the manual unlinking steps may abruptly terminate active database sessions. Only use this if traffic has already been safely drained from the node at the orchestration layer.

1

hashtag
Destroy the Listener (If Applicable)

If your setup utilizes a dedicated listener that must be removed alongside the server, you must destroy the listener first.

  • Destroying a listener closes the listening socket, opening it up for immediate reuse.

  • If two arguments are given and they are a service and a listener, the listener is only destroyed if it is for the given service.

2

hashtag
Unlink the Server from the Service

Next, the server object for the node must be unlinked from the service.

3

hashtag
Unlink the Server from the Monitor

The server object for the node must now be unlinked from its health monitor.

4

hashtag
Destroy the Server in MaxScale

Finally, the server object for the node must be removed from MaxScale.

admin_host
admin_port
admin_ssl_key
admin_ssl_cert
admin_ssl_ca_cert
maxctrl destroy server mariadbgalera3 --force
This command unlinks targets from a service, removing them from the list of available targets for that service.
  • Unlink the server object from the service using the unlink service command.

    • Confirm that the server object was properly unlinked from the service

    This command unlinks servers from a monitor, removing them from the list of monitored servers.
  • Unlink a server object from the monitor using the unlink monitor command.

    • Confirm that the server object was properly unlinked from the monitor

    The server must be unlinked from all services and monitor before it can be destroyed.
  • Remove the server object using the destroy server command.

    • Confirm that the server object was properly removed

    maxctrl destroy listener \
       Round-Robin-Service \
       Round-Robin-Listener
    maxctrl unlink service \
       Round-Robin-Service \
       mariadbgalera3
    maxctrl show services
    maxctrl unlink monitor \
       MariaDB-Monitor \
       mariadbgalera3
    maxctrl show monitors
    maxctrl destroy server \
       mariadbgalera3
    maxctrl show servers

    Creating a REST API User for MaxScale with MaxCtrl

    Create new users for the MaxScale REST API using MaxCtrl. This page explains the difference between basic and admin users and provides command examples for adding credentials to your system.

    hashtag
    Overview

    MaxScale has a , which can be configured to require authentication. When first installed, it has a single default admin user (admin) and password (mariadb). However, this user can be deleted, and other users can be created.

    MaxCtrl is a command-line utility that can perform administrative tasks using MaxScale's . It can create a user for the REST API.

    spinner
    spinner
    spinner
    hashtag
    User Types

    There are two types of users:

    User Type
    Description

    Basic

    The user has read-only access

    Admin

    The user can change global MaxScale parameters and reconfigure modules.

    hashtag
    Creating a Basic User

    1. Configure the REST API if the default configuration is not sufficient.

    2. Use MaxCtrl to execute the create user command:

    Replace maxscale_rest and maxscale_rest_password with the desired user and password.

    hashtag
    Creating an Admin User

    1. Configure the REST API if the default configuration is not sufficient.

    2. Use MaxCtrl to execute the create user command with the --type=admin option:

    Replace maxscale_rest_admin and maxscale_rest_admin_password with the desired user and password.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    REST API
    REST API
    spinner
    $ maxctrl --secure
       --user=admin
       --password=mariadb
       --hosts=192.0.2.100:8443
       --tls-key=/certs/client-key.pem
       --tls-cert=/certs/client-cert.pem
       --tls-ca-cert=/certs/ca.pem
       create user "maxscale_rest" "maxscale_rest_password"
    $ maxctrl --secure
       --user=admin
       --password=mariadb
       --hosts=192.0.2.100:8443
       --tls-key=/certs/client-key.pem
       --tls-cert=/certs/client-cert.pem
       --tls-ca-cert=/certs/ca.pem
       create user "maxscale_rest_admin" "maxscale_rest_admin_password" --type=admin