Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
This space includes documentation for clients, utilities, and applications, including AI-focused ones, designed to help you manage, monitor, back up, and interact with your MariaDB Server deployment.
MariaDB Enterprise Manager is a comprehensive observability and management solution designed for your entire database fleet. It provides advanced, topology-aware monitoring and a powerful suite of visual tools for query development and schema management, all from a single, centralized interface.
MariaDB Enterprise Operator provides a seamless way to run and operate containerized versions of MariaDB Enterprise Server and MaxScale on Kubernetes, allowing you to leverage Kubernetes orchestration and automation capabilities. This document outlines the features and advantages of using Kubernetes and the MariaDB Enterprise Operator to streamline the deployment and management of MariaDB and MaxScale instances.
MariaDB Enterprise MCP (Model Context Protocol) Server is a secure, enterprise-grade application designed to act as the primary interface between AI assistants and MariaDB data ecosystems. This product solves a key challenge: how to allow powerful AI agents to safely and efficiently leverage an organization's most valuable asset—its data.
MariaDB AI RAG is an enterprise-grade Retrieval-Augmented Generation (RAG) solution that integrates with MariaDB to provide AI-powered document processing, semantic search, and natural language generation capabilities.
MariaDB Enterprise Manager is a comprehensive observability and management solution designed for your entire database fleet. It provides advanced, topology-aware monitoring and a powerful suite of visual tools for query development and schema management, all from a single, centralized interface.
At its core, Enterprise Manager uses lightweight agents to collect deep telemetry from your standalone databases, replicated topologies, and MaxScale clusters via the OpenTelemetry standard. This foundation powers the integrated Grafana dashboards, which come pre-packaged with production-ready visualizations and alerts. Beyond monitoring, the provides a shared environment for developers and DBAs with an advanced Query Editor and a visual ERD Designer. The entire system is secured with role-based access control, audit logging, and can integrate with your corporate identity provider (OIDC) for single sign-on.
MariaDB Enterprise Manager is a client/server application for monitoring and managing MariaDB deployments. It provides topology-aware monitoring, visual schema management, and query editing across multiple database connections.
The architecture consists of two primary components: a central Enterprise Manager Server that aggregates data and hosts the user interface, and an Enterprise Manager Agent that is deployed on each monitored host.
The Enterprise Manager Server runs on a dedicated host and acts as the central command center. It is delivered as a suite of Docker containers managed by Docker Compose.

Different topologies supported by the operator.
MariaDB Enterprise Kubernetes Operator automates provisioning, scaling, backups, and high availability, making cloud-native database operations efficient and reliable.
Leverage the power of a built-in Grafana instance, complete with pre-packaged dashboards and production-ready alerts. The platform provides the flexibility to create custom dashboards, define unique alert rules, and route notifications to a wide range of destinations.
Built on open standards, Enterprise Manager uses OpenTelemetry for metrics collection. Its integrated Prometheus time-series database exposes a query API, allowing you to seamlessly export metrics and integrate with your existing observability stack.
Gain a topology-based, centralized view of your entire database fleet. Enterprise Manager discovers and visualizes your replication and clustering setups, providing the ability to drill down into a specific through a seamless single sign-on (SSO) experience.
The Workspace provides a powerful suite of tools for developers and DBAs. It features a rich Query Editor for running and debugging SQL and a visual ERD Designer for schema management and modeling across multiple database connections.
Secure your management layer with robust security features. Authenticate users with your corporate identity provider (OIDC), enforce granular permissions with role-based access control (RBAC), and maintain compliance with a comprehensive audit log for all administrative actions.

The core components are the following:
Supermax
The primary backend application that serves the main web UI for management, server registration, and configuration.
Grafana
Provides powerful, pre-built dashboards for visualizing time-series performance metrics.
Prometheus
The time-series database that ingests and stores all monitoring data collected from the agents.
OpenTelemetry Collector
The central endpoint that receives telemetry data (metrics, logs, traces) from all agents.
Nginx
A web server that acts as a reverse proxy, directing browser traffic to the appropriate service (Supermax or Grafana).
The Enterprise Manager Agent is installed on each MariaDB Server and MaxScale host that you want to monitor. Its job is to collect data and forward it to the central server.
These components are installed via the mema-agent package (RPM or DEB) and include:
Prometheus Exporters: These are the primary data gatherers.
Node Exporter: Collects system-level metrics (CPU, RAM, disk usage).
Mysqld Exporter: Collects detailed metrics from the MariaDB database itself.
OpenTelemetry Collector: This local collector pulls data from the Prometheus exporters and pushes it to the central collector on the Enterprise Manager Server.
mema-agent CLI: A setup utility used to register the host with the Enterprise Manager Server and configure the local agent services.
For the system to function correctly, the following firewall ports must be open on the Enterprise Manager Server host:
8090 (HTTP/S): The main entry point for the web UI. Nginx listens on this port and proxies requests to Supermax and Grafana.
4318 (HTTP/S): Agents on monitored nodes push telemetry data to this port.

For topologies managed by MaxScale, you can seamlessly access the MaxScale GUI directly from Enterprise Manager using Single Sign-On.SSO to MaxScale requires MaxScale 25.10.0 or higher.1
MariaDB Enterprise Manager allows you to monitor multiple logical databases or clusters that are managed by the same set of high-availability MaxScale instances. After adding your first MaxScale instance, you can easily add more monitors to track different services without re-entering the connection details.
It's recommended to run MariaDB Enterprise Manager on an internal, secured network. Direct public exposure is not recommended.
Before installing MariaDB Enterprise Manager, ensure that your firewall and network rules allow traffic on all required ports. Proper connectivity is essential for the system to function correctly.
The following table details the necessary ports and their purposes.
This section provides an overview of the deployment process for MariaDB Enterprise Manager, covering installation and upgrades for both the central server and the monitoring agents.
MariaDB Enterprise Manager is designed for a streamlined deployment experience. You can launch the main server with a single-line command for a quick start, and a UI-integrated helper tool simplifies the process of installing and registering agents on your monitored databases.
The Enterprise Manager Server is a Docker-based application installed on a dedicated host. The installation is handled by the installer script, which pulls the necessary container images and starts the application.
As a first step review the hardware, system, and network requirements:
Installation instructions for MariaDB Enterprise Kubernetes Operator in Kubernetes and OpenShift
Learn about the plugins supported by the MariaDB Enterprise Kubernetes Operator and how to configure them.
Configure multiple backup strategies and perform restoration.
Learn about migrations with MariaDB Enterprise Kubernetes Operator. This section covers strategies and procedures for smoothly migrating your MariaDB databases within Kubernetes environments.
admin_oidc_url
Hostname or IP address of your Enterprise Manager server.
admin_host
Must be set to 0.0.0.0 to allow external connections from Enterprise Manager.
admin_oidc_client_id
Default credentials used by Enterprise Manager to request the access token.
admin_oidc_client_secret
Default credentials used by Enterprise Manager to request the access token.

Follow these steps to add another logical database that is monitored by the same MaxScale deployment.
If you need to change which MaxScale monitor an existing logical database is tracking, follow these steps.
Enterprise Manager Server
8090
HTTP/S
Inbound
User Access: Allows users to access the Enterprise Manager UI.
Enterprise Manager Server
4318
HTTP/S
Inbound
Agent Metrics: Receives metrics data pushed from the Enterprise Manager Agents.
Enterprise Manager Agent
4318
HTTP/S
Outbound
Agent Metrics: Pushes metrics data to the Enterprise Manager Server.
For the current version of MariaDB Enterprise Manager, ensure the following rules are in place:
From user workstations, allow traffic to the Enterprise Manager Server on TCP port 8090.
From agent hosts, allow traffic to the Enterprise Manager Server on TCP port 4318.
After confirming your hardware, system, and network are compliant, proceed with the installation instructions: Installing MariaDB Enterprise Manager
To monitor a MariaDB Server and MaxScale host, install agent on it. Then, use the Enterprise Manager UI to add the database topology and generate the agent setup command. This command includes the correct metric labels for that host.


This guide outlines the system and hardware requirements for deploying the Enterprise Manager Server and the Enterprise Manager Agent.
The Enterprise Manager Server is the central component that hosts the UI and stores monitoring data.
CPU Architecture: x86-64
Operating System: 64-bit Linux with Docker support.
Software: Docker Engine and Docker Compose must be installed.
The agent must be installed on each and instance you wish to monitor. Below are the supported operating systems.
* Monitoring and Single Sign-On(SSO) are only supported for MaxScale versions 25.10 and Above
To install mema-agent, you need to setup
The mema-agent is a small application that must be installed on every server you wish to monitor with MariaDB Enterprise Manager, including MariaDB Server nodes and MaxScale nodes.
This guide covers the recommended installation method using a package manager.
Before installing the agent on a MariaDB Server host, you must create a local user that the agent will use to connect to the database and collect metrics.
Log in to your MariaDB Server and run the following:
Replace <password> with a secure password. You will need these credentials later when linking the agent in the Enterprise Manager UI.
This method uses your OS's native package manager (dnf, apt, zypper) to install the agent from the MariaDB Enterprise repository.
If you haven't already configured the MariaDB Enterprise repository on the server, follow these steps.
Once the repository is configured, use your system's package manager to install the agent.
The agent is now installed and running as a service.
After the agent is installed, it is running but not yet configured or linked to your MariaDB Enterprise Manager server.
The final step is to link the agent, which is done from the Enterprise Manager UI. Please refer to the for the specific steps to generate the linking command.
MariaDB Enterprise Manager provides a powerful and flexible alerting system, built on the capabilities of the integrated Grafana Alerting engine. It allows you to proactively monitor your entire database fleet, define custom rules for potential issues, and receive notifications through various channels to ensure you can respond quickly.
All persistent Grafana settings are managed through the MariaDB Enterprise Manager configuration files. Changes made directly in the Grafana UI will be lost upon restart.
The alerting process in MariaDB Enterprise Manager follows a clear, four-step flow from detection to notification.
To configure alerting effectively, it's helpful to understand these core concepts from Grafana:
This operator allows you to configure standalone MariaDB Enterprise Server instances. To achieve this, you can either omit the replicas field or set it to 1:
apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb
spec:
rootPasswordSecretKeyRef:
name: mariadb
key: password
replicas: 1
port: 3306
storage:
size: 1Gi
myCnf: |
[mariadb]
bind-address=*
default_storage_engine=InnoDB
binlog_format=row
innodb_autoinc_lock_mode=2
innodb_buffer_pool_size=800M
max_allowed_packet=256M
resources:
requests:
cpu: 500m
memory: 1Gi
limits:
memory: 1Gi
metrics:
enabled: trueWhilst this can be useful for development and testing, it is not recommended for production use because of the following reasons:
Single point of failure
Upgrades require downtime
Only vertical scaling is possible
For achieving high availability, we recommend deploying a highly available topology as described in the .
The MariaDB Enterprise Manager Workspace includes a powerful set of integrated tools that allow DBAs and developers to perform common administrative tasks graphically, without needing to write raw SQL commands. These features are primarily accessed through the Schemas Sidebar and dedicated tabs in the main worksheet area.
The Schema Inspector provides detailed, read-only metadata views for any selected schema object. This allows you to quickly understand the structure, data types, constraints, and dependencies of your tables, views, and other objects without querying the information_schema. To use it, simply click on an object in the Object Browser.
The Object Browser is the hierarchical tree view located in the Schemas Sidebar on the left side of the Workspace. It is your primary tool for navigating and exploring your database instances. You can expand databases to see their tables, views, stored procedures, and triggers, and use the filter box at the top to quickly locate specific objects.
The Object Editor allows you to create, modify, and delete schema objects using graphical forms and dialogs. You can access these functions by right-clicking on an object (or object type) in the Object Browser. This will open a context menu with actions such as:
CREATE TABLE, CREATE VIEW
ALTER TABLE
DROP TABLE
This dedicated tab provides a grid-based interface for managing database users and their privileges directly, without writing GRANT or CREATE USER statements.
From this interface, you can:
View a list of all database users and their assigned global privileges.
Create new database users using a simple form.
Edit an existing user's password or modify their privileges.
Delete users who no longer require access.
The Processlist tab provides a real-time view of the database server's active sessions and the commands they are executing, equivalent to running SHOW FULL PROCESSLIST. This is an essential tool for diagnosing performance issues.
Using the Processlist Viewer, you can:
Monitor all active connections, their current status (e.g., Query, Sleep), and how long they have been running.
Identify long-running or problematic queries that may be impacting server performance.
Manage live sessions, which may include the ability to terminate (kill) a specific process.
The examples catalog contains a number of sample manifests that aim to show the operator functionality in a practical way. Follow these instructions for getting started:
Download the examples catalog:
curl -sLO https://operator.mariadb.com/examples/manifests.tar.gz
mkdir -p examples
tar -xzf manifests.tar.gz -C examplesInstall the configuration shared by all the examples:
Start deploying examples:
Some examples rely on external dependencies for specific tasks, make sure to install them when it applies:
for metrics
for TLS certificates
for S3 object storage
It is recommended to complement the examples with the documentation to understand the full range of configuration options available.
If you are looking for production-grade examples, you can check the following manifests:
mariadb_replication_production.yaml and maxscale_replication_production.yaml for
mariadb_galera_production.yaml and maxscale_galera_production.yaml for
The following is a list of images that have plugins installed and available to use.
{ "tool": "execute_sql", "parameters": { "database_name": "test_db", "sql_query": "SELECT * FROM users WHERE id = %s", "parameters": [123] } }{ "tool": "create_vector_store", "parameters": { "database_name": "test_db", "vector_store_name": "my_vectors", "model_name": "text-embedding-3-small", "distance_function": "cosine" } }MariaDB Enterprise Manager installation and configuration guide
MariaDB Enterprise Manager is a database management and observability solution that provides advanced topology-aware monitoring coupled with visual schema management, query editing, and ERD design across multiple database connections.
This guide describes steps to install MariaDB Enterprise Manager for evaluation purposes.
In this guide, we will be migrating an external MariaDB into a new MariaDB instance running in Kubernetes and managed by MariaDB Enterprise Kubernetes Operator. We will be using for achieving this migration.
1. Take a logical backup of your external MariaDB using one of the commands below:
If you are currently using or migrating to a Galera instance, use the following command instead:
2. Ensure that your backup file matches the following format: backup.2024-08-26T12:24:34Z.sql
This guide illustrates, step by step, how to update to 25.10.2 from previous versions.
The Galera data-plane must be updated to the 25.10.2 version. You must set updateStrategy.autoUpdateDataPlane=true in your MariaDB resources before updating the operator. Then, once updated, the operator will also be updating the data-plane based on its version:
The dashboard mirrors most sections from the dashboard extending it with Galera Metrics section and the Galera Nodes table. Use this dashboard when you need Galera-specific cluster health alongside the familiar server views.
Insights into Galera Cluster health with critical metrics and node-specific status details.
"Model Context Protocol" (MCP) is a standard or interface designed to bridge the gap between AI development tools (like copilots in your code editor) and your project's specific environment.
In simple terms, it's a way for an AI to understand the context of what you're working on.
The MariaDB Enterprise MCP (Model Context Protocol) Server is a secure, enterprise-grade application designed to act as the primary interface between AI assistants and MariaDB data ecosystems. This product solves a key challenge: how to allow powerful AI agents to safely and efficiently leverage an organization's most valuable asset—its data.
It achieves this by providing a single, hardened endpoint that offers not only standard database operations but also advanced AI workflow orchestration and integration with industry-standard authentication systems.
To set the hostname or IP address for an existing MariaDB Enterprise Management instance, follow these instructions. Changing the hostname or IP address is useful if your server's IP changed or if you need to switch from an IP address to a public DNS name.
This page explains how to configure email alerting for MariaDB Enterprise Manager using Grafana's integrated alerting engine. Configure SMTP credentials and server details in the main environment file so Enterprise Manager can send alert notifications via email.
This is an advanced draft.
[maxscale]
# ... other settings ...
admin_host=0.0.0.0
admin_oidc_url=<Enterprise Manager Host Name>
admin_oidc_client_id=admin
admin_oidc_client_secret=mariadbkubectl apply -f examples/configkubectl apply -f examples/mariadb.yamlClick the Confirm button to add the new monitored database.
Click the Confirm button to save your changes.


Copy your Customer Download Token. You will need this for the script.
Alert Rules
The combination of a data query and a threshold condition defining what to measure and when it's a problem.
Alert Instances
Generated from an alert rule for each monitored entity, showing individual statuses.
Contact Points
Destinations for notifications, such as email, Slack, PagerDuty, or webhooks.
Notification Policies
Uses labels to route alerts to contact points, facilitating team-specific alerting.
Silences and Mute Timings
Allow temporary notification pauses without halting alerts. Silences cover single events, like maintenance, while Mute Timings are for recurring periods, such as at night or weekends.
Renaming or copying objects
Machine requirements (minimal hardware resources for evaluation):
CPU: 2 cores (or 2 vCPUs) with x86-64 architecture
RAM: 4 GB
Storage: 100 GB
Other requirements:
64-bit Linux OS with installed Docker engine and Docker Compose: https://docs.docker.com/engine/install/
Network ports 8090 and 4318 opened for inbound traffic
Navigate to the Customer Download Token at the MariaDB Customer Portal
Log in using your
Copy the Customer Download Token — you will use it as the password when logging in to the MariaDB Enterprise Docker Registry
Below are procedures for topologies without and with MaxScale.
Run on each MariaDB server (replace <Enterprise_Manager_IP> ):
3. Upload the backup file to one of the supported storage types. We recommend using S3.
4. Create your MariaDB resource declaring that you want to bootstrap from the previous backup and providing a root password Secret that matches the backup:
5. If you are using Galera in your new instance, migrate your previous users and grants to use the User and Grant CRs. Refer to the SQL resource documentation for further detail.
mariadb-dump --user=${MARIADB_USER} --password=${MARIADB_PASSWORD} --host=${MARIADB_HOST} --single-transaction --events --routines --all-databases > backup.2024-08-26T12:24:34Z.sqlmariadb-dump --user=${MARIADB_USER} --password=${MARIADB_PASSWORD} --host=${MARIADB_HOST} --single-transaction --events --routines --all-databases --skip-add-locks --ignore-table=mysql.global_priv > backup.2024-08-26T12:24:34Z.sqlUpgrade the mariadb-enterprise-operator-crds helm chart to 25.10.2:
Upgrade the mariadb-enterprise-operator helm chart to 25.10.2:
As part of the 25.10 LTS release, we have introduced support for LTS versions. Refer to the Helm docs for sticking to LTS versions.
If you are on OpenShift:
If you are on the stable channel using installPlanApproval=Automatic in your Subscription object, then the operator will be automatically updated. If you use installPlanApproval=Manual, you should have a new InstallPlan which needs to be approved to update the operator:
As part of the 25.10 LTS release, we have introduced new release channels. Consider switching to the stable-v25.10 if you are willing to stay in the 25.10.x version:
Consider reverting updateStrategy.autoUpdateDataPlane back to false in your MariaDB object to avoid unexpected updates:
helm repo update mariadb-enterprise-operator
helm upgrade --install mariadb-enterprise-operator-crds mariadb-enterprise-operator/mariadb-enterprise-operator-crds --version 25.10.2Flow Control Pause %
Percent of time a node is paused due to Galera flow control backpressure.
Flow Control Messages Sent
"Slow-down" signals sent per second when a node is under pressure.
Replication Queue Depth Received
Size of the receive/apply queue; growth indicates apply lag.
Write Conflicts
Certification conflicts per second (failed concurrent writes on hot rows).
Max Galera Replication Latency (s)
Maximum observed replication/EVS latency per node.
Transactions
Per-node throughput: transactions received from peers and/or replicated out.
Writeset Traffic
Bytes/s of Galera writesets per node (inbound vs outbound).
Per-node status summary with short state logic
Instance / Status
Is the server up? (Based on mariadb_up)
Accept Queries
Can this node take client traffic right now? (Based on wsrep_ready)
Local State
Where is the node in the Galera lifecycle? (Based on wsrep_local_state)
Flow Control
Is this node throttling or being throttled? (wsrep_flow_control_* rate > 0 → ON, otherwise OFF)
Cluster Status
Is the node in the Primary component? (Based on wsrep_cluster_status)
Connected
Is the node linked to the group? (Based on wsrep_connected)

Go to the Enterprise Manager installation directory
Run docker compose stop to stop the Enterprise Manager
Create a directory for backups
Take a backup of all the volumes
The backups directory now contains the data from the Enterprise Manager.
MCP provides a standardized, model-agnostic way for language models and other AI systems to interact with external tools and data sources. The MCP Server implements this protocol, ensuring a consistent and reliable method for AI applications to request information and perform operations. This streamlined communication layer accelerates the development and deployment of AI-integrated systems.
Connecting AI directly to a production database is both risky and inefficient. An MCP server provides a critical abstraction layer that delivers three key benefits:
Security and Governance: It acts as a single, hardened chokepoint for all AI-driven data interactions. Instead of embedding credentials across numerous applications, the MCP Server manages access centrally, enabling robust auditing, permission enforcement, and integration with enterprise secret managers.
Abstraction and Simplicity: Developers building AI applications do not need to be database experts. They can interact with a simple, well-defined set of tools (e.g., list_tables, execute_sql) without writing complex connection logic or security checks, dramatically accelerating development cycles.
Standardization and Interoperability: By adhering to the MCP standard, your data infrastructure can seamlessly connect with a growing ecosystem of AI assistants and development frameworks—such as Cursor, Windsurf, and VSCode plugins—without requiring bespoke integrations for each one.
The primary goal of the MariaDB Enterprise MCP Server is to enable the secure and scalable deployment of AI agents within enterprise environments.
Key objectives include:
Enhance Security and Compliance: Integrate with centralized secret management platforms like HashiCorp Vault and 1Password to eliminate static credentials and meet stringent enterprise security policies.
Streamline Complex AI Workflows: Provide a unified endpoint for orchestrating multi-step RAG (Retrieval-Augmented Generation) pipelines, from data ingestion to final response generation.
Improve Manageability: Offer a robust, configurable, and observable server that can be reliably deployed and managed by platform engineering and DBA teams.
Accelerate AI Application Development: Provide a standardized protocol that simplifies how developers connect AI agents to MariaDB data.
Ubuntu
Navigate to your MariaDB Enterprise Manager installation directory:
Open the .env file in a text editor (example uses nano):
Add the following block of variables to the file, filling in values for your SMTP server:
Save the file and exit the editor.
Once a client has a JWT, it includes it in the Authorization header of every request to the MCP Server. The server then validates the token before processing the request.
Signature Verification: Prevents token tampering.
Expiration Check: Tokens have a limited lifetime (e.g., 30 minutes).
Database Validation: Ensures the user associated with the token still exists and is active.
Issuer/Audience Validation: Prevents a token from one system from being used on another.
Not-Before Check: Prevents a token from being used before it is valid
RAM: Minimum 8GB, 16GB+ recommended
Storage: 10GB for installation, additional space for document storage
Database: MariaDB 10.6+ or compatible MySQL 8.0+
Python: Version 3.9+ (included in the installation package)
Download the Debian / Ubuntu .deb installation package from:
Install the package:
Install dependencies:
50
4 cores
8 GB
200 GB
200
16 cores
32 GB
800 GB
500+
48 cores
96 GB
10.6, 11.4, 11.8
RHEL/Rocky/AlmaLinux/Oracle Linux 8, 9, 10
Ubuntu LTS 22.04, 24.04
Debian 11, 12, 13
23.02*, 23.08*, 24.02*, 25.01*, 25.10
RHEL/Rocky/AlmaLinux 8, 9, 10
Ubuntu LTS 22.04, 24.04
Debian 11, 12, 13
2000 GB
MariaDB Enterprise Server (ppc64le support)
docker.mariadb.com/enterprise-server
11.8.3-1 11.4.8-5 11.4.7-4.3 11.4.7-4.2 11.4.7-4.1 11.4 10.6.23-19 10.6.22-18.1 10.6
amd64 arm64 ppc64le
{ "tool": "insert_docs_vector_store", "parameters": { "database_name": "test_db", "vector_store_name": "my_vectors", "documents": ["Sample text 1", "Sample text 2"], "metadata": [{"source": "doc1"}, {"source": "doc2"}] } }{ "tool": "search_vector_store", "parameters": { "database_name": "test_db", "vector_store_name": "my_vectors", "user_query": "What is the capital of France?", "k": 5 } }# View API logs
cat logs/api.log
# View ingestion logs
cat logs/ingestion.logBy default, MariaDB Enterprise Manager retains detailed metrics for 30 days. You can configure this data retention period to balance your need for historical data with storage costs.
This guide explains how to change the retention period and how the underlying storage system works.
Changing the retention time is done by editing the environment file for Enterprise Manager and then restarting the services.
Prometheus, the time-series database used by Enterprise Manager, does not delete expired data instantly.
Block-Based Storage: Prometheus stores metrics data in blocks, which are typically two-hour chunks of time. In the background, these small blocks are compacted into larger ones.
Delayed Cleanup: Data is not deleted on a sample-by-sample basis. Instead, Prometheus removes an entire block once all the data within it has passed the retention period. This cleanup process runs in the background and may not be immediate.
When setting PROMETHEUS_RETENTION_TIME, you can use the following units:
y - years
w - weeks
d - days
This dashboard shows MaxScale’s health and load, how backend servers are seen by each MaxScale, and the traffic/query volume flowing through it—plus cache efficiency from the Query Classifier.
Provides a visual representation of the entire system's architecture and connectivity.
System Metrics provide comprehensive insights into the performance and health of individual system resources.
Query Classifier Cache Metrics help in analyzing and optimizing query routing efficiency by tracking cache hits/misses and monitoring cache size.
Evaluate query routing efficiency by tracking and optimizing cache metrics like hits, misses, and cache size.
This guide aims to provide a quick way to get started with the MariaDB Enterprise Kubernetes Operator for Kubernetes. It will walk you through the process of deploying a MariaDB Enterprise Cluster and MaxScale via the MariaDB and MaxScale CRs (Custom Resources) respectively.
Before you begin, ensure you meet the following prerequisites:
Configure your customer access for docker.mariadb.com
The first step will be configuring a Secret with the credentials used by the MariaDB CR:
Next, we will deploy a MariaDB Enterprise Cluster (Galera) using the following CR:
Let's break it down:
rootPasswordSecretKeyRef: A reference to a Secret containing the root password.
imagePullSecrets: The name of the Secret containing the customer credentials to pull the MariaDB Enterprise Server image.
maxScaleRef: The name of the
After applying the CR, we can observe the MariaDB Pods being created:
Now, let's deploy a MaxScale CR:
Again, let's break it down:
imagePullSecrets: The name of the Secret containing the customer credentials to pull the MaxScale image.
mariaDbRef: A reference to the MariaDB CR that we want to connect to.
replicas: The number of MaxScale instances to deploy.
After applying the CR, we can observe the MaxScale Pods being created, and that both the MariaDB and MaxScale CRs will become ready eventually:
To conclude, let's connect to the MariaDB Enterprise Cluster through MaxScale using the initial user and database we initially defined in the MariaDB CR:
You have successfully deployed a MariaDB Enterprise Cluster with MaxScale in Kubernetes using the MariaDB Enterprise Kubernetes Operator!
Refer to the , the and the for further detail.
In order to effectively manage the full lifecycle of both replication and Galera topologies, the operator relies on a set of components that run alonside the MariaDB instances and expose APIs for remote management. These components are collectively referred to as the "data-plane".
The mariadb-enterprise-operator data-plane components are implemented as lightweight containers that run alongside the MariaDB instances within the same Pod. These components are available in the operator image. More preciselly, they are subcommands of the CLI shipped as binary inside the image.
The init container is reponsible for dynamically generating the Pod-specifc configuration files before the MariaDB container starts. It also plays a crucial role in the MariaDB container startup, enabling replica recovery for the replication topolology and guaranteeing ordered deployment of Pods for the Galera topology.
The agent sidecar provides an HTTP API that enables the operator to remotely manage MariaDB instances. Through this API, the operator is able to remotely operate the data directory and handle the instance lifecycle, including operations such as replica recovery for replication and cluster recovery for the Galera topology.
It supports methods to ensure that only the operator is able to call the agent API.
As previously mentioned, the agent exposes an API to remotely manage the replication and Galera clusters. The following authentication methods are supported to ensure that only the operator is able to call the agent:
ServiceAccount based authenticationThe operator uses its ServiceAccount token as a mean of authentication for communicating with the agent, which subsequently verifies the token by creating a . This is the default authentication method and will be automatically applied by setting:
This Kubernetes-native authentication mechanism eliminates the need for the operator to manage credentials, as it relies entirely on Kubernetes for this purpose. However, the drawback is that the agent requires cluster-wide permissions to impersonate the ClusterRole and to create , which are cluster-scoped objects.
As an alternative, the agent also supports basic authentication:
Unlike the , the operator needs to explicitly generate credentials to authenticate. The advantage of this approach is that it is entirely decoupled from Kubernetes and it does not require cluster-wide permissions on the Kubernetes API.
Please refer to the updates documentation for more information about .
Welcome to MariaDB AI RAG! This section will guide you through installing, configuring, and running the MariaDB AI RAG API and MCP Server.
Learn about the MariaDB AI RAG system architecture and components:
System architecture
Core modules (Ingestion, Chunking, Retrieval, Generation)
Data flow and processing pipeline
Integration with MariaDB vector database
Step-by-step installation instructions for all supported platforms:
Linux (Ubuntu/Debian - .deb packages)
Linux (RHEL/Fedora - .rpm packages)
Windows (.msi installer)
System requirements and prerequisites
Configure the RAG API and MCP Server:
Environment variables
Configuration file setup
Database connection settings
API keys and authentication
Manage the RAG API and MCP Server services:
Starting and stopping services
Service status monitoring
Log file locations
Troubleshooting service issues
Install the package for your platform (see )
Configure your environment with database credentials and API keys (see )
Start the services using the service management commands
Verify installation by accessing the API health endpoint:
After completing the getting started guide:
Explore the for detailed endpoint documentation
Learn about for user management
Review for optimization
When a resource is suspended, all operations performed by the operator are disabled, including but not limited to:
Provisioning
Upgrades
Volume resize
Galera cluster recovery
More specifically, the reconciliation loop of the operator is omitted, anything part of it will not happen while the resource is suspended. This could be useful in maintenance scenarios, where manual operations need to be performed, as it helps prevent conflicts with the operator.
Currently, only MariaDB and MaxScale resources support suspension. You can enable it by setting suspend=true:
This results in the reconciliation loop being disabled and the status being marked as Suspended:
To re-enable it, simply remove the suspend setting or set it to suspend=false.
MariaDB Server metrics are gathered with the Prometheus exporter for MySQL and stored in Enterprise Manager’s Prometheus with the mariadb prefix. The agent runs the exporter with the following collector flags:
MariaDB Enterprise Manager collects a wide range of time-series metrics from your MariaDB MaxScale instances to provide deep insight into their performance, health, and activity. Monitoring these metrics is crucial for diagnosing performance bottlenecks, ensuring high availability, and understanding how your database proxy is handling application traffic.
Here is the list of available collected by Enterprise Manager.
Node metrics provide crucial information about the health and performance of the underlying hardware and operating system on each monitored host. These metrics are essential for diagnosing infrastructure bottlenecks, understanding resource utilization, and planning for future capacity.
MariaDB Enterprise Manager gathers these metrics using Prometheus Node Exporter, which includes a default set of collectors.
Key metrics collected by default include:
CPU Usage: Overall and per-core utilization, load average, and context switching.
Memory: Total, used, free, and cached memory, including swap space.
Disk I/O: Read/write operations, throughput (bytes per second), and I/O time.
Filesystem Usage: Total, used, and available space for each mounted filesystem.
For a complete and detailed list of all metrics gathered by the default collectors, please refer to the official .
The MariaDB AI RAG API provides a comprehensive RESTful interface for document ingestion, chunking, retrieval, and AI-powered generation. All endpoints require JWT authentication except for the login endpoint.
Complete reference for all API endpoints including:
Document ingestion and management
Chunking operations
Retrieval and search
AI generation
Authentication and authorization documentation:
JWT-based authentication
User management endpoints
Role-based access control
Document sharing and permissions
Direct database ingestion capabilities:
SQL query ingestion
Table and view ingestion
Role-based database access
Structured data processing
High-level workflow endpoints:
Full pipeline orchestration
Ingestion orchestration
Generation orchestration
Multi-step RAG workflows
All API requests require authentication. First, obtain a JWT token:
Then include the token in subsequent requests:
The default base URL for the API is:
For production deployments, replace with your configured host and port.
MariaDB Enterprise Manager includes a comprehensive set of pre-configured alert rules to provide production-ready monitoring for your entire database stack out-of-the-box. These alerts are built on the integrated Grafana Alerting engine and are designed to detect common issues across your MariaDB Servers, Galera Clusters, MaxScale instances, and the underlying operating systems.
A key feature of these rules is the use of a "sustained for" duration. This means a condition must remain true for a specified period (e.g., 3 minutes) before an alert will fire. This prevents alert fatigue from brief, transient spikes and ensures you are only notified of persistent, actionable problems.
This documentation shows how to configure metadata in the MariaDB Enterprise Kubernetes Operator CRs.
MariaDB and MaxScale resources allow you to propagate metadata to all the children objects by specifying the inheritMetadata field:
This means that all the reconciled objects will inherit these labels and annotations. For instance, see the Services
mariadb-enterprise-operator supports managing resources in external MariaDB instances i.e running outside of the Kubernetes cluster where the operator runs. This feature allows to manage users, privileges, databases, run SQL jobs declaratively and taking backups using the same CRs that you use to manage internal MariaDB instances.
ExternalMariaDB configurationThe ExternalMariaDB resource is similar to the internal MariaDB resource, but we need to provide a host
MariaDB Enterprise Kubernetes Operator provides a seamless way to run and operate containerized versions of MariaDB Enterprise Server and MaxScale on Kubernetes, allowing you to leverage Kubernetes orchestration and automation capabilities. This document outlines the features and advantages of using Kubernetes and the MariaDB Enterprise Kubernetes Operator to streamline the deployment and management of MariaDB and MaxScale instances.
Kubernetes is more than just a container orchestrator; it is a comprehensive platform that provides APIs for managing both applications and the underlying infrastructure. It automates key aspects of container management, including deployment, scaling, and monitoring, while also handling essential infrastructure needs such as networking and storage. By unifying the management of applications and infrastructure, Kubernetes simplifies operations and improves efficiency in cloud-native environments.
The Node Dashboard pane provides detailed visibility into the health and performance of individual nodes that run MariaDB Server and MaxScale. It combines uptime, system capacity, operating system details, and hardware utilization with disk and network activity. This view helps administrators ensure each node has sufficient resources and can support the workloads running on it.
Provides a high-level, at-a-glance summary of a specific server node's status, configuration, and capacity.
This documentation aims to provide guidance on how to configure access to docker.mariadb.com in your MariaDB Enterprise Kubernetes Operator resources.
MariaDB Corporation requires customers to authenticate when logging in to the . A Customer Download Token must be provided as the password. Customer Download Tokens are available through the MariaDB Customer Portal. To retrieve the customer download token for your account:
Troubleshooting installation/deployment issues for Enterprise Manager and Agent
This guide illustrates, step by step, how to update to 25.8.0 from previous versions.
Uninstall you current mariadb-enterprise-operator for preventing conflicts:
Alternatively, you may only downscale and delete the webhook configurations:
Upgrade mariadb-enterprise-operator-crds to 25.8.0
This operator gives you flexibility to define the storage that will back the /var/lib/mysql data directory mounted by MariaDB.
The simplest way to configure storage for your MariaDB is:
This will make use of the default StorageClass available in your cluster, but you can also provide a different one:
curl -LsSO https://dlm.mariadb.com/enterprise-release-helpers/mariadb_es_repo_setupchmod +x mariadb_es_repo_setup
sudo ./mariadb_es_repo_setup --token="YOUR_TOKEN_HERE" --applyCREATE USER 'monitor'@'localhost' IDENTIFIED BY '<password>';
GRANT SELECT, PROCESS, REPLICATION CLIENT, RELOAD, REPLICA MONITOR, REPLICATION MASTER ADMIN ON *.* TO 'monitor'@'localhost';sudo dnf install mema-agentsudo apt-get install mema-agentdocker login docker.mariadb.comCREATE USER 'monitor'@'<Enterprise_Manager_IP>' IDENTIFIED BY '<password>';
GRANT REPLICA MONITOR ON *.* TO 'monitor'@'<Enterprise_Manager_IP>';apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
rootPasswordSecretKeyRef:
name: mariadb
key: root-password
replicas: 3
galera:
enabled: true
storage:
size: 1Gi
bootstrapFrom:
s3:
bucket: backups
prefix: mariadb
endpoint: minio.minio.svc.cluster.local:9000
accessKeyIdSecretKeyRef:
name: minio
key: access-key-id
secretAccessKeySecretKeyRef:
name: minio
key: secret-access-key
tls:
enabled: true
caSecretKeyRef:
name: minio-ca
key: tls.crt
targetRecoveryTime: 2024-08-26T12:24:34ZapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
updateStrategy:
+ autoUpdateDataPlane: truehelm repo update mariadb-enterprise-operator
helm upgrade --install mariadb-enterprise-operator mariadb-enterprise-operator/mariadb-enterprise-operator --version 25.10.2oc get installplan
NAME CSV APPROVAL APPROVED
install-sjgcs mariadb-enterprise-operator.v25.10.2 Manual false
oc patch installplan install-sjgcs --type merge -p '{"spec":{"approved":true}}'
installplan.operators.coreos.com/install-sjgcs patchedapiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
name: mariadb-enterprise-operator
namespace: openshift-operators
spec:
channel: stable-v25.10
installPlanApproval: Automatic
name: mariadb-enterprise-operator
source: certified-operators
sourceNamespace: openshift-marketplaceapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
updateStrategy:
+ autoUpdateDataPlane: false
- autoUpdateDataPlane: truemkdir backupsdocker run --rm --volumes-from enterprise-manager-grafana -v $(pwd)/backups/:/backups/ alpine:latest tar -czf /backups/grafana-backup.tar.gz /var/lib/grafana/
docker run --rm --volumes-from enterprise-manager-prometheus -v $(pwd)/backups/:/backups/ alpine:latest tar -czf /backups/prometheus-backup.tar.gz /prometheus/
docker run --rm --volumes-from enterprise-manager-supermax -v $(pwd)/backups/:/backups/ alpine:latest tar -czf /backups/supermax-backup.tar.gz /var/lib/supermax/cd enterprise-managernano .envMEMA_HOSTNAME=your.new.hostname.or.ipdocker compose up -d --force-recreatessh user@your-server-ip# Take down the existing Grafana container
docker compose down grafana
# Start a new Grafana container with the updated configuration
docker compose up -d grafanacd enterprise-manager/nano .env# --- Grafana SMTP Email Settings ---
# Set to true to enable email alerting
GF_SMTP_ENABLED=true
# Your SMTP server hostname and port
GF_SMTP_HOST=smtp.example.com:587
# Credentials for your SMTP user
GF_SMTP_USER=my-email-user
GF_SMTP_PASSWORD=my-super-secret-password
# Set to true if your server uses a self-signed certificate
GF_SMTP_SKIP_VERIFY=false
# The "From" address that will appear on alert emails
GF_SMTP_FROM_ADDRESS=alerts@my-domain.com
# The display name for the sender
GF_SMTP_FROM_NAME=MariaDB Enterprise Manager{ "tool": "rag_generation", "parameters": { "database_name": "test_db", "vector_store_name": "my_vectors", "user_query": "What is the capital of France?", "k": 5, "temperature": 0.9 } }Debian-based (Ubuntu, Debian):
The UI will generate a unique setup command for that specific server with the username and password you provide.
Copy and run the command on that specific server.
Repeat for all servers in the database fleet.\
The UI will generate a unique setup command for that specific server/MaxScale instance with the username and password you provide. Copy the command.
On that specific server/MaxScale instance, paste and run the command in your terminal.
Repeat for all MaxScale and MariaDB servers.




docker compose up -d to start the Enterprise ManagerInstall the package:
sudo rpm -i ai-rag-*.rpmRun the .msi installer.
Follow the installation wizard instructions.
sudo dpkg -i ai-rag-*.deb sudo apt-get install -fChanges to PROMETHEUS_RETENTION_TIME take effect only after the Prometheus service is restarted.
hm - minutes
s - seconds
MaxScaleusername, passwordSecretKeyRef and database: The initial user and database to create.
storage: The size of the volume that will back the data directory.
replicas: The number of MariaDB Enterprise Server instances to deploy.
galera: Configuration for the Galera clustering.
Network Traffic: Data sent and received, packets, and network interface errors.
collect.binlog_size
Reports binary log files and their sizes to track binlog count and total disk usage/growth.
collect.engine_innodb_status
Parses SHOW ENGINE INNODB STATUS to expose InnoDB internals (waits, deadlocks, transaction and I/O snapshots).
collect.info_schema.innodb_metrics
Reads INFORMATION_SCHEMA.INNODB_METRICS for detailed InnoDB counters (buffer pool, I/O, log, lock, purge, recovery, etc.).
collect.info_schema.innodb_tablespaces
Exposes per-tablespace/file size and allocation details from Information Schema for space-usage monitoring.
collect.info_schema.processlist
Exposes current session/thread activity (users, hosts, commands, states, runtimes) based on the process list.
collect.info_schema.replica_host
Discovers replica hosts via Information Schema (MariaDB-friendly alternative to SHOW SLAVE HOSTS) for topology visibility.
collect.slave_hosts
Emits replica host topology using SHOW SLAVE HOSTS/SHOW REPLICA HOSTS (note: MariaDB expects the legacy SHOW SLAVE HOSTS syntax).
collect.slave_status
Exposes replication status from SHOW SLAVE/REPLICA STATUS (I/O/SQL thread states, positions/GTID, seconds behind, etc.).
Before configuring OIDC in Enterprise Manager, you must first register Enterprise Manager as a client application within your Identity Provider's administrative console and obtain the necessary credentials.
In your Identity Provider's client configuration screen, you will need to provide several URLs that point back to your MariaDB Enterprise Manager instance. These URLs tell the provider where to send the user after authentication and what origins are allowed to make requests.
While the exact field names may vary, you must configure the following endpoints, replacing <Your_Enterprise_Manager_Address> with the actual address of your instance:
Root / Home URL: https://<Your_Enterprise_Manager_Address>:8090
Valid Redirect URI: https://<Your_Enterprise_Manager_Address>:8090/landing
Valid Post Logout Redirect URI: https://<Your_Enterprise_Manager_Address>:8090/
OIDC Using Keycloak
Here is an example of what the filled-in fields might look like if you are using Keycloak.
Authentication URL: This is the URL to your specific Keycloak realm: http://<keycloak_ip>:<port>/realms/<your_realm>
Authentication Flow: The default auto flow is recommended for Keycloak.
Client ID: The Client ID you configured for the application within your Keycloak realm: enterprise-manager
Client Secret: This secret is generated by Keycloak and found in the 'Credentials' tab of your client configuration in the Keycloak admin console: 12345ab-c67d-89e0-f123-456789abcdef
For Enterprise Manager to assign the correct permissions to a user logging in via OIDC, it expects the JWT token from your provider to contain a specific field (claim) named account.
The value of this account field must exactly match the name of a role that exists in MariaDB Enterprise Manager (for example, admin, viewer, or a custom role).
Example JWT payload showing the account claim
{
"account": "admin",
"aud": "admin",
"exp": 1760133641,
"iat": 1760104841,
"iss": "maxscale",
"jti": "0780a545-bb7a-404d-a384-64d04557801d",
"sub": "admin"
}
This token's account claim value "admin" would grant the user the admin role upon login.
Resetting the OIDC Configuration
To restore the default settings:
Click the Reset Configuration button.\
In the confirmation dialog, click Reset.\
A success message will confirm the reset.
MariadbInstanceDown
MariaDB instance down for 3 minutes (sustained for 3m). Triggers when the exporter reports the instance as down (mariadb_up = 0) or when no sample from mariadb_up has been received for more than 120 seconds.
ReplicaProcessDown
MariaDB instance has a Replica process Down (sustained for 3m). Triggers when replication is unhealthy: the I/O or SQL thread is stopped, or Seconds_Behind_Master is missing (replica not reporting progress).
ReplicaSecondsBehindPrimary
MariaDB replica is more than 600s behind primary (sustained for 3m). Triggers when replication lag exceeds 600 seconds.
HighUtilizationMaxConnections
MariaDB instance has high connection utilization (sustained for 5m). Triggers when Threads_connected exceeds ~80% of max_connections.
MariaDBInstanceRestart
MariaDB instance restarted recently (sustained for 5m). Triggers when server uptime is below 1 hour, indicating a recent restart.
MariaDBDeadlockFound
MariaDB Deadlock found in the last 15m (sustained for 5m). Triggers when the count of InnoDB deadlocks increases compared to 15 minutes ago.
GaleraClusterDown
Galera instance down for 5 minutes (sustained for 5m). Triggers when the cluster is not in Primary state (wsrep_cluster_status ≠ 1) or the node is not ready (wsrep_ready ≠ 1).
GaleraNodeNotReady
Galera node not ready (state ≠ 4) for 5m (sustained for 5m). Triggers when the node is not in Synced state and it’s not a temporary DESYNC (desync counter did not change in the last 5 minutes).
GaleraInWrongState
Galera instance is in an unexpected state (sustained for 5m). Triggers when the node’s state comment isn’t one of the normal values (Synced / Donor / Joining / Joined / Waiting for SST).
GaleraClusterDonorFallingBehind
Galera donor lagging (recv queue > 100) for 5m (sustained for 5m). Triggers when a Donor node (state=2) accumulates a large receive queue, indicating it’s falling behind replication.
GaleraClusterSizeChanged
Galera cluster size changed in last 15m (sustained for 5m). Triggers when the cluster size increases within 15 minutes.
MaxScaleInstanceDown
MaxScale down for 3 minutes (sustained for 3m). Triggers when no recent MaxScale metrics have been received for more than 120 seconds (e.g., MaxScale down or exporter/scrape pipeline issue).
MaxScaleNoPrimary
MaxScale has no primary for 3 minutes (sustained for 3m). Triggers when MaxScale reports zero servers with role = Primary/Master.
NodeFilesystemSpaceUsage
Filesystem disk space is above 90% (sustained for 1h). Triggers when disk space used exceeds 90% on a writable filesystem.
NodeFilesystemSpaceFillingUp
Filesystem predicted to run out of space within ~24h (sustained for 1h). Triggers when usage is above 80% and the trend (predictive model) indicates free space will reach zero within ~24 hours; excludes read-only filesystems.
NodeMemoryHighUtilization
Instance is running out of memory > 95% (sustained for 15m). Triggers when memory utilization exceeds 95%.
NodeCPUHighUtilization
Instance is running out of CPU > 90% (sustained for 15m). Triggers when CPU utilization exceeds 90% over a 5-minute window.
NodeFilesystemAlmostOutOfFiles
Filesystem has less than 3% inodes left (sustained for 1h). Triggers when available inodes drop below 3% on a writable filesystem.
NodeNetworkReceiveErrs
Network interface has a high receive-error rate (sustained for 1h). Triggers when receive errors exceed 1% of total received packets over a 2-minute rate window.
Obtain MariaDB Customer Download Token
Navigate to the Customer Download Token at the MariaDB Customer Portal
Log in using your MariaDB ID
Copy the Customer Download Token to use as the password when logging in to the MariaDB Enterprise Docker Registry
Set up MariaDB Enterprise Repository - MariaDB Enterprise Tools for each monitored MariaDB Server and MaxScale
https://mariadb.com/docs/server/server-management/install-and-upgrade-mariadb/installing-mariadb/binary-packages/mariadb-package-repository-setup-and-usage
Log in to Docker registry
Login to the MariaDB Enterprise Docker Registry providing your MariaDB ID as a username and Customer Download Token as a password:
Download the installation script
Insert your Customer Download Token into the download URL and download the installation script:
Make the installer executable
Run the installer
Install Enterprise Manager by running the script:
The script prompts you to enter IP address and port number on which Enterprise Manager should listen to for incoming connections. Verify the auto-detected value and correct it if it's wrong.
After you provide the details, the script launches Enterprise Manager.
Verify containers
Run docker compose ps in the enterprise-manager directory to check that all of the constituent Docker containers are running. The containers are:
enterprise-manager-grafana
Access the UI
Access Enterprise Manager UI at:
https://<Enterprise_Manager_IP>:8090
At the login screen, use the default username admin and the generated password displayed after the installation script finishes.
The installer generates a self-signed TLS certificate for Enterprise Manager. To change the certificate, follow instructions at Security in Enterprise Manager.
To modify metrics retention time, see Metrics retention configuration.
Installing Enterprise Manager to a machine without an Internet connection is possible by manually copying the Docker images and related settings from an Internet-connected machine to the final target machine.
Follow these steps:
Install on an Internet-connected machine
First, install Enterprise Manager on an Internet-connected machine as explained in the normal installation section. When the installation script asks for the address and port that Enterprise Manager should listen at for incoming connections, enter the values for the final target machine.
Save images and settings
Once installation is complete, save all related Docker images and settings by running the following commands from the directory that contains the enterprise-manager folder:
The resulting archive enterprise-manager.tar.gz contains all components of Enterprise Manager.
Transfer archive to target machine
Copy enterprise-manager.tar.gz to the target (air-gapped) machine into the directory under which you want to install Enterprise Manager.
Extract and load images on target machine
On the target machine, extract the archive and load the Docker images:
Start Enterprise Manager
Start Enterprise Manager with:
PodsYou have the ability to provide dedicated metadata for Pods by specifying the podMetadata field in any CR that reconciles a Pod, for instance: MariaDB, MaxScale, Backup, Restore and SqlJobs:
It is important to note that the podMetadata field supersedes the inheritMetadata field, therefore the labels and annotations provided in the former will override the ones in the latter.
Provision dedicated metadata for Services in the MariaDB resources can be done via the service, primaryService and secondaryService fields:
In the case of MaxScale, you can also do this via the kubernetesService field.
Refer to the to know more about the Service fields and MaxScale.
Both MariaDB and MaxScale allow you to define a volumeClaimTemplate to be used by the underlying StatefulSet. You may also define metadata for it:
Being able to provide metadata allows you to integrate with other CNCF landscape projects:
If you run on bare metal and you use Metallb for managing the LoadBalancer objects, you can declare its IPs via annotations:
Istio injects the data-plane container to all Pods, but you might want to opt-out of this feature in some cases:
For instance, you probably don't want to inject the Istio sidecar to Backup Pods, as it will prevent the Jobs from finishing and therefore your backup process will hang.
usernameSecretIf you need to use TLS to connect to the external MariaDB, you can provide the server CA certificate and the client certificate Secrets via the tls field:
As a result, you will be able to specify the ExternalMariaDB as a reference in multiple objects, the same way you would do for a internal MariaDB resource.
As part of the ExternalMariaDB reconciliation, a Connection will be created whenever the connection template is specified. This could be handy to track the external connection status and declaratively create a connection string in a Secret to be consumed by applications to connect to the external MariaDB.
Currently, the ExternalMariaDB resource is supported by the following objects:
Connection
User
Grant
Database
Backup
SqlJob
You can use it as an internal MariaDB resource, just by setting kind to ExternalMariaDB in the mariaDBRef field:
When the previous example gets reconciled, an user will be created in the referred external MariaDB instance.
Kubernetes brings several key benefits to the table when managing applications in a containerized environment:
Standardization: Kubernetes relies on standard APIs for managing applications and infrastructure, making it easier to ensure uniformity across various environments. It acts as a common denominator across cloud providers and on-premises.
Automation: Kubernetes APIs encapsulate operational best practises, minimizing the need for manual intervention and improving the efficiency of operations.
Cost Effectiveness: Having an standarized way to manage infrastructure across cloud providers and automation to streamline operations, Kubernetes helps reducing the infrastructure and operational costs.
Kubernetes has been designed with flexibility in mind, allowing developers to extend its capabilities through custom resources and operators.
In particular, MariaDB Enterprise Kubernetes Operator, watches the desired state defined by users via MariaDB and MaxScale resources, and takes actions to ensure that the actual state of the system matches the desired state. This includes managing compute, storage and network resources, as well as the full lifecycle of the MariaDB and MaxScale instances. Whenever the desired state changes or the underlying infrastructure is modified, the Operator takes the necessary actions to reconcile the actual state with the desired state.
Operational expertise is baked into the MariaDB and MaxScale APIs and seamlessly managed by the Operator. This includes automated backups, restores, upgrades, monitoring, and other critical lifecycle tasks, ensuring reliability in Day 2 operations.
Provision and Configure MariaDB and MaxScale Declaratively: Define MariaDB Enterprise Server and MaxScale clusters in YAML manifests and deploy them with ease in Kubernetes.
Multiple Highly Available Topologies supported:
as a Database proxy to load balance requests and perform failover/switchover operations.
Cluster-Aware Rolling Updates: Perform rolling updates on MariaDB and MaxScale clusters, ensuring zero-downtime upgrades with no disruptions to your applications.
Flexible Storage Configuration and Volume Expansion: Easily configure storage for MariaDB instances, including the ability to expand volumes as needed.
Physical Backups based on and . By leveraging the feature, backups are taken without long read locks or service interruptions.
Logical Backups based on .
Backup Management: Take, restore, and schedule backups with multiple storage types supported: S3, PVCs, Kubernetes volumes and VolumeSnapshots..
Policy-Driven Backup Retention: Implement backup retention policies with bzip2 and gzip compression.
Target Recovery Time: Restore your database to the closest available backup based on a specified recovery time.
Bootstrap New Instances: Initialize new MariaDB instances from backups, S3, PVCs or VolumeSnapshots to quickly spin up new clusters.
TLS Certificate Management: Issue, configure, and rotate TLS certificates and Certificate Authorities (CAs) for secure connections.
Advanced TLS Support: customize certificate lifetime, private key algorithm and TLS version.
Native Integration with cert-manager: Leverage , the de-facto standard for managing certificates in Kubernetes, to enable issuance with private CAs, public CAs and HashiCorp Vault.
Prometheus Metrics: Expose metrics using the MariaDB and MaxScale Prometheus exporters.
Native Integration with prometheus-operator: Leverage to scrape metrics from MariaDB and MaxScale instances.
Declarative User and Database Management: Manage users, grants, and logical databases in a declarative manner using Kubernetes resources.
Secure, immutable and lightweight images based on Red Hat UBI, available for multiple architectires (amd64, arm64 and ppc64le).
by Red Hat.
This column displays the logical names of your databases and the individual server nodes within each topology. It also contains important status and quick-access icons.
🟢 Green
Aggregated Topology, Server, MaxScale
The component and all its members are running correctly.
🔴 Red
Aggregated Topology, Server, MaxScale
One or more members in the topology are down or not functioning properly.
⚫ Gray
Server
The server's status is unknown. This typically happens if the MaxScale node managing it is down.
This column shows the role of each node as automatically detected by Enterprise Manager (e.g., Primary, Replica, MaxScale, Galera Node, Standalone Server).
If this column shows '-', it indicates an issue. For instance, in a Primary/Replica topology, a server expected to be a Replica that shows '-' is likely not replicating correctly from the primary.
This column shows the time elapsed since the agent on that node last reported metrics.
If the age is 5 minutes or greater, it indicates a problem. Verify that the mema-agent is installed, running, and can communicate with the Enterprise Manager server on that host.
You can perform actions on your databases and nodes using the three-dot menu (⋮) on the far right of each row.

The audit log records all REST API requests made to MariaDB Enterprise Manager, providing a clear trail of administrative actions for security and compliance.
The connection from the mema-agent to the Enterprise Manager server is secured using HTTPS.
To enable encryption: ensure the URL provided in the agent setup command uses https://.
To bypass certificate checks: if you are using a self-signed or non-trusted TLS certificate on the Enterprise Manager server, you can add the --otlp-insecure flag to the agent setup command. This is recommended only for testing environments.
You can configure secure TLS connections from Enterprise Manager to your monitored MariaDB Servers and MaxScale instances when you first add them.
In the "Add Database" page:
Toggle the SSL/TLS option to ON.
To validate the server's certificate against your Certificate Authority (CA), provide the path to your CA file in the Certificate Authority field. The file must be located in the enterprise-manager/certs/ directory and the path must begin with /certs/.
Check Verify peer certificate to enable validation.
(Optional) Check Verify peer host to ensure the server's hostname matches the certificate.
If the database requires client-side certificates for authentication, provide the paths to your client certificate and key in the Certificate and Key fields, respectively. These files must also be in the enterprise-manager/certs/ directory.
All certificate and key files referenced for server validation or client authentication must be placed in the enterprise-manager/certs/ directory on the host and referenced with a path beginning with /certs/.
Node Uptime
Shows the total amount of time the server node has been running since its last restart.
Topology Info
Displays the node's current role or state within its database topology (e.g., Primary, Replica).
Node Allocatable Capacity
Details the compute resources allocated to the node, such as the number of CPU cores available.
Node Disk Capacity
Shows the total size of the key mounted filesystems, such as /boot and /home.
OS Info
Provides details about the node's OS, including architecture, distribution (e.g., CentOS Stream 9), and kernel release.
Tracks memory usage, CPU performance, system load, and resource consumption at the process level.
Memory Usage
Percentage of physical memory in use.
CPU
Graph showing CPU usage distribution across user, system, idle, iowait, and kernel.
Memory Stack
Breakdown of memory allocation: applications, cache, buffers, swap, etc.
Network Traffic
Inbound and outbound network throughput per interface.
CPU Utilisation
Effective CPU usage and number of cores for the node.
System Load
Load averages for the last 1, 5, and 15 minutes.
Monitors disk performance and utilization for the node’s storage devices.
Disk Throughput
Read and write throughput (bytes per second) per device.
Disk IOPS
Number of input/output operations per second for reads and writes.
Disk Utilisation
Percentage of time that disk devices are busy handling I/O requests.

Log in using your MariaDB ID.
Copy the Customer Download Token to use as the password when logging in to the MariaDB Enterprise Docker Registry.
Then, configure a Kubernetes kubernetes.io/dockerconfigjson Secret to authenticate:
If you are running in Openshift, it is recommended to use the global pull secret to configure customer credentials. The global pull secret is automatically used by all Pods in the cluster, without having to specify imagePullSecrets explicitly.
To configure the global pull secret, you can use the following commands:
Extract your Openshift global pull secret:
Login in the MariaDB registry providing the customer download token as password:
Update the global pull secret:
Alternatively, you can also create a dedicated Secret for authenticating:
In order to configure access to docker.mariadb.com in your MariaDB resources, you can use the imagePullSecrets field to specify your customer credentials:
As a result, the Pods created as part of the reconciliation process will have the imagePullSecrets.
Similarly to MariaDB, you are able to configure access to docker.mariadb.com in your MaxScale resources:
The batch Job resources will inherit the imagePullSecrets from the referred MariaDB, as they also make use of its image. However, you are also able to provide dedicated imagePullSecrets for these resources:
When the resources from the previous examples are created, a Job with both mariadb-enterprise and backup-registry imagePullSecrets will be reconciled.
The agent installation can be done with the native package manager for your OS.
# For Red Hat/CentOS/Rocky
sudo dnf install -y mema-agent
# For Debian/Ubuntu
sudo apt install -y mema-agentThe Galera data-plane must be updated to the 25.8.0 version.
If you want the operator to automatically update the data-plane (i.e. init and agent containers), you can set updateStrategy.autoUpdateDataPlane=true in your MariaDB resources:
Alternatively, you can also do this manually:
Upgrade mariadb-enterprise-operator to 25.8.0:
If you previously decided to downscale the operator, make sure you upscale it back:
If you previously set updateStratety.autoUpdateDataPlane=true, you may consider reverting the changes once the upgrades have finished:
helm uninstall mariadb-enterprise-operatorkubectl scale deployment mariadb-enterprise-operator --replicas=0
kubectl scale deployment mariadb-enterprise-operator-webhook --replicas=0
kubectl delete validatingwebhookconfiguration mariadb-enterprise-operator-webhook
kubectl delete mutatingwebhookconfiguration mariadb-enterprise-operator-webhookMariaDB AI RAG enables organizations to leverage their document repositories and databases for AI-powered search and generation. By combining the reliability of MariaDB with modern AI capabilities, AI RAG provides accurate, context-aware responses based on your organization's proprietary data.
Document ingestion and processing
Semantic chunking and embedding
Vector-based similarity search
AI-powered response generation
Database integration
Fine-grained access control
Comprehensive REST API
For detailed information on each component, please refer to the specific documentation sections.
StatefulSet's volumeClaimTemplate property, which you are also able to provide yourself:The StorageClass used for volume resizing must define allowVolumeExpansion = true.
It is possible to resize your storage after having provisioned a MariaDB. We need to distinguish between:
PVCs already in use.
StatefulSet storage size, which will be used when provisioning new replicas.
It is important to note that, for the first case, your StorageClass must support volume expansion by declaring the allowVolumeExpansion = true. In such case, it will be safe to expand the storage by increasing the size and setting resizeInUseVolumes = true:
Depending on your storage provider, this operation might take a while, and you can decide to wait for this operation before the MariaDB becomes ready by setting waitForVolumeResize = true. Operations such as Galera cluster recovery and will not be performed if the MariaDB resource is not ready.
Provisioning standalone MariaDB instances with ephemeral storage can be done by setting ephemeral = true:
This may be useful for multiple use cases, like provisioning ephemeral MariaDBs for the integration tests of your CI.
Docker Deployment Guide - Container-based deployment configuration
Deployment Checklist - Configuration validation checklist
Technical Architecture - System architecture and configuration details
MariaDB AI RAG uses a .env configuration file located in the installation directory. A template is provided at config.env.template. Copy this file to .env and modify the parameters according to your environment.
MariaDB AI RAG requires a properly configured database. The system can automatically initialize the database schema during first startup, or you can manually initialize it using the provided SQL script:
MariaDB AI RAG implements JWT-based authentication. Configure the following parameters in your .env file:
For production environments, it is strongly recommended to use a properly generated secure random string for the SECRET_KEY.
External service API keys should be securely stored in the .env file. In production environments, consider using a secure vault solution or environment variable management system.
Project
Displays the currently selected project label.
Name
Shows the selected database/topology name.
Version
Shows MaxScale version.
Topology Info
Count of nodes grouped by type (e.g., server, MaxScale).
Backend Server States
Timeline of each backend server’s role and health as seen by each MaxScale. Values are color-mapped to: Read, Write, Up, Down. Use this to spot failovers, read/write role flips, or outages over time.
Maxscale Uptime by Instance
Uptime in seconds for each MaxScale instance.
CPU Utilisation
Effective CPU usage (%) per instance, excluding idle/iowait/guest time.
Memory Usage
Working memory in use (%) per instance (total minus free/buffers/cache/slab).
Network Traffic
Per-interface throughput (bits/s). Transmit is plotted below the axis (negative-Y), receive above—making direction easy to read.
MaxScale Processing Load
Percentage of total CPU time consumed by the MaxScale process over time (a direct view of router load).
Connections
Active backend connections per server as observed by MaxScale.
Operations
Active operations per backend server (ongoing requests tracked by MaxScale).
Packets Read/Writes
Per-server packet read and write rates (packets/s). Useful for spotting uneven load distribution.
QPS
Queries per second passing through MaxScale across the selected instances (overall routing throughput).
Cache Hits vs Misses
Per-second hits and misses in the Query Classifier cache. Analyze the relationship to assess effectiveness.
Cache Size
Current size of the Query Classifier cache (bytes). Monitor growth with Hits/Misses for tuning insights.




apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
suspend: true

{
"mcpServers": {
"rag-mcp": {
"serverUrl": "http://localhost:8002/mcp",
"headers": {
"Authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.xyz.abc"
}
}
}
}MariaDB Enterprise Manager provides two primary methods for exporting metrics, allowing you to integrate with external observability platforms for aggregation or long-term retention.
The Prometheus server integrated within MariaDB Enterprise Manager exposes its metrics via a standard federation endpoint. You can configure your own external Prometheus server (or any Prometheus-compatible system) to "scrape" these metrics.
Identify the Federation Endpoint
The endpoint is located on your MariaDB Enterprise Manager server at the /prometheus/federate path. The full URL will be:
https://<Enterprise_Manager_IP>:8090/prometheus/federate
Configure Your External Prometheus
In your external Prometheus server's configuration file (prometheus.yml), add a new scrape job to target the Enterprise Manager endpoint.
After adding this configuration and restarting your external Prometheus, it will begin scraping and storing all metrics from your MariaDB Enterprise Manager instance.
The mema-agent can be configured to push metrics directly to a third-party monitoring system that supports the OpenTelemetry Protocol (OTLP). This method sends data straight from the agent to your external endpoint, bypassing the built-in Prometheus server.
To configure this, run the mema-agent setup command on your MariaDB Server or MaxScale host with the appropriate flags.
Enterprise manager provides a visual interface for creating entity relationship diagrams (ERD) and for observing existing database schemas, so you can quickly understand table relationships, identify dependencies, and visually assess the impact of schema changes before implementation.
This procedure outlines the steps required to access and utilize the ERD Designer within the Workspace section of Enterprise Manager UI.
From the main Workspace screen, click the "Run Queries" card.\
In the "Connect to..." dialog, select your target server, enter your credentials, and click Connect.\
Upon successful connection, the main ERD worksheet will appear.\
The core of the designer is a visual canvas where you can build and manage your database structures.
You can graphically manage all core MariaDB schema objects.
Use the toolbar or right-click on the canvas to add new table entities to your diagram.
Double-click any table to open the Entity Editor at the bottom of the screen.
Here, you can define and modify columns (including data types and NOT NULL constraints), indexes, and foreign keys through an intuitive interface.
To create a new relationship, simply click the connection point on a column in one table and drag it to the column it references in another table.
For large or complex schemas, the diagram can become cluttered. Use the Auto Arrange Entities feature, typically found in the top toolbar, to automatically rearrange the tables and relationships into a clean, organized, and easily navigable diagram.
The ERD worksheet provides several tools and shortcuts to streamline your workflow.
Right-click on a relationship link between two tables to open a context menu with quick actions, such as editing or removing the foreign key, toggling the relationship type (e.g., one-to-one vs. one-to-many), and changing NOT NULL constraints.
Once your design is complete, you can export it for documentation or deployment. The export options, found in the toolbar or by right-clicking the canvas, include the following:
Export as SQL Script: Generates the CREATE TABLE and ALTER TABLE statements for your entire diagram.
Export as JPEG: Creates an image of your diagram for use in presentations or other documents.
Copy script to clipboard: A quick way to get the SQL for pasting elsewhere.
Click the "Apply Script" button (▶) in the toolbar to execute the generated SQL against your connected database. This allows you to deploy your new or modified schema directly from the designer.
Purpose: Ingests data directly from a MariaDB table or view, treating it as a CSV data source. This allows for seamless integration with existing database content.
Request body:
Response:
Usage Example: Use this endpoint to ingest structured data from your database tables or views. The system will process each row as a document, with specified columns as content and metadata.
Purpose: Executes a SELECT query and ingests the results as a CSV document. The query results are stored as a document that can be chunked and searched. This provides a way to make database query results searchable via RAG.
Request body:
Request Parameters:
sql_query (required): A SELECT query to execute (only SELECT queries are allowed)
role (optional): Database role to use for query execution (default: from DEFAULT_SQL_ROLE environment variable)
document_name (optional): Name for the generated CSV document (default: "query_results")
Security Notes:
Only SELECT queries are allowed (enforced by regex validation)
Multiple statements are not allowed (no semicolons outside of quoted strings)
User must have permission to use the specified role
Query is executed using MariaDB's role-based access control
Response:
Usage Example: Query database and ingest results for RAG search.
Note: The query results are converted to CSV format and stored as a document. You can then chunk this document using the chunking endpoints to make the data searchable.
Purpose: Checks the status of a database ingestion job.
Response:
Usage Example: Use this endpoint to monitor the progress of database ingestion jobs.
This section provides comprehensive guides for deploying the MariaDB AI RAG system in various environments.
High-level overview of deployment options and considerations:
Deployment architecture options
System requirements
Prerequisites
Security considerations
Step-by-step guide for deploying on Ubuntu/Debian systems:
Installing the .deb package
System configuration
Service setup
Database initialization
Complete guide for Docker-based deployments:
Docker image setup
Docker Compose configuration
Container orchestration
Volume management
Detailed technical architecture documentation:
System components and interactions
Data flow diagrams
Database schema
API architecture
Pre-deployment and post-deployment checklists:
Pre-deployment verification
Configuration validation
Security hardening steps
Performance optimization
Use for quick setup
Configure minimal settings (database, API keys)
Start services with docker-compose
Verify with health checks
Review for architecture planning
Follow platform-specific guide ( or )
Complete
Configure monitoring and backups
Use strong JWT secrets and API keys
Enable HTTPS/TLS for production
Implement network security (firewalls, VPNs)
Regular security updates
Allocate sufficient resources (CPU, RAM, storage)
Configure connection pooling appropriately
Use SSD storage for database
Enable caching where appropriate
Set up automated backups
Configure health checks
Implement logging and monitoring
Plan for disaster recovery
Design for horizontal scaling
Use load balancers for high availability
Separate database and API servers
Consider read replicas for database
- Detailed configuration options
- Managing services
- Optimization
- Common issues
The MariaDB MCP (Model Context Protocol) Server is a modular, multi-layered system designed to provide secure, scalable, and extensible AI-powered tools and services. Its architecture is centered around a primary gateway (MCP Server), an optional specialized microservice for Retrieval-Augmented Generation (RAG API), and a Shared MariaDB Database that serves as the single source of truth for all components.
This design prioritizes security through multi-layered token validation and promotes flexibility with an adaptive tool registration system, allowing services to be enabled or disabled dynamically.
The following diagram illustrates the flow of a request from a client application through the various components of the MCP ecosystem.
These are the consumers of the MCP Server's services. They are responsible for acquiring a JWT Bearer Token and including it in the Authorization header of every request.
Examples: AI assistants, custom applications using the REST API, and dedicated MCP clients.
The MCP Server acts as the primary gateway and orchestrator. All client requests must pass through it. It performs two critical functions:
This is the first layer of security. The MCP Server validates the identity and legitimacy of every incoming request through a three-step process:
Extract Token: It retrieves the JWT from the Authorization header.
Verify Signature: It cryptographically verifies the token's signature to ensure it hasn't been tampered with.
Validate User: It queries the Users table in the shared database to confirm the user exists and is active.
A key feature of the MCP Server is its ability to dynamically adjust the tools it offers based on the availability of dependent services.
Core, Database, & Vector Tools: These are foundational toolsets and are always registered and available.
RAG Tools: These tools, which rely on the RAG API, are only registered if the MCP Server can successfully connect to the RAG API. This makes the RAG component an optional, plug-in extension.
This is a specialized microservice designed for complex, knowledge-based tasks using the Retrieval-Augmented Generation pattern. It operates as a distinct service that the MCP Server communicates with.
The RAG API implements a second, more granular layer of security. After receiving a forwarded request from the MCP Server, it re-verifies the JWT and performs deeper authorization checks:
Verify JWT Token: Ensures the token is still valid.
Check User Roles: Examines the user's roles and permissions to determine if they are authorized to perform the requested RAG operation.
Enforce Permissions: Applies access control rules, for example, restricting document access based on ownership or group membership.
This is the core logic of the RAG API. It transforms a user's query into a knowledge-rich response.
Document Ingestion: The process of adding new documents to the knowledge base.
Vector Embedding: Documents are converted into numerical representations (vectors) and stored in the Vector Store within the MariaDB database.
Retrieval: When a query is received, the API searches the Vector Store to find the most semantically relevant document chunks.
The database is the foundation of the entire architecture, providing a single, consistent source of data for all services.
Users: Stores user credentials, roles, and metadata required for authentication and authorization across both the MCP Server and RAG API.
Documents: Contains the raw content (e.g., text, metadata) that the RAG pipeline uses for retrieval.
Vector Store: A dedicated table or set of tables within MariaDB that stores the vector embeddings of the documents, enabling efficient similarity searches.
Request Initiation: A client application sends a request to the MCP Server (:8002) with a JWT in the Authorization header.
MCP Server Authentication: The MCP Server validates the JWT against the shared database. If invalid, the request is rejected with a 401 Unauthorized error.
Tool Dispatching: The server identifies that the request requires a RAG tool. It's checks if the RAG API is available.
This architecture ensures a clear separation of concerns, enhances security with multiple checkpoints, and provides a highly extensible platform for building advanced AI tools.
In this guide, we will be migrating from the MariaDB Community Operator to the MariaDB Enterprise Kubernetes Operator without downtime. This guide assumes:
0.37.1 version of the MariaDB Community Operator is installed in the cluster.
MariaDB community resources will be migrated to its counterpart MariaDB enterprise resource. In this case, we will be using 11.4.4 version, which is supported in both community and enterprise versions. Check the supported MariaDB Enterprise images and migrate to a counterpart community version first if needed.
MaxScale resources cannot be migrated in a similar way, they need to be recreated. To avoid downtime, temporarily point your applications to MariaDB directly during the migration.
1. Install the Enterprise CRDs as described in the .
2. Get the and grant execute permissions:
3. Migrate MariaDB resources using the migration script. Make sure you set <mariadb-name> with the name of the MariaDB resource to be migrated and <operator-version> with the version of the Enterprise operator you will be installing:
4. Update the apiVersion of the rest of CRs to enterprise.mariadb.com/v1alpha1.
5. Uninstall the Community operator:
6. If your MariaDB Community had Galera enabled, delete the <mariadb-name> Role, as it will be specyfing the Community CRDs:
7. Install the Enterprise operator as described in the . This will trigger a rolling upgrade, make sure it finishes successfully before proceeding with the next step.
8. Delete the finalizers and uninstall the Community CRDs:
9. Run mariadb-upgrade in all Pods. Make sure you set <mariadb-name> with the name of the MariaDB resource:
10. Restart the Enterprise operator:
This documentation provides guidance on installing the MariaDB Enterprise Kubernetes Operator operator in OpenShift. This operator has been and it is available in the OpenShift console.
Operators are deployed into OpenShift with the , which facilitates the installation, updates, and overall management of their lifecycle.
Configure your to be able to pull images.
The recommended way to configure credentials is to use the provided by OpenShift, as described . Alternatively, the operator bundle has a mariadb-enterprise
In this guide, we will be migrating existing MariaDB Galera and MaxScale instances to without downtime.
1. Ensure that MariaDB has TLS enabled and not enforced. Set the following options if needed:
By setting these options, the operator will issue and configure certificates for MariaDB, but TLS will not be enforced in the connections i.e. both TLS and non-TLS connections will be accepted. TLS enforcement will be optionally configured at the end of the migration process.
This will trigger a rolling upgrade, make sure it finishes successfully before proceeding with the next step. Refer to the for further information about update strategies.
2. If you are currently using MaxScale
A cornerstone of the Enterprise edition is its ability to integrate with centralized secret managers, eliminating the need for static credentials stored in local or .env files. The server dynamically fetches database credentials and API keys at startup, ensuring a secure and compliant operational posture.
Multi-layered Authentication: JWT-based authentication (HS256/RS256) with bcrypt password hashing
MariaDB AI RAG is an enterprise-grade Retrieval-Augmented Generation (RAG) solution that integrates with MariaDB to provide AI-powered document processing, semantic search, and natural language generation capabilities.
The system enables organizations to leverage their document repositories and databases for AI-powered search and generation. By combining the reliability of MariaDB with modern AI capabilities, AI RAG provides accurate, context-aware responses based on your organization's proprietary data.
By leveraging the automation provided by MariaDB Enterprise Kubernetes Operator, you can declaratively manage large fleets of databases using CRs. This also covers day two operations, such as upgrades, which can be risky when rolling out updates to thousands of instances simultaneously.
To mitigate this, and to give you full control on the upgrade process, you are able to choose between multiple update strategies described in the following sections.
In order to provide you with flexibility for updating MariaDB reliably, this operator supports multiple update strategies:
The MariaDB Enterprise MCP Server offers a comprehensive suite of tools, categorized into standard database operations, advanced vector functionalities, and workflow orchestration.
These tools provide fundamental control and insight into your MariaDB environment. By default, operations are read-only (MCP_READ_ONLY = true) but can be configured for write access (MCP_READ_ONLY = false).
wget https://dlm.mariadb.com/<Customer_Download_Token>/enterprise-release-helpers/install-enterprise-manager.shchmod +x install-enterprise-manager.sh./install-enterprise-manager.shsudo yum install -y mema-agentCREATE USER 'monitor'@'localhost' IDENTIFIED BY '<password>';
GRANT PROCESS, BINLOG MONITOR, REPLICA MONITOR, REPLICATION MASTER ADMIN ON *.* TO 'monitor'@'localhost';sudo yum install -y mema-agentsudo apt install -y mema-agentCREATE USER 'monitor'@'localhost' IDENTIFIED BY '<password>';
GRANT PROCESS, BINLOG MONITOR, REPLICA MONITOR, REPLICATION MASTER ADMIN ON *.* TO 'monitor'@'localhost';sudo apt install -y mema-agent# Clear out any existing data first
docker run --rm --volumes-from enterprise-manager-grafana -v $(pwd)/backups/:/backups/ alpine:latest find /var/lib/grafana/ -delete -mindepth 1
docker run --rm --volumes-from enterprise-manager-prometheus -v $(pwd)/backups/:/backups/ alpine:latest find /prometheus/ -delete -mindepth 1
docker run --rm --volumes-from enterprise-manager-supermax -v $(pwd)/backups/:/backups/ alpine:latest find /var/lib/supermax/ -delete -mindepth 1
# Restore the data from the backups
docker run --rm --volumes-from enterprise-manager-grafana -v $(pwd)/backups/:/backups/ alpine:latest tar -C / -xzf /backups/grafana-backup.tar.gz
docker run --rm --volumes-from enterprise-manager-prometheus -v $(pwd)/backups/:/backups/ alpine:latest tar -C / -xzf /backups/prometheus-backup.tar.gz
docker run --rm --volumes-from enterprise-manager-supermax -v $(pwd)/backups/:/backups/ alpine:latest tar -C / -xzf /backups/supermax-backup.tar.gzcd enterprise-manager/
vim .envPROMETHEUS_RETENTION_TIME=90dPROMETHEUS_RETENTION_TIME=52wdocker compose up -dapiVersion: v1
kind: Secret
metadata:
name: mariadb
stringData:
password: MariaDB11!kubectl apply -f secret.yamlapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
rootPasswordSecretKeyRef:
name: mariadb
key: password
imagePullSecrets:
- name: mariadb-enterprise
maxScaleRef:
name: maxscale-galera
username: mariadb
passwordSecretKeyRef:
name: mariadb
key: password
database: mariadb
storage:
size: 1Gi
replicas: 3
galera:
enabled: truekubectl apply -f mariadb-galera.yaml❯ kubectl get pods
NAME READY STATUS RESTARTS AGE
mariadb-galera-0 2/2 Running 0 101s
mariadb-galera-1 2/2 Running 0 101s
mariadb-galera-2 2/2 Running 0 101sapiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale-galera
spec:
imagePullSecrets:
- name: mariadb-enterprise
mariaDbRef:
name: mariadb-galera
replicas: 2kubectl apply -f maxscale-galera.yaml❯ kubectl get pods
mariadb-galera-0 2/2 Running 0 10m
mariadb-galera-1 2/2 Running 0 10m
mariadb-galera-2 2/2 Running 0 10m
maxscale-galera-0 1/1 Running 0 81s
maxscale-galera-1 1/1 Running 0 81s
❯ kubectl get maxscale
NAME READY STATUS PRIMARY AGE
maxscale-galera True Running mariadb-galera-0 65s
❯ kubectl get mariadb
NAME READY STATUS PRIMARY UPDATES AGE
mariadb-galera True Running mariadb-galera-0 ReplicasFirstPrimaryLast 10m❯ kubectl run mariadb-connect --rm -it --image=docker.mariadb.com/enterprise-server:11.4 -- bash -c "mariadb -u mariadb -p'MariaDB11!' --ssl=false -h maxscale-galera"
If you don't see a command prompt, try pressing enter.
MariaDB [(none)]> SHOW DATABASES;
+--------------------+
| Database |
+--------------------+
| information_schema |
| mariadb |
+--------------------+
2 rows in set (0.001 sec)curl http://localhost:8000/healthcurl -X POST "http://localhost:8000/token" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "username=user@example.com&password=your_password"curl -X GET "http://localhost:8000/documents" \
-H "Authorization: Bearer YOUR_TOKEN"http://localhost:8000docker login docker.mariadb.comwget https://dlm.mariadb.com/<Customer_Download_Token>/enterprise-release-helpers/install-enterprise-manager.shcd enterprise-manager
docker compose images | awk 'p{print $2 ":" $3} {p=1}' | xargs docker image save -o images.tar
cd ..
tar -czvf enterprise-manager.tar.gz enterprise-managerapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
inheritMetadata:
labels:
database.myorg.io: mariadb
annotations:
database.myorg.io: mariadbapiVersion: v1
kind: Service
metadata:
annotations:
database.myorg.io: mariadb
labels:
database.myorg.io: mariadb
name: mariadb-galera-primaryapiVersion: v1
kind: Pod
metadata:
annotations:
database.myorg.io: mariadb
labels:
database.myorg.io: mariadb
name: mariadb-galera-0apiVersion: enterprise.mariadb.com/v1alpha1
kind: Backup
metadata:
name: backup
spec:
inheritMetadata:
labels:
sidecar.istio.io/inject: "true"
annotations:
database.myorg.io: mariadb
podMetadata:
labels:
sidecar.istio.io/inject: "false"apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
service:
type: LoadBalancer
metadata:
annotations:
metallb.universe.tf/loadBalancerIPs: 172.18.0.150
primaryService:
type: LoadBalancer
metadata:
annotations:
metallb.universe.tf/loadBalancerIPs: 172.18.0.160
secondaryService:
type: LoadBalancer
metadata:
annotations:
metallb.universe.tf/loadBalancerIPs: 172.18.0.161apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
storage:
size: 1Gi
volumeClaimTemplate:
metadata:
annotations:
database.myorg.io: mariadb
labels:
database.myorg.io: mariadb
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1GiapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
service:
type: LoadBalancer
metadata:
annotations:
metallb.universe.tf/loadBalancerIPs: 172.18.0.150apiVersion: enterprise.mariadb.com/v1alpha1
kind: Backup
metadata:
name: backup
spec:
podMetadata:
labels:
sidecar.istio.io/inject: "false"apiVersion: enterprise.mariadb.com/v1alpha1
kind: ExternalMariaDB
metadata:
name: external-mariadb
spec:
host: mariadb.example.com
port: 3306
username: root
passwordSecretKeyRef:
name: mariadb
key: password
connection:
secretName: external-mariadb
healthCheck:
interval: 5sapiVersion: enterprise.mariadb.com/v1alpha1
kind: ExternalMariaDB
metadata:
name: external-mariadb
spec:
host: mariadb.example.com
port: 3306
username: root
passwordSecretKeyRef:
name: mariadb
key: password
tls:
enabled: true
clientCertSecretRef:
name: client-cert-secret
serverCASecretRef:
name: ca-cert-secret
connection:
secretName: external-mariadb
healthCheck:
interval: 5s
retryInterval: 10sapiVersion: enterprise.mariadb.com/v1alpha1
kind: User
metadata:
name: user-external
spec:
name: user
mariaDbRef:
name: external-mariadb
kind: ExternalMariaDB
passwordSecretKeyRef:
name: mariadb
key: password
maxUserConnections: 20
host: "%"
cleanupPolicy: Delete
requeueInterval: 10h
retryInterval: 30scd enterprise-manager/mema-agent setup --endpoint=https://<MEM_Address> ...kubectl create secret docker-registry mariadb-enterprise \
--docker-server=docker.mariadb.com \
--docker-username=<email> \
--docker-password=<customer-download-token>oc extract secret/pull-secret -n openshift-config --confirmoc registry login \
--registry="docker.mariadb.com" \
--auth-basic="<email>:<customer-download-token>" \
--to=.dockerconfigjsonoc set data secret/pull-secret -n openshift-config --from-file=.dockerconfigjsonoc create secret docker-registry mariadb-enterprise \
--docker-server=docker.mariadb.com \
--docker-username=<email> \
--docker-password=<customer-download-token>apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb
spec:
...
image: docker.mariadb.com/enterprise-server:11.4.4-2
imagePullPolicy: IfNotPresent
imagePullSecrets:
- name: mariadb-enterpriseapiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale
spec:
...
image: docker.mariadb.com/maxscale-enterprise:25.01.1
imagePullPolicy: IfNotPresent
imagePullSecrets:
- name: mariadb-enterpriseapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb
spec:
...
image: docker.mariadb.com/enterprise-server:11.4.4-2
imagePullPolicy: IfNotPresent
imagePullSecrets:
- name: mariadb-enterpriseapiVersion: enterprise.mariadb.com/v1alpha1
kind: Backup
metadata:
name: backup
spec:
...
mariaDbRef:
name: mariadb
imagePullSecrets:
- name: backup-registrymaxctrl alter maxscale log_info=truemaxctrl alter maxscale log_info=false$ curl http://192.168.122.16:4318
Client sent an HTTP request to an HTTPS server.
$ curl -k https://192.168.122.16:4318
404 page not foundcurl -u admin:mariadb -k "https://192.168.122.16:8090/prometheus/api/v1/query?query=node_os_info"helm repo update mariadb-enterprise-operator
helm upgrade --install mariadb-enterprise-operator-crds mariadb-enterprise-operator/mariadb-enterprise-operator-crds --version 25.8.0apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
updateStrategy:
+ autoUpdateDataPlane: trueapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb
spec:
galera:
agent:
- image: docker.mariadb.com/mariadb-enterprise-operator:1.0.0
+ image: docker.mariadb.com/mariadb-enterprise-operator:25.8.0
initContainer:
- image: docker.mariadb.com/mariadb-enterprise-operator:1.0.0
+ image: docker.mariadb.com/mariadb-enterprise-operator:25.8.0helm repo update mariadb-enterprise-operator
helm upgrade --install mariadb-enterprise-operator mariadb-enterprise-operator/mariadb-enterprise-operator --version 25.8.0 kubectl scale deployment mariadb-enterprise-operator --replicas=1
kubectl scale deployment mariadb-enterprise-operator-webhook --replicas=1apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
updateStrategy:
+ autoUpdateDataPlane: false
- autoUpdateDataPlane: trueapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
...
storage:
size: 1GiapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
...
storage:
size: 1Gi
storageClassName: gp3apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
...
storage:
size: 1Gi
storageClassName: gp3
volumeClaimTemplate:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
storageClassName: gp3apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
...
storage:
size: 2Gi
resizeInUseVolumes: true
waitForVolumeResize: trueapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
...
storage:
ephemeral: true# Database Configuration (Required)
DB_HOST=localhost
DB_PORT=3306
DB_USER=your_mysql_username
DB_PASSWORD=your_mysql_password
DB_NAME=rag_db
# Authentication (Required)
SECRET_KEY=your_secret_key_here_generate_a_secure_random_string
# Embedding Configuration (Required)
EMBEDDING_PROVIDER=openai
EMBEDDING_MODEL=text-embedding-3-small
# API Keys (Set based on your embedding/LLM provider)
OPENAI_API_KEY=your_openai_api_key
GEMINI_API_KEY=your_gemini_api_key
VOYAGE_API_KEY=your_voyage_api_key
COHERE_API_KEY=your_cohere_api_keymysql -u username -p database_name < init-db.sqlSECRET_KEY=your_secure_random_string
ACCESS_TOKEN_EXPIRE_MINUTES=60apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-repl
spec:
replication:
agent:
kubernetesAuth:
enabled: trueapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-repl
spec:
replication:
agent:
basicAuth:
enabled: truekubectl get mariadbs
NAME READY STATUS PRIMARY UPDATES AGE
mariadb-galera True Suspended mariadb-galera-0 ReplicasFirstPrimaryLast 12mPOST /documents/ingest-from-tablehttps://<Your_Enterprise_Manager_Address>:8090Client ID: The unique ID for the Enterprise Manager application.
Client Secret: The secret key for the Enterprise Manager application.
Authentication Flow: Choose the OIDC flow. auto is the default and recommended for most providers.
Client ID: The Client ID you obtained from your provider.
Client Secret: The Client Secret you obtained from your provider.





enterprise-manager-nginxenterprise-manager-otelcol
enterprise-manager-prometheus
enterprise-manager-supermax
admin_oidc_url
URL for Enterprise Manager server that includes hostname or IP address and port.
admin_host
Must be set to 0.0.0.0 to allow external connections from Enterprise Manager.
admin_oidc_client_id
Default credentials used by Enterprise Manager to request the access token.
admin_oidc_client_secret
Default credentials used by Enterprise Manager to request the access token.
admin_oidc_ssl_insecure
Skip TLS certificate verification in case certificates aren't configured

Change it to:

Command examples
For a MariaDB Server host:
For a MaxScale host:
Flag descriptions
--endpoint
The address of your external OTLP-compatible monitoring system.
--otlp-port
The port on the external system that accepts OTLP data.
--cluster-name
An informational name for the cluster this host belongs to.
--host-name
An informational name for this specific host.
--mariadb-user
The database user for scraping MariaDB Server metrics.
--mariadb-password
The password for the MariaDB user.
For a full list of all available flags and their descriptions, run mema-agent help setup on the host where the agent is installed.
From the Query Editor In the Query Editor, right-click on a schema name in the Schemas Sidebar and select the "Generate ERD" option.










Multi-container deployments
Performance considerations
Backup and recovery planning
Review Technical Architecture for optimization
Generation: The retrieved chunks are combined with the original query and fed to a language model to generate a comprehensive, context-aware answer.
Request Forwarding: The MCP Server forwards the original request, including the JWT, to the RAG API (:8000).
RAG API Authorization: The RAG API performs its own validation of the JWT and checks the user's permissions for the requested action. If unauthorized, it returns an error.
RAG Pipeline Execution: The RAG API executes its pipeline, querying the Documents and Vector Store tables in the MariaDB database to retrieve relevant context.
Response Generation: The RAG API generates a final response.
Response Relay: The response is sent back to the MCP Server, which in turn relays it to the client application.
Click the Settings icon (⚙️) in the left navigation bar.
In MariaDB Enterprise Manager, permissions, roles, and users are organized in a clear structure:
Permissions define specific actions a user can perform (viewing data, editing settings, accessing the SQL editor).
Roles are collections of one or more permissions grouped together. They can be pre-configured (for example admin, monitoring-admin, viewer) or custom-defined.
Users are assigned one or more roles and inherit the associated permissions.
This structure allows administrators to manage access by assigning roles to users rather than setting individual permissions per user.
Access to the User Management page is restricted based on a user's assigned permissions.
✅ Only users with admin permissions (assigned via a role) can add, modify, or remove other users and roles.
❌ Non-admin users cannot access or change these settings, but they can update their own password via their Profile page.\
Enterprise Manager ships with three pre-configured roles:
admin: Has all permissions. Can do everything, including managing other users.
monitoring-admin: Can manage databases and monitoring, but cannot manage users or roles.
viewer: Has read-only access to monitoring data and can use the Workspace.
Roles (pre-configured or custom) are built from combinations of the following base permissions:
admin
Can view and manage all users and roles.
edit
Can manage databases and monitoring settings. Requires the view permission to be selected as well.
view
Can view dashboards and monitoring data.
sql
Can access the Query Editor and ERD tools in the Workspace. Enabling this allows you to set a query row limit for the role.
Only users with the admin permission can create or modify roles.
Upon installation of MariaDB Enterprise Manager, a default admin user is created with an automatically generated password.
imagePullSecretSecretmariadb-enterpriseYou can install the certified operator in OpenShift clusters that have the mariadb-enterprise-operator packagemanifest available. In order to check this, run the following command:
Both the operator and the operand Pods run with the restricted-v2 SecurityContextConstraint, the most restrictive SCC in OpenShift in terms of container permissions. This implies that OpenShift automatically assigns a SecurityContext for the Pods with minimum permissions, for example:
OpenShift does not assign SecurityContexts in the default and kube-system namespaces. Please refrain from deploying operands on them, as it will result in permission errors when trying to write to the filesystem.
You can read more about SecurityContextConstraints in the OpenShift documentation.
To install the operator watching resources on all namespaces, you need to create a Subscription object for mariadb-enterprise-operator using the stable channel in the openshift-operators namespace:
This will use the global-operators OperatorGroup that is created by default in the openshift-operators namespace. This OperatorGroup will watch all namespaces in the cluster, and the operator will be able to manage resources across all namespaces.
You can read more about OperatorGroups in the OpenShift documentation.
In order to define which namespaces the operator will be watching, you need to create an OperatorGroup in the namespace where the operator will be installed:
This OperatorGroup will watch the namespaces defined in the targetNamespaces field. The operator will be able to manage resources only in these namespaces.
Then, the operator can be installed by creating a Subscription object in the same namespace as the OperatorGroup:
We maintain support across a variety of OpenShift channels to ensure compatibility with different release schedules and stability requirements. Below, you will find an overview of the specific OpenShift channels we support.
stable
4.18, 4.16
Points to the latest stable version of the operator. This channel may span multiple major versions.
stable-v25.10
4.18, 4.16
v25.10.x is an LTS release. This channel points to the latest patch release of 25.10. Use this if you require version pinning to a stable version of the operator without necessarily looking for newer features.
An example Subscription would look like this:
Updates are fully managed by OLM and controlled by the installPlanApproval field in the Subscription object. The default value is Automatic, which means that OLM will automatically update the operator to the latest version available in the channel. If you want to control the updates, you can set this field to Manual, and OLM will only update the operator when you approve the update.
The first step for uninstalling the operator is to delete the Subscription object. This will not remove the operator, but it will stop OLM from managing the operator:
After that, you can uninstall the ClusterServiceVersion (CSV) object that was created by OLM. This will remove the operator from the cluster:
As an alternative to create Subscription objects via the command line, you can install operators by using the OpenShift console. Go to the Operators > OperatorHub section and search by mariadb enterprise:
Select MariaDB Enterprise Kubernetes Operator, click on install, and you will be able to create a Subscription object via the UI.
Once deployed, the operator comes with example resources that can be deployed from the console directly. For instance, to create a MariaDB:
As you can see in the previous screenshot, the form view that the OpenShift console offers is limited, we recommend using the YAML view:
Use this method for a single MariaDB Server or to manually define a Primary/Replica or Galera cluster.
First, perform these actions on each MariaDB Server you plan to add.
Install the Agent package.
Create the Enterprise Manager user (allows the Enterprise Manager server to connect remotely):
Replace <Enterprise_Manager_IP> with the IP of your Enterprise Manager server and <password> with a secure password.
Create the Local Agent user (required for the agent to collect detailed metrics from the local database instance):
Replace <password> with a secure password.
Use this method to add a complete primary/replica or Galera cluster that is managed by one or more MaxScale instances.
Context-sensitive suggestions for keywords and objects to speed authoring and reduce errors.
SQL Code Formatter
Automatically formats SQL for readability and consistent style.
SQL Syntax Highlighting
Color syntax highlighting for quicker scanning and fewer mistakes.
SQL Snippets
Save and reuse your favorite SQL blocks across sessions and teams.
SQL History
Running history of executed SQL with quick replay into the editor.
Multiple Connections
Open simultaneous connections (dev/test/prod) and work in parallel, tab-isolated.
Open/Edit/Save SQL Files
Load scripts, edit, and save changes without leaving the workspace.
Export Result Sets
Export results as CSV, JSON, or SQL for hand-offs and audits.
Display multiple Result Sets
View multiple result sets in the same window.
Vertical Results Mode
Columnar display for wide rows to improve readability of tall/wide data.
Result Set Limits
Cap returned rows to keep queries responsive and safe in production.
Result Visualizations
Visualize results as line, bar, or scatter charts for quick trend checks.
Grid Operations
Search, filter, group, and control column visibility directly in the result sets.
ER Diagramming
Build complete entity-relationship diagrams from your database structures.
Auto Layout
Automatically arrange large models for clear, navigable diagrams.
Model Tables, Indexes
Manage MariaDB data-related objects.
Create from Live Databases
Generate ERD models directly from live schemas.
Schema Inspector
Detailed metadata views for all schema objects to understand structure and dependencies.
Object Browser
Navigate and explore databases, tables, views, routines, and triggers.
Object Editor
Create, modify, and delete schema objects together with managing constraints, renaming, copying objects relationships.
User Management
View, edit, create, delete database users and privileges.
Process List Viewer
View and manage live sessions/commands.
SQL Editor
Write, run, and debug SQL with parallel query execution in multi-tab sessions.
SQL Code Completion
MariaDBMariaDB during the migration process. You can achieve this by configuring your application to use the MariaDB migration process, the MaxScale instance will need to be recreated in order to use TLS, and then you will be able to point your application back to MaxScale. Ensure that all applications are pointing to MariaDB before moving on to the next step.3. MariaDB is now accepting TLS connections. The next step is migrating your applications to use TLS by pointing them to MariaDB securely. Ensure that all applications are connecting to MariaDB via TLS before proceeding to the next step.
4. If you are currently using MaxScale, and you are planning to connect via TLS through it, you should now delete your MaxScale instance. If needed, keep a copy of the MaxScale manifest, as we will need to recreate it with TLS enabled in further steps:
It is very important that you wait until your old MaxScale instance is fully terminated to make sure that the old configuration is cleaned up by the operator.
5. For enhanced security, it is recommended to enforce TLS in all MariaDB connections by setting the following options. This will trigger a rolling upgrade, make sure it finishes successfully before proceeding with the next step:
6. For improved security, you can optionally configure TLS for Galera SSTs by following the steps below:
Get the migration script and grant execute permissions:
Run the migration script. Make sure you set <mariadb-name> with the name of the MariaDB resource:
Set the following option to enable TLS for Galera SSTs:
This will trigger a rolling upgrade, make sure it finishes successfully before proceeding with the next step
7. As mentioned in step 4, recreate your MaxScale instance with tls.enabled=true if needed:
8. MaxScale is now accepting TLS connections. Next, you need to migrate your applications to use TLS by pointing them back to MaxScale securely. You have done this previously for MariaDB, you just need to update your application configuration to use the MaxScale Service and its CA bundle.
Adaptive Architecture: Intelligent tool registration based on service availability
Role-Based Access Control (RBAC): Fine-grained permission management
Multiple Deployment Modes: Standalone, 1Password, Local Vault, and HCP Vault
Database-Enforced User Validation: Shared database ensures only registered users can access services
Purpose: Simple deployment with direct environment variables
Configuration: Direct environment variables
Key Settings:
When to Use: Development, testing, small deployments, No external secret management available
Startup:
Purpose: Secure secret management using 1Password CLI
Configuration: op:// secret references
Key Settings:
Prerequisites:
Install 1Password CLI
Authenticate: op signin
Create vault and items with required secrets
Startup:
When to Use: Team environments, shared secrets, Production
Purpose: Development with local HashiCorp Vault
Configuration: Local Vault server
Key Settings:
Setup:
Startup:
When to Use: Development, Production with proper vault setup
Purpose: Production deployment with HashiCorp Cloud Platform Vault
Configuration: HCP Vault cluster
Key Settings:
Setup:
Create HCP Vault cluster
Configure AppRole authentication
Create policies for application access
Store secrets in Vault
Generate role_id and secret_id
Startup:
When to Use: Production, enterprise deployments
MariaDB AI RAG follows a modular architecture with the following key components:
Document Ingestion Module
Handles document uploads and text extraction
Supports multiple file formats (PDF, DOCX, TXT, etc.)
Processes metadata extraction
Manages document storage and versioning
Chunking Module
Divides documents into semantically meaningful segments
Supports multiple chunking strategies (fixed size, recursive, semantic)
Optimizes chunk size and overlap for retrieval quality
Vector Database Integration
Creates and stores vector embeddings for document chunks
Integrates with MariaDB's vector search capabilities
Enables efficient similarity search
Retrieval Module
Converts queries into vector embeddings
Performs semantic similarity search
Ranks and filters results based on relevance
Generation Module
Integrates with multiple LLM providers (OpenAI, Google, Anthropic)
Constructs prompts with retrieved context
Generates natural language responses
Orchestration Module
Coordinates the end-to-end RAG pipeline
Manages asynchronous processing
Handles error recovery and retries
API Interface
Exposes RESTful endpoints for all functionality
Implements JWT-based authentication
Manages user permissions and access control
Document Processing Flow
Documents are uploaded via the API
Text is extracted based on document format
Documents are divided into chunks
Chunks are converted to vector embeddings
Embeddings are stored in the vector database
Query Processing Flow
User submits a query via the API
Query is converted to a vector embedding
Similar document chunks are retrieved
Database Integration Flow
Database table/view is selected for ingestion
Rows are processed as individual documents
Column mapping defines content and metadata
Database: MariaDB 10.6+ or MySQL 8.0+
Operating System: Linux (Debian/Ubuntu, RHEL/CentOS), Windows Server
Hardware: Minimum 4 CPU cores, 8GB RAM, 100GB storage
Network: Internet connectivity for external AI services
Dependencies: Python 3.9+, FastAPI, SQLAlchemy, PyTorch (optional for local embeddings)
For detailed installation instructions, see the Installation Guide.
ReplicasFirstPrimaryLast: Roll out replica Pods one by one, wait for each of them to become ready, and then proceed with the primary Pod.
RollingUpdate: Utilize the rolling update strategy from Kubernetes.
OnDelete: Updates are performed manually by deleting Pods.
Never: Pause updates.
The update strategy can be configured in the updateStrategy field of the MariaDB resource:
It defaults to ReplicasFirstPrimaryLast if not provided.
Updates are not limited to updating the image field in the MariaDB resource, an update will be triggered whenever any field of the Pod template is changed. This translates into making changes to MariaDB fields that map directly or indirectly to the Pod template, for instance, the CPU and memory resources:
Once the update is triggered, the operator manages it differently based on the selected update strategy.
This role-aware update strategy consists in rolling out the replica Pods one by one first, waiting for each of them become ready (i.e. readiness probe passed), and then proceed with the primary Pod. This is the default update strategy, as it can potentially meet various reliability requirements and minimize the risks associated with updates:
Write operations won't be affected until all the replica Pods have been rolled out. If something goes wrong in the update, such as an update to an incompatible MariaDB version, this is detected early when the replicas are being rolled out and the update operation will be paused at that point.
Read operations impact is minimized by only rolling one replica Pod at a time.
Waiting for every Pod to be synced minimizes the impact in the clustering protocols and the network.
This strategy leverages the rolling update strategy from the StatefulSet resource, which, unlike ReplicasFirstPrimaryLast, does not take into account the role of the Pods(primary or replica). Instead, it rolls out the Pods one by one, from the highest to the lowest StatefulSet index.
You are able to pass extra parameters to this strategy via the rollingUpdate object:
This strategy aims to provide a method to update MariaDB resources manually by allowing the user to restart the Pods individually. This way, the user has full control over the update process and can decide which Pods are rolled out at any given time.
Whenever an update is triggered, the MariaDB will be marked as pending to update:
From this point, you are able to delete the Pods to trigger the update, which will result the MariaDB marked as updating:
Once all the Pods have been rolled out, the MariaDB resource will be back to a ready state:
The operator will not perform updates on the StatefulSet whenever this update strategy is configured. This could be useful in multiple scenarios:
Progressive fleet upgrades: If you're managing large fleets of databases, you likely prefer to roll out updates progressively rather than simultaneously across all instances.
Operator upgrades: When upgrading the operator, changes to the StatefulSet or the Pod template may occur from one version to another, which could trigger a rolling update of your MariaDB instances.
Highly available topologies rely on data-plane containers that run alongside MariaDB to enable the remote management of the database instances. These containers use the mariadb-enterprise-operator image, which can be automatically updated by the operator based on its image version:
By default, updateStrategy.autoUpdateDataPlane is false, which means that no automatic upgrades will be performed, but you can opt-in/opt-out from this feature at any point in time by updating this field. For instance, you may want to selectively enable updateStrategy.autoUpdateDataPlane in a subset of your MariaDB instances after the operator has been upgraded to a newer version, and then disable it once the upgrades are completed.
It is important to note that this feature is fully compatible with the Never strategy: no upgrades will happen when updateStrategy.autoUpdateDataPlane=true and updateStrategy.type=Never.
list_databases: Discovers all accessible databases.
list_tables: Enumerates all tables within a specified database.
get_table_schema: Retrieves the detailed schema for a specific table, including column names, data types, keys, and default values.
execute_sql: Executes read-only SQL queries like SELECT, SHOW, and DESCRIBE. Supports parameterized queries for enhanced security.
create_database: Creates a new database if it does not already exist.
The server’s integrated vector functionality enables semantic search and other embedding-based operations directly within your database.
create_vector_store: Creates a new table optimized as a vector store. The schema includes columns for id, document, embedding (VECTOR type), and metadata (JSON). Users can specify the embedding model and distance function (e.g., cosine, euclidean) at creation.
list_vector_stores: Lists all tables in a database that are identified as vector stores.
delete_vector_store: Securely removes a vector store table.
insert_docs_vector_store: Inserts documents and associated metadata into a vector store. The server manages the generation of embeddings using a configured service.
search_vector_store: Performs semantic similarity searches by generating an embedding for a user query and finding the 'k' most similar documents in the specified vector store.
The server exposes powerful orchestration endpoints that allow an AI agent to execute an entire RAG pipeline through a single, secure interface.
Ingestion (/orchestrate/ingestion): Triggers the ingestion of documents into a specified vector store, including the chunking and embedding processes.
Generation (/orchestrate/generation): Executes a query against a set of documents, performing retrieval and generating a final, context-aware response from an LLM.
list_databases
Discovers all accessible databases.
Standard Database Operations
list_tables
Enumerates all tables within a specified database.
Standard Database Operations
get_table_schema
Retrieves the detailed schema for a specific table.
Standard Database Operations
execute_sql
Executes read-only SQL queries.
NodeFileDescriptorLimit
Kernel is predicted to exhaust file descriptors soon (sustained for 15m). Triggers when allocated file descriptors exceed 70% of the kernel limit.
NodeFileDescriptorLimit
Kernel is close to exhausting file descriptors (sustained for 15m). Triggers when allocated file descriptors exceed 90% of the kernel limit.
File Descriptors
Current vs. maximum number of open file descriptors.
Filesystem Type
Table of filesystem types and mount points on the node.




The Query Editor is a powerful, integrated environment for database developers and administrators. It provides a comprehensive set of tools for writing and debugging SQL and analyzing query results, all from a single interface.
This procedure outlines the steps required to access and utilize the Query Editor within the Workspace section of Enterprise Manager UI.
From the main Workspace screen, click the "Run Queries" card.\
In the "Connect to..." dialog, select your target server, enter your credentials, and click Connect.\
MariaDB Operator Enterprise enables you to manage SQL resources declaratively through CRs. By SQL resources, we refer to users, grants, and databases that are typically created using SQL statements.
The key advantage of this approach is that, unlike executing SQL statements manually, which is a one-time operation, declaring a SQL resource via a CR ensures that the resource is periodically reconciled by the operator. This provides a guarantee that the resource will be recreated if it gets manually deleted. Additionally, it prevents state drifts, as the operator will regularly update the resource according to the CR specification.
User CRBy creating this resource, you are declaring an intent to create an user in the referred MariaDB instance, just like a
chmod +x install-enterprise-manager.sh./install-enterprise-manager.shtar -xzvf enterprise-manager.tar.gz
cd enterprise-manager
docker image load -i images.tardocker compose up -dcd enterprise-manager
docker compose ps[maxscale]
# ... other settings ...
admin_host=0.0.0.0
admin_oidc_url=https://<Enterprise Manager Host Name>:8090
admin_oidc_client_id=admin
admin_oidc_client_secret=mariadb
admin_oidc_ssl_insecure=trueMEMA_TLS_CERTPATH=/certs/my-host.crt
MEMA_TLS_KEYPATH=/certs/my-host.keydocker compose up -dnano .envMEMA_AUDIT_API=falsedocker compose up -dMEMA_AUDIT_API=truescrape_configs:
- job_name: 'mem-federation'
scrape_interval: 60s
honor_labels: true
metrics_path: '/prometheus/federate'
params:
'match[]':
- '{job=~".+"}' # This parameter tells the endpoint to return all series.
static_configs:
- targets: ['<Enterprise_Manager_IP>:8090']
scheme: https
basic_auth:
username: admin # default username for Enterprise Manager
password: mariadb # default password for admin user
# You may need to add TLS and authentication configurations
# depending on your network setup and security requirements.
# tls_config:
# insecure_skip_verify: truesudo mema-agent setup --cluster-name=MyCluster \
--endpoint=https://<external_ip> --otlp-port=<external_port> \
--mariadb --host-name=<hostname> \
--mariadb-user=<user> --mariadb-password=<password> \
--otlp-insecure --otlp-interval=60ssudo mema-agent setup --cluster-name=MyCluster \
--endpoint=https://<external_ip> --otlp-port=<external_port> \
--maxscale --host-name=<hostname> \
--maxscale-user=admin --maxscale-password=mariadb \
--otlp-insecure --otlp-interval=60soc get packagemanifests -n openshift-marketplace mariadb-enterprise-operator
NAME CATALOG AGE
mariadb-enterprise-operator Certified Operators 21hsecurityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsNonRoot: true
runAsUser: 1000650000apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
name: mariadb-enterprise-operator
namespace: openshift-operators
spec:
channel: stable
installPlanApproval: Automatic
name: mariadb-enterprise-operator
source: certified-operators
sourceNamespace: openshift-marketplaceapiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
name: mariadb-enterprise-operator
namespace: my-namespace
spec:
targetNamespaces:
- my-namespace
- my-other-namespace
- my-other-other-namespace
upgradeStrategy: DefaultapiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
name: mariadb-enterprise-operator
namespace: my-namespace
spec:
channel: stable
installPlanApproval: Automatic
name: mariadb-enterprise-operator
source: certified-operators
sourceNamespace: openshift-marketplaceapiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
name: mariadb-enterprise-operator
namespace: openshift-operators
spec:
channel: stable # Change this to the actual channel you want
installPlanApproval: Automatic
name: mariadb-enterprise-operator
source: certified-operators
sourceNamespace: openshift-marketplaceoc delete subscription mariadb-enterprise-operatoroc delete clusterserviceversion mariadb-enterprise-operator.v1.0.0# For Red Hat/CentOS/Rocky
sudo dnf install -y mema-agent# For Debian/Ubuntu
sudo apt install -y mema-agent# For Red Hat/CentOS/Rocky
sudo dnf install -y mema-agent# For Debian/Ubuntu
sudo apt install -y mema-agentapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
tls:
+ enabled: true
+ required: false
+ galeraSSTEnabled: false
+ galeraServerSSLMode: PROVIDER
+ galeraClientSSLMode: DISABLEDkubectl get mxs maxscale-galera -o yaml > maxscale-galera.yaml
kubectl delete mxs maxscale-galeraapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
tls:
+ required: true
+ galeraServerSSLMode: SERVER_X509curl -sLO https://operator.mariadb.com/scripts/migrate_galera_ssl.sh
chmod +x migrate_galera_ssl.sh./migrate_galera_ssl.sh <mariadb-name>apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
tls:
+ galeraSSTEnabled: true
+ galeraClientSSLMode: VERIFY_IDENTITYapiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale-galera
spec:
+ tls:
+ enabled: true# Direct values in config file
DB_HOST=localhost
DB_PASSWORD=your_password
SECRET_KEY=your_secret_key
JWT_SECRET_KEY=your_jwt_secret
GEMINI_API_KEY=your_api_key# RAG API
rag-api.exe --config=config.env.secure.local
# MCP Server
$env:MCP_CONFIG="config.env.secure.local"
mcp-server.exe# 1Password references
DB_USER=op://Employee/RAG-Database/username
DB_PASSWORD=op://Employee/RAG-Database/password
SECRET_KEY=op://Employee/RAG-Security/secret-key
JWT_SECRET_KEY=op://Employee/RAG-Security/jwt-secret
GEMINI_API_KEY=op://Employee/RAG-API-Keys/gemini# RAG API
op run --env-file=config.env.1password.employee -- rag-api.exe
# MCP Server
op run --env-file=config.env.1password.employee -- mcp-server.exe# Vault Configuration
VAULT_ADDR=http://127.0.0.1:8200
VAULT_TOKEN=rag-root-token
VAULT_SKIP_VERIFY=true
VAULT_SECRET_PATH=rag-in-a-box
VAULT_MOUNT_POINT=secret# Start Vault in dev mode
vault server -dev -dev-root-token-id="rag-root-token"
# Store secrets
vault kv put secret/rag-in-a-box/database \
DB_USER=root \
DB_PASSWORD=Password123! \
DB_NAME=kb_chunks
vault kv put secret/rag-in-a-box/security \
SECRET_KEY=your_secret_key \
JWT_SECRET_KEY=your_jwt_secret
vault kv put secret/rag-in-a-box/api-keys \
GEMINI_API_KEY=your_api_key# RAG API
rag-api.exe --config=config.env.vault.local
# MCP Server
$env:MCP_CONFIG="config.env.vault.local"
mcp-server.exe# HCP Vault Configuration
VAULT_ADDR=https://your-vault-cluster.hashicorp.cloud:8200
VAULT_NAMESPACE=admin
VAULT_SKIP_VERIFY=false
VAULT_SECRET_PATH=rag-in-a-box
VAULT_MOUNT_POINT=secret
# AppRole Authentication
VAULT_ROLE_ID=your-vault-role-id
VAULT_SECRET_ID=your-vault-secret-id# RAG API
rag-api.exe --config=config.env.hcp.live
# MCP Server
$env:MCP_CONFIG="config.env.hcp.live"
mcp-server.exeapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb
spec:
updateStrategy:
type: ReplicasFirstPrimaryLastapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb
spec:
...
- image: docker.mariadb.com/enterprise-server:10.6.18-14.2
+ image: docker.mariadb.com/enterprise-server:10.6.19-15.1
resources:
requests:
cpu: 200m
memory: 128Mi
limits:
- memory: 1Gi
+ memory: 2GiapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb
spec:
...
updateStrategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 1kubectl get mariadbs
NAME READY STATUS PRIMARY UPDATES AGE
mariadb-galera True Pending update mariadb-galera-0 OnDelete 5m17skubectl get mariadbs
NAME READY STATUS PRIMARY UPDATES AGE
mariadb-galera True Updating mariadb-galera-0 OnDelete 9m50sNAME READY STATUS PRIMARY UPDATES AGE
mariadb-galera True Running mariadb-galera-0 OnDelete 12mapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-repl
spec:
updateStrategy:
autoUpdateDataPlane: true{
"table_name": "customer_feedback",
"schema_name": "databridge",
"column_mapping": {
"content": "feedback_text",
"metadata": ["customer_id", "product_id", "rating", "date_submitted"],
"id_column": "feedback_id"
},
"filter_condition": "rating >= 3 AND date_submitted > '2025-01-01'",
"batch_size": 1000,
"authorized_users": ["user1@example.com", "user2@example.com"]
}{
"job_id": "db_ingest_xyz123",
"status": "processing",
"table_name": "customer_feedback",
"estimated_rows": 5230,
"authorized_users": ["user1@example.com", "user2@example.com"]
}curl -X POST "http://localhost:8000/documents/ingest-from-table" \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"table_name": "customer_feedback", "schema_name": "databridge", "column_mapping": {"content": "feedback_text", "metadata": ["customer_id", "product_id", "rating", "date_submitted"], "id_column": "feedback_id"}, "authorized_users": ["user1@example.com"]}'POST /documents/sql-ingest{
"sql_query": "SELECT id, title, content, author, published_date FROM articles WHERE status = 'published' AND category = 'technical'",
"role": "ai_nexus",
"document_name": "published_articles"
}{
"id": 42,
"source": "sql://generated/1729425000/published_articles.csv",
"filename": "published_articles.csv",
"status": "completed",
"content": "id,title,content,author,published_date\n1,Article Title,Article content...,John Doe,2025-01-15\n...",
"error_message": null,
"created_at": "2025-10-20T12:00:00.123456",
"updated_at": "2025-10-20T12:00:01.234567"
}curl -X POST "http://localhost:8000/documents/sql-ingest" \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"sql_query": "SELECT id, title, content, author FROM articles WHERE status = '\''published'\''",
"role": "ai_nexus",
"document_name": "published_articles"
}'GET /documents/ingest-status/{job_id}{
"job_id": "db_ingest_xyz123",
"status": "completed",
"processed_rows": 5230,
"created_documents": 5230,
"failed_rows": 0,
"completion_time": "2025-08-25T12:34:56.789Z",
"authorized_users": ["user1@example.com", "user2@example.com"]
}curl "http://localhost:8000/documents/ingest-status/db_ingest_xyz123" \
-H "Authorization: Bearer YOUR_TOKEN"curl -sLO https://operator.mariadb.com/scripts/migrate_enterprise.sh
chmod +x migrate_enterprise.shRESOURCE="<mariadb-name>" \
OLD_API_GROUP="k8s.mariadb.com" \
NEW_API_GROUP="enterprise.mariadb.com" \
NEW_MARIADB_IMAGE="docker.mariadb.com/enterprise-server:11.4.4-2" \
NEW_MARIADB_OPERATOR_IMAGE="docker.mariadb.com/mariadb-enterprise-operator:<operator-version>" \
./migrate_enterprise.shhelm uninstall mariadb-operatorkubectl delete role <mariadb-name>for crd in $(kubectl get crds -o json | jq -r '.items[] | select(.spec.group=="k8s.mariadb.com") | .metadata.name'); do
kubectl get "$crd" -A -o json | jq -r '.items[] | "\(.metadata.namespace)/\(.metadata.name)"' | while read cr; do
ns=$(echo "$cr" | cut -d'/' -f1)
name=$(echo "$cr" | cut -d'/' -f2)
echo "Removing finalizers from $crd: $name in $ns..."
kubectl patch "$crd" "$name" -n "$ns" --type merge -p '{"metadata":{"finalizers":[]}}'
done
done
helm uninstall mariadb-operator-crdsfor pod in $(kubectl get pods -l app.kubernetes.io/instance=<mariadb-name> -o jsonpath='{.items[*].metadata.name}'); do
kubectl exec "$pod" -- sh -c 'mariadb-upgrade -u root -p${MARIADB_ROOT_PASSWORD} -f'
donekubectl rollout restart deployment mariadb-enterprise-operatorsql permission, a "Query editor row limit" dropdown will appear. You can adjust this value as needed.When creating a role, selecting the edit permission requires you to also select the view permission.
Delete: Permanently removes the custom role. A confirmation dialog will appear.
Delete: Permanently removes the user from MariaDB Enterprise Manager.







Log in with user who has edit permission.
Begin the Add Database process:
If this is your first time and no databases are present, you'll be on the "Add Database" screen automatically.
If you already have other databases, click the + Add Database button.
Ensure the Database without MaxScale option is selected.\
Fill in the connection details for your first server using the Enterprise Manager User ('monitor'@'<Enterprise_Manager_IP>').
Fill in the connection details for the second server in your topology and click Confirm. Repeat for all nodes in your topology.
Once all nodes are added, select the Topology Type (e.g., Primary/Replica — default — or Galera Cluster) and click Confirm.\
Enter the credentials for the Local Agent User ('monitor'@'localhost') to generate a setup command.\
Copy the command and run it on that server's terminal to link the agent.
If this is your first time and no databases are present, you'll be on the "Add Database" screen to begin with.
If you already have other databases, click the + Add Database button.
Select the Database with MaxScale option.
Provide the connection details for your MaxScale instance (IP address, API port 8989, and its admin credentials).
Click Add. Enterprise Manager will connect to MaxScale and automatically discover all backend MariaDB servers it manages.
The UI will generate a unique setup command for that specific server with the username and password you provide. Copy the command.\
On that specific server, paste and run the command in the terminal.
Repeat this process for every server in the topology. Once all agents are linked, the dashboard will begin showing the health of the entire topology.
Preserves document structure and metadata
Manages vector indexes and optimizations
Supports metadata-based filtering
Supports streaming output for real-time display
Provides status monitoring and reporting
Provides comprehensive error handling and logging
Retrieved chunks are ranked by relevance
Top chunks are used as context for generation
LLM generates a response based on the context
Text is chunked and embedded
Embeddings are stored with source metadata
Upon successful connection, the main Query Editor worksheet will appear, ready for you to begin.\
The Query Editor Workspace is organized around a flexible, multi-tabbed interface designed for parallel work. At the top level, Worksheet tabs represent your connections to different database servers. Within each worksheet, you can open multiple Query Tabs, allowing you to write and execute several independent SQL statements without losing your context.
These features are designed to make writing and managing SQL code efficient and intuitive.
Write, run, and debug SQL statements. The editor supports executing queries in parallel across multiple Query Tabs, allowing you to work on different tasks or connect to different servers simultaneously within isolated sessions.
Speed up query authoring and minimize syntax errors with context-sensitive suggestions. As you type, the editor offers relevant SQL keywords, functions, and objects (like tables and columns) from the currently selected database schema.
Improve readability and maintain consistent coding standards by automatically formatting your SQL code. Access this feature via the editor's context menu or command palette (F1).
Enhance code clarity with color syntax highlighting. Different parts of your SQL statements (keywords, strings, comments) are displayed in distinct colors, making queries easier to scan and debug.
Save frequently used SQL code blocks for quick reuse across sessions. Press CTRL+D (or CMD+D on Mac) to save the current content of the editor as a snippet.
Keep track of every query executed within the Workspace. The History tab provides a running log, allowing you to quickly find, review, and re-execute previous commands.
Define and manage connections to various database servers (e.g., development, testing, production). Each connection opens in its own top-level Worksheet tab, within which you can open multiple Query Tabs.
Load existing SQL scripts from your local machine into the editor, make changes, and save them back without leaving the workspace.
These features help you interact with and understand the results of your queries.
Easily share or archive query results. You can export data grids directly into common formats like CSV, JSON, or as SQL INSERT statements.
When executing a script with multiple SELECT statements, view each result set in its own dedicated grid within the Results panel for easy comparison.
Improve readability for tables with many columns by displaying results in a vertical, record-by-record format.
Control the number of rows returned by SELECT statements (default: 10,000). This safety feature keeps queries responsive and can be adjusted per role.
Gain quick insights from your data by visualizing query results directly within the Workspace as simple line, bar, or scatter charts.
Interact directly with the data displayed in the Results grid. Perform actions like searching for specific values, filtering rows, grouping data, and customizing column visibility without writing additional SQL.


In the example above, a user named bob identified by the password available in the bob-password Secret will be created in the mariadb instance.
Refer to the API reference for more detailed information about every field.
By default, the CR name is used to create the user in the database, but you can specify a different one providing the name field under spec:
By creating this resource, you are declaring an intent to grant permissions to a given user in the referred MariaDB instance, just like a statement would do.
You may provide any set of .
Refer to the API reference for more detailed information about every field.
By creating this resource, you are declaring an intent to create a logical database in the referred MariaDB instance, just like a statement would do:
Refer to the API reference for more detailed information about every field.
By default, the CR name is used to create the user in the database, but you can specify a different one providing the name field under spec:
If you only need one user to interact with a single logical database, you can use of the MariaDB resource to configure it, instead of creating the User, Grant and Database resources separately:
Behind the scenes, the operator will be creating an User resource with ALL PRIVILEGES in the initial Database.
This feature requires the skip-strict-password-validation option to be set. See: .
Passwords can be supplied using the passwordSecretKeyRef field in the User CR. This is a reference to a Secret that contains a password in plain text.
Alternatively, you can use to avoid passing passwords in plain text and provide the password in a hashed format instead. This doesn't affect the end user experience, as they will still need to provide the password in plain text to authenticate.
Provide the password hashed using the function:
The password hash can be obtained by executing SELECT PASSWORD('<password>'); in an existing MariaDB installation.
Provide the password hashed using any of the available , for example mysql_native_password:
The plugin name should be available in a Secret referenced by pluginNameSecretKeyRef and the argument passed to it in pluginArgSecretKeyRef. The argument is the hashed password in most cases, refer to the for further detail.
As we previously mentioned, SQL resources are periodically reconciled by the operator into SQL statements. You are able to configure the reconciliation interval using the following fields:
If the SQL statement executed by the operator is successful, it will schedule the next reconciliation cycle using the requeueInterval. If the statement encounters an error, the operator will use the retryInterval instead.
Whenever you delete a SQL resource, the operator will also delete the associated resource in the database. This is the default behaviour, that can also be achieved by setting cleanupPolicy=Delete:
You can opt-out from this cleanup process using cleanupPolicy=Skip. Note that this resources will remain in the database.
--maxscale-user
The MaxScale API user for scraping MaxScale metrics.
--maxscale-password
The password for the MaxScale user.
--otlp-insecure
Disables TLS certificate validation (use for testing or with self-signed certs).
--otlp-interval
The interval at which the agent should push metrics (e.g., 60s).
Standard Database Operations
create_database
Creates a new database if it does not already exist.
Standard Database Operations
create_vector_store
Creates a new table optimized as a vector store.
Vector & AI Functionality
list_vector_stores
Lists all tables identified as vector stores.
Vector & AI Functionality
delete_vector_store
Securely removes a vector store table.
Vector & AI Functionality
insert_docs_vector_store
Inserts documents and metadata into a vector store.
Vector & AI Functionality
search_vector_store
Performs a semantic similarity search on a vector store.
Vector & AI Functionality
rag_ingestion
Triggers the full document ingestion pipeline.
Workflow Orchestration
rag_generation
Synthesizes retrieved information with the user's query to generate a final, context-aware response.
Workflow Orchestration





This dashboard provides a unified view of a database topology. It combines topology information, system health, replication or cluster metrics, and query performance in one place. Administrators can use it to monitor availability, troubleshoot issues, and optimize performance.
Summarizes the overall topology, showing which servers are active, their versions, and how they are organized.
Name — Displays the name of the MariaDB topology currently being monitored.
Project — Shows the associated project or environment label.
Primary/Replica — A table with:
Instance: Server hostname.
Type: Instance role.
Seconds behind primary: Replication delay value.
Topology Info — Count of nodes grouped by type (e.g., server, MaxScale).
MariaDB Server Uptime by Instance — Uptime in seconds for each server instance.
Monitors server resource usage to detect bottlenecks in CPU, memory, network, and storage.
Provides insight into replication and cluster-related activity, including binary log usage, commit rates, and delay measurements.
Replication Status Table
This table provides a consolidated view of the health status of replication across instances.
Focuses on query execution and workload behavior, highlighting concurrency, throughput, and inefficiencies.
This section provides visibility into how clients connect to the server and whether connection limits or failures are occurring.
Highlights query access patterns where range operations or scans are used.
Shows activity within the InnoDB storage engine.
Shows information about active sessions and thread states collected from information_schema.processlist.
Processlist Count — Table view showing:
Instance: Database node.
Client: Client host connected.
Value: Number of processes/threads from that client.
This section provides guidance on how to configure high availability in MariaDB and MaxScale instances. If you are looking for an HA setup for the operator, please refer to the Helm documentation.
Our recommended setup for production is:
Use a highly available topology for MariaDB:
Asynchronous replication with a primary node and at least 2 replicas.
Synchronous multi-master with at least 3 nodes. Always an odd number of nodes, as it is quorum-based.
Leverage as database proxy to load balance requests and perform failover/switchover operations. Configure 2 replicas to enable MaxScale upgrades without downtime.
Use to avoid noisy neighbours.
Define .
: The primary node allows both reads and writes, while secondary nodes only serve reads. The primary has a binary log and the replicas asynchronously replicate the binary log events.
: All nodes support reads and writes, but writes are only sent to one node to avoid contention. The fact that is synchronous and that all nodes are equally configured makes the primary failover/switchover operation seamless and usually instantaneous.
In order to address nodes, MariaDB Enterprise Kubernetes Operator provides you with the following Kubernetes Services:
<mariadb-name>: This is the default Service, only intended for the .
<mariadb-name>-primary: To be used for write requests. It will point to the primary node.
<mariadb-name>-secondary: To be used for read requests. It will load balance requests to all nodes except the primary.
Whenever the primary changes, either by the user or by the operator, both the <mariadb-name>-primary and <mariadb-name>-secondary Services will be automatically updated by the operator to address the right nodes.
The primary may be manually changed by the user at any point by updating the spec.[replication|galera].primary.podIndex field. Alternatively, automatic primary failover can be enabled by setting spec.[replication|galera].primary.autoFailover, which will make the operator to switch primary whenever the primary Pod goes down.
While Kubernetes Services can be used for addressing primary and secondary instances, we recommend utilizing as database proxy for doing so, as it comes with additional advantages:
Enhanced failover/switchover operations for both replication and Galera
Single entrypoint for both reads and writes
Multiple router modules available to define how to route requests
Replay pending transaction when primary goes down
The full lifecyle of the MaxScale proxy is covered by this operator. Please refer to for further detail.
Bear in mind that, when enabling this, you need to have at least as many Nodes available as the replicas specified. Otherwise your Pods will be unscheduled and the cluster won't bootstrap.
To achieve real high availability, we need to run each MariaDB Pod in different Kubernetes Nodes. This practice, known as anti-affinity, helps reducing the blast radius of Nodes being unavailable.
By default, anti-affinity is disabled, which means that multiple Pods may be scheduled in the same Node, something not desired in HA scenarios.
You can selectively enable anti-affinity in all the different Pods managed by the MariaDB resource:
Anti-affinity may also be enabled in the resources that have a reference to MariaDB, resulting in their Pods being scheduled in Nodes where MariaDB is not running. For instance, the Backup and Restore processes can run in different Nodes:
In the case of MaxScale, the Pods will also be placed in Nodes isolated in terms of compute, ensuring isolation not only among themselves but also from the MariaDB Pods. For example, if you run a MariaDB and MaxScale with 3 replicas each, you will need 6 Nodes in total:
Default anti-affinity rules generated by the operator might not satisfy your needs, but you can always define your own rules. For example, if you want the MaxScale Pods to be in different Nodes, but you want them to share Nodes with MariaDB:
If you want to avoid noisy neighbours running in the same Kubernetes Nodes as your MariaDB, you may consider using dedicated Nodes. For achieving this, you will need:
Taint your Nodes and add the counterpart toleration in your Pods.
Select the Nodes where Pods will be scheduled in via a nodeSelector.
Add podAntiAffinity to your Pods as described in the section.
The previous steps can be achieved by setting these fields in the MariaDB resource:
By defining a PodDisruptionBudget, you are telling Kubernetes how many Pods your database tolerates to be down. This quite important for planned maintenance operations such as Node upgrades.
MariaDB Enterprise Kubernetes Operator creates a default PodDisruptionBudget if you are running in HA, but you are able to define your own by setting:
This documentation aims to provide guidance on various configuration aspects shared across many MariaDB Enterprise Kubernetes Operator CRs.
An inline can be provisioned in the MariaDB resource via the myCnf field:
In this field, you may provide any or supported by MariaDB.
Under the hood, the operator automatically creates a ConfigMap with the contents of the myCnf field, which will be mounted in the MariaDB instance. Alternatively, you can manage your own configuration using a pre-existing ConfigMap by linking it via myCnfConfigMapKeyRef. It is important to note that the key in this ConfigMap i.e. the config file name, must have a .cnf extension in order to be detected by MariaDB:
To ensure your configuration changes take effect, the operator triggers a MariaDB update whenever the myCnf field or the ConfigMap is updated. For the operator to detect changes in a ConfigMap, it must be labeled with enterprise.mariadb.com/watch. Refer to the section for further detail.
CPU and memory resouces can be configured via the resources field in both the MariaDB and MaxScale CRs:
In the case of MariaDB, it is recommended to set the innodb_buffer_pool_size system variable to a value that is 70-80% of the available memory. This can be done via the :
By default, MariaDB does not load timezone data on startup for performance reasons and defaults the timezone to SYSTEM, obtaining the timezone information from the environment where it runs. See the for further information.
You can explicitly configure a timezone in your MariaDB instance by setting the timeZone field:
This setting is immutable and implies loading the timezone data on startup.
In regards to Backup and SqlJob resources, which get reconciled into CronJobs, you can also define a timeZone associated with their cron expression:
If timeZone is not provided, the local timezone will be used, as described in the .
Some CRs require passwords provided as Secret references to function properly. For instance, the root password for a MariaDB resource:
By default, fields like rootPasswordSecretKeyRef are optional and defaulted by the operator, resulting in random password generation if not provided:
You may choose to explicitly provide a Secret reference via rootPasswordSecretKeyRef and opt-out from random password generation by either not providing the generate field or setting it to false:
This way, we are telling the operator that we are expecting a Secret to be available eventually, enabling the use of GitOps tools to seed the password:
: The Secret is reconciled from a SealedSecret, which is decrypted by the sealed-secrets controller.
: The Secret is reconciled fom an ExternalSecret, which is read by the external-secrets controller from an external secrets source (Vault, AWS Secrets Manager ...).
Many CRs have a references to external resources (i.e. ConfigMap, Secret) not managed by the operator.
These external resources should be labeled with enterprise.mariadb.com/watch so the operator can watch them and perform reconciliations based on their changes. For example, see the my.cnf ConfigMap:
Kubernetes probes serve as an inversion of control mechanism, enabling the application to communicate its health status to Kubernetes. This enables Kubernetes to take appropriate actions when the application is unhealthy, such as restarting or stop sending traffic to Pods.
Fine tunning of probes for databases running in Kubernetes is critical, you may do so by tweaking the following fields:
There isn't an universally correct default value for these thresholds, so we recommend determining your own based on factors like the compute resources, network, storage, and other aspects of the environment where your MariaDB and MaxScale instances are running.
CREATE USER 'monitor'@'<Enterprise_Manager_IP>' IDENTIFIED BY '<password>';
GRANT REPLICA MONITOR ON *.* TO 'monitor'@'<Enterprise_Manager_IP>';CREATE USER 'monitor'@'localhost' IDENTIFIED BY '<password>';
GRANT PROCESS, BINLOG MONITOR, REPLICA MONITOR, REPLICATION MASTER ADMIN ON *.* TO 'monitor'@'localhost';CREATE USER 'monitor'@'localhost' IDENTIFIED BY '<password>';
GRANT PROCESS, BINLOG MONITOR, REPLICA MONITOR, REPLICATION MASTER ADMIN ON *.* TO 'monitor'@'localhost';apiVersion: enterprise.mariadb.com/v1alpha1
kind: User
metadata:
name: bob
spec:
mariaDbRef:
name: mariadb
passwordSecretKeyRef:
name: bob-password
key: password
maxUserConnections: 20
host: "%"
cleanupPolicy: DeleteapiVersion: enterprise.mariadb.com/v1alpha1
kind: User
metadata:
name: user
spec:
name: user-customapiVersion: enterprise.mariadb.com/v1alpha1
kind: Grant
metadata:
name: grant-bob
spec:
mariaDbRef:
name: mariadb
privileges:
- "SELECT"
- "INSERT"
- "UPDATE"
database: "*"
table: "*"
username: bob
grantOption: true
host: "%"apiVersion: enterprise.mariadb.com/v1alpha1
kind: Database
metadata:
name: wordpress
spec:
mariaDbRef:
name: mariadb
characterSet: utf8
collate: utf8_general_ciapiVersion: enterprise.mariadb.com/v1alpha1
kind: Database
metadata:
name: database
spec:
name: database-customapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb
spec:
username: bob
passwordSecretKeyRef:
name: bob-password
key: password
database: wordpressapiVersion: v1
kind: Secret
metadata:
name: mariadb-auth
stringData:
passwordHash: "*57685B4F0FF9D049082E296E2C39354B7A98774E"
---
apiVersion: enterprise.mariadb.com/v1alpha1
kind: User
metadata:
name: user-password-hash
spec:
mariaDbRef:
name: mariadb
passwordHashSecretKeyRef:
name: mariadb-auth
key: passwordHash
host: "%"apiVersion: v1
kind: Secret
metadata:
name: mariadb-auth
stringData:
passwordHash: "*57685B4F0FF9D049082E296E2C39354B7A98774E"
nativePasswordPlugin: mysql_native_password
---
apiVersion: enterprise.mariadb.com/v1alpha1
kind: User
metadata:
name: user-password-plugin
spec:
mariaDbRef:
name: mariadb
passwordPlugin:
pluginNameSecretKeyRef:
name: mariadb-auth
key: nativePasswordPlugin
pluginArgSecretKeyRef:
name: mariadb-auth
key: passwordHash
host: "%"apiVersion: enterprise.mariadb.com/v1alpha1
kind: User
metadata:
name: user
spec:
requeueInterval: 30s
retryInterval: 5sapiVersion: enterprise.mariadb.com/v1alpha1
kind: User
metadata:
name: user
spec:
cleanupPolicy: DeleteapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb
spec:
...
myCnf: |
[mariadb]
bind-address=*
default_storage_engine=InnoDB
binlog_format=row
innodb_autoinc_lock_mode=2
innodb_buffer_pool_size=1024M
max_allowed_packet=256MNULL replaced by
How NULL values should be represented (e.g., \N).
With Headers
Checkbox to include column names as the first row.
SQL Options
Export option
Choose whether to export Both structure and data, Data only (INSERT statements), or Structure only (CREATE TABLE).
JSON Options
None
File name
The name for the downloaded export file. A default name with the current date is usually suggested.
Fields to export
Allows you to select which columns from the query result set to include in the export.
File format
Choose the output format: CSV, SQL, or JSON.
CSV Options
Fields terminated by
The character used to separate values (e.g., , or \t).
Lines terminated by
The character indicating the end of a row (e.g., \n).









Last_SQL_Errno
Most recent numeric error code reported by the SQL thread.
Read_Master_Log_Pos
Current read position in the source’s binary log.
Relay_Log_Pos
Last executed position in the local relay log.
Deadlocks
Number of detected deadlocks, where transactions block each other and require one to be rolled back.
CPU Utilisation
Line graph of CPU usage percentage per instance.
Memory Usage
Percentage of used memory per instance (excluding cache/buffers).
Network Traffic
Time-series of receive and transmit throughput per instance (bits per second).
Filesystems Info
Table with filesystem type, mount point, capacity, and instance.
Disk Used Space Utilisation
Graph of percentage disk space used per mount point.
Disk IOPS
Reads and writes per second per storage device.
Binlog Size
Current binary log size per instance.
Binlog Throughput
Bytes written to binary logs per second.
Binlog Commits
Rate of commit operations recorded in binary logs.
Replication Lag
Replication delay value reported in seconds.
Slave_connections
Number of replication I/O connections to the upstream source.
Retried_transactions
Total replicated transactions retried due to transient errors.
Slave_IO_Running
Status flag indicating if the I/O thread is fetching events.
Slave_SQL_Running
Status flag indicating if the SQL thread is applying events.
Last_Errno
Most recent numeric error code for replication issues overall.
Last_IO_Errno
Most recent numeric error code reported by the I/O thread.
Current Threads Running
Number of threads actively executing queries.
Questions (QPS)
Queries per second executed on each instance.
Slow Queries
Rate of queries exceeding long_query_time.
Created Tmp Disk Tables
On-disk temporary tables created per second.
Number of Connections
Current number of active client connections (Threads_connected).
Connection Utilization
Share of connections in use compared to the configured maximum (Threads_connected / max_connections).
% of Aborted Connections
Percentage of connection attempts that failed or were aborted (aborted_connects / connections).
Select Range Scan
Number of SELECT operations performing range scans.
Select Full Range Join
Number of queries that performed a full range join. Indicates potential suboptimal indexing or join conditions.
Select Range Check
Number of SELECT operations requiring range checks.
InnoDB Read/Writes
Rate of physical read and write operations by InnoDB per second. Reads are disk fetches, writes are disk flushes.
InnoDB Buffer Pool Reads
Logical reads from the buffer pool vs. evicted or read-ahead pages, indicating buffer pool efficiency.
InnoDB Row Lock
Number of row lock waits in InnoDB, with high values indicating contention or poor indexing.
InnoDB Checkpoint Age
Size of uncheckpointed redo log data in bytes, with large sizes signaling risk of long crash recovery times.
InnoDB Log Writes
Number of write operations to the InnoDB redo log per second, reflecting redo logging activity.
InnoDB History List Length
Length of the undo log history list, with growth indicating long-running transactions preventing purge.







Ability to choose whether the old primary rejoins as a replica
Connection pooling
Transparent Data Encryption (TDE) can be configured in MariaDB leveraging the Hashicorp Key Management Plugin.
Running and accessible Vault KMS setup with a valid SSL certificate.
Vault is unsealed and you've logged in to it with vault login $AUTH_TOKEN, where $AUTH_TOKEN is an authentication token given to you by an administrator
openssl for generating secrets
Creating A New Key-Value Store In Vault. Create a new key-value store and take note of the path. In our example we will use mariadb.
Adding necessary secrets. We will put 2 secrets with ids 1 and 2. 2 will be used for temporary files, while 1 will be used for everything else. It is not neccessary to create 2 of them and in that case, temporary files will use 1.
Note: Here you should use the path we chose in the previous step.
(Optional) Create An Authentication Token With Policy. This step can be skipped if you want to use your own token. Consult with a Vault administrator regarding this. Policies are Vault's way to restrict access to what you are allowed to do. The following is a policy that should be used by the token following the least permission principle.
After which, we can create a new token with the given policy.
You will see output similar to:
Your new token is: EXAMPLE_TOKEN.
Create A Secret For the vault token. Now that you've either created a new token, or are using an existing one, we need to create a secret with it.
Create a Secret for the Certificate Authority (CA) used to issue the Vault certificate. For further information, consult If you have the certificate locally in a file called ca.crt you can run:
Create A MariaDB Custom Resource. The final step is creating a new MariaDB instance.
mariadb-vault.yaml
kubectl apply -f mariadb-vault.yaml
Verify Encryption Works.
You should see something along the lines of:
At this point, you can check the encryption status:
If you create a new database and then table, the above query should return additional information about them. Something like:
Note: The above query is truncated. In reality, you will see a few more columns.
Put A New Secret In Vault. After logging in to vault, you can run again:
This will start re-encrypting data.
Monitor Re-Encryption.
If you check the encrpytion status again:
You should see CURRENT_KEY_VERSION column start getting updated to point to the new key version.
Make sure when rotating the token, to do so in advance of the token expiring.
Acquire a new token and update the secret.
Restart MariaDB Pods. MariaDB will continue using the old token until the Pods are restarted. You can add the following annotation to the Pods in order to trigger an update, see the updates documentation for further detail:
As MariaDB uses Vault to fetch it's decryption key, in case that Vault becomes unavailable, it will result in MariaDB not being able to fetch the decryption key and hence stop working. While the Hashicorp plugin has a configurable cache, that should be set and will result in MariaDB still working for a few seconds to minutes, depending on configuration, the cache is not reliable as it's ephemeral and short lived.
It is recommended to back up the decryption key so accidental deletions will not result in issues.
Use the following to generate correct decryption keys.
To check the re-encryption progress, you can run:
Look for the CURRENT_KEY_VERSION and make sure they are in sync with the latest version you have in Vault.









apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
bootstrapFrom:
restoreJob:
affinity:
antiAffinityEnabled: true
...
metrics:
exporter:
affinity:
antiAffinityEnabled: true
...
affinity:
antiAffinityEnabled: trueapiVersion: enterprise.mariadb.com/v1alpha1
kind: Backup
metadata:
name: backup
spec:
mariaDbRef:
name: mariadb-galera
...
affinity:
antiAffinityEnabled: trueapiVersion: enterprise.mariadb.com/v1alpha1
kind: Restore
metadata:
name: restore
spec:
mariaDbRef:
name: mariadb-galera
...
affinity:
antiAffinityEnabled: trueapiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale-galera
spec:
mariaDbRef:
name: mariadb-galera
...
metrics:
exporter:
affinity:
antiAffinityEnabled: true
...
affinity:
antiAffinityEnabled: trueapiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale-galera
spec:
mariaDbRef:
name: mariadb-galera
...
affinity:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchExpressions:
- key: app.kubernetes.io/instance
operator: In
values:
- maxscale-galera
# 'mariadb-galera' instance omitted (default anti-affinity rule)
topologyKey: kubernetes.io/hostnameapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
...
tolerations:
- key: "enterprise.mariadb.com/ha"
operator: "Exists"
effect: "NoSchedule"
nodeSelector:
"enterprise.mariadb.com/node": "ha"
affinity:
antiAffinityEnabled: trueapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
...
podDisruptionBudget:
maxUnavailable: 33%vault secrets enable -path /mariadb -version=2 kvvault kv put /mariadb/1 data="$(openssl rand -hex 32)"
vault kv put /mariadb/2 data="$(openssl rand -hex 32)"kubectl run mariadb-connect --rm -it --image=mariadb:11.4 -- bash -c "mariadb -u root -p'MariaDB11!' --ssl=false -h mariadb"SELECT * from information_schema.INNODB_TABLESPACES_ENCRYPTION;MariaDB [my_db]> SELECT * from information_schema.INNODB_TABLESPACES_ENCRYPTION;
+-----------------+-------------------+-----------------+---------------------+----------------+----------------------+
| NAME | ENCRYPTION_SCHEME | MIN_KEY_VERSION | CURRENT_KEY_VERSION | CURRENT_KEY_ID | ROTATING_OR_FLUSHING |
+-----------------+-------------------+-----------------+---------------------+----------------+----------------------+
| innodb_system | 1 | 1 | 2 | 1 | 0 |
| innodb_undo001 | 1 | 1 | 2 | 1 | 0 |
| innodb_undo002 | 1 | 1 | 2 | 1 | 0 |
| innodb_undo003 | 1 | 1 | 2 | 1 | 0 |
| mysql/innodb_ta | 1 | 1 | 2 | 1 | 0 |
| mysql/innodb_in | 1 | 1 | 2 | 1 | 0 |
| mysql/gtid_slav | 1 | 1 | 2 | 1 | 0 |
| mysql/transacti | 1 | 1 | 2 | 1 | 0 |
| my_db/people | 1 | 1 | 2 | 1 | 0 |
+-----------------+-------------------+-----------------+---------------------+----------------+----------------------+export TOKEN="EXAMPLE_TOKEN"
kubeclt create secret generic mariadb-vault-token --from-literal=token="$TOKEN"apiVersion: k8s.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb
spec:
...
podMetadata:
annotations:
enterprise.mariadb.com/restarted-at: "2025-09-19T12:54:10Z"openssl rand -hex 32SELECT * from information_schema.INNODB_TABLESPACES_ENCRYPTION;apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb
spec:
...
myCnfConfigMapKeyRef:
name: mariadb
key: mycnfapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb
spec:
...
resources:
requests:
cpu: 1
memory: 4Gi
limits:
memory: 4GiapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb
spec:
...
myCnf: |
[mariadb]
innodb_buffer_pool_size=3200MapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
timeZone: "UTC"apiVersion: enterprise.mariadb.com/v1alpha1
kind: Backup
metadata:
name: backup-scheduled
spec:
mariaDbRef:
name: mariadb
schedule:
cron: "*/1 * * * *"
suspend: false
timeZone: "UTC"apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
rootPasswordSecretKeyRef:
name: mariadb
key: root-passwordapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
rootPasswordSecretKeyRef:
name: mariadb
key: root-password
generate: trueapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
rootPasswordSecretKeyRef:
name: mariadb
key: root-password
generate: falseapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb
spec:
...
myCnfConfigMapKeyRef:
name: mariadb
key: mycnfapiVersion: v1
kind: ConfigMap
metadata:
name: mariadb
labels:
enterprise.mariadb.com/watch: ""
data:
mycnf: |
[mariadb]
bind-address=*
default_storage_engine=InnoDB
binlog_format=row
innodb_autoinc_lock_mode=2
innodb_buffer_pool_size=1024M
max_allowed_packet=256MapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
# Tune your liveness probe accordingly to avoid Pod restarts.
livenessProbe:
periodSeconds: 10
timeoutSeconds: 5
# Tune your readiness probe accordingly to prevent disruptions in network traffic.
readinessProbe:
periodSeconds: 10
timeoutSeconds: 5
# Tune your startup probe accordingly to ensure that the SST completes with a large amount of data.
# failureThreshold × periodSeconds = 30 × 10 = 300s = 5m until the container gets restarted if unhealthy
startupProbe:
failureThreshold: 30
periodSeconds: 10
timeoutSeconds: 5vault kv put /mariadb/1 data="$(openssl rand -hex 32)"
vault kv put /mariadb/2 data="$(openssl rand -hex 32)"cat <<'EOF' | vault policy write -non-interactive mariadb -
# Allow access to MariaDB secrets
path "mariadb/*" {
capabilities = ["create", "read", "update", "delete", "list"]
}
# Allow reading the mount configuration
path "sys/mounts/mariadb/tune" {
capabilities = ["read"]
}
EOFvault token create -policy mariadbKey Value
--- -----
token EXAMPLE_TOKEN
token_accessor utFtmh98YAAJyYdxEVN3SFQA
token_duration 768h
token_renewable true
token_policies ["default" "mariadb"]
identity_policies []
policies ["default" "mariadb"]export TOKEN="EXAMPLE_TOKEN"
kubeclt create secret generic mariadb-vault-token --from-literal=token="$TOKEN"kubectl create secret generic vault-tls --from-file=./ca.crt---
apiVersion: v1
kind: Secret
metadata:
name: mariadb # Used to hold the mariadb and root user passwords
labels:
enterprise.mariadb.com/watch: ""
stringData:
password: MariaDB11!
root-password: MariaDB11!
---
apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb
spec:
image: docker.mariadb.com/enterprise-server:11.4.7-4.3
rootPasswordSecretKeyRef:
name: mariadb
key: password
username: mariadb
passwordSecretKeyRef:
name: mariadb-password
key: password
generate: true
database: mariadb
port: 3306
storage:
size: 1Gi
# storageClassName: csi-hostpath-sc
myCnf: |
[mariadb]
bind-address=*
default_storage_engine=InnoDB
binlog_format=row
innodb_autoinc_lock_mode=2
innodb_buffer_pool_size=800M
max_allowed_packet=256M
plugin_load_add = hashicorp_key_management
hashicorp-key-management-vault-url=https://vault-0.vault-internal.default.svc.cluster.local:8200/v1/mariadb
hashicorp-key-management-caching-enabled=ON
hashicorp-key-management-vault-ca=/etc/vault/certs/ca.crt
innodb_encrypt_tables = FORCE
innodb_encrypt_log = ON
innodb_encrypt_temporary_tables = ON
encrypt_tmp_disk_tables = ON
encrypt_tmp_files = ON
encrypt_binlog = ON
aria_encrypt_tables = ON
innodb_encryption_threads = 4
innodb_encryption_rotation_iops = 2000
env:
- name: VAULT_TOKEN # This is where our token is defined!
valueFrom:
secretKeyRef:
name: mariadb-vault-token
key: token
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
memory: 1Gi
metrics:
enabled: true
volumes:
- name: vault-certificates
secret:
secretName: vault-tls
defaultMode: 0600
volumeMounts:
- name: vault-certificates
mountPath: /etc/vault/certs/kubectl run mariadb-connect --rm -it --image=mariadb:11.4 -- bash -c "mariadb -u root -p'MariaDB11!' --ssl=false -h mariadb"If you don't see a command prompt, try pressing enter.
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 95
Server version: 11.4.7-4-MariaDB-enterprise MariaDB Enterprise Server
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]>SELECT * from information_schema.INNODB_TABLESPACES_ENCRYPTION;MariaDB [my_db]> SELECT * from information_schema.INNODB_TABLESPACES_ENCRYPTION;
+-----------------+-------------------+-----------------+---------------------+----------------+----------------------+
| NAME | ENCRYPTION_SCHEME | MIN_KEY_VERSION | CURRENT_KEY_VERSION | CURRENT_KEY_ID | ROTATING_OR_FLUSHING |
+-----------------+-------------------+-----------------+---------------------+----------------+----------------------+
| innodb_system | 1 | 1 | 1 | 1 | 0 |
| innodb_undo001 | 1 | 1 | 1 | 1 | 0 |
| innodb_undo002 | 1 | 1 | 1 | 1 | 0 |
| innodb_undo003 | 1 | 1 | 1 | 1 | 0 |
| mysql/innodb_ta | 1 | 1 | 1 | 1 | 0 |
| mysql/innodb_in | 1 | 1 | 1 | 1 | 0 |
| mysql/gtid_slav | 1 | 1 | 1 | 1 | 0 |
| mysql/transacti | 1 | 1 | 1 | 1 | 0 |
| my_db/people | 1 | 1 | 1 | 1 | 0 |
+-----------------+-------------------+-----------------+---------------------+----------------+----------------------+Security and compliance: Regular CVE scanning and vulnerability patching help maintain compliance with industry standards and security best practices.
Enterprise-grade support: UBI images are maintained and supported by Red Hat, ensuring timely security updates and long-term stability.
MariaDB Enterprise Kubernetes Operator is compatible with the following Docker images:
MariaDB Enterprise Kubernetes Operator (ppc64le support)
docker.mariadb.com/mariadb-enterprise-operator
25.10.2 25.10.1 25.10.0 25.8.0
amd64 arm64 ppc64le
MariaDB Enterprise Kubernetes Operator
docker.mariadb.com/mariadb-enterprise-operator
1.0.0
amd64 arm64
MariaDB Enterprise Server (ppc64le support)
docker.mariadb.com/enterprise-server
11.8.3-1 11.4.8-5 11.4.7-4.3 11.4.7-4.2 11.4.7-4.1 11.4 10.6.23-19 10.6.22-18.1 10.6
Refer to the registry documentation to access docker.mariadb.com with your customer credentials.
This section outlines several methods for pulling official MariaDB container images from docker.mariadb.com and making them available in your private container registry. This is often necessary for air-gapped, offline, or secure environments.
This method is ideal for a "bastion" or "jump" host that has network access to both the public internet (specifically docker.mariadb.com) and your internal private registry.
Log in to both registries. You will need a MariaDB token for the public registry and your credentials for the private one. Refer to the official documentation.
Pull the required image. Pull the official MariaDB Enterprise Kubernetes Operator image from its public registry.
Tag the image for your private registry. Create a new tag for the image that points to your private registry's URL and desired repository path.
Push the re-tagged image. Push the newly tagged image to your private registry.
Many modern container registries can be configured to function as a pull-through cache or proxy for public registries. When an internal client requests an image, your registry pulls it from the public source, stores a local copy, and then serves it. This automates the process after initial setup.
You can use Harbor as a pull-through cache (Harbor calls this Replication Rules).
This method is designed for fully air-gapped environments where no single machine has simultaneous access to the internet and the private registry.
Log in and pull the image.
Save the image to a tar archive. This command packages the image into a single, portable file.
Use a tool like scp or sftp or a USB drive to copy the generated .tar archives from the internet-connected machine to your isolated systems.
Load the image from the archive.
Log in to your private registry.
Tag the loaded image. The image loaded from the tar file will retain its original tag. You must re-tag it for your private registry.
Push the image to your private registry.
Refer to the official Red Hat documentation
This method is for air-gapped environments that use containerd as the container runtime (common in Kubernetes) and do not have the Docker daemon. It uses the ctr command-line tool to import, tag, and push images. ⚙️
First, on a machine with internet access, you'll pull the images and export them to portable archive files.
Pull the Container Image Use the ctr image pull command to download the required image from its public registry.
Note: If your bastion host uses Docker, you can use
docker pullinstead as we did in Option 3.
Export the Image to an Archive Next, export the pulled image to a .tar file using ctr image export. The format is ctr image export <output-filename> <image-name>.
Note: To find the exact image name as
containerdsees it, runctr image ls. The Docker equivalent for this step isdocker save <image-name> -o <output-filename>.
Repeat this process for all the container images you need to transfer.
Use a tool like scp or sftp or a USB drive to copy the generated .tar archives from the bastion host to your isolated systems.
Finally, on the isolated system, you will import the archives into containerd. Official Docs
Importing for Kubernetes (Important!) ⚙️ If the images need to be available to Kubernetes, you must import them into the k8s.io namespace by adding the -n=k8s.io flag.
Verify the Image Check that containerd recognizes the newly imported image.
You can also verify that the Container Runtime Interface (CRI) sees it by running:
The examples above use the mariadb-enterprise-operator:25.8.0 image. You must repeat the chosen process for all required container images. A complete list is available here
# Log in to the official MariaDB registry
docker login docker.mariadb.com
# Log in to your private registry
docker login <private-registry-url>docker pull docker.mariadb.com/mariadb-enterprise-operator:25.8.0docker tag docker.mariadb.com/mariadb-enterprise-operator:25.8.0 <private-registry-url>/mariadb/mariadb-enterprise-operator:25.8.0docker login docker.mariadb.com
docker pull docker.mariadb.com/mariadb-enterprise-operator:25.8.0docker save [docker.mariadb.com/mariadb-enterprise-operator:25.8.0 -o mariadb-enterprise-operator_25.8.0.tardocker load -i mariadb-enterprise-operator_25.8.0.tardocker login <private-registry-url>docker tag docker.mariadb.com/mariadb-enterprise-operator:25.8.0 <private-registry-url>/mariadb/mariadb-enterprise-operator:25.8.0docker push <private-registry-url>/mariadb/mariadb-enterprise-operator:25.8.0ctr image pull docker.mariadb.com/mariadb-enterprise-operator:25.8.0ctr -n=k8s.io image import mariadb-enterprise-operator-25.8.0.tarctr image lscrictl imagesamd64 arm64 ppc64le
MariaDB Enterprise Server
docker.mariadb.com/enterprise-server
11.4.5-3 11.4.4-2 10.6.21-17 10.6.20-16.1 10.6.19-15.1 10.6.18-14.2 10.6.17-13.2
amd64 arm64
MaxScale Enterprise (ppc64le support)
docker.mariadb.com/maxscale
25.10.0 25.01.4 25.01.3-1 25.01
amd64 arm64 ppc64le
MaxScale Enterprise
docker.mariadb.com/maxscale-enterprise
25.01.2 25.01.1
amd64 arm64
MaxScale
mariadb/maxscale
23.08.9-ubi 23.08-ubi 24.02.5-ubi 24.02-ubi
amd64 arm64
MariaDB Prometheus Exporter (ppc64le support)
mariadb/mariadb-prometheus-exporter-ubi
1.1.0
amd64 arm64 ppc64le
MariaDB Prometheus Exporter
mariadb/mariadb-prometheus-exporter-ubi
1.0.0
amd64 arm64
MaxScale Prometheus Exporter (ppc64le support)
mariadb/maxscale-prometheus-exporter-ubi
1.1.0
amd64 arm64 ppc64le
MaxScale Prometheus Exporter
mariadb/maxscale-prometheus-exporter-ubi
1.0.0
amd64 arm64
MariaDB Enterprise nslcd sidecar
docker.mariadb.com/nslcd
0.9.10-13
amd64 arm64 ppc64le
The MariaDB pam plugin facilitates user authentication by interfacing with the Pluggable Authentication Modules (PAM) framework, enabling diverse and centralized authentication schemes.
Currently the enterprise operator utilizes this plugin to provide support for:
LDAP based authentication
This guide outlines the process of configuring MariaDB to authenticate users against an LDAP or Active Directory service. The integration is achieved by using MariaDB's Pluggable Authentication Module (PAM) plugin, which delegates authentication requests to the underlying Linux PAM framework.
To enable LDAP authentication for MariaDB through PAM, several components work in tandem:
PAM (Pluggable Authentication Modules): A framework used by Linux and other UNIX-like systems to consolidate authentication tasks. Applications like MariaDB can use PAM to authenticate users without needing to understand the underlying authentication mechanism. Operations such as system login, screen unlocking, and sudo access commonly use PAM.
nss-pam-ldapd: This is the software package that provides the necessary bridge between PAM and an LDAP server. It includes the core components required for authentication.
pam_ldap.so: A specific PAM module, provided by the nss-pam-ldapd package. This module is the "plug-in" that the PAM framework loads to handle authentication requests destined for an LDAP server.
nslcd is configured with 2 files. nslcd.conf which tells the daemon about the LDAP server and nsswitch.conf, determine the sources from which to obtain name-service information.
nslcd can be configured to run as a specific user based on the uid and gid props specified in the config file, however that user should have sufficient permissions to read/write to /var/run/nslcd, should own both nslcd.conf and nsswitch.conf and they should not be too open (0600).
Both of these configuration files will be attached later on in the example given.
The /etc/nslcd.conf is the configuration file for LDAP nameservice daemon.
In a production environment it is recommended to use LDAPS (LDAP secure), which uses traditional TLS encryption to secure data in transit. To do so, you need to add the following to your nslcd.conf file:
The Name Service Switch (NSS) configuration file, located at /etc/nsswitch.conf. It is used by the GNU C Library and certain other applications to determine the sources from which to obtain name-service information in a range of categories, and in what order. Each category of information is identified by a database name.
The pam plugin is not enabled by default (even though it is installed). To enable it, you should add the following lines to your MariaDB Custom Resource:
See below for a complete example.
Fistly, we need to create our ConfigMaps and Secrets, that will store the nsswitch.conf, nslcd.conf and the mariadb pam module.
mariadb-nss-config.yaml:
kubectl apply -f mariadb-nss-config.yaml
Now that our configuration is done, we need to create the MariaDB custom resource along with needed configurations.
mariadb.yaml:
kubectl apply -f mariadb.yaml
And in the end we need to create our user in the database, which must have the same name as a user in ldap server. In the example below that's ldap-user. We also create mariadb-ldap secret, which holds the name of the plugin we are using as well as the module we need to load.
mariadb-user.yaml:
kubectl apply -f mariadb-user.yaml
After a few seconds, the user should have been created by the operator. To verify that all is working as expected, modify the <password> field below and run:
You should see something along the lines of:
If you followed the instructions for setting up a basic MariaDB instance with ldap, you need to fetch the public certificate that your LDAP server is set up with and add it to a called mariadb-ldap-tls.
If you have the certificate locally in a file called tls.crt you can run:
Slow Start On KIND
This may be a problem with the maximum number of file-handles a process can allocate. Some systems have this value set to really high, which causes an issue. To remedy this, you need to delete your kind cluster and run:
At this point, the problem should be fixed.
For more information, check .
docker push <private-registry-url>/mariadb/mariadb-enterprise-operator:25.8.0ctr image export mariadb-enterprise-operator-25.8.0.tar docker.mariadb.com/mariadb-enterprise-operator:25.8.0nslcd (Name Service Lookup Daemon): This daemon acts as an intermediary service. The pam_ldap.so module does not communicate directly with the LDAP server. Instead, it forwards authentication requests to the nslcd daemon, which manages the connection and communication with the LDAP directory. This design allows for connection caching and a more robust separation of concerns.
One Package: ai-nexus.deb
What's Inside the Package:
RAG API application
MCP Server application
Both applications bundled together
This contains your RAG API and MCP Server applications.
The applications need a database to store documents and vector embeddings.
You need to choose HOW to provide secrets (API keys, passwords) to the applications.
What happens: Install the .deb package directly on Ubuntu
Steps:
Install MariaDB on Ubuntu
Install ai-nexus.deb on Ubuntu
Configure secrets (choose a mode)
Start services
Guide: UBUNTU_DEPLOYMENT_GUIDE.md
What happens: Package everything in Docker containers
Steps:
Build Docker image (wraps the .deb package)
Start containers with docker-compose
Configure secrets (choose a mode)
Guide: DOCKER_DEPLOYMENT_GUIDE.md
After you deploy the application (Ubuntu or Docker), you choose ONE mode:
How it works: Secrets stored in a plain text config file
Config File Location:
Ubuntu: /opt/rag-in-a-box/config/config.env.template
Docker: config.env.secure.local
Example:
How to generate secure keys:
When to use: Development, testing, single developer
How it works: Secrets stored in HashiCorp Vault (running locally)
Architecture:
Config File Location:
Ubuntu: /opt/rag-in-a-box/config/config.env.template
Docker: config.env.vault.local
Example:
When to use: Team development, production-like testing
How it works: Secrets stored in 1Password vault
Architecture:
Config File:
When to use: Enterprise with 1Password subscription
How it works: Secrets stored in HashiCorp Cloud Platform
Architecture:
When to use: Production cloud deployments
The ai-nexus.deb package is identical regardless of:
Where you deploy it (Ubuntu or Docker)
Which secret mode you use (Standalone, Vault, 1Password, HCP)
You can use ANY secret mode with ANY deployment location:
Ubuntu + Standalone ✅
Ubuntu + Vault ✅
Ubuntu + 1Password ✅
Docker + Standalone ✅
When RAG API and MCP Server start, they:
Read the config file
Check which mode is configured
Fetch secrets accordingly:
Standalone: Read from config file directly
→ Use: UBUNTU_DEPLOYMENT_GUIDE.md
Then choose secret mode:
Standalone: Edit /opt/rag-in-a-box/config/config.env.template with actual secrets
Vault: Install Vault, store secrets, configure Vault connection in config
1Password: Install 1Password CLI, configure 1Password references in config
→ Use: DOCKER_DEPLOYMENT_GUIDE.md
Then choose secret mode:
Standalone: Edit config.env.secure.local with actual secrets
Vault: Run Vault container, store secrets, use config.env.vault.local
1Password: Install 1Password CLI, use config.env.1password.employee
One Package (ai-nexus.deb) contains RAG API + MCP Server
Two Deployment Options:
Ubuntu Native (install .deb directly)
Docker (wrap .deb in container)
Four Secret Modes (choose one):
Standalone (secrets in config file)
Local Vault (secrets in local Vault)
1Password (secrets in 1Password)
HCP Vault (secrets in cloud Vault)
The application is the same - only the deployment location and secret source change.
Is this clearer now? The key insight is:
Same package everywhere
Choose where to deploy (Ubuntu or Docker)
Choose how to manage secrets (Standalone/Vault/1Password/HCP)
# /etc/nslcd.conf: Configuration file for nslcd(8)
# The user/group nslcd will run as. Note that these should not be LDAP users.
uid mysql # required to be `mysql`
gid mysql # required to be `mysql`
# The location of the LDAP server.
uri ldap://openldap-service.default.svc.cluster.local:389
# The search base that will be used for all queries.
base dc=openldap-service,dc=default,dc=svc,dc=cluster,dc=local
# The distinguished name with which to bind to the directory server for lookups.
# This is a service account used by the daemon.
binddn cn=admin,dc=openldap-service,dc=default,dc=svc,dc=cluster,dc=local
bindpw PASSWORD_REPLACE-ME# Change the protocol to `ldaps`
+uri ldaps://openldap-service.default.svc.cluster.local:636
-uri ldap://openldap-service.default.svc.cluster.local:389
# ...
+tls_reqcert demand # Look at: https://linux.die.net/man/5/ldap.conf then search for TLS_REQCERT
+tls_cacertfile /etc/openldap/certs/tls.crt # You will need to mount this certificate (from a secret) laterpasswd: files ldap
group: files ldap
shadow: files ldap # ....
myCnf: |
[mariadb]
plugin_load_add = auth_pam # Load auth plugin
# ....---
apiVersion: v1
kind: Secret
type: Opaque
metadata:
name: mariadb-nslcd-secret
stringData:
nslcd.conf: |
# /etc/nslcd.conf: Configuration file for nslcd(8)
# The user/group nslcd will run as. Note that these should not be LDAP users.
uid mysql # required to be `mysql`
gid mysql # required to be `mysql`
# The location of the LDAP server.
uri ldap://openldap-service.default.svc.cluster.local:389
# The search base that will be used for all queries.
base dc=openldap-service,dc=default,dc=svc,dc=cluster,dc=local
# The distinguished name with which to bind to the directory server for lookups.
# This is a service account used by the daemon.
binddn cn=admin,dc=openldap-service,dc=default,dc=svc,dc=cluster,dc=local
bindpw PASSWORD_REPLACE-ME
---
apiVersion: v1
kind: ConfigMap
metadata:
name: mariadb-nsswitch-configmap
labels:
enterprise.mariadb.com/watch: ""
data:
nsswitch.conf: |
passwd: files ldap
group: files ldap
shadow: files ldap
---
apiVersion: v1
kind: ConfigMap
metadata:
name: mariadb-pam-configmap
labels:
enterprise.mariadb.com/watch: ""
data:
mariadb: |
# This is needed to tell PAM to use pam_ldap.so
auth required pam_ldap.so
account required pam_ldap.so---
apiVersion: v1
kind: Secret
metadata:
name: mariadb # Used to hold the mariadb and root user passwords
labels:
enterprise.mariadb.com/watch: ""
stringData:
password: MariaDB11!
root-password: MariaDB11!
---
apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb
spec:
rootPasswordSecretKeyRef:
name: mariadb
key: root-password
username: mariadb
passwordSecretKeyRef:
name: mariadb
key: password
generate: true
database: mariadb
port: 3306
storage:
size: 1Gi
service:
type: LoadBalancer
metadata:
annotations:
metallb.universe.tf/loadBalancerIPs: 172.18.0.20
myCnf: |
[mariadb]
bind-address=*
default_storage_engine=InnoDB
binlog_format=row
innodb_autoinc_lock_mode=2
innodb_buffer_pool_size=800M
max_allowed_packet=256M
plugin_load_add = auth_pam # Load auth plugin
resources:
requests:
cpu: 1
memory: 128Mi
limits:
memory: 1Gi
metrics:
enabled: true
volumes: # Attach `nslcd.conf`, `nsswitch.conf` and `mariadb` (pam). Also add an emptyDir volume for `nslcd` socket
- name: nslcd
secret:
secretName: mariadb-nslcd-secret
defaultMode: 0600
- name: nsswitch
configMap:
name: mariadb-nsswitch-configmap
defaultMode: 0600
- name: mariadb-pam
configMap:
name: mariadb-pam-configmap
defaultMode: 0600
- name: nslcd-run
emptyDir: {}
sidecarContainers:
# The `nslcd` daemon is ran as a sidecar container
- name: nslcd
image: docker.mariadb.com/nslcd:0.9.10-13
volumeMounts:
- name: nslcd
mountPath: /etc/nslcd.conf
subPath: nslcd.conf
- name: nsswitch
mountPath: /etc/nsswitch.conf
subPath: nsswitch.conf
# nslcd-run is missing because volumeMounts from main container are shared with sidecar
volumeMounts:
- name: mariadb-pam
mountPath: /etc/pam.d/mariadb
subPath: mariadb
- name: nslcd-run
mountPath: /var/run/nslcd---
apiVersion: v1
kind: Secret
metadata:
name: mariadb-ldap
stringData:
plugin: pam # name of the plugin, must be `pam`
pamModule: mariadb # This is the name of the pam config file placed in `/etc/pam.d/`
---
apiVersion: enterprise.mariadb.com/v1alpha1
kind: User
metadata:
name: ldap-user # This user must exist already in your ldap server.
spec:
mariaDbRef:
name: mariadb
host: "%" # Don't specify the ldap host here. Keep this as is
passwordPlugin:
pluginNameSecretKeyRef:
name: mariadb-ldap
key: plugin
pluginArgSecretKeyRef:
name: mariadb-ldap
key: pamModule
cleanupPolicy: Delete
requeueInterval: 10h
retryInterval: 30skubectl run mariadb-connect --rm -it --image=mariadb:11.4 -- bash -c "mariadb -u ldap-user -p'<secret>' --ssl=false -h mariadb"If you don't see a command prompt, try pressing enter.
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 95
Server version: 11.4.7-4-MariaDB-enterprise MariaDB Enterprise Server
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]>kubectl create secret generic mariadb-ldap-tls --from-file=./tls.crt volumes: # Attach `nslcd.conf`, `nsswitch.conf` and `mariadb` (pam). Also add an emptyDir volume for `nslcd` socket
- name: nslcd
secret:
secretName: mariadb-nslcd-secret
defaultMode: 0600
- name: nsswitch
configMap:
name: mariadb-nsswitch-configmap
defaultMode: 0600
- name: mariadb-pam
configMap:
name: mariadb-pam-configmap
defaultMode: 0600
- name: nslcd-run
emptyDir: {}
+ - name: ldap-tls
+ secret:
+ secretName: mariadb-ldap-tls
+ defaultMode: 0600
sidecarContainers:
# The `nslcd` daemon is ran as a sidecar container
- name: nslcd
image: docker.mariadb.com/nslcd:0.9.10-13
volumeMounts:
- name: nslcd
mountPath: /etc/nslcd.conf
subPath: nslcd.conf
- name: nsswitch
mountPath: /etc/nsswitch.conf
subPath: nsswitch.conf
+ - name: ldap-tls
+ mountPath: /etc/openldap/certs/
# nslcd-run is missing because volumeMounts from main container are shared with sidecar
volumeMounts:
- name: mariadb-pam
mountPath: /etc/pam.d/mariadb
subPath: mariadb
- name: nslcd-run
mountPath: /var/run/nslcdsudo sysctl -w fs.nr_open=1048576
kind create clusterDocker + 1Password ✅
Vault: Connect to Vault and fetch
1Password: Use 1Password CLI to fetch
HCP: Connect to HCP Vault and fetch
Have Ubuntu, want simplest setup
Have Ubuntu, want Vault
Ubuntu Deployment Guide + Vault setup
Have Windows, want Docker
Have Windows, want Docker + Vault
Need to understand architecture
Need step-by-step checklist
MariaDB AI RAG (RAG-in-a-Box) is a containerized RAG system providing:
Document ingestion & processing (PDF, TXT, DOCX, MD, etc.)
Vector embeddings using Google Gemini
Semantic search & AI-powered queries
RESTful RAG API (Port 8000)
Container: Docker Desktop + Docker Compose
OS: Ubuntu 24.04 LTS
Database: MariaDB 11 with vector support
Embedding: Google Gemini text-embedding-004 (768-dim)
Windows 10/11 Pro/Enterprise (64-bit)
Docker Desktop 4.x+ with WSL 2 backend
PowerShell 5.1+ (built-in)
Google Gemini API Key (Required)
Get from: https://makersuite.google.com/app/apikey
Free tier available
8000 (RAG API)
8002 (MCP Server)
3306 (MariaDB)
8200 (Vault - if using Vault mode)
Standalone Mode = Simplest setup with secrets in config file
Time: 2-5 minutes (first time)
Expected Output:
Wait for:
Press Ctrl+C to exit logs (containers keep running)
Expected:
Access Points:
RAG API: http://localhost:8000/docs
MCP Server: http://localhost:8002/mcp
Vault Mode = Production-like secret management with HashiCorp Vault
Expected:
Vault Management:
Open http://localhost:8000/docs
Authorize with Bearer token
Use POST /documents/ingest endpoint
Upload file(s)
Open http://localhost:8000/docs
Use POST /orchestrate/generation endpoint
Enter your question
Get AI-generated answer
Add to MCP configuration:
Database Tools: execute_sql, list_tables, get_table_schema
Vector Tools: create_vector_store, search_vector_store
RAG API: http://localhost:8000/docs
MCP Server: http://localhost:8002/mcp
Database: localhost:3306
🎉 Deployment Complete! Your MariaDB AI RAG is ready to use.
A physical backup is a snapshot of the entire data directory (/var/lib/mysql), including all data files. This type of backup captures the exact state of the database at a specific point in time, allowing for quick restoration in case of data loss or corruption.
Physical backups are the recommended method for backing up MariaDB databases, especially in production environments, as they are faster and more efficient than .
Ubuntu Server
├── MariaDB (you install separately)
├── RAG API (from .deb package)
└── MCP Server (from .deb package)Windows + Docker Desktop
├── Docker Container 1: MariaDB
└── Docker Container 2: ai-nexus.deb GEMINI_API_KEY=your_actual_gemini_api_key_here
DB_PASSWORD=your_secure_database_password
SECRET_KEY=your_generated_secret_key_64_chars_long# Generate a secure secret key (Python)
python3 -c "import secrets; print(secrets.token_urlsafe(64))"
# Or using PowerShell
[Convert]::ToBase64String((1..64 | ForEach-Object { Get-Random -Maximum 256 }))Your Application (RAG API + MCP Server)
↓ (fetches secrets at startup)
HashiCorp Vault (running locally)
↓ (stores)
Secrets (API keys, passwords)VAULT_ADDR=http://127.0.0.1:8200
VAULT_TOKEN=your_vault_token
VAULT_SECRET_PATH=rag-in-a-box
# Application fetches secrets from Vault at startupYour Application (RAG API + MCP Server)
↓ (fetches secrets via 1Password CLI)
1Password CLI
↓ (connects to)
1Password Cloud
↓ (stores)
Secrets (API keys, passwords)GEMINI_API_KEY=op://Employee/RAG-API-Keys/gemini
DB_PASSWORD=op://Employee/RAG-Database/password
# op:// references point to 1Password itemsYour Application (RAG API + MCP Server)
↓ (fetches secrets at startup)
HCP Vault (cloud service)
↓ (stores)
Secrets (API keys, passwords)Step 1: Install MariaDB on Ubuntu
↓
Step 2: Install ai-nexus.deb on Ubuntu
↓
Step# 3. Edit /opt/rag-in-a-box/config/config.env.template
Put secrets directly in file (Standalone mode)
GEMINI_API_KEY=your_actual_api_key
DB_PASSWORD=your_secure_password
↓
Step 4: Start services in their own terminals by running:
/opt/rag-in-a-box/bin/rag-api --config /path/to/config.env
CONFIG_FILE=/path/to/config.env /opt/rag-in-a-box/bin/mcp-server
↓
Step 5: Application reads secrets from config file
↓
✅ Done! Application running with Standalone modeStep 1: Install MariaDB on Ubuntu
↓
Step 2: Install HashiCorp Vault on Ubuntu
↓
Step# 3. Store secrets in Vault
vault kv put secret/rag-in-a-box \
GEMINI_API_KEY="your_api_key" \
DB_PASSWORD="your_password"
↓
Step 4: Install ai-nexus.deb on Ubuntu
↓
Step 5: Edit /opt/rag-in-a-box/config/config.env.template
Configure Vault connection (NOT the secrets themselves)
VAULT_ADDR=http://127.0.0.1:8200
VAULT_TOKEN=your_vault_root_token
↓
Step 6: Start services in their own terminals by running:
/opt/rag-in-a-box/bin/rag-api --config /path/to/config.env
CONFIG_FILE=/path/to/config.env /opt/rag-in-a-box/bin/mcp-server
↓
Step 7: Application connects to Vault and fetches secrets
↓
✅ Done! Application running with Vault modeStep 1: Build Docker image (wraps ai-nexus.deb)
docker build -t ai-nexus-image .
↓
Step# 2. Edit config.env.secure.local
Put secrets directly in file (Standalone mode)
GEMINI_API_KEY=your_actual_api_key
DB_PASSWORD=your_secure_password
↓
Step 3: Start containers
docker-compose up -d
(Starts MariaDB container + ai-nexus container)
↓
Step 4: Application reads secrets from config file
↓
✅ Done! Application running with Standalone modeStep 1: Build Docker image (wraps ai-nexus.deb)
docker build -t ai-nexus-image .
↓
Step 2: Start Vault container
docker-compose -f Localvault/docker-compose.vault.yml up -d
↓
Step 3. Store secrets in Vault
docker exec vault vault kv put secret/rag-in-a-box \
GEMINI_API_KEY="your_api_key" \
DB_PASSWORD="your_password"
↓
Step 4: Edit config.env.vault.local
Configure Vault connection
VAULT_ADDR=http://rag-vault:8200
VAULT_TOKEN=your_vault_token
↓
Step 5: Start containers with Vault config
docker-compose --env-file config.env.vault.local up -d
↓
Step 6: Application connects to Vault and fetches secrets
↓
✅ Done! Application running with Vault modeDo you have Ubuntu system?
├─ Yes → Deploy natively on Ubuntu
│ Guide: UBUNTU_DEPLOYMENT_GUIDE.md
│
│ Choose secret mode:
│ ├─ Simple testing? → Standalone
│ ├─ Team development? → Local Vault
│ ├─ Have 1Password? → 1Password
│ └─ Production cloud? → HCP Vault
│
└─ No (Windows/Mac) → Deploy with Docker
Guide: DOCKER_DEPLOYMENT_GUIDE.md
Choose secret mode:
├─ Simple testing? → Standalone
├─ Team development? → Local Vault (Docker)
├─ Have 1Password? → 1Password
└─ Production cloud? → HCP Vault# 1. Install database
sudo apt install -y mariadb-server
sudo mysql_secure_installation
# 2. Create database
sudo mariadb -u root -p
CREATE DATABASE kb_chunks;
EXIT;
# 3. Install application
sudo apt install -y ./ai-nexus.deb
# 4. Configure (Standalone mode - secrets in file)
cp /opt/rag-in-a-box/config/config.env.template /path/to/config.env
nano /path/to/config.env
# Add these lines:
GEMINI_API_KEY=your_actual_gemini_api_key_here
DB_PASSWORD=your_secure_database_password
SECRET_KEY=your_generated_secret_key_must_be_same_for_all_three
JWT_SECRET_KEY=your_generated_secret_key_must_be_same_for_all_three
MCP_AUTH_SECRET_KEY=your_generated_secret_key_must_be_same_for_all_three
# 5. Start services in their own terminals:
/opt/rag-in-a-box/bin/rag-api --config /path/to/config.env
CONFIG_FILE=/path/to/config.env /opt/rag-in-a-box/bin/mcp-server
# 6. Verify
curl http://localhost:8000/health
# ✅ Done! Running in Standalone mode# 1. Install database
sudo apt install -y mariadb-server
sudo mysql_secure_installation
sudo mariadb -u root -p -e "CREATE DATABASE kb_chunks;"
# 2. Install Vault
wget https://releases.hashicorp.com/vault/1.15.0/vault_1.15.0_linux_amd64.zip
unzip vault_1.15.0_linux_amd64.zip
sudo mv vault /usr/local/bin/
# 3. Start Vault
vault server -dev &
export VAULT_ADDR='http://127.0.0.1:8200'
export VAULT_TOKEN='root'
# 4. Store secrets in Vault
vault kv put secret/rag-in-a-box \
GEMINI_API_KEY="your_actual_gemini_api_key" \
DB_PASSWORD="your_secure_database_password" \
SECRET_KEY="your_generated_secret_key"
# 5. Install application
sudo apt install -y ./ai-nexus.deb
# 6. Configure (Vault mode - connection info only)
cp /opt/rag-in-a-box/config/config.env.template /path/to/config.env
nano /path/to/config.env
# Add these lines:
VAULT_ADDR=http://127.0.0.1:8200
VAULT_TOKEN=your_vault_root_token
VAULT_SECRET_PATH=rag-in-a-box
VAULT_MOUNT_POINT=secret
# 7. Start services in their own terminals:
/opt/rag-in-a-box/bin/rag-api --config /path/to/config.env
CONFIG_FILE=/path/to/config.env /opt/rag-in-a-box/bin/mcp-server
# 8. Verify
curl http://localhost:8000/health
# ✅ Done! Running in Vault mode
# Application fetched secrets from Vault at startupMariaDB 11 with vector support (Port 3306)
LLM: Google Gemini gemini-2.0-flash
Framework: FastAPI + Uvicorn
Wait for processing
ingest_documentsgenerate_responseHealth Tools: health_check, get_server_status
CPU
4 cores
8+ cores
RAM
8 GB
16+ GB
Storage
20 GB free
50+ GB free
Multiple strategies are available for performing physical backups, including:
mariadb-backup: Taken using the enterprise version of mariadb-backup, specifically MariaDB Enterprise backup, which is available in the MariaDB enterprise images. The operator supports scheduling Jobs to perform backups using this utility.
Kubernetes VolumeSnapshot: Leverage Kubernetes VolumeSnapshots to create snapshots of the persistent volumes used by the MariaDB Pods. This method relies on a compatible CSI (Container Storage Interface) driver that supports volume snapshots. See the VolumeSnapshots section for more details.
In order to use VolumeSnapshots, you will need to provide a VolumeSnapshotClass that is compatible with your storage provider. The operator will use this class to create snapshots of the persistent volumes:
For the rest of compatible backup storage types, the mariadb-backup CLI will be used to perform the backup. For instance, to use S3 as backup storage:
Multiple storage types are supported for storing physical backups, including:
Persistent Volume Claims (PVC): Use any of the StorageClasses available in your Kubernetes cluster to create a PersistentVolumeClaim (PVC) for storing backups.
Kubernetes Volumes: Store backups in any of the in-tree storage providers supported by Kubernetes out of the box, such as NFS.
Kubernetes VolumeSnapshots: Use to create snapshots of the persistent volumes used by the MariaDB Pods. This method relies on a compatible CSI (Container Storage Interface) driver that supports volume snapshots. See the section for more details.
Physical backups can be scheduled using the spec.schedule field in the PhysicalBackup resource. The schedule is defined using a Cron format and allows you to specify how often backups should be taken:
If you want to immediatly trigger a backup after creating the PhysicalBackup resource, you can set the immediate field to true. This will create a backup immediately, regardless of the schedule.
If you want to suspend the schedule, you can set the suspend field to true. This will prevent any new backups from being created until the PhysicalBackup is resumed.
When using physical backups based on mariadb-backup, you are able to choose the compression algorithm used to compress the backup files. The available options are:
bzip2: Good compression ratio, but slower compression/decompression speed compared to gzip.
gzip: Good compression/decompression speed, but worse compression ratio compared to bzip2.
none: No compression.
To specify the compression algorithm, you can use the compression field in the PhysicalBackup resource:
compression is defaulted to none by the operator.
You can define a retention policy both for backups based on mariadb-backup and for VolumeSnapshots. The retention policy allows you to specify how long backups should be retained before they are automatically deleted. This can be defined via the maxRetention field in the PhysicalBackup resource:
When using physical backups based on mariadb-backup, the operator will automatically delete backups files in the specified storage older than the retention period.
When using VolumeSnapshots, the operator will automatically delete the VolumeSnapshot resources older than the retention period using the Kubernetes API.
Physical backups can only be restored in brand new MariaDB instances without any existing data. This means that you cannot restore a physical backup into an existing MariaDB instance that already has data.
To perform a restoration, you can specify a PhysicalBackup as restoration source under the spec.bootstrapFrom field in the MariaDB resource:
This will take into account the backup strategy and storage type used in the PhysicalBackup, and it will perform the restoration accordingly.
As an alternative, you can also provide a reference to an S3 bucket that was previously used to store the physical backup files:
It is important to note that the backupContentType field must be set to Physical when restoring from a physical backup. This ensures that the operator uses the correct restoration method.
To restore a VolumeSnapshot, you can provide a reference to a specific VolumeSnapshot resource in the spec.bootstrapFrom field:
By default, the operator will match the closest backup available to the current time. You can specify a different target recovery time by using the targetRecoveryTime field in the PhysicalBackup resource. This lets you define the exact point in time you want to restore to:
By default, both backups based on mariadb-backup and VolumeSnapshots will have a timeout of 1 hour. You can change this timeout by using the timeout field in the PhysicalBackup resource:
When timed out, the operator will delete the Jobs or VolumeSnapshots resources associated wit the PhysicalBackup resource. The operator will create new Jobs or VolumeSnapshots to retry the backup operation if the PhysicalBackup resource is still scheduled.
When taking backups based on mariadb-backup, you can specify extra options to be passed to the mariadb-backup command using the args field in the PhysicalBackup resource:
Refer to the mariadb-backup documentation for a list of available options.
Credentials for accessing an S3 compatible storage can be provided via the s3 key in the storage field of the PhysicalBackup resource. The credentials can be provided as a reference to a Kubernetes Secret:
Alternatively, if you are running in EKS, you can use dynamic credentials from an EKS Service Account using EKS Pod Identity or IRSA:
By leaving out the accessKeyIdSecretKeyRef and secretAccessKeySecretKeyRef credentials and pointing to the correct serviceAccountName, the backup Job will use the dynamic credentials from EKS.
When using S3 storage for backups, a staging area is used for keeping the external backups while they are being processed. By default, this staging area is an emptyDir volume, which means that the backups are temporarily stored in the node's local storage where the PhysicalBackup Job is scheduled. In production environments, large backups may lead to issues if the node doesn't have sufficient space, potentially causing the backup/restore process to fail.
Additionally, when restoring these backups, the operator will pull the backup files from S3, uncompress them if needded, and restore them to each of the MariaDB Pods in the cluster individually. To save network bandwidth and compute resources, a staging area is used to keep the uncompressed backup files after they have been restored to the first MariaDB Pod. This allows the operator to restore the same backup to the rest of MariaDB Pods seamlessly, without needing to pull and uncompress the backup again.
To configure the staging area, you can use the stagingStorage field in the PhysicalBackup resource:
Similarly, you may also use a staging area when bootstrapping from backup, in the MariaDB resource:
In the examples above, a PVC with the default StorageClass will be provisioned to be used as staging area.
Before using this feature, ensure that you meet the following prerequisites :
external-snapshotter and its CRs are installed in the cluster.
You have a compatible CSI driver that supports VolumeSnapshots installed in the cluster.
You have a VolumeSnapshotClass configured configured for your CSI driver.
The operator is capable of creating VolumeSnapshot resources of the PVCs used by the MariaDB Pods. This allows you to create point-in-time snapshots of your data in a Kubernetes-native way, leveraging the capabilities of your storage provider.
Most of the fields described in this documentation apply to VolumeSnapshots, including scheduling, retention policy, and compression. The main difference with the mariadb-backup based backups is that the operator will not create a Job to perform the backup, but instead it will create a VolumeSnapshot resource directly.
In order to create consistent, point-in-time snapshots of the MariaDB data, the operator will perform the following steps:
Execute a BACKUP STAGE START statement followed by BACKUP STAGE BLOCK_COMMIT in one of the secondary Pods.
Create a VolumeSnapshot resource of the data PVC mounted by the MariaDB secondary Pod.
Wait until the VolumeSnapshot resource becomes ready. When timing out, the operator will delete the VolumeSnapshot resource and retry the operation.
Issue a BACKUP STAGE END statement.
This backup process is described in the MariaDB documentation and is designed to be non-blocking.
Both for mariadb-backup and VolumeSnapshot backup strategies, the enterprise operator performs non-blocking physical backups by leveraging the BACKUP STAGE feature.. This implies that the backups are taken without long read locks, enabling consistent, production-grade backups with minimal impact on running workloads, ideal for high-availability and performance-sensitive environments.
When restoring a backup, the root credentials specified through the spec.rootPasswordSecretKeyRef field in the MariaDB resource must match the ones in the backup. These credentials are utilized by the liveness and readiness probes, and if they are invalid, the probes will fail, causing your MariaDB Pods to restart after the backup restoration.
When using backups based on mariadb-backup, restoring and uncompressing large backups can consume significant compute resources and may cause restoration Jobs to become stuck due to insufficient resources. To prevent this, you can define the compute resources allocated to the Job:
When using backups based on mariadb-backup, the data PVC used by the MariaDB Pod cannot use the ReadWriteOncePod access mode, as it needs to be mounted at the same time by both the MariaDB Pod and the PhysicalBackup Job. In this case, please use either the ReadWriteOnce or ReadWriteMany access modes instead.
Alternatively, if you want to keep using the ReadWriteOncePod access mode, you must use backups based on VolumeSnapshots, which do not require creating a Job to perform the backup and therefore avoid the volume sharing limitation.
PhysicalBackup Jobs must mount the data PVC used by one of the secondary MariaDB Pods. To avoid scheduling issues caused by the commonly used ReadWriteOnce access mode, the operator schedules backup Jobs on the same node as MariaDB by default.
If you prefer to disable this behavior and allow Jobs to run on any node, you can set podAffinity=false:
This configuration may be suitable when using the ReadWriteMany access mode, which allows multiple Pods across different nodes to mount the volume simultaneously.
Custom columns are used to display the status of the PhysicalBackup resource:
To get a higher level of detail, you can also check the status field directly:
You may also check the related events for the PhysicalBackup resource to see if there are any issues:
In some situations, when using the mariadb-backup strategy, you may encounter the following error in the backup Job logs:
This can be addressed by increasing the innodb_log_file_size in the MariaDB configuration. You can do this by adding the following to your MariaDB resource:
Refer to MDEV-36159 for further details on this issue.
MariaDB AI RAG exposes a comprehensive RESTful API for programmatic interaction with the system. All API endpoints require authentication except for the login endpoint.
Purpose: Authenticates a user and provides a JWT token for subsequent API calls.
Request body:
Response:
Usage Example: Authentication should be performed before any other API calls. The returned JWT token must be included in the Authorization header of subsequent requests:
Purpose: Uploads and processes one or more documents for ingestion into the system. Documents are processed asynchronously in the background.
Request: multipart/form-data with one or more file attachments
Request Parameters:
files: One or more files to upload (required)
Response:
Status Values:
pending: Document is queued for processing
completed: Document has been successfully processed
failed: Document processing failed (check error_message)
Usage Example: Upload one or more documents for ingestion.
Note: The endpoint accepts both single and multiple files. Documents are processed asynchronously, so the initial status will be pending. Use the document ID to check processing status later.
Purpose: Retrieves a paginated list of all documents uploaded by the authenticated user.
Parameters:
skip (optional): Number of records to skip for pagination (default: 0)
limit (optional): Maximum number of records to return (default: 100)
Response:
Usage Example: Use this endpoint to monitor all documents in the system, check their processing status, or select documents for further operations.
Purpose: Retrieves detailed information about a specific document.
Response:
Usage Example: Use this endpoint to check the status of a specific document or retrieve its metadata.
Purpose: Deletes multiple documents and their associated chunks and vector embeddings.
Request body:
Response:
Usage Example: Use this endpoint to remove documents that are no longer needed, freeing up storage space and improving search performance.
Purpose: Processes multiple documents into chunks and creates vector embeddings for semantic search. Documents are processed asynchronously in the background.
Request body:
Chunking Methods:
recursive: Recursive text splitting (default)
sentence: Sentence-based chunking
token: Token-based chunking
Response:
Usage Example: Use this endpoint after document ingestion to prepare documents for semantic search. The chunking process divides documents into semantically meaningful segments and creates vector embeddings.
Note: For semantic chunking, the threshold parameter controls how similar adjacent chunks should be before they are merged.
Purpose: Processes all documents in the system into chunks. Useful for batch processing or reprocessing all documents with new chunking parameters.
Request body:
Response:
Usage Example: Use this endpoint to reprocess all documents with new chunking settings.
Purpose: Retrieves chunks for specific documents. Use this to check if chunking has completed or to retrieve chunk data.
Request body:
Response: Array of chunk objects
Usage Example: Check if documents have been chunked and retrieve their chunks.
Purpose: Performs semantic search to retrieve relevant document chunks based on a query using vector similarity.
Request body:
Request Parameters:
query (required): The search query
top_k (optional): Number of results to return (default: 20)
document_ids (optional): Filter results to specific document IDs (default: all documents)
Response: Array of retrieval results
Response Fields:
id: Unique chunk identifier
document_id: ID of the source document
content: The chunk text content
Usage Example: Use this endpoint to find semantically relevant information. The system converts your query into a vector embedding and finds the most similar chunks.
Purpose: Performs full-text search using MariaDB's FULLTEXT index to find relevant document chunks.
Request body:
Request Parameters:
query (required): The search query
top_k (optional): Number of results to return (default: 10)
document_ids (optional): Filter results to specific document IDs
Response: Array of search results
Response Fields:
id: Unique chunk identifier
document_id: ID of the source document
source: File path of the source document
Usage Example: Use this endpoint for keyword-based search when you need exact term matching.
Purpose: Combines semantic search (vector similarity) and full-text search using Reciprocal Rank Fusion (RRF) for optimal results.
Request body:
Request Parameters:
query (required): The search query
top_k (optional): Number of results to return (default: 20)
k (optional): RRF parameter for rank fusion (default: 60)
Response: Array of hybrid search results
Response Fields:
id: Unique chunk identifier
document_id: ID of the source document
source: File path of the source document
Usage Example: Use this endpoint for the best of both worlds - combining semantic understanding with keyword matching.
Purpose: Generates a response to a query using a language model and the provided context chunks.
Request body:
Request Parameters:
query (required): The user's question or prompt
chunks (required): Array of context chunks to use for generation
llm_provider (optional): LLM provider - openai, anthropic, gemini
Response:
Usage Example: Use this endpoint after retrieving relevant chunks to generate a coherent response based on the information in those chunks.
Purpose: Generates a response asynchronously, useful for long-running generation tasks.
Request body: Same as /generate
Response: Same as /generate
Usage Example: Use this endpoint for generation tasks that may take longer to complete.
Purpose: Generates a response with streaming output (Server-Sent Events), allowing for real-time display of results as tokens are generated.
Request body: Same as /generate
Response: Server-Sent Events (SSE) stream with the following event types:
Usage Example: Use this endpoint for a better user experience when generating longer responses, as it allows displaying partial results as they become available.
Windows Host
└─ Docker Desktop
├─ ai-nexus Container (Ubuntu 24.04)
│ ├─ RAG API (Port 8000) - FastAPI
│ └─ MCP Server (Port 8002) - FastAPI
└─ mysql-db Container (MariaDB 11)
└─ Vector Database (Port 3306)docker --version
docker-compose --version
# Test Docker
docker run hello-world# Verify ports are free
netstat -ano | findstr :8000
netstat -ano | findstr :8002
netstat -ano | findstr :3306
# No output = ports are free ✓# Navigate to your MariaDB AI RAG deployment directory
cd "<path-to-your-mariadb-ai-rag-directory>"
# Verify required files exist
Get-ChildItem | Select-Object Name
# Required files:
# ✓ ai-nexus.deb
# ✓ Dockerfile
# ✓ docker-compose.yml
# ✓ start-services.sh
# ✓ config.env.secure.local# Edit configuration file
notepad config.env.secure.local
# Update this line with your actual API key:
# GEMINI_API_KEY=YOUR_ACTUAL_API_KEY_HERE
# Save and close# Ensure you're in the MariaDB AI RAG directory
docker build -t ai-nexus-image .docker-compose up -d[+] Running 3/3
✔ Network ai-nexus-network Created
✔ Container mysql-db Started
✔ Container ai-nexus Starteddocker logs ai-nexus -f✓ RAG API is ready! (took ~30 seconds)
Starting MCP server...
Adaptive MCP Server ready on 0.0.0.0:8002docker-compose psNAME STATUS PORTS
ai-nexus Up X minutes 0.0.0.0:8000->8000/tcp, 0.0.0.0:8002->8002/tcp
mysql-db Up X minutes (healthy) 0.0.0.0:3306->3306/tcp# Test RAG API
Invoke-RestMethod -Uri "http://localhost:8000/health"
# Open Swagger UI
Start-Process "http://localhost:8000/docs"# Ensure you're in the MariaDB AI RAG directory
docker build -t ai-nexus-image ..\Localvault\setup_vault_local.ps1[SUCCESS] Vault Setup Complete!
Vault Details:
URL: http://127.0.0.1:8200
Token: rag-root-token
Path: secret/rag-in-a-boxdocker exec -e VAULT_TOKEN=rag-root-token rag-vault vault kv patch secret/rag-in-a-box GEMINI_API_KEY="YOUR_ACTUAL_API_KEY"docker-compose --env-file config.env.vault.local up -d# Watch logs
docker logs ai-nexus -f
# Check status
docker-compose ps# View secrets
docker exec -e VAULT_TOKEN=rag-root-token rag-vault vault kv get secret/rag-in-a-box
# Update secret
docker exec -e VAULT_TOKEN=rag-root-token rag-vault vault kv patch secret/rag-in-a-box KEY="value"
# Restart to apply changes
docker restart ai-nexus# Open Swagger UI
Start-Process "http://localhost:8000/docs"
# In browser:
# 1. Navigate to POST /token endpoint
# 2. Click "Try it out"
# 3. Enter credentials:
# {
# "username": "admin",
# "password": "your_password"
# }
# 4. Click "Execute"
# 5. Copy the "access_token" from response1. Click "Authorize" button (🔒 icon)
2. Enter: Bearer YOUR_TOKEN_HERE
3. Click "Authorize"1. Navigate to POST /ingest endpoint
2. Click "Try it out"
3. Upload a test document (PDF/TXT)
4. Click "Execute"
5. Verify: Response shows document processed1. Navigate to POST /generate endpoint
2. Enter a question about your document
3. Click "Execute"
4. Verify: AI-generated response with sources$token = "YOUR_TOKEN_HERE"
$headers = @{
"Authorization" = "Bearer $token"
}
$file = "C:\path\to\document.pdf"
$form = @{
file = Get-Item -Path $file
}
Invoke-RestMethod -Uri "http://localhost:8000/documents/ingest" `
-Method POST `
-Headers $headers `
-Form $form$token = "YOUR_TOKEN_HERE"
$headers = @{
"Authorization" = "Bearer $token"
"Content-Type" = "application/json"
}
$body = @{
query = "What is the main topic of the document?"
} | ConvertTo-Json
Invoke-RestMethod -Uri "http://localhost:8000/orchestrate/generation" `
-Method POST `
-Headers $headers `
-Body $body{
"mcpServers": {
"ai-nexus": {
"url": "http://localhost:8002/mcp",
"headers": {
"Authorization": "Bearer YOUR_TOKEN_HERE"
}
}
}
}# Check logs
docker logs ai-nexus --tail 100
docker logs mysql-db --tail 50
# Rebuild and restart
docker build -t ai-nexus-image .
docker-compose down
docker-compose up -d# Check MariaDB status
docker logs mysql-db --tail 20
# Wait for healthy status
docker-compose ps
# Look for "(healthy)" next to mysql-db
# Verify DB_HOST in config
# Should be: DB_HOST=mysql-db# Find process using port
netstat -ano | findstr :8000
# Stop process (replace <PID>)
Stop-Process -Id <PID> -Force
# Or change port in docker-compose.yml# Verify secret keys are identical
docker exec ai-nexus env | Select-String "SECRET"
# All three must match:
# SECRET_KEY
# JWT_SECRET_KEY
# MCP_AUTH_SECRET_KEY
# If different, edit config and restart
docker-compose down
docker-compose up -d# Test Gemini API key
$apiKey = "YOUR_API_KEY"
$uri = "https://generativelanguage.googleapis.com/v1beta/models?key=$apiKey"
Invoke-RestMethod -Uri $uri
# If error: Get new key from https://makersuite.google.com/app/apikey
# Update in config.env.secure.local or Vault
# Restart: docker restart ai-nexus# Increase timeout in start-services.sh
# Edit: MAX_WAIT=300 # 5 minutes
# Rebuild
docker build -t ai-nexus-image .
docker-compose down
docker-compose up -ddocker-compose ps# All services
docker-compose logs -f
# Specific service
docker logs ai-nexus -f
docker logs mysql-db -f
# Last N lines
docker logs ai-nexus --tail 100# Stop MariaDB AI RAG
docker-compose down
# Stop Vault (if using Vault mode)
docker-compose -f "Localvault/docker-compose.vault.yml" down# Standalone mode
docker-compose up -d
# Vault mode
docker-compose --env-file config.env.vault.local up -d# Restart all
docker-compose restart
# Restart specific service
docker restart ai-nexusdocker-compose down -vdocker exec -it ai-nexus /bin/bashdocker stats ai-nexus mysql-db# Build
docker build -t ai-nexus-image .
# Start
docker-compose up -d
# Stop
docker-compose down# Setup Vault (one-time)
.\Localvault\setup_vault_local.ps1
# Start
docker-compose --env-file config.env.vault.local up -d
# Stop
docker-compose down
docker-compose -f "Localvault/docker-compose.vault.yml" down# Stop current mode
docker-compose down
# Start different mode
docker-compose up -d # Standalone
docker-compose --env-file config.env.vault.local up -d # Vaultdocker logs ai-nexus --tail 100docker exec ai-nexus env | Select-String "GEMINI"
docker exec ai-nexus env | Select-String "DB_"# RAG API
Invoke-RestMethod -Uri "http://localhost:8000/health"
# MCP Server
Invoke-RestMethod -Uri "http://localhost:8002/health"
# Database (from container)
docker exec ai-nexus curl -s http://mysql-db:3306apiVersion: enterprise.mariadb.com/v1alpha1
kind: PhysicalBackup
metadata:
name: physicalbackup
spec:
mariaDbRef:
name: mariadb
storage:
volumeSnapshot:
volumeSnapshotClassName: csi-hostpath-snapclassapiVersion: enterprise.mariadb.com/v1alpha1
kind: PhysicalBackup
metadata:
name: physicalbackup
spec:
mariaDbRef:
name: mariadb
storage:
s3:
bucket: physicalbackups
endpoint: minio.minio.svc.cluster.local:9000
accessKeyIdSecretKeyRef:
name: minio
key: access-key-id
secretAccessKeySecretKeyRef:
name: minio
key: secret-access-key
tls:
enabled: true
caSecretKeyRef:
name: minio-ca
key: ca.crtapiVersion: enterprise.mariadb.com/v1alpha1
kind: PhysicalBackup
metadata:
name: physicalbackup
spec:
mariaDbRef:
name: mariadb
schedule:
cron: "*/1 * * * *"
suspend: false
immediate: trueapiVersion: enterprise.mariadb.com/v1alpha1
kind: PhysicalBackup
metadata:
name: physicalbackup
spec:
mariaDbRef:
name: mariadb
compression: bzip2apiVersion: enterprise.mariadb.com/v1alpha1
kind: PhysicalBackup
metadata:
name: physicalbackup
spec:
mariaDbRef:
name: mariadb
maxRetention: 720h # 30 daysapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
bootstrapFrom:
backupRef:
name: physicalbackup
kind: PhysicalBackupapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
bootstrapFrom:
s3:
bucket: physicalbackups
prefix: mariadb
endpoint: minio.minio.svc.cluster.local:9000
accessKeyIdSecretKeyRef:
name: minio
key: access-key-id
secretAccessKeySecretKeyRef:
name: minio
key: secret-access-key
tls:
enabled: true
caSecretKeyRef:
name: minio-ca
key: ca.crt
backupContentType: PhysicalapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
bootstrapFrom:
volumeSnapshotRef:
name: physicalbackup-20250611163352apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
bootstrapFrom:
targetRecoveryTime: 2025-06-17T08:07:00ZapiVersion: enterprise.mariadb.com/v1alpha1
kind: PhysicalBackup
metadata:
name: physicalbackup
spec:
mariaDbRef:
name: mariadb
timeout: 2hapiVersion: enterprise.mariadb.com/v1alpha1
kind: PhysicalBackup
metadata:
name: physicalbackup
spec:
mariaDbRef:
name: mariadb
args:
- "--verbose"apiVersion: enterprise.mariadb.com/v1alpha1
kind: PhysicalBackup
metadata:
name: physicalbackup
spec:
mariaDbRef:
name: mariadb
storage:
s3:
bucket: physicalbackups
endpoint: minio.minio.svc.cluster.local:9000
accessKeyIdSecretKeyRef:
name: minio
key: access-key-id
secretAccessKeySecretKeyRef:
name: minio
key: secret-access-key
tls:
enabled: true
caSecretKeyRef:
name: minio-ca
key: ca.crtapiVersion: v1
kind: ServiceAccount
metadata:
name: mariadb-backup
annotations:
eks.amazonaws.com/role-arn: arn:aws:iam::<<account_id>>:role/my-role-irsaapiVersion: enterprise.mariadb.com/v1alpha1
kind: PhysicalBackup
metadata:
name: physicalbackup
spec:
mariaDbRef:
name: mariadb
serviceAccountName: mariadb-backup
storage:
s3:
bucket: physicalbackups
prefix: mariadb
endpoint: s3.us-east-1.amazonaws.com
region: us-east-1
tls:
enabled: trueapiVersion: enterprise.mariadb.com/v1alpha1
kind: PhysicalBackup
metadata:
name: physicalbackup
spec:
mariaDbRef:
name: mariadb
storage:
s3:
bucket: physicalbackups
prefix: mariadb
endpoint: minio.minio.svc.cluster.local:9000
region: us-east-1
accessKeyIdSecretKeyRef:
name: minio
key: access-key-id
secretAccessKeySecretKeyRef:
name: minio
key: secret-access-key
tls:
enabled: true
caSecretKeyRef:
name: minio-ca
key: ca.crt
stagingStorage:
persistentVolumeClaim:
resources:
requests:
storage: 1Gi
accessModes:
- ReadWriteOnceapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
mariaDbRef:
name: mariadb
bootstrapFrom:
s3:
bucket: physicalbackups
prefix: mariadb
endpoint: minio.minio.svc.cluster.local:9000
accessKeyIdSecretKeyRef:
name: minio
key: access-key-id
secretAccessKeySecretKeyRef:
name: minio
key: secret-access-key
tls:
enabled: true
caSecretKeyRef:
name: minio-ca
key: ca.crt
backupContentType: Physical
stagingStorage:
persistentVolumeClaim:
resources:
requests:
storage: 1Gi
accessModes:
- ReadWriteOnceapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb
spec:
bootstrapFrom:
restoreJob:
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
memory: 1GiapiVersion: enterprise.mariadb.com/v1alpha1
kind: PhysicalBackup
metadata:
name: physicalbackup
spec:
mariaDbRef:
name: mariadb
podAffinity: falsekubectl get physicalbackups
NAME COMPLETE STATUS MARIADB LAST SCHEDULED AGE
physicalbackup True Success mariadb 17s 17skubectl get physicalbackups physicalbackup -o json | jq -r '.status'
{
"conditions": [
{
"lastTransitionTime": "2025-07-14T07:01:14Z",
"message": "Success",
"reason": "JobComplete",
"status": "True",
"type": "Complete"
}
],
"lastScheduleCheckTime": "2025-07-14T07:00:00Z",
"lastScheduleTime": "2025-07-14T07:00:00Z",
"nextScheduleTime": "2025-07-15T07:00:00Z"
}kubectl get events --field-selector involvedObject.name=physicalbackup
LAST SEEN TYPE REASON OBJECT MESSAGE
116s Normal WaitForFirstConsumer persistentvolumeclaim/physicalbackup waiting for first consumer to be created before binding
116s Normal JobScheduled physicalbackup/physicalbackup Job physicalbackup-20250714140837 scheduled
116s Normal ExternalProvisioning persistentvolumeclaim/physicalbackup Waiting for a volume to be created either by the external provisioner 'rancher.io/local-path' or manually by the system administrator. If volume creation is delayed, please verify that the provisioner is running and correctly registered.
116s Normal Provisioning persistentvolumeclaim/physicalbackup External provisioner is provisioning volume for claim "default/physicalbackup"
113s Normal ProvisioningSucceeded persistentvolumeclaim/physicalbackup Successfully provisioned volume pvc-7b7c71f9-ea7e-4950-b612-2d41d7ab35b7mariadb [00] 2025-08-04 09:15:57 Was only able to copy log from 58087 to 59916, not 68968; try increasing
innodb_log_file_size
mariadb mariabackup: Stopping log copying thread.[00] 2025-08-04 09:15:57 Retrying read of log at LSN=59916apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb
spec:
...
myCnf: |
[mariadb]
innodb_log_file_size=200MPOST /tokensemantic: Semantic similarity-based chunking (requires threshold)metadata: Additional metadata about the chunkdistance: Vector distance (lower = more similar)
content: The chunk text contentscore: Relevance score (higher = more relevant)
provider (optional): Embedding provider for semantic searchmodel (optional): Embedding model for semantic search
document_ids (optional): Filter results to specific document IDs
content: The chunk text contentmetadata: Additional metadata about the chunk
distance: Vector distance from semantic search (lower = more similar)
score: Full-text relevance score (higher = more relevant)
cohereollamaazurebedrockllm_model (optional): Specific model to use (e.g., gpt-4, claude-3-opus)
temperature (optional): Controls randomness (0.0-2.0, default: 0.7)
top_p (optional): Nucleus sampling parameter (0.0-1.0, default: 0.9)
max_tokens (optional): Maximum tokens to generate (1-8192, default: 1000)
Deploy MariaDB AI RAG .deb package directly on Ubuntu (without Docker)
OS: Ubuntu 22.04 LTS or 24.04 LTS (x86_64)
CPU: 4+ cores (8+ recommended)
RAM: 8+ GB (16+ recommended)
Storage: 20+ GB free
Google Gemini API Key: Get from https://makersuite.google.com/app/apikey
Follow prompts:
Enter current password for root: [Press Enter]
Switch to unix_socket authentication? n
Change the root password? Y
New password: [Choose a secure password]
In MariaDB shell:
Add under [mysqld] section:
Save and restart:
Verify installation:
Update these essential settings:
Save: Ctrl+X, Y, Enter
Check listening ports:
Should show LISTEN on both ports
Expected log messages:
In MariaDB:
After successful deployment:
RAG API Swagger UI: http://<server-ip>:8000/docs
RAG API Health: http://<server-ip>:8000/health
MCP Server: http://<server-ip>:8002/mcp
MCP Health: http://<server-ip>:8002/health
Get server IP:
Check logs in the terminal windows
Common causes:
MariaDB not running
Configuration errors
Port already in use
Permission issues
Update config:
Update config:
Start order: MariaDB → RAG API → MCP Server Stop order: MCP Server → RAG API → MariaDB
Your MariaDB AI RAG is now running natively on Ubuntu.
Next Steps:
Access Swagger UI: http://<server-ip>:8000/docs
Generate authentication token
Upload test documents
Start querying with RAG
For support:
Check logs
Verify config: nano /path/to/config.env
Test health: curl http://localhost:8000/health
A logical backup is a backup that contains the logical structure of the database, such as tables, indexes, and data, rather than the physical storage format. It is created using , which generates SQL statements that can be used to recreate the database schema and populate it with data.
Logical backups serve not just as a source of restoration, but also enable data mobility between MariaDB instances. These backups are called "logical" because they are independent from the MariaDB topology, as they only contain DDLs and INSERT statements to populate data.
{
"username": "user@example.com",
"password": "secure_password"
}{
"access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"token_type": "bearer"
}Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...POST /documents/ingest{
"message": "2 documents have been queued for ingestion.",
"documents": [
{
"id": 42,
"source": "/uploaded_files/example1.pdf",
"filename": "example1.pdf",
"status": "pending",
"content": null,
"error_message": null,
"created_at": "2025-10-20T12:00:00.123456",
"updated_at": null
},
{
"id": 43,
"source": "/uploaded_files/example2.docx",
"filename": "example2.docx",
"status": "pending",
"content": null,
"error_message": null,
"created_at": "2025-10-20T12:00:00.234567",
"updated_at": null
}
]
}# Upload single document
curl -X POST "http://localhost:8000/documents/ingest" \
-H "Authorization: Bearer YOUR_TOKEN" \
-F "files=@/path/to/document.pdf"
# Upload multiple documents
curl -X POST "http://localhost:8000/documents/ingest" \
-H "Authorization: Bearer YOUR_TOKEN" \
-F "files=@/path/to/document1.pdf" \
-F "files=@/path/to/document2.docx"GET /documents{
"documents": [
{
"id": 42,
"filename": "example.pdf",
"content_type": "application/pdf",
"size": 1048576,
"status": "completed",
"created_at": "2025-08-25T11:42:00.123456",
"updated_at": "2025-08-25T11:43:30.123456",
"chunk_count": 15
},
{...}
],
"total_count": 42,
"page": 1,
"pages": 5
}curl "http://localhost:8000/documents?skip=0&limit=10" \
-H "Authorization: Bearer YOUR_TOKEN"GET /documents/{document_id}{
"id": 42,
"filename": "example.pdf",
"content_type": "application/pdf",
"size": 1048576,
"status": "completed",
"created_at": "2025-08-25T11:42:00.123456",
"updated_at": "2025-08-25T11:43:30.123456",
"chunk_count": 15,
"metadata": {
"page_count": 10,
"author": "John Doe",
"creation_date": "2025-08-20"
}
}curl "http://localhost:8000/documents/42" \
-H "Authorization: Bearer YOUR_TOKEN"DELETE /documents{
"document_ids": [42, 43, 44]
}{
"deleted_count": 3,
"status": "success"
}curl -X DELETE "http://localhost:8000/documents" \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"document_ids": [42, 43, 44]}'POST /chunk{
"document_ids": [42, 43, 44],
"chunking_method": "recursive",
"chunk_size": 512,
"chunk_overlap": 128,
"threshold": 0.8
}{
"message": "Chunking task scheduled for 3 documents",
"queued_documents": [42, 43, 44],
"status": "success"
}curl -X POST "http://localhost:8000/chunk" \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"document_ids": [42, 43],
"chunking_method": "semantic",
"chunk_size": 512,
"chunk_overlap": 128,
"threshold": 0.8
}'POST /chunk/all{
"chunking_method": "recursive",
"chunk_size": 512,
"chunk_overlap": 128,
"threshold": 0.8
}{
"message": "Chunking task scheduled for all documents",
"queued_documents": [42, 43, 44, 45, 46],
"status": "success"
}curl -X POST "http://localhost:8000/chunk/all" \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"chunking_method": "recursive",
"chunk_size": 512,
"chunk_overlap": 128
}'POST /chunks/filter{
"document_ids": [42, 43]
}[
{
"id": "uuid-string",
"document_id": 42,
"chunk_text": "This is the content of the first chunk...",
"chunk_index": 0,
"embedding": [0.123, 0.456, ...],
"metadata": {}
},
{
"id": "uuid-string-2",
"document_id": 42,
"chunk_text": "This is the content of the second chunk...",
"chunk_index": 1,
"embedding": [0.789, 0.012, ...],
"metadata": {}
}
]curl -X POST "http://localhost:8000/chunks/filter" \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{"document_ids": [42, 43]}'POST /retrieve{
"query": "What is MariaDB AI RAG?",
"top_k": 20,
"document_ids": [42, 43]
}[
{
"id": "uuid-chunk-id",
"document_id": 42,
"content": "MariaDB AI RAG is an enterprise-grade RAG solution...",
"metadata": {},
"distance": 0.15
},
{
"id": "uuid-chunk-id-2",
"document_id": 43,
"content": "Key features include document processing and semantic search...",
"metadata": {},
"distance": 0.23
}
]curl -X POST "http://localhost:8000/retrieve" \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"query": "What is MariaDB AI RAG?",
"top_k": 5,
"document_ids": [42, 43]
}'POST /search{
"query": "MariaDB features",
"top_k": 10,
"document_ids": [42, 43]
}[
{
"id": "uuid-chunk-id",
"document_id": 42,
"source": "/uploaded_files/product_overview.pdf",
"content": "MariaDB features include vector search, full-text indexing...",
"score": 15.5
},
{
"id": "uuid-chunk-id-2",
"document_id": 43,
"source": "/uploaded_files/technical_docs.pdf",
"content": "Additional MariaDB capabilities for enterprise applications...",
"score": 12.3
}
]curl -X POST "http://localhost:8000/search" \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"query": "MariaDB features",
"top_k": 10
}'POST /hybrid_search{
"query": "MariaDB vector capabilities",
"top_k": 20,
"k": 60,
"provider": "openai",
"model": "text-embedding-3-small",
"document_ids": [42, 43]
}[
{
"id": "uuid-chunk-id",
"document_id": 42,
"source": "/uploaded_files/product_overview.pdf",
"content": "MariaDB vector capabilities enable semantic search...",
"metadata": {},
"distance": 0.18,
"score": 14.2
},
{
"id": "uuid-chunk-id-2",
"document_id": 43,
"source": "/uploaded_files/technical_docs.pdf",
"content": "Vector indexing in MariaDB provides fast similarity search...",
"metadata": {},
"distance": 0.25,
"score": 11.8
}
]curl -X POST "http://localhost:8000/hybrid_search" \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"query": "MariaDB vector capabilities",
"top_k": 10,
"k": 60
}'POST /generate{
"query": "Explain MariaDB AI RAG features",
"chunks": [
"MariaDB AI RAG is an enterprise-grade RAG solution that integrates with MariaDB...",
"Key features include document processing, semantic search, and AI-powered responses..."
],
"llm_provider": "openai",
"llm_model": "gpt-4",
"temperature": 0.7,
"top_p": 0.9,
"max_tokens": 1000
}{
"response": "MariaDB AI RAG is an enterprise-grade Retrieval-Augmented Generation (RAG) solution that seamlessly integrates with MariaDB. Its key features include..."
}curl -X POST "http://localhost:8000/generate" \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"query": "Explain MariaDB AI RAG features",
"chunks": ["chunk1", "chunk2"],
"llm_provider": "openai",
"llm_model": "gpt-4",
"temperature": 0.7
}'POST /generate-asynccurl -X POST "http://localhost:8000/generate-async" \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"query": "Provide a detailed analysis",
"chunks": ["chunk1", "chunk2"],
"llm_provider": "openai",
"llm_model": "gpt-4"
}'POST /generate-stream// Start event
{"type": "start", "provider": "openai", "model": "gpt-4"}
// Token events (streamed as generated)
{"type": "token", "content": "MariaDB", "chunk_index": 1}
{"type": "token", "content": " Data", "chunk_index": 2}
{"type": "token", "content": " Bridge", "chunk_index": 3}
// Completion event
{"type": "complete", "duration": 2.5, "chunks_streamed": 150}
// Error event (if error occurs)
{"type": "error", "message": "Error description"}curl -X POST "http://localhost:8000/generate-stream" \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"query": "Explain MariaDB AI RAG features",
"chunks": ["chunk1", "chunk2"],
"llm_provider": "openai",
"llm_model": "gpt-4"
}'Access: Root/sudo privileges
Re-enter: [Same password]
Remove anonymous users? Y
Disallow root login remotely? Y
Remove test database? Y
Reload privilege tables? Y
MariaDB databases, especially in production environments.Currently, the following storage types are supported:
PVCs: Use the available StorageClasses in your Kubernetes cluster to provision a PVC dedicated to store the backup files.
Kubernetes volumes: Use any of the volume types supported natively by Kubernetes.
Our recommendation is to store the backups externally in a S3 compatible storage.
You can take a one-time backup of your MariaDB instance by declaring the following resource:
This will use the default StorageClass to provision a PVC that would hold the backup files, but ideally you should use a S3 compatible storage:
By providing the authentication details and the TLS configuration via references to Secret keys, this example will store the backups in a local Minio instance.
Alternatively you can use dynamic credentials from an EKS Service Account using EKS Pod Identity or IRSA:
By leaving out the accessKeyIdSecretKeyRef and secretAccessKeySecretKeyRef credentials and pointing to the correct serviceAccountName, the backup Job will use the dynamic credentials from EKS.
To minimize the Recovery Point Objective (RPO) and mitigate the risk of data loss, it is recommended to perform backups regularly. You can do so by providing a spec.schedule in your Backup resource:
This resource gets reconciled into a CronJob that periodically takes the backups.
It is important to note that regularly scheduled Backups complement very well the target recovery time feature detailed below.
Given that the backups can consume a substantial amount of storage, it is crucial to define your retention policy by providing the spec.maxRetention field in your Backup resource:
You are able to compress backups by providing the compression algorithm you want to use in the spec.compression field:
Currently the following compression algorithms are supported:
bzip2: Good compression ratio, but slower compression/decompression speed compared to gzip.
gzip: Good compression/decompression speed, but worse compression ratio compared to bzip2.
none: No compression.
compression is defaulted to none by the operator.
You can easily restore a Backup in your MariaDB instance by creating the following resource:
This will trigger a Job that will mount the same storage as the Backup and apply the dump to your MariaDB database.
Nevertheless, the Restore resource doesn't necessarily need to specify a spec.backupRef, you can point to other storage source that contains backup files, for example a S3 bucket:
If you have multiple backups available, specially after configuring a scheduled Backup, the operator is able to infer which backup to restore based on the spec.targetRecoveryTime field.
The operator will look for the closest backup available and utilize it to restore your MariaDB instance.
By default, spec.targetRecoveryTime will be set to the current time, which means that the latest available backup will be used.
To minimize your Recovery Time Objective (RTO) and to switfly spin up new clusters from existing Backups, you can provide a Restore source directly in the MariaDB object via the spec.bootstrapFrom field:
As in the Restore resource, you don't strictly need to specify a reference to a Backup, you can provide other storage types that contain backup files:
Under the hood, the operator creates a Restore object just after the MariaDB resource becomes ready. The advantage of using spec.bootstrapFrom over a standalone Restore is that the MariaDB is bootstrap-aware and this will allow the operator to hold primary switchover/failover operations until the restoration is finished.
By default, all the logical databases are backed up when a Backup is created, but you may also select specific databases by providing the databases field:
When it comes to restore, all the databases available in the backup will be restored, but you may also choose a single database to be restored via the database field available in the Restore resource:
There are a couple of points to consider here:
The referred database (db1 in the example) must previously exist for the Restore to succeed.
The mariadb CLI invoked by the operator under the hood only supports selecting a single database to restore via the --one-database option, restoration of multiple specific databases is not supported.
Not all the flags supported by mariadb-dump and mariadb have their counterpart field in the Backup and Restore CRs respectively, but you may pass extra options by using the args field. For example, setting the --verbose flag can be helpful to track the progress of backup and restore operations:
Refer to the mariadb-dump and mariadb CLI options in the reference section.
When using S3 storage for backups, a staging area is used for keeping the external backups while they are being processed. By default, this staging area is an emptyDir volume, which means that the backups are temporarily stored in the node's local storage where the Backup/Restore Job is scheduled. In production environments, large backups may lead to issues if the node doesn't have sufficient space, potentially causing the backup/restore process to fail.
To overcome this limitation, you are able to define your own staging area by setting the stagingStorage field to both the Backup and Restore CRs:
In the examples above, a PVC with the default StorageClass will be used as staging area. Refer to the API reference for more configuration options.
Similarly, you may also use a custom staging area when bootstrapping from backup:
When restoring a backup, the root credentials specified through the spec.rootPasswordSecretKeyRef field in the MariaDB resource must match the ones in the backup. These credentials are utilized by the liveness and readiness probes, and if they are invalid, the probes will fail, causing your MariaDB Pods to restart after the backup restoration.
Restoring large backups can consume significant compute resources and may cause Restore Jobs to become stuck due to insufficient resources. To prevent this, you can define the compute resources allocated to the Job:
Galera only replicates the tables with InnoDB engine, see the Galera docs.
Something that does not include mysql.global_priv, the table used to store users and grants, which uses the MyISAM engine. This basically means that a Galera instance with mysql.global_priv populated will not replicate this data to an empty Galera instance. However, DDL statements (CREATE USER, ALTER USER ...) will be replicated.
Taking this into account, if we think now about a restore scenario where:
The backup file includes a DROP TABLE statement for the mysql.global_priv table.
The backup has some INSERT statements for the mysql.global_priv table.
The Galera cluster has 3 nodes: galera-0, galera-1 and galera-2.
The backup is restored in galera-0.
This is what will happen under the scenes while restoring the backup:
The DROP TABLE statement is a DDL so it will be executed in galera-0, galera-1 and galera-2.
The INSERT statements are not DDLs, so they will only be applied to galera-0.
This results in the galera-1 and galera-2 not having the mysql.global_priv table.
After the backup is fully restored, the liveness and readiness probes will kick in, they will succeed in galera-0, but they will fail in galera-1 and galera-2, as they rely in the root credentials available in mysql.global_priv, resulting in the galera-1 and galera-2 getting restarted.
To address this issue, when backing up MariaDB instances with Galera enabled, the mysql.global_priv table will be excluded from backups by using the --ignore-table option with mariadb-dump. This prevents the replication of the DROP TABLE statement for the mysql.global_priv table. You can opt-out from this feature by setting spec.ignoreGlobalPriv=false in the Backup resource.
Also, to avoid situations where mysql.global_priv is unreplicated, all the entries in that table must be managed via DDLs. This is the recommended approach suggested in the Galera docs. There are a couple of ways that we can guarantee this:
Use the rootPasswordSecretKeyRef, username and passwordSecretKeyRef fields of the MariaDB CR to create the root and initial user respectively. This fields will be translated into DDLs by the image entrypoint.
Rely on the User and Grant CRs to create additional users and grants. Refer to the SQL resource documentation for further detail.
Galera is not compatible with the LOCK TABLES statement:
For this reason, the operator automatically adds the --skip-add-locks option to the Backup to overcome this limitation.
You can leverage logical backups to bring your external MariaDB data into a new MariaDB instance running in Kubernetes. Follow this runbook for doing so:
Take a logical backup of your external MariaDB using one of the commands below:
If you are using Galera or planning to migrate to a Galera instance, make sure you understand the Galera backup limitations and use the following command instead:
Ensure that your backup file is named in the following format: backup.2024-08-26T12:24:34Z.sql. If the file name does not follow this format, it will be ignored by the operator.
Upload the backup file to one of the supported storage types. We recommend using S3.
Create your MariaDB resource declaring that you want to bootstrap from the previous backup and providing a root password Secret that matches the backup:
If you are using Galera in your new instance, migrate your previous users and grants to use the User and Grant CRs. Refer to the SQL resource documentation for further detail.
Database mobility between MariaDB instances with different topologies is possible with logical backups. However, there are a couple of technical details that you need to be aware of in the following scenarios:
This should be fully compatible, no issues have been detected.
There are a couple of limitations regarding the backups in Galera, please make sure you read the Galera backup limitations section before proceeding.
To overcome this limitations, the Backup in the standalone/replicated instance needs to be taken with spec.ignoreGlobalPriv=true. In the following example, we are backing up a standalone MariaDB (single instance):
Once the previous Backup is completed, we will be able bootstrap a new Galera instance from it:
Please make sure you understand the Galera backup limitations.
After doing so, ensure that your backup does not contain a DROP TABLE mysql.global_priv; statement, as it will make your liveness and readiness probes to fail after the backup restoration.
MariaDB Enterprise Kubernetes Operator provides cloud native support for provisioning and operating multi-master MariaDB clusters using Galera. This setup enables the ability to perform writes on a single node and reads in all nodes, enhancing availability and allowing scalability across multiple nodes.
In certain circumstances, it could be the case that all the nodes of your cluster go down at the same time, something that Galera is not able to recover by itself, and it requires manual action to bring the cluster up again, as documented in the Galera documentation. The MariaDB Enterprise Kubernetes Operator encapsulates this operational expertise in the MariaDB CR. You just need to declaratively specify spec.galera, as explained in more detail later in this guide.
To accomplish this, after the MariaDB cluster has been provisioned, the operator will regularly monitor the cluster's status to make sure it is healthy. If any issues are detected, the operator will initiate the recovery process to restore the cluster to a healthy state. During this process, the operator will set status conditions in the MariaDB and emit Events so you have a better understanding of the recovery progress and the underlying activities being performed. For example, you may want to know which Pods were out of sync to further investigate infrastructure-related issues (i.e. networking, storage...) on the nodes where these Pods were scheduled.
MariaDB configurationThe easiest way to get a MariaDB Galera cluster up and running is setting spec.galera.enabled = true:
This relies on sensible defaults set by the operator, which may not be suitable for your Kubernetes cluster. This can be solved by overriding the defaults, so you have fine-grained control over the Galera configuration.
Refer to the to better understand the purpose of each field.
By default, the operator provisions two PVCs for running Galera:
Storage PVC: Used to back the MariaDB data directory, mounted at /var/lib/mysql.
Config PVC: Where the Galera config files are located, mounted at /etc/mysql/conf.d.
However, you are also able to use just one PVC for keeping both the data and the config files:
You are able to pass extra options to the Galera wsrep provider by using the galera.providerOptions field:
It is important to note that, the ist.recv_addr cannot be set by the user, as it is automatically configured to the Pod IP by the operator, something that an user won't be able to know beforehand.
A list of the available options can be found in the .
If you have a Kubernetes cluster running with IPv6, the operator will automatically detect the IPv6 addresses of your Pods and it will configure several options to ensure that the Galera protocol runs smoothly with IPv6.
MariaDB Enterprise Kubernetes Operator monitors the Galera cluster and acts accordinly to recover it if needed. This feature is enabled by default, but you may tune it as you need:
The minClusterSize field indicates the minimum cluster size (either absolut number of replicas or percentage) for the operator to consider the cluster healthy. If the cluster is unhealthy for more than the period defined in clusterHealthyTimeout (30s by default), a cluster recovery process is initiated by the operator. The process is explained in the and consists of the following steps:
Recover the sequence number from the grastate.dat on each node.
Trigger a to obtain the sequence numbers in case that the previous step didn't manage to.
Mark the node with highest sequence (bootstrap node) as safe to bootstrap.
Bootstrap a new cluster in the bootstrap node.
The operator monitors the Galera cluster health periodically and performs the cluster recovery described above if needed. You are able to tune the monitoring interval via the clusterMonitorInterval field.
Refer to the to better understand the purpose of each field.
JobDuring the recovery process, a Job is triggered for each MariaDB Pod to obtain the sequence numbers. It's crucial for this Job to succeed; otherwise, the recovery process will fail. As a user, you are responsible for adjusting this Job to allocate sufficient resources and provide the necessary metadata to ensure its successful completion.
For example, if you're using a service mesh like Istio, it's important to add the sidecar.istio.io/inject=false label. Without this label, the Job will not complete, which would prevent the recovery process from finishing successfully.
Use this option only in exceptional circumstances. Not selecting the Pod with the highest sequence number may result in data loss.
Ensure you unset forceClusterBootstrapInPod after completing the bootstrap to allow the operator to choose the appropriate Pod to bootstrap from in an event of cluster recovery.
You have the ability to manually select which Pod is used to bootstrap a new cluster during the recovery process by setting forceClusterBootstrapInPod:
This should only be used in exceptional circumstances:
You are absolutely certain that the chosen Pod has the highest sequence number.
The operator has not yet selected a Pod to bootstrap from.
You can verify this with the following command:
In this case, assuming that mariadb-galera-2 sequence is lower than 350454, it should be safe to bootstrap from mariadb-galera-0.
Finally, after your cluster has been bootstrapped, remember to unset forceClusterBootstrapInPod to allow the operator to select the appropriate node for bootstrapping in the event of a cluster recovery.
MariaDB Enterprise Kubernetes Operator will never delete your MariaDB PVCs. Whenever you delete a MariaDB resource, the PVCs will remain intact so you could reuse them to re-provision a new cluster.
That said, Galera is unable to form a cluster from pre-existing state, it requires a process to identify which Pod has the highest sequence number to bootstrap a new cluster. That's exactly what the operator does: whenever a new MariaDB Galera cluster is created and previously created PVCs exist, a cluster recovery process is automatically triggered.
Apply the following manifests to get started with Galera in Kubernetes:
Next, check the MariaDB status and the resources created by the operator:
Let's now proceed with simulating a Galera cluster failure by deleting all the Pods at the same time:
After some time, we will see the MariaDB entering a non Ready state:
Eventually, the operator will kick in and recover the Galera cluster:
Finally, the MariaDB resource will become Ready and your Galera cluster will be operational again:
The aim of this section is showing you how to diagnose your Galera cluster when something goes wrong. In this situations, observability is a key factor to understand the problem, so we recommend following these steps before jumping into debugging the problem.
Inspect MariaDB status conditions.
Make sure network connectivity is fine by checking that you have an Endpoint per Pod in your Galera cluster.
Check the events associated with the MariaDB object, as they provide significant insights for diagnosis, particularly within the context of cluster recovery.
Enable debug logs in mariadb-enterprise-operator.
Get the logs of all the MariaDB Pod containers, not only of the main mariadb container but also the agent and init ones.
Once you are done with these steps, you will have the context required to jump ahead to the section to see if any of them matches your case.
If your MariaDB Galera cluster has been in GaleraNotReady state for a long time, the recovery process might not be progressing. You can diagnose this by checking:
Operator logs.
Galera recovery status:
MariaDB events:
If you have Pods named <mariadb-name>-<ordinal>-recovery-<suffix> running for a long time, check its logs to understand if something is wrong.
One of the reasons could be misconfigured Galera recovery Jobs, please make sure you read . If after checking all the points above, there are still no clear symptoms of what could be wrong, continue reading.
First af all, you could attempt to forcefully bootstrap a new cluster as it is described in . Please, refrain from doing so if the conditions described in the docs are not met.
Alternatively, if you can afford some downtime and your PVCs are in healthy state, you may follow this procedure:
Delete your existing MariaDB, this will leave your PVCs intact.
Create your MariaDB again, this will trigger a Galera recovery process as described in .
As a last resource, you can always delete the PVCs and bootstrap a new MariaDB from a backup as documented .
This error occurs when the user that runs the container does not have enough privileges to write in /etc/mysql/mariadb.conf.d:
To mitigate this, by default, the operator sets the following securityContext in the MariaDB's StatefulSet :
This enables the CSIDriver and the kubelet to recursively set the ownership ofr the /etc/mysql/mariadb.conf.d folder to the group 999, which is the one expected by MariaDB. It is important to note that not all the CSIDrivers implementations support this feature, see the for further information.
This situation occurs when the mariadb-enterprise-operator credentials passed to the agent as authentication are either invalid or the agent is unable to verify them. To confirm this, ensure that both the mariadb-enterprise-operator and the MariaDB ServiceAccounts are able to create TokenReview objects:
If that's not the case, check that the following ClusterRole and ClusterRoleBindings are available in your cluster:
mariadb-enterprise-operator:auth-delegator is the ClusterRoleBinding bound to the mariadb-enterprise-operator ServiceAccount which is created by the helm chart, so you can re-install the helm release in order to recreate it:
mariadb-galera:auth-delegator is the ClusterRoleBinding bound to the mariadb-galera ServiceAccount which is created on the flight by the operator as part of the reconciliation logic. You may check the mariadb-enterprise-operator logs to see if there are any issues reconciling it.
Bear in mind that ClusterRoleBindings are cluster-wide resources that are not garbage collected when the MariaDB owner object is deleted, which means that creating and deleting MariaDBs could leave leftovers in your cluster. These leftovers can lead to RBAC misconfigurations, as the ClusterRoleBinding might not be pointing to the right ServiceAccount. To overcome this, you can override the ClusterRoleBinding name setting the spec.galera.agent.kubernetesAuth.authDelegatorRoleName field.
This error appears in the mariadb-enterprise-operator logs when a Pod is in non synced state for a duration exceeding the spec.galera.recovery.podRecoveryTimeout. Just after, the operator will restart the Pod.
Increase this timeout if you consider that your Pod may take longer to recover.
This is error is returned by the mariadb-enterprise-operator after exceeding the spec.galera.recovery.clusterBootstrapTimeout when recovering the cluster. At this point, the operator will reset the recovered sequence numbers and start again from a clean state.
Increase this timeout if you consider that your Galera cluster may take longer to recover.
Linux:
Windows (PowerShell):
Linux:
Windows (PowerShell):
Visit: https://makersuite.google.com/app/apikey
Sign in with Google account
Click "Create API Key"
Copy and save the key
Linux:
Windows (PowerShell):
Linux:
Windows (PowerShell):
Linux:
Windows (PowerShell):
Linux:
Windows (PowerShell):
Open: http://localhost:8000/docs
Click on POST /token
Click "Try it out"
Enter credentials:
Use files from test_documents/ directory or upload your own:
PDF files
TXT files
DOCX files
MD files
Linux:
Windows (PowerShell):
Deployment Date: _______________
Deployment Mode:
Deployed By: _______________
Access URLs:
RAG API: http://localhost:8000/docs
MCP Server: http://localhost:8002/mcp
Notes:
✅ Deployment Complete!
MaxScale is a sophisticated database proxy, router, and load balancer designed specifically for and by MariaDB. It provides a range of features that ensure optimal high availability:
Query-based routing: Transparently route write queries to the primary nodes and read queries to the replica nodes.
Connection-based routing: Load balance connections between multiple servers.
Automatic primary failover based on MariaDB internals.
# 1. Install MariaDB
sudo apt update && sudo apt install -y mariadb-server mariadb-client
sudo systemctl start mariadb && sudo systemctl enable mariadb
# 2. Secure MariaDB (set root password during setup)
sudo mysql_secure_installation
# 3. Create database
sudo mariadb -u root -p <<EOF
CREATE DATABASE kb_chunks CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
EXIT;
EOF
# 4. Install MariaDB AI RAG
sudo apt install -y ./ai-nexus.deb
# 5. Configure (update GEMINI_API_KEY)
cp /opt/rag-in-a-box/config/config.env.template /path/to/config.env
nano /path/to/config.env
# 6. Start services in their own terminals
/opt/rag-in-a-box/bin/rag-api --config /path/to/config.env
CONFIG_FILE=/path/to/config.env /opt/rag-in-a-box/bin/mcp-server
# 7. Verify
curl http://localhost:8000/health# Check Ubuntu version
lsb_release -a
# Check disk space
df -h /
# Check ports are free
sudo netstat -tuln | grep -E ':(8000|8002|3306)'
# No output = ports available# Update package lists
sudo apt update
# Install MariaDB
sudo apt install -y mariadb-server mariadb-client
# Start and enable MariaDB
sudo systemctl start mariadb
sudo systemctl enable mariadb
# Verify running
sudo systemctl status mariadbsudo mysql_secure_installation# Login to MariaDB
sudo mariadb -u root -p
# Enter password: [your_password]-- Create database
CREATE DATABASE kb_chunks CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
-- Verify
SHOW DATABASES;
-- Exit
EXIT;# Edit configuration
sudo nano /etc/mysql/mariadb.conf.d/50-server.cnfcharacter-set-server = utf8mb4
collation-server = utf8mb4_unicode_ci
innodb_page_size = 16k
innodb_default_row_format = dynamic
max_connections = 100
innodb_buffer_pool_size = 2G# Save: Ctrl+X, Y, Enter
sudo systemctl restart mariadb# Navigate to directory with .deb file
cd ~/
# Install package
sudo apt install -y ./ai-nexus.deb
# If dependency issues:
sudo dpkg -i ai-nexus.deb
sudo apt-get install -f# Check installed files
dpkg -L ai-nexus | head -20
# Expected locations:
# /opt/rag-in-a-box/bin/rag-api
# /opt/rag-in-a-box/bin/mcp-server
# /opt/rag-in-a-box/config/config.env.template
# Check binaries exist
ls -lh /opt/rag-in-a-box/bin/# Edit configuration file
cp /opt/rag-in-a-box/config/config.env.template /path/to/config.env
nano /path/to/config.env# ===== DATABASE CONFIGURATION =====
DB_HOST=localhost
DB_PORT=3306
DB_USER=root
DB_PASSWORD=your_secure_database_password
DB_NAME=kb_chunks
# ===== API KEYS (REQUIRED - UPDATE THIS!) =====
GEMINI_API_KEY=your_actual_gemini_api_key_here
# ===== SECURITY KEYS (MUST BE IDENTICAL) =====
SECRET_KEY=your_generated_secret_key_must_be_same_for_all_three
JWT_SECRET_KEY=your_generated_secret_key_must_be_same_for_all_three
MCP_AUTH_SECRET_KEY=your_generated_secret_key_must_be_same_for_all_three
# ===== SERVER CONFIGURATION =====
APP_HOST=0.0.0.0
APP_PORT=8000
MCP_HOST=0.0.0.0
MCP_PORT=8002
# ===== EMBEDDING & LLM =====
EMBEDDING_PROVIDER=gemini
embedding_model=text-embedding-004
LLM_PROVIDER=gemini
LLM_MODEL=gemini-2.0-flash
# ===== TABLE NAMES =====
DOCUMENTS_TABLE=documents_DEMO_gemini
VDB_TABLE=vdb_tbl_DEMO_gemini
# ===== MCP CONFIGURATION =====
MCP_ENABLE_AUTH=true
MCP_ENABLE_VECTOR_TOOLS=true
MCP_ENABLE_DATABASE_TOOLS=true
MCP_ENABLE_RAG_TOOLS=true
MCP_READ_ONLY=false
MCP_LOG_LEVEL=INFO
# ===== PROCESSING =====
CHUNK_SIZE=512
CHUNK_OVERLAP=128
DOCUMENT_PROCESSING_BATCH_SIZE=5
EMBEDDING_BATCH_SIZE=32# Start RAG API
/opt/rag-in-a-box/bin/rag-api --config /path/to/config.env
# Start MCP Server
CONFIG_FILE=/path/to/config.env /opt/rag-in-a-box/bin/mcp-serversudo netstat -tuln | grep -E ':(8000|8002)'# Test RAG API
curl http://localhost:8000/health
# Expected: {"status":"healthy","database":"connected"}
# Test MCP Server
curl http://localhost:8002/health
# Expected: {"status":"healthy"}
# Test API info
curl http://localhost:8000/INFO: Started server process
INFO: Waiting for application startup.
INFO: Application startup complete.
INFO: Uvicorn running on http://0.0.0.0:8000# Generate token
curl -X POST "http://localhost:8000/token" \
-H "Content-Type: application/json" \
-d '{"username":"admin","password":"your_password"}'
# Save token for next commands
export TOKEN="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."# Create test document
echo "This is a test document for MariaDB AI RAG RAG system. It contains sample text for testing." > test_document.txt
# Upload document
curl -X POST "http://localhost:8000/documents/ingest" \
-H "Authorization: Bearer $TOKEN" \
-F "file=@test_document.txt"
# Expected output:
# {"document_id":1,"filename":"test_document.txt","chunks_created":1,"status":"success"}# Query the document
curl -X POST "http://localhost:8000/orchestrate/generation" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"query":"What is this document about?"}'
# Expected: AI-generated response with sources# Login to MariaDB
mariadb -u root -p kb_chunks
# Enter password: [your_password]-- Show tables
SHOW TABLES;
-- Check documents
SELECT id, filename, created_at FROM documents_DEMO_gemini;
-- Check embeddings
SELECT COUNT(*) FROM vdb_tbl_DEMO_gemini;
-- Exit
EXIT;hostname -Isudo systemctl status mariadb
sudo systemctl start mariadbnano /path/to/config.env
# Check for typos, missing valuessudo lsof -i :8000
sudo lsof -i :8002
# Stop conflicting service or kill processsudo chmod +x /opt/rag-in-a-box/bin/rag-api
sudo chmod +x /opt/rag-in-a-box/bin/mcp-server
sudo chmod 640 /opt/rag-in-a-box/config/config.env.template# Test MariaDB connection
mariadb -u root -p -e "SELECT 1;"
# Check MariaDB status
sudo systemctl status mariadb
# Restart MariaDB
sudo systemctl restart mariadb
# Check credentials in config
sudo grep DB_ /path/to/config.env
# View MariaDB logs
sudo tail -f /var/log/mysql/error.log# Verify all three secret keys are identical
sudo grep SECRET_KEY /path/to/config.env
# Should show same value for:
# SECRET_KEY=...
# JWT_SECRET_KEY=...
# MCP_AUTH_SECRET_KEY=...
# If different, fix and restart
nano /path/to/config.env# Test Gemini API key
API_KEY="YOUR_KEY"
curl -s "https://generativelanguage.googleapis.com/v1beta/models?key=$API_KEY"
# If invalid, update config
nano /path/to/config.env
# Update: GEMINI_API_KEY=...
# Restart services
/opt/rag-in-a-box/bin/rag-api --config /path/to/config.env
CONFIG_FILE=/path/to/config.env /opt/rag-in-a-box/bin/mcp-server# Find process using port
sudo lsof -i :8000
sudo lsof -i :8002
# Kill process (if safe)
sudo kill <PID># Check memory
free -h
top
# Add swap if needed (4GB example)
sudo fallocate -l 4G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
# Make permanent
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab# Check service status
sudo systemctl status mariadb
# Test RAG API
curl http://localhost:8000/health
# Expected: {"status":"healthy","database":"connected"}
# Test MCP Server
curl http://localhost:8002/health
# Expected: {"status":"healthy"}
# Test API info
curl http://localhost:8000/
# Monitor disk space
df -h# Backup
sudo mysqldump -u root -p kb_chunks > kb_chunks_backup_$(date +%Y%m%d).sql
# Compress backup
gzip kb_chunks_backup_$(date +%Y%m%d).sql
# Restore (if needed)
mariadb -u root -p kb_chunks < kb_chunks_backup_20241013.sql# Edit config
nano /path/to/config.env
# Restart services to apply changes
/opt/rag-in-a-box/bin/rag-api --config /path/to/config.env
CONFIG_FILE=/path/to/config.env /opt/rag-in-a-box/bin/mcp-server# Install new version
sudo apt install -y ./ai-nexus-new-version.deb
# Start services in their own terminals
/opt/rag-in-a-box/bin/rag-api --config /path/to/config.env
CONFIG_FILE=/path/to/config.env /opt/rag-in-a-box/bin/mcp-server
# Verify
curl http://localhost:8000/healthmariadb -u root -p <<EOF
USE kb_chunks;
OPTIMIZE TABLE documents_DEMO_gemini;
OPTIMIZE TABLE vdb_tbl_DEMO_gemini;
EXIT;
EOF# Remove package
sudo apt remove --purge rag-in-a-box
# Remove configuration (optional)
sudo rm -rf /opt/rag-in-a-box/
# Remove database (optional - ⚠️ deletes all data)
mariadb -u root -p -e "DROP DATABASE kb_chunks;"# Change MariaDB root password
sudo mariadb -u root -pALTER USER 'root'@'localhost' IDENTIFIED BY 'your_new_secure_password';
FLUSH PRIVILEGES;
EXIT;nano /path/to/config.env
# DB_PASSWORD=your_new_secure_password
/opt/rag-in-a-box/bin/rag-api --config /path/to/config.env
CONFIG_FILE=/path/to/config.env /opt/rag-in-a-box/bin/mcp-server# Generate secure key
python3 -c "import secrets; print(secrets.token_urlsafe(64))"
# Use same value for all three keys in config
nano /path/to/config.env# Install UFW
sudo apt install -y ufw
# Allow SSH (IMPORTANT!)
sudo ufw allow 22/tcp
# Allow RAG API
sudo ufw allow 8000/tcp
# Allow MCP Server
sudo ufw allow 8002/tcp
# Enable firewall
sudo ufw enable
# Check status
sudo ufw status# Create dedicated database user
sudo mariadb -u root -pCREATE USER 'rag_user'@'localhost' IDENTIFIED BY 'your_secure_password';
GRANT ALL PRIVILEGES ON kb_chunks.* TO 'rag_user'@'localhost';
FLUSH PRIVILEGES;
EXIT;nano /path/to/config.env
# DB_USER=rag_user
# DB_PASSWORD=your_secure_password# Start services
/opt/rag-in-a-box/bin/rag-api --config /path/to/config.env
CONFIG_FILE=/path/to/config.env /opt/rag-in-a-box/bin/mcp-server
# Test health
curl http://localhost:8000/health
# Edit config
nano /path/to/config.env
# Database access
mariadb -u root -p kb_chunks/opt/rag-in-a-box/bin/rag-api # RAG API binary
/opt/rag-in-a-box/bin/mcp-server # MCP Server binary
/opt/rag-in-a-box/config/config.env.template # Configuration file
/var/log/mysql/error.log # MariaDB logsMariaDB (Port 3306)
↓
RAG API (Port 8000)
↓
MCP Server (Port 8002)Ubuntu System (Native)
├── MariaDB Service (systemd)
│ └── Database: kb_chunks (Port 3306)
├── RAG API Service (systemd)
│ └── FastAPI Server (Port 8000)
└── MCP Server Service (systemd)
└── FastAPI Server (Port 8002)sudo nano /etc/mysql/mariadb.conf.d/50-server.cnf[mysqld]
# Adjust based on available RAM
innodb_buffer_pool_size = 4G # 50-70% of RAM
max_connections = 200
innodb_log_file_size = 512M
query_cache_size = 0
query_cache_type = 0# Monitor resources
htop
# Or
top
# Check disk I/O
iostat -x 1
# Check network
iftopapiVersion: enterprise.mariadb.com/v1alpha1
kind: Backup
metadata:
name: backup
spec:
mariaDbRef:
name: mariadb
storage:
persistentVolumeClaim:
resources:
requests:
storage: 100Mi
accessModes:
- ReadWriteOnceapiVersion: enterprise.mariadb.com/v1alpha1
kind: Backup
metadata:
name: backup
spec:
mariaDbRef:
name: mariadb
storage:
s3:
bucket: backups
prefix: mariadb
endpoint: minio.minio.svc.cluster.local:9000
region: us-east-1
accessKeyIdSecretKeyRef:
name: minio
key: access-key-id
secretAccessKeySecretKeyRef:
name: minio
key: secret-access-key
tls:
enabled: true
caSecretKeyRef:
name: minio-ca
key: tls.crtapiVersion: v1
kind: ServiceAccount
metadata:
name: mariadb-backup
annotations:
eks.amazonaws.com/role-arn: arn:aws:iam::<<account_id>>:role/my-role-irsaapiVersion: enterprise.mariadb.com/v1alpha1
kind: Backup
metadata:
name: backup
spec:
mariaDbRef:
name: mariadb
serviceAccountName: mariadb-backup
storage:
s3:
bucket: backups
prefix: mariadb
endpoint: s3.us-east-1.amazonaws.com
region: us-east-1
tls:
enabled: trueapiVersion: enterprise.mariadb.com/v1alpha1
kind: Backup
metadata:
name: backup
spec:
mariaDbRef:
name: mariadb
schedule:
cron: "*/1 * * * *"
suspend: falseapiVersion: enterprise.mariadb.com/v1alpha1
kind: Backup
metadata:
name: backup
spec:
mariaDbRef:
name: mariadb
maxRetention: 720h # 30 daysapiVersion: enterprise.mariadb.com/v1alpha1
kind: Backup
metadata:
name: backup
spec:
mariaDbRef:
name: mariadb
compression: gzipapiVersion: enterprise.mariadb.com/v1alpha1
kind: Restore
metadata:
name: restore
spec:
mariaDbRef:
name: mariadb
backupRef:
name: backupapiVersion: enterprise.mariadb.com/v1alpha1
kind: Restore
metadata:
name: restore
spec:
mariaDbRef:
name: mariadb
s3:
bucket: backups
prefix: mariadb
endpoint: minio.minio.svc.cluster.local:9000
region: us-east-1
accessKeyIdSecretKeyRef:
name: minio
key: access-key-id
secretAccessKeySecretKeyRef:
name: minio
key: secret-access-key
tls:
enabled: true
caSecretKeyRef:
name: minio-ca
key: tls.crtapiVersion: enterprise.mariadb.com/v1alpha1
kind: Restore
metadata:
name: restore
spec:
mariaDbRef:
name: mariadb
backupRef:
name: backup
targetRecoveryTime: 2023-12-19T09:00:00ZapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-from-backup
spec:
storage:
size: 1Gi
bootstrapFrom:
backupRef:
name: backup
targetRecoveryTime: 2023-12-19T09:00:00ZapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-from-backup
spec:
storage:
size: 1Gi
bootstrapFrom:
s3:
bucket: backups
prefix: mariadb
endpoint: minio.minio.svc.cluster.local:9000
accessKeyIdSecretKeyRef:
name: minio
key: access-key-id
secretAccessKeySecretKeyRef:
name: minio
key: secret-access-key
tls:
enabled: true
caSecretKeyRef:
name: minio-ca
key: tls.crt
targetRecoveryTime: 2023-12-19T09:00:00ZapiVersion: enterprise.mariadb.com/v1alpha1
kind: Backup
metadata:
name: backup
spec:
mariaDbRef:
name: mariadb
databases:
- db1
- db2
- db3apiVersion: enterprise.mariadb.com/v1alpha1
kind: Restore
metadata:
name: restore
spec:
mariaDbRef:
name: mariadb
backupRef:
name: backup
database: db1apiVersion: enterprise.mariadb.com/v1alpha1
kind: Backup
metadata:
name: backup
spec:
mariaDbRef:
name: mariadb
args:
- --verboseapiVersion: enterprise.mariadb.com/v1alpha1
kind: Restore
metadata:
name: restore
spec:
mariaDbRef:
name: mariadb
backupRef:
name: backup
args:
- --verboseapiVersion: enterprise.mariadb.com/v1alpha1
kind: Backup
metadata:
name: backup
spec:
storage:
s3:
...
stagingStorage:
persistentVolumeClaim:
resources:
requests:
storage: 10Gi
accessModes:
- ReadWriteOnceapiVersion: enterprise.mariadb.com/v1alpha1
kind: Restore
metadata:
name: restore
spec:
s3:
...
stagingStorage:
persistentVolumeClaim:
resources:
requests:
storage: 10Gi
accessModes:
- ReadWriteOnceapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb
spec:
bootstrapFrom:
s3:
...
stagingStorage:
persistentVolumeClaim:
resources:
requests:
storage: 10Gi
accessModes:
- ReadWriteOnceapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb
spec:
storage:
size: 1Gi
bootstrapFrom:
restoreJob:
args:
- --verbose
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
memory: 1GiapiVersion: enterprise.mariadb.com/v1alpha1
kind: Backup
metadata:
name: backup
spec:
mariaDbRef:
name: mariadb
ignoreGlobalPriv: falsemariadb-dump --user=${MARIADB_USER} --password=${MARIADB_PASSWORD} --host=${MARIADB_HOST} --single-transaction --events --routines --all-databases > backup.2024-08-26T12:24:34Z.sqlmariadb-dump --user=${MARIADB_USER} --password=${MARIADB_PASSWORD} --host=${MARIADB_HOST} --single-transaction --events --routines --all-databases --skip-add-locks --ignore-table=mysql.global_priv > backup.2024-08-26T12:24:34Z.sqlapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
rootPasswordSecretKeyRef:
name: mariadb
key: root-password
replicas: 3
galera:
enabled: true
storage:
size: 1Gi
bootstrapFrom:
s3:
bucket: backups
prefix: mariadb
endpoint: minio.minio.svc.cluster.local:9000
accessKeyIdSecretKeyRef:
name: minio
key: access-key-id
secretAccessKeySecretKeyRef:
name: minio
key: secret-access-key
tls:
enabled: true
caSecretKeyRef:
name: minio-ca
key: tls.crt
targetRecoveryTime: 2024-08-26T12:24:34ZapiVersion: enterprise.mariadb.com/v1alpha1
kind: Backup
metadata:
name: backup-standalone
spec:
mariaDbRef:
name: mariadb-standalone
ignoreGlobalPriv: trueapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
replicas: 3
galera:
enabled: true
storage:
size: 1Gi
bootstrapFrom:
backupRef:
name: backup-standaloneRestart and wait until the bootstrap node becomes ready.
Restart the rest of the nodes one by one so they can join the new cluster.
Click "Execute"
Copy access_token from response
Replay pending transactions when a server goes down.
Support for Galera and Replication.
To better understand what MaxScale is capable of you may check the product page and the documentation.
Prior to configuring MaxScale within Kubernetes, it's essential to have a basic understanding of the resources managed through its API.
A server defines the backend database servers that MaxScale forwards traffic to. For more detailed information, please consult the server reference.
A monitor is an agent that queries the state of the servers and makes it available to the services in order to route traffic based on it. For more detailed information, please consult the monitor reference.
Depending on which highly available configuration your servers have, you will need to choose betweeen the following modules:
Galera Monitor: Detects whether servers are part of the cluster, ensuring synchronization among them, and assigning primary and replica roles as needed.
MariaDB Monitor: Probes the state of the cluster, assigns roles to the servers, and executes failover, switchover, and rejoin operations as necessary.
A service defines how the traffic is routed to the servers based on a routing algorithm that takes into account the state of the servers and its role. For more detailed information, please consult the service reference.
Depending on your requirements to route traffic, you may choose between the following routers:
Readwritesplit: Route write queries to the primary server and read queries to the replica servers.
Readconnroute: Load balance connections between multiple servers.
A listener specifies a port where MaxScale listens for incoming connections. It is associated with a service that handles the requests received on that port. For more detailed information, please consult the listener reference.
The minimal spec you need to provision a MaxScale instance is just a reference to a MariaDB resource:
This will provision a new StatefulSet for running MaxScale and configure the servers specified by the MariaDB resource. Refer to the Server configuration section if you want to manually configure the MariaDB servers.
The rest of the configuration uses reasonable defaults set automatically by the operator. If you need a more fine grained configuration, you can provide this values yourself:
As you can see, the MaxScale resources we previously mentioned have a counterpart resource in the MaxScale CR.
The previous example configured a MaxScale for a Galera cluster, but you may also configure MaxScale with a MariaDB that uses replication. It is important to note that the monitor module is automatically inferred by the operator based on the MariaDB reference you provided, however, its parameters are specific to each monitor module:
You also need to set a reference in the MariaDB resource to make it MaxScale-aware. This is explained in the MariaDB CR section.
Refer to the API reference for further detail.
You can set a spec.maxScaleRef in your MariaDB resource to make it MaxScale-aware. By doing so, the primary server reported by MaxScale will be used in MariaDB and the high availability tasks such the primary failover will be delegated to MaxScale:
Refer to the API reference for further detail.
To streamline the setup outlined in the MaxScale CR and MariaDB CR sections, you can provision a MaxScale to be used with MariaDB in just one resource:
This will automatically set the references between MariaDB and MaxScale and default the rest of the fields.
It is important to note that, this is intended for simple use cases that only require a single replica and where no further modifications are done on the spec.maxscale field. If you need a more fine grained configuration and perform further updates to the MaxScale resource, please use a dedicated MaxScale as described in the MaxScale CR section.
Refer to the API reference for further detail.
MariaDB Enterprise Kubernetes Operator aims to provide highly configurable CRs, but at the same time maximize its usability by providing reasonable defaults. In the case of MaxScale, the following defaulting logic is applied:
spec.servers are inferred from spec.mariaDbRef.
spec.monitor.module is inferred from the spec.mariaDbRef.
spec.monitor.cooperativeMonitoring is set if high availability is enabled.
If spec.services is not provided, a readwritesplit service is configured on port 3306 by default.
As an alternative to provide a reference to a MariaDB via spec.mariaDbRef, you can also specify the servers manually:
As you could see, you can refer to in-cluser MariaDB servers by providing the DNS names of the MariaDB Pods as server addresses. In addition, you can also refer to external MariaDB instances running outside of the Kubernetes cluster where the operator was deployed:
Pointing to external MariaDBs has some limitations: Since the operator doesn't have a reference to a MariaDB resource (spec.mariaDbRef), it will be unable to perform the following actions:
Infer the monitor module (spec.monitor.module), so it will need to be provided by the user.
Autogenerate authentication credentials (spec.auth), so they will need to be provided by the user. See Authentication section.
You can declaratively select the primary server by setting spec.primaryServer=<server>:
This will trigger a switchover operation and MaxScale will promote the specified server to be the new primary server.
You can put servers in maintenance mode by setting the server field maintenance=true:
Similar to MariaDB, MaxScale allows you to provide global configuration parameters in a maxscale.conf file. You don't need to provide this config file directly, but instead you can use the spec.config.params to instruct the operator to create the maxscale.conf:
Both this global configuration and the resources created by the operator using the MaxScale API are stored under a volume provisioned by the spec.config.volumeClaimTemplate. Refer to the troubleshooting if you are getting errors writing on this volume.
Refer to the MaxScale reference for more details about the supported parameters.
MaxScale requires authentication with differents levels of permissions for the following components/actors:
MaxScale API consumed by MariaDB Enterprise Kubernetes Operator.
Clients connecting to MaxScale.
MaxScale connecting to MariaDB servers.
MaxScale monitor connecting to MariaDB servers.
MaxScale configuration syncer to connect to MariaDB servers. See section.
By default, the operator generates this credentials when spec.mariaDbRef is set and spec.auth.generate = true, but you are still able to provide your own:
As you could see, you are also able to limit the number of connections for each component/actor. Bear in mind that, when running in high availability, you may need to increase this number, as more MaxScale instances implies more connections.
To enable your applications to communicate with MaxScale, a Kubernetes Service is provisioned with all the ports specified in the MaxScale listeners. You have the flexibility to provide a template to customize this Service:
This results in the reconciliation of the following Service:
There is also another Kubernetes Service to access the GUI, please refer to the MaxScale GUI section for further detail.
You can leverage the Connection resource to automatically configure connection strings as Secret resources that your applications can mount:
Alternatively, you can also provide a connection template to your MaxScale resource:
Note that, the Connection uses the Service described in the Kubernetes Service section and you are able to specify which MaxScale service to connect to by providing the port (spec.port) of the corresponding MaxScale listener.
To synchronize the configuration state across multiple replicas, MaxScale stores the configuration externally in a MariaDB table and conducts periodic polling across all replicas. By default, the table mysql.maxscale_config is used, but this can be configured by the user as well as the synchronization interval.
Another crucial aspect to consider regarding HA is that only one monitor can be running at any given time to avoid conflicts. This can be achieved via cooperative locking, which can be configured by the user. Refer to for more information.
Multiple MaxScale replicas can be specified by providing the spec.replicas field. Note that, MaxScale exposes the scale subresource, so you can scale/downscale it by running the following command:
In order to enable this feature, you must set the --feature-maxscale-suspend feature flag:
Then you will be able to suspend any MaxScale resources, for instance, you can suspend a monitor:
MaxScale offers a great user interface that provides very useful information about the MaxScale resources. You can enable it by providing the following configuration:
The GUI is exposed via a dedicated Kubernetes Service in the same port as the MaxScale API. Once you access, you will need to enter the MaxScale API credentials configured by the operator in a Secret. See the Authentication section for more details.
MariaDB Enterprise Kubernetes Operator interacts with the to reconcile the specification provided by the user, considering both the MaxScale status retrieved from the API and the provided spec.
The operator tracks both the MaxScale status in regards to Kubernetes resources as well as the status of the MaxScale API resources. This information is available on the status field of the MaxScale resource, it may be very useful for debugging purposes:
Kubernetes events emitted by mariadb-enterprise-operator may also be very relevant for debugging. For instance, an event is emitted whenever the primary server changes:
The operator logs can also be a good source of information for troubleshooting. You can increase its verbosity and enable MaxScale API request logs by running:
This error occurs when the user that runs the container does not have enough privileges to write in /var/lib/maxscale:
To mitigate this, by default, the operator sets the following securityContext in the MaxScale's StatefulSet:
This enables the CSIDriver and the kubelet to recursively set the ownership ofr the /var/lib/maxscale folder to the group 999, which is the one expected by MaxScale. It is important to note that not all the CSIDrivers implementations support this feature, see the CSIDriver documentation for further information.
apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
...
replicas: 3
galera:
enabled: trueapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
...
galera:
enabled: true
config:
reuseStorageVolume: trueapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
...
galera:
providerOptions:
gcs.fc_limit: '64'apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
...
galera:
enabled: true
recovery:
enabled: true
minClusterSize: 1
clusterMonitorInterval: 10s
clusterHealthyTimeout: 30s
clusterBootstrapTimeout: 10m
podRecoveryTimeout: 5m
podSyncTimeout: 5mapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
...
galera:
enabled: true
recovery:
job:
metadata:
labels:
sidecar.istio.io/inject: "false"
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
memory: 256MiapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
...
galera:
enabled: true
recovery:
enabled: true
forceClusterBootstrapInPod: "mariadb-galera-0"kubectl get mariadb mariadb-galera -o jsonpath="{.status.galeraRecovery}" | jq
{
"recovered": {
"mariadb-galera-0": {
"seqno": 350454,
"uuid": "67a44ea9-63a8-11ef-98a2-2b0c0aa0a627"
},
"mariadb-galera-1": {
"seqno": 350450,
"uuid": "67a44ea9-63a8-11ef-98a2-2b0c0aa0a627"
}
},
"state": {
"mariadb-galera-0": {
"safeToBootstrap": false,
"seqno": -1,
"uuid": "67a44ea9-63a8-11ef-98a2-2b0c0aa0a627",
"version": "2.1"
},
"mariadb-galera-1": {
"safeToBootstrap": false,
"seqno": -1,
"uuid": "67a44ea9-63a8-11ef-98a2-2b0c0aa0a627",
"version": "2.1"
},
"mariadb-galera-2": {
"safeToBootstrap": false,
"seqno": -1,
"uuid": "67a44ea9-63a8-11ef-98a2-2b0c0aa0a627",
"version": "2.1"
}
}
}apiVersion: v1
kind: Secret
metadata:
name: mariadb
stringData:
root-password: MariaDB11!
---
apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
rootPasswordSecretKeyRef:
name: mariadb
key: root-password
storage:
size: 1Gi
replicas: 3
galera:
enabled: truekubectl get mariadbs
NAME READY STATUS PRIMARY POD AGE
mariadb-galera True Running mariadb-galera-0 48m
kubectl get events --field-selector involvedObject.name=mariadb-galera --sort-by='.lastTimestamp'
LAST SEEN TYPE REASON OBJECT MESSAGE
...
45m Normal GaleraClusterHealthy mariadb/mariadb-galera Galera cluster is healthy
kubectl get mariadb mariadb-galera -o jsonpath="{.status.conditions[?(@.type=='GaleraReady')]}" | jq
{
"lastTransitionTime": "2023-07-13T18:22:31Z",
"message": "Galera ready",
"reason": "GaleraReady",
"status": "True",
"type": "GaleraReady"
}
kubectl get mariadb mariadb-galera -o jsonpath="{.status.conditions[?(@.type=='GaleraConfigured')]}" | jq
{
"lastTransitionTime": "2023-07-13T18:22:31Z",
"message": "Galera configured",
"reason": "GaleraConfigured",
"status": "True",
"type": "GaleraConfigured"
}
kubectl get statefulsets
NAME READY AGE
mariadb-galera 3/3 58m
kubectl get pods -o wide
NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
mariadb-galera-0 2/2 Running 0 58m 10.244.2.4 mdb-worker3 <none> <none>
mariadb-galera-1 2/2 Running 0 58m 10.244.1.9 mdb-worker2 <none> <none>
mariadb-galera-2 2/2 Running 0 58m 10.244.5.4 mdb-worker4 <none> <none>kubectl delete pods -l app.kubernetes.io/instance=mariadb-galera
pod "mariadb-galera-0" deleted
pod "mariadb-galera-1" deleted
pod "mariadb-galera-2" deletedkubectl get mariadb mariadb-galera
NAME READY STATUS PRIMARY POD AGE
mariadb-galera False Galera not ready mariadb-galera-0 67m
kubectl get events --field-selector involvedObject.name=mariadb-galera --sort-by='.lastTimestamp'
LAST SEEN TYPE REASON OBJECT MESSAGE
...
48s Warning GaleraClusterNotHealthy mariadb/mariadb-galera Galera cluster is not healthy
kubectl get mariadb mariadb-galera -o jsonpath="{.status.conditions[?(@.type=='GaleraReady')]}" | jq
{
"lastTransitionTime": "2023-07-13T19:25:17Z",
"message": "Galera not ready",
"reason": "GaleraNotReady",
"status": "False",
"type": "GaleraReady"
}kubectl get events --field-selector involvedObject.name=mariadb-galera --sort-by='.lastTimestamp'
LAST SEEN TYPE REASON OBJECT MESSAGE
...
16m Warning GaleraClusterNotHealthy mariadb/mariadb-galera Galera cluster is not healthy
16m Normal GaleraPodStateFetched mariadb/mariadb-galera Galera state fetched in Pod 'mariadb-galera-2'
16m Normal GaleraPodStateFetched mariadb/mariadb-galera Galera state fetched in Pod 'mariadb-galera-1'
16m Normal GaleraPodStateFetched mariadb/mariadb-galera Galera state fetched in Pod 'mariadb-galera-0'
16m Normal GaleraPodRecovered mariadb/mariadb-galera Recovered Galera sequence in Pod 'mariadb-galera-1'
16m Normal GaleraPodRecovered mariadb/mariadb-galera Recovered Galera sequence in Pod 'mariadb-galera-2'
17m Normal GaleraPodRecovered mariadb/mariadb-galera Recovered Galera sequence in Pod 'mariadb-galera-0'
17m Normal GaleraClusterBootstrap mariadb/mariadb-galera Bootstrapping Galera cluster in Pod 'mariadb-galera-2'
20m Normal GaleraClusterHealthy mariadb/mariadb-galera Galera cluster is healthy
kubectl get mariadb mariadb-galera -o jsonpath="{.status.galeraRecovery}" | jq
{
"bootstrap": {
"pod": "mariadb-galera-2",
"time": "2023-07-13T19:25:28Z"
},
"recovered": {
"mariadb-galera-0": {
"seqno": 3,
"uuid": "bf00b9c3-21a9-11ee-984f-9ba9ff0e9285"
},
"mariadb-galera-1": {
"seqno": 3,
"uuid": "bf00b9c3-21a9-11ee-984f-9ba9ff0e9285"
},
"mariadb-galera-2": {
"seqno": 3,
"uuid": "bf00b9c3-21a9-11ee-984f-9ba9ff0e9285"
}
},
"state": {
"mariadb-galera-0": {
"safeToBootstrap": false,
"seqno": -1,
"uuid": "bf00b9c3-21a9-11ee-984f-9ba9ff0e9285",
"version": "2.1"
},
"mariadb-galera-1": {
"safeToBootstrap": false,
"seqno": -1,
"uuid": "bf00b9c3-21a9-11ee-984f-9ba9ff0e9285",
"version": "2.1"
},
"mariadb-galera-2": {
"safeToBootstrap": false,
"seqno": -1,
"uuid": "bf00b9c3-21a9-11ee-984f-9ba9ff0e9285",
"version": "2.1"
}
}
}kubectl get mariadb mariadb-galera -o jsonpath="{.status.conditions[?(@.type=='GaleraReady')]}" | jq
{
"lastTransitionTime": "2023-07-13T19:27:51Z",
"message": "Galera ready",
"reason": "GaleraReady",
"status": "True",
"type": "GaleraReady"
}
kubectl get mariadb mariadb-galera
NAME READY STATUS PRIMARY POD AGE
mariadb-galera True Running mariadb-galera-0 82mkubectl get mariadb mariadb-galera -o jsonpath="{.status.conditions}" | jq
[
{
"lastTransitionTime": "2023-08-05T14:58:57Z",
"message": "Galera not ready",
"reason": "GaleraNotReady",
"status": "False",
"type": "Ready"
},
{
"lastTransitionTime": "2023-08-05T14:58:57Z",
"message": "Galera not ready",
"reason": "GaleraNotReady",
"status": "False",
"type": "GaleraReady"
},
{
"lastTransitionTime": "2023-08-03T19:21:16Z",
"message": "Galera configured",
"reason": "GaleraConfigured",
"status": "True",
"type": "GaleraConfigured"
}
]kubectl get endpoints mariadb-galera-internal -o yaml
apiVersion: v1
kind: Endpoints
metadata:
name: mariadb-internal
subsets:
- addresses:
- hostname: mariadb-1
ip: 10.255.140.181
nodeName: k8s-worker-1
targetRef:
kind: Pod
name: mariadb-1
namespace: mariadb
- hostname: mariadb-2
ip: 10.255.20.156
nodeName: k8s-worker-2
targetRef:
kind: Pod
name: mariadb-2
namespace: mariadb
- hostname: mariadb-0
ip: 10.255.214.164
nodeName: k8s-worker-0
targetRef:
kind: Pod
name: mariadb-0
namespace: mariadb
ports:
- name: sst
port: 4568
protocol: TCP
- name: ist
port: 4567
protocol: TCP
- name: mariadb
port: 3306
protocol: TCP
- name: agent
port: 5555
protocol: TCP
- name: cluster
port: 4444
protocol: TCPkubectl get events --field-selector involvedObject.name=mariadb-galera --sort-by='.lastTimestamp'
LAST SEEN TYPE REASON OBJECT MESSAGE
...
16m Warning GaleraClusterNotHealthy mariadb/mariadb-galera Galera cluster is not healthy
16m Normal GaleraPodStateFetched mariadb/mariadb-galera Galera state fetched in Pod 'mariadb-galera-2'
16m Normal GaleraPodStateFetched mariadb/mariadb-galera Galera state fetched in Pod 'mariadb-galera-1'
16m Normal GaleraPodStateFetched mariadb/mariadb-galera Galera state fetched in Pod 'mariadb-galera-0'
16m Normal GaleraPodRecovered mariadb/mariadb-galera Recovered Galera sequence in Pod 'mariadb-galera-1'
16m Normal GaleraPodRecovered mariadb/mariadb-galera Recovered Galera sequence in Pod 'mariadb-galera-2'
17m Normal GaleraPodRecovered mariadb/mariadb-galera Recovered Galera sequence in Pod 'mariadb-galera-0'
17m Normal GaleraClusterBootstrap mariadb/mariadb-galera Bootstrapping Galera cluster in Pod 'mariadb-galera-2'
20m Normal GaleraClusterHealthy mariadb/mariadb-galera Galera cluster is healthyhelm upgrade --install mariadb-enterprise-operator mariadb-enterprise-operator/mariadb-enterprise-operator --set logLevel=debug
kubectl logs mariadb-enterprise-operator-546c78f4f5-gq44k
{"level":"info","ts":1691090524.4911606,"logger":"galera.health","msg":"Checking Galera cluster health","controller":"statefulset","controllerGroup":"apps","controllerKind":"StatefulSet","statefulSet":{"name":"mariadb-galera","namespace":"default"},"namespace":"default","name":"mariadb-galera","reconcileID":"098620db-4486-45cc-966a-9f3fec0d165e"}
{"level":"debug","ts":1691090524.4911761,"logger":"galera.health","msg":"StatefulSet ready replicas","controller":"statefulset","controllerGroup":"apps","controllerKind":"StatefulSet","statefulSet":{"name":"mariadb-galera","namespace":"default"},"namespace":"default","name":"mariadb-galera","reconcileID":"098620db-4486-45cc-966a-9f3fec0d165e","replicas":1}kubectl logs mariadb-galera-0 -c init
{"level":"info","ts":1691090778.5239124,"msg":"Starting init"}
{"level":"info","ts":1691090778.5305626,"msg":"Configuring Galera"}
{"level":"info","ts":1691090778.5307593,"msg":"Already initialized. Init done"}
kubectl logs mariadb-galera-0 -c agent
{"level":"info","ts":1691090779.3193653,"logger":"server","msg":"server listening","addr":":5555"}
2023/08/03 19:26:28 "POST http://mariadb-galera-0.mariadb-galera-internal.default.svc.cluster.local:5555/api/recovery HTTP/1.1" from 10.244.4.2:39162 - 200 58B in 4.112086ms
2023/08/03 19:26:28 "DELETE http://mariadb-galera-0.mariadb-galera-internal.default.svc.cluster.local:5555/api/recovery HTTP/1.1" from 10.244.4.2:39162 - 200 0B in 883.544µs
kubectl logs mariadb-galera-0 -c mariadb
2023-08-03 19:27:10 0 [Note] WSREP: Member 2.0 (mariadb-galera-0) synced with group.
2023-08-03 19:27:10 0 [Note] WSREP: Processing event queue:...100.0% (1/1 events) complete.
2023-08-03 19:27:10 0 [Note] WSREP: Shifting JOINED -> SYNCED (TO: 6)
2023-08-03 19:27:10 2 [Note] WSREP: Server mariadb-galera-0 synced with group
2023-08-03 19:27:10 2 [Note] WSREP: Server status change joined -> synced
2023-08-03 19:27:10 2 [Note] WSREP: Synchronized with group, ready for connectionskubectl get mariadb mariadb-galera -o jsonpath="{.status.galeraRecovery}" | jqkubectl get events --field-selector involvedObject.name=mariadb-galeraError writing Galera config: open /etc/mysql/mariadb.conf.d/0-galera.cnf: permission deniedapiVersion: apps/v1
kind: StatefulSet
metadata:
name: mariadb-galera
spec:
securityContext:
fsGroup: 999
runAsGroup: 999
runAsNonRoot: true
runAsUser: 999Error reconciling Galera: error disabling bootstrap in Pod 0: unauthorizedkubectl auth can-i --list --as=system:serviceaccount:default:mariadb-enterprise-operator | grep tokenreview
tokenreviews.authentication.k8s.io [] [] [create]
kubectl auth can-i --list --as=system:serviceaccount:default:mariadb-galera | grep tokenreview
tokenreviews.authentication.k8s.io [] [] [create]kubectl get clusterrole system:auth-delegator
NAME CREATED AT
system:auth-delegator 2023-08-03T19:12:37Z
kubectl get clusterrolebinding | grep mariadb | grep auth-delegator
mariadb-galera:auth-delegator ClusterRole/system:auth-delegator 108m
mariadb-enterprise-operator:auth-delegator ClusterRole/system:auth-delegator 112mhelm upgrade --install mariadb-enterprise-operator mariadb-enterprise-operator/mariadb-enterprise-operatorTimeout waiting for Pod 'mariadb-galera-2' to be SyncedGalera cluster bootstrap timed out. Resetting recovery status# Check Docker
docker --version
# Check disk space
df -h /
# Check shell
echo $SHELL# Check Docker
docker --version
# Check disk space
Get-PSDrive C | Select-Object Used,Free# Check if ports are in use
sudo lsof -i :8000
sudo lsof -i :8002
sudo lsof -i :3306
sudo lsof -i :8200
# No output = ports are free ✓
# Alternative using netstat:
netstat -an | grep :8000# Check if ports are in use
netstat -ano | findstr :8000
netstat -ano | findstr :8002
netstat -ano | findstr :3306
netstat -ano | findstr :8200
# No output = ports are free ✓# Test API key
API_KEY="YOUR_API_KEY_HERE"
curl "https://generativelanguage.googleapis.com/v1beta/models?key=$API_KEY"
# Should return list of models$apiKey = "YOUR_API_KEY_HERE"
$uri = "https://generativelanguage.googleapis.com/v1beta/models?key=$apiKey"
Invoke-RestMethod -Uri $uri
# Should return list of models├── rag-in-a-box_1.0_amd64.deb
├── Dockerfile
├── docker-compose.yml
├── start-services.sh
├── config.env.secure.local
├── config.env.vault.local
├── config.env.template
└── Localvault/
├── docker-compose.vault.yml
└── setup_vault_local.ps1# Navigate to download location
cd /path/to/download/location
# List files
ls -lh# Navigate to download location
cd "C:\path\to\download\location"
# List files
Get-ChildItem | Select-Object Name, Length# API Key (MUST UPDATE)
GEMINI_API_KEY=YOUR_ACTUAL_API_KEY_HERE
# Database (default values OK)
DB_HOST=mysql-db
DB_PORT=3306
DB_USER=root
DB_PASSWORD=your_secure_database_password
DB_NAME=kb_chunks
# Security Keys (MUST BE IDENTICAL)
SECRET_KEY=your_generated_secret_key_must_be_same_for_all_three
JWT_SECRET_KEY=your_generated_secret_key_must_be_same_for_all_three
MCP_AUTH_SECRET_KEY=your_generated_secret_key_must_be_same_for_all_three
# Server Configuration (default values OK)
APP_HOST=0.0.0.0
APP_PORT=8000
MCP_HOST=0.0.0.0
MCP_PORT=8002cd "c:\Users\YourUsername\OneDrive\WIP\MariaDB AI RAG Binaries\Ubuntu"
cd "c:\Users\YourUsername\OneDrive\WIP\AI Nexus Binaries\Ubuntu"
cd "c:\DOWNLOAD-LOCATION"
docker build -t ai-nexus-image .docker images | Select-String "ai-nexus-image"
# Should show: ai-nexus-image latest <image-id> <time> ~1.2GBdocker compose up -d[+] Running 3/3
✔ Network ai-nexus-network Created
✔ Container mysql-db Started
✔ Container ai-nexus Starteddocker logs ai-nexus -f
# Press Ctrl+C to exit (containers keep running)Starting RAG server...
RAG server started with PID: 15
Waiting for RAG API to be ready...
✓ RAG API is ready! (took ~30 seconds)
Starting MCP server...
Adaptive MCP Server ready on 0.0.0.0:8002
INFO: Uvicorn running on http://0.0.0.0:8000docker-compose psNAME STATUS PORTS
ai-nexus Up X minutes 0.0.0.0:8000->8000/tcp, 0.0.0.0:8002->8002/tcp
mysql-db Up X minutes (healthy) 0.0.0.0:3306->3306/tcp# Test RAG API
curl http://localhost:8000/health
# Open Swagger UI in browser
xdg-open http://localhost:8000/docs # Linux
# Test MCP Server
curl http://localhost:8002/health# Test RAG API
Invoke-RestMethod -Uri "http://localhost:8000/health"
# Open Swagger UI
Start-Process "http://localhost:8000/docs"
# Test MCP Server
Invoke-RestMethod -Uri "http://localhost:8002/health"cd "c:\Users\YourUsername\OneDrive\WIP\MariaDB AI RAG Binaries\Ubuntu"
cd "c:\Users\YourUsername\OneDrive\WIP\AI Nexus Binaries\Ubuntu"
cd "c:\DOWNLOAD-LOCATION"
docker build -t ai-nexus-image ..\Localvault\setup_vault_local.ps1[SUCCESS] Vault Setup Complete!
Vault Details:
URL: http://127.0.0.1:8200
Token: rag-root-token
Path: secret/rag-in-a-box# Check Vault container
docker ps --filter "name=rag-vault"
# View secrets
docker exec -e VAULT_TOKEN=rag-root-token rag-vault vault kv get secret/rag-in-a-boxdocker exec -e VAULT_TOKEN=rag-root-token rag-vault vault kv patch secret/rag-in-a-box GEMINI_API_KEY="YOUR_ACTUAL_API_KEY"docker-compose --env-file config.env.vault.local up -ddocker compose ps
docker logs ai-nexus -f
curl http://localhost:8000/healthdocker compose ps
docker logs ai-nexus -f
Invoke-RestMethod -Uri "http://localhost:8000/health"{
"username": "admin",
"password": "your_password"
}{
"query": "What is the main topic of the document?"
}{
"mcpServers": {
"ai-nexus": {
"url": "http://localhost:8002/mcp",
"headers": {
"Authorization": "Bearer YOUR_TOKEN_HERE"
}
}
}
}# Check all services
docker compose ps
# Check RAG API health
curl http://localhost:8000/health
# Check MCP Server health
curl http://localhost:8002/health
# Check logs
docker logs ai-nexus --tail 50
docker logs mysql-db --tail 50# Check all services
docker compose ps
# Check RAG API health
Invoke-RestMethod -Uri "http://localhost:8000/health"
# Check MCP Server health
Invoke-RestMethod -Uri "http://localhost:8002/health"
# Check logs
docker logs ai-nexus --tail 50
docker logs mysql-db --tail 50# Monitor resource usage
docker stats ai-nexus mysql-db
# Check disk space
docker system dfdocker logs mysql-db --tail 20
docker-compose ps
docker exec ai-nexus ping mysql-db# Check secret keys
docker exec ai-nexus env | Select-String "SECRET"
# Restart if needed
docker-compose restart$apiKey = "YOUR_API_KEY"
$uri = "https://generativelanguage.googleapis.com/v1beta/models?key=$apiKey"
Invoke-RestMethod -Uri $uri# Find process on port 8000
netstat -ano | findstr :8000
# Stop process (replace <PID>)
Stop-Process -Id <PID> -Force# Navigate to project
cd "c:\Users\YourUsername\OneDrive\WIP\MariaDB AI RAG Binaries\Ubuntu"
cd "c:\Users\YourUsername\OneDrive\WIP\AI Nexus Binaries\Ubuntu"
cd "c:\DOWNLOAD-LOCATION"
# Build image
docker build -t ai-nexus-image .
# Start (Standalone)
docker-compose up -d
# Start (Vault)
docker-compose --env-file config.env.vault.local up -d
# Stop
docker-compose down
# View logs
docker logs ai-nexus -f
# Check status
docker-compose ps
# Restart
docker-compose restart
# Clean restart
docker-compose down -v && docker-compose up -dapiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale-galera
spec:
mariaDbRef:
name: mariadb-galeraapiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale-galera
spec:
...
mariaDbRef:
name: mariadb-galera
services:
- name: rw-router
router: readwritesplit
listener:
port: 3306
monitor:
interval: 2s
cooperativeMonitoring: majority_of_all
params:
disable_master_failback: "false"
available_when_donor: "false"
disable_master_role_setting: "false"
kubernetesService:
type: LoadBalancer
metadata:
annotations:
metallb.universe.tf/loadBalancerIPs: 172.18.0.224apiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale-repl
spec:
...
mariaDbRef:
name: mariadb-repl
services:
- name: rw-router
router: readwritesplit
params:
transaction_replay: "true"
transaction_replay_attempts: "10"
transaction_replay_timeout: "5s"
max_slave_connections: "255"
max_replication_lag: "3s"
master_accept_reads: "true"
listener:
port: 3306
protocol: MariaDBProtocol
params:
connection_metadata: "tx_isolation=auto"
- name: rconn-master-router
router: readconnroute
params:
router_options: "master"
max_replication_lag: "3s"
master_accept_reads: "true"
listener:
port: 3307
- name: rconn-slave-router
router: readconnroute
params:
router_options: "slave"
max_replication_lag: "3s"
listener:
port: 3308
monitor:
interval: 2s
cooperativeMonitoring: majority_of_all
params:
auto_failover: "true"
auto_rejoin: "true"
switchover_on_low_disk_space: "true"
kubernetesService:
type: LoadBalancer
metadata:
annotations:
metallb.universe.tf/loadBalancerIPs: 172.18.0.214apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
...
maxScaleRef:
name: maxscale-galera
galera:
enabled: trueapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
...
maxScale:
enabled: true
kubernetesService:
type: LoadBalancer
metadata:
annotations:
metallb.universe.tf/loadBalancerIPs: 172.18.0.229
galera:
enabled: trueapiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale-galera
spec:
...
servers:
- name: mariadb-0
address: mariadb-galera-0.mariadb-galera-internal.default.svc.cluster.local
- name: mariadb-1
address: mariadb-galera-1.mariadb-galera-internal.default.svc.cluster.local
- name: mariadb-2
address: mariadb-galera-2.mariadb-galera-internal.default.svc.cluster.localapiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale-galera
spec:
...
servers:
- name: mariadb-0
address: 172.18.0.140
port: 3306
- name: mariadb-1
address: 172.18.0.141
- name: mariadb-2
address: 172.18.0.142
monitor:
name: mariadb-monitor
module: galeramon
interval: 2s
cooperativeMonitoring: majority_of_all
params:
disable_master_failback: "false"
available_when_donor: "false"
disable_master_role_setting: "false"
auth:
adminUsername: mariadb-enterprise-operator
adminPasswordSecretKeyRef:
name: maxscale
key: password
clientUsername: maxscale-client
clientPasswordSecretKeyRef:
name: maxscale
key: password
serverUsername: maxscale-server
serverPasswordSecretKeyRef:
name: maxscale
key: password
monitorUsername: maxscale-monitor
monitorPasswordSecretKeyRef:
name: maxscale
key: password
syncUsername: maxscale-sync
syncPasswordSecretKeyRef:
name: maxscale
key: passwordapiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale-repl
spec:
primaryServer: mariadb-repl-1kubectl patch maxscale maxscale-repl \
--type='merge' \
-p '{"spec":{"primaryServer":"mariadb-repl-1"}}'
kubectl get maxscale
NAME READY STATUS PRIMARY AGE
maxscale-repl False Switching primary to 'mariadb-repl-1' mariadb-repl-0 2m15sapiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale-galera
spec:
servers:
- name: mariadb-0
address: mariadb-galera-0.mariadb-galera-internal.default.svc.cluster.local
port: 3306
protocol: MariaDBBackend
maintenance: trueapiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale-galera
spec:
...
config:
params:
log_info: "true"
volumeClaimTemplate:
resources:
requests:
storage: 100Mi
accessModes:
- ReadWriteOnceapiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale-galera
spec:
...
auth:
generate: false
adminUsername: mariadb-enterprise-operator
adminPasswordSecretKeyRef:
name: maxscale
key: password
deleteDefaultAdmin: true
clientUsername: maxscale-client
clientPasswordSecretKeyRef:
name: maxscale
key: password
clientMaxConnections: 90
serverUsername: maxscale-server
serverPasswordSecretKeyRef:
name: maxscale
key: password
serverMaxConnections: 90
monitorUsername: maxscale-monitor
monitorPasswordSecretKeyRef:
name: maxscale
key: password
monitorMaxConnections: 90
syncUsername: maxscale-sync
syncPasswordSecretKeyRef:
name: maxscale
key: password
syncMaxConnections: 90apiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale-galera
spec:
...
kubernetesService:
type: LoadBalancer
metadata:
annotations:
metallb.universe.tf/loadBalancerIPs: 172.18.0.224apiVersion: v1
kind: Service
metadata:
annotations:
metallb.universe.tf/loadBalancerIPs: 172.18.0.229
name: maxscale-galera
spec:
...
ports:
- name: admin
port: 8989
targetPort: 8989
- name: rw-router-listener
port: 3306
targetPort: 3306
selector:
app.kubernetes.io/instance: maxscale-galera
app.kubernetes.io/name: maxscale
type: LoadBalancerapiVersion: enterprise.mariadb.com/v1alpha1
kind: Connection
metadata:
name: connection-maxscale
spec:
maxScaleRef:
name: maxscale-galera
username: maxscale-galera-client
passwordSecretKeyRef:
name: maxscale-galera-client
key: password
secretName: conn-mxs
port: 3306apiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale-galera
spec:
...
connection:
secretName: mxs-galera-conn
port: 3306apiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale-galera
spec:
...
replicas: 2
monitor:
name: mariadb-monitor
module: galeramon
interval: 2s
cooperativeMonitoring: majority_of_all
params:
disable_master_failback: "false"
available_when_donor: "false"
disable_master_role_setting: "false"
config:
sync:
database: mysql
interval: 5s
timeout: 10skubectl scale maxscale maxscale-galera --replicas 3helm upgrade --install mariadb-enterprise-operator mariadb-enterprise-operator/mariadb-enterprise-operator --set extraArgs={--feature-maxscale-suspend}apiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale-galera
spec:
...
monitor:
name: mariadb-monitor
module: galeramon
interval: 2s
cooperativeMonitoring: majority_of_all
params:
disable_master_failback: "false"
available_when_donor: "false"
disable_master_role_setting: "false"
suspend: trueapiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale-galera
spec:
...
admin:
port: 8989
guiEnabled: true
guiKubernetesService:
type: LoadBalancer
metadata:
metadata:
annotations:
metallb.universe.tf/loadBalancerIPs: 172.18.0.231status:
conditions:
- lastTransitionTime: "2024-02-08T17:29:01Z"
message: Running
reason: MaxScaleReady
status: "True"
type: Ready
configSync:
databaseVersion: 20
maxScaleVersion: 20
listeners:
- name: rw-router-listener
state: Running
monitor:
name: galeramon-monitor
state: Running
primaryServer: mariadb-galera-1
replicas: 1
servers:
- name: mariadb-galera-0
state: Slave, Synced, Running
- name: mariadb-galera-1
state: Master, Synced, Running
- name: mariadb-galera-2
state: Slave, Synced, Running
services:
- name: rw-router
state: Startedkubectl get events --field-selector involvedObject.name=mariadb-repl-maxscale --sort-by='.lastTimestamp'
LAST SEEN TYPE REASON OBJECT MESSAGE
24s Normal MaxScalePrimaryServerChanged maxscale/mariadb-repl-maxscale MaxScale primary server changed from 'mariadb-repl-0' to 'mariadb-repl-1'helm upgrade --install mariadb-enterprise-operator mariadb-enterprise-operator/mariadb-enterprise-operator --set logLevel=debug --set extraArgs={--log-maxscale}Failed to create directory '/var/lib/maxscale/maxscale.cnf.d': 13, Permission deniedapiVersion: apps/v1
kind: StatefulSet
metadata:
name: maxscale-galera
spec:
securityContext:
fsGroup: 999
runAsGroup: 999
runAsNonRoot: true
runAsUser: 999WHITE PAPER
The Ultimate Guide to High Availability with MariaDB



Developing Applications with MariaDB & Containers via Docker
The operator supports provisioning and operating MariaDB clusters with replication as a highly availability topology. In the following sections we will be covering how to manage the full lifecycle of a replication cluster.
In a replication setup, one primary server handles all write operations while one or more replica servers replicate data from the primary, being able to handle read operations. More precisely, the primary has a binary log and the replicas asynchronously replicate the binary log events over the network.
Please refer to the MariaDB documentation for more details about replication.
In order to provision a replication cluster, you need to configure a number of replicas greater than 1 and set the replication.enabled=true in the MariaDB CR:
After applying the previous CR, the operator will provision a replication cluster with one primary and two replicas. The operator will take care of setting up replication, configuring the replication user and monitoring the replication status:
As you can see, the primary can be identified in the PRIMARY column of the kubectl get mariadb output. You may also inspect the current replication status by checking the MariaDB CR status:
The operator continiously monitors the replication status via , taking it into account for internal operations and updating the CR status accordingly.
By default, is configured, which requires an acknowledgement from at least one replica before committing the transaction back to the client. This trades off performance for better consistency and facilitates and operations.
If you are aiming for better performance, you can disable semi-synchronous replication, and go fully asynchronous, please refer to section for doing so.
The replication settings can be customized under the replication section of the MariaDB CR. The following options are available:
gtidStrictMode: Enables GTID strict mode. It is recommended and enabled by default. See .
semiSyncEnabled: Determines whether semi-synchronous replication should be enabled. It is enabled by default. See .
semiSyncAckTimeout: ACK timeout for the replicas to acknowledge transactions to the primary. It requires semi-synchronous replication. See .
These options are used by the operator to create a replication configuration file that is applied to all nodes in the cluster. When updating any of these options, an will be triggered in order to apply the new configuration.
For replica-specific configuration options, please refer to the section. Additional system variables may be configured via the myCnf configuration field. Refer to the for more details.
The following options are replica-specific and can be configured under the replication.replica section of the MariaDB CR:
replPasswordSecretKeyRef: Reference to the Secret key containing the password for the replication user, used by the replicas to connect to the primary. By default, a Secret with a random password will be created.
gtid: GTID position mode to be used (CurrentPos and SlavePos allowed). It defaults to CurrentPos. See .
Kubernetes probes are resolved by the agent (see documentation) in the replication topology, taking into account both the MariaDB and replication status. Additionally, as described in the , probe thresholds may be tuned accordingly for a better reliability based on your environment.
In the following sub-sections we will be covering specifics about the replication topology.
As part of the liveness probe, the agent checks that the MariaDB server is running and that the replication threads (Slave_IO_Running and Slave_SQL_Running) are both running on replicas. If any of these checks fail, the liveness probe will fail.
If such a behaviour is undesirable, it is possible to opt in for regular standalone startup/liveness probes (default SELECT 1 query). See standaloneProbes in the section.
The readiness probe checks that the MariaDB server is running and that the Seconds_Behind_Master value is within the acceptable lag range defined by the spec.replication.replica.maxLagSeconds configuration option. If the lag exceeds this value, the readiness probe will fail and the replica will be marked as not ready.
A replica is considered to be lagging behind the primary when the Seconds_Behind_Master value reported by SHOW SLAVE STATUS exceeds the spec.replication.replica.maxLagSeconds configuration option. This results in the failing for that replica, and it has the following implications:
When using , queries will not be forwarded to lagged replicas. This doesn't affect MaxScale routing.
When taking a , lagged replicas will not be considered as a target for taking the backup.
During a managed by the operator, lagged replicas will block switchover operations, as all the replicas must be in sync before promoting the new primary. This doesn't affect MaxScale switchover operation.
During a managed by the operator, lagged replicas will not be considered as candidates to be promoted as the new primary. MaxScale failover will not consider lagged replicas either.
In order to back up and restore a replication cluster, all the concepts and procedures described in the documentation apply.
Additionally, for the replication topology, the operator tracks the GTID position at the time of taking the backup, and sets this position in the gtid_slave_pos system variable when restoring the backup, as described in the .
Depending on the PhysicalBackup strategy used, the operator will track the GTID position accordingly:
When using PhysicalBackup with the mariadb-backup strategy, the GTID will be restored to a mariadb-enterprise-operator.info file in the data directory, which the agent will expose to the operator via HTTP.
VolumeSnapshotWhen using PhysicalBackup with the VolumeSnapshot strategy, the GTID position will be kept in a enterprise.mariadb.com/gtid annotation in the VolumeSnapshot object, which later on the operator will read when restoring the backup.
Refrain from removing the enterprise.mariadb.com/gtid annotation in the VolumeSnapshot object, as it is required for configuring the replica when restoring the backup.
You can declaratively trigger a primary switchover by updating the spec.replication.primary.podIndex field in the MariaDB CR to the index of the replica you want to promote as the new primary. For example, to promote the replica at index 1:
You can also do this imperatively using kubectl:
This will result in the MariaDB object reporting the following status:
The steps involved in the switchover operation are:
Lock the current primary using FLUSH TABLES WITH READ LOCK to ensure no new transactions are being processed.
Set the read_only system variable on the current primary to prevent any write operations.
Wait until all the replicas are in sync with the current primary. The timeout for this step can be configured via the spec.replication.replica.syncTimeout option. If the timeout is reached, the switchover operation will be retried from the beginning.
If the switchover operation is stuck waiting for replicas to be in sync, you can check the MariaDB status to identify which replicas are causing the issue. Furthermore, if still in this step, you can cancel the switchover operation by setting back the spec.replication.primary.podIndex field back to the previous primary index.
You can configure the operator to automatically perform a primary failover whenever the current primary becomes unavailable:
Optionally, you may also specify a autoFailoverDelay, which will add a delay before triggering the failover operation. By default, the failover is immediate, but introducing a delay may be useful to avoid failovers due to transient issues. But note that the delay should be lower than the readiness probe failure threshold (e.g. 20 seconds delay when readiness threshold is 30 seconds), otherwise all the replicas will be marked as not ready and the automatic failover will not be able to proceed.
Whenever the primary becomes unavailable, the following status will be reported in the MariaDB CR:
The criteria for choosing a new primary is:
The Pod should be in Ready state, therefore not considering unavailable or lagged replicas (see and sections).
Both the IO(Slave_IO_Running) and the SQL(Slave_SQL_Running) threads should be running.
The replica should not have relay log events.
Once the new primary is selected, the failover process will be performed, consisting of the following steps:
Wait for the new primary to apply all relay log events.
Promote the selected replica to be the new primary.
Connect replicas to the new primary.
When updating a replication cluster, all the considerations and procedures described in the documentation apply.
Furthermore, for the replication topology, the operator will trigger an additional once all the replicas have been updated, just before updating the primary. This ensures that the primary is always updated last, minimizing the impact on write operations.
The steps involved in updating a replication cluster are:
Update each replica one by one, waiting for each replica to be ready before proceeding to the next one (see section).
Once all replicas are up to date and synced, perform a to promote one of the replicas as the new primary. If MariaDB CR has a MaxScale configured using the spec.maxScaleRef field, the operator will trigger the instead.
Update the previous primary, now running as a replica.
Scaling out a replication cluster implies adding new replicas to the cluster i.e scaling horizontally. The process involves taking a physical backup from a ready replica to setup the new replica PVC, and upscaling the replication cluster afterwards.
The first step is to define the to be used for taking the backup. For doing so, we will be defining a PhysicalBackup CR, that will be used by the operator as template for creating the actual PhysicalBackup object during scaling out events. For instance, to use the mariadb-backup strategy, we can define the following PhysicalBackup:
It is important to note that, we set the spec.schedule.suspend=true to prevent scheduling this backup, as it will be only be used as a template.
Alternatively, you may also use a VolumeSnapshot strategy for taking the backup:
Once the PhysicalBackup template is created, you neeed to set a reference to it in the spec.replication.replica.bootstrapFrom, indicating that this will be the source for creating new replicas:
At this point, you can proceed to scale out the cluster by increasing the spec.replicas field in the MariaDB CR. For example, to scale out from 3 to 4 replicas:
You can also do this imperatively using kubectl:
This will trigger an scaling out operation, resulting in:
A PhysicalBackup based on the template being created.
Creating a new PVC for the new replica based on the PhysicalBackup.
Upscaling the StatefulSet, adding a Pod that mounts the newly created PVC.
It is important to note that, if there are no ready replicas available at the time of the scaling out operation, the PhysicalBackup will not become ready, and the scaling out operation will be stuck until a replica becomes ready. You have the ability to cancel the scaling out operation by setting back the spec.replicas field to the previous value.
The operator has the ability to automatically recover replicas that become unavailable and report a specific error code in the replication status. For doing so, the operator continiously monitors the replication status of each replica, and whenever a replica reports an error code listed in the table below, the operator will trigger an automated recovery process for that replica:
To perform the recovery, the operator will take a physical backup from a ready replica, restore it to the failed replica PVC, and reconfigure the replica to connect to the primary from the GTID position stored in the backup.
Similarly to the operation, you need to define a PhysicalBackup template and set a reference to it in the spec.replication.replica.bootstrapFrom field of the MariaDB CR. Additionally, you need to explicitly enable the replica recovery, as it is disabled by default:
The errorDurationThreshold option defines the duration after which, a replica reporting an unknown error code will be considered for recovery. This is useful to avoid recovering replicas due to transient issues. It defaults to 5m.
We will be simulating a 1236 error in a replica to demostrate how the recovery process works:
Do not perform the following steps in a production environment.
Purge the binary logs in the primary:
Delete the PVC and restart one of the replicas:
This will trigger a replica recovery operation, resulting in:
A PhysicalBackup based on the template being created.
Restoring the backup to the failed replica PVC.
Reconfigure the replica to connect to the primary from the GTID position stored in the backup.
It is important to note that, if there are no ready replicas available at the time of the recovery operation, the PhysicalBackup will not become ready, and the recovery operation will be stuck until a replica becomes ready. You have the ability to cancel the recovery operation by setting spec.replication.replica.recovery.enabled=false.
The operator tracks the current replication status under the MariaDB status subresource. This status is updated every time the operator reconciles the MariaDB resource, and it is the first place to look for when troubleshooting replication issues:
Additionally, also under the status subresource, the operator sets status conditions whenever a specific state of the MariaDB lifecycle is reached:
The operator also emits Kubernetes events during failover/switchover operations. You may check them to see how these operations progress:
Primary has purged binary logs, unable to configure replica
The primary may purge binary log events at some point, after then, if a replica requests events before that point, it will fail with the following error:
This is a something the operator is able to recover from, please refer to the .
Scaling out/recovery operation stucked
These operations rely on a PhysicalBackup for setting up the new replicas. If this PhysicalBackup does not become ready, the operation will not progress. In order to debug this please refer to the .
One of the reasons could be that there are not replicas in ready state at the time of creating the PhysicalBackup, for instance, all the replicas are lagging behind the primary. Please verify that this is the case by checking the status of your MariaDB resource and your Pods.
MaxScale switchover stucked during update
When using MaxScale, after having updated all the replica Pods, it could happen that MaxScale refuses to perform the switchover, as it considers the Pod chosen by the operator to be unsafe:
For this case, you can manually update the primaryServer field in the MaxScale resource to a safe Pod, and restart the operator. If the new primary server is the right Pod, MaxScale will start the switchover and the update will continue after it completes.
Binary Location: /opt/rag-in-a-box/bin/rag-api
Responsibilities:
Document ingestion and processing
Text chunking and embedding generation
Vector storage and retrieval
Semantic search
Technology Stack:
Framework: FastAPI (Python)
ASGI Server: Uvicorn
Database Driver: PyMySQL / aiomysql
Embedding Client: Google Generative AI SDK
Endpoints:
Configuration Variables:
Binary Location: /opt/rag-in-a-box/bin/mcp-server
Responsibilities:
Model Context Protocol implementation
Database tool exposure
Vector store tool exposure
RAG tool exposure
Technology Stack:
Framework: FastAPI (Python)
ASGI Server: Uvicorn
Protocol: MCP (Model Context Protocol)
Database Client: PyMySQL
Available Tools:
Core Tools:
health_check - Server health verification
get_server_status - Detailed server status
Database Tools:
list_databases - List all databases
list_tables - List tables in database
get_table_schema - Get table structure
Vector Store Tools:
create_vector_store - Create vector store
delete_vector_store - Delete vector store
list_vector_stores - List all vector stores
RAG Tools:
ingest_documents - Ingest documents via RAG API
generate_response - Generate RAG responses
Configuration Variables:
Image: mariadb:11
Configuration:
Database Schema:
Critical Requirement: All three keys must be identical for unified authentication:
Key Generation (for production):
JWT Authentication
Algorithm: HS256
Expiration: 30 minutes (configurable)
Unified token for RAG API and MCP Server
File: config.env.secure.local Usage: Direct environment variables Security: Secrets stored in file Best for: Development, single developer
File: config.env.vault.local Usage: HashiCorp Vault integration Security: Secrets stored in Vault Best for: Team development, production-like
Vault Configuration:
File: config.env.1password.employee Usage: 1Password CLI references Security: Secrets in 1Password vault Best for: Enterprise with 1Password
1Password References:
File: config.env.hcp.live Usage: HashiCorp Cloud Platform Security: Cloud-managed secrets Best for: Production cloud deployments
Description: Generate JWT authentication token
Request:
Response:
Description: Upload and process documents
Headers:
Request:
Response:
Description: Generate RAG response
Headers:
Request:
Response:
Embedding Dimensions: 768 (float32) Storage Size: 768 × 4 bytes = 3,072 bytes per vector Format: Binary BLOB Encoding: IEEE 754 single-precision floating-point
Per Container:
Document Ingestion:
Processing speed: ~5 documents/batch
Chunking: ~100 chunks/second
Embedding generation: ~32 chunks/batch
Total time: ~30-60 seconds per document (depends on size)
Query Performance:
Embedding generation: ~100-200ms
Similarity search: ~50-100ms (depends on dataset size)
LLM generation: ~1-3 seconds
Total response time: ~2-4 seconds
Current Limits:
Max file size: 200MB
Max concurrent requests: 100/minute
Database connections: 10 (pool size)
Scaling Options:
Horizontal: Deploy multiple ai-nexus containers
Vertical: Increase container resources
Database: Use read replicas for queries
End of Technical Architecture Document
semiSyncWaitPoint: Determines whether the transaction should wait for an ACK after having synced the binlog (AfterSync) or after having committed to the storage engine (AfterCommit, the default). It requires semi-synchronous replication. See MariaDB documentation.
syncBinlog: Number of events after which the binary log is synchronized to disk. See MariaDB documentation.
standaloneProbes: Determines whether to use regular non-HA startup and liveness probes. It is disabled by default.
connectionRetrySeconds: Number of seconds that the replica will wait between connection retries. See MariaDB documentation.
maxLagSeconds: Maximum acceptable lag in seconds between the replica and the primary. If the lag exceeds this value, the readiness probe will fail and the replica will be marked as not ready. It defaults to 0, meaning that no lag is allowed. See lagged replicas section for more details.
syncTimeout: Timeout for the replicas to be synced during switchover and failover operations. It defaults to 10s. See the primary switchover and primary failover sections for more details.
During updates, lagged replicas will block the update operation, as each of the replicas must pass the readiness probe before proceeding to the update of the next one.
Promote the selected replica to be the new primary.
Connect replicas to the new primary.
Change the current primary to be a replica of the new primary.
Among the candidates, the one with the highest gtid_current_pos will be selected.
The Pod is configured as a replica, connected to the primary by starting the replication in the GTID position stored in the backup.
1236
IO
Error 1236: Got fatal error from master when reading data from binary log.
Authentication and authorization
Document Processing: LangChain / Custom parsers
execute_sql - Execute SQL queriescreate_database - Create new database
drop_database - Delete database
insert_docs_vector_store - Add documentssearch_vector_store - Semantic search
Rate Limiting
100 requests per minute (default)
Configurable per endpoint
CORS Configuration
Allowed origins: Configurable
Credentials: Supported
Methods: GET, POST, PUT, DELETE, OPTIONS
File Upload Security
Max file size: 200MB
Allowed extensions: .pdf, .txt, .docx, .md, .html, .csv, .json, .xml
Malware scanning: Optional
Quarantine: Enabled for suspicious files
Database Security
Parameterized queries (SQL injection prevention)
Connection pooling
Encrypted connections (optional)
apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-repl
spec:
replicas: 3
replication:
enabled: truekubectl get pods
NAME READY STATUS RESTARTS AGE
mariadb-repl-0 2/2 Running 0 2d19h
mariadb-repl-1 2/2 Running 0 2d19h
mariadb-repl-2 2/2 Running 0 2d19h
mariadb-repl-metrics-56865fff65-t72kc 1/1 Running 0 2d20h
kubectl get mariadb
NAME READY STATUS PRIMARY UPDATES AGE
mariadb-repl True Running mariadb-repl-0 ReplicasFirstPrimaryLast 2d20hkubectl get mariadb mariadb-repl -o jsonpath="{.status.replication}" | jq
{
"replicas": {
"mariadb-repl-1": {
"gtidCurrentPos": "0-10-155",
"gtidIOPos": "0-10-155",
"lastErrorTransitionTime": "2025-10-22T10:51:10Z",
"lastIOErrno": 0,
"lastIOError": "",
"lastSQLErrno": 0,
"lastSQLError": "",
"secondsBehindMaster": 0,
"slaveIORunning": true,
"slaveSQLRunning": true
},
"mariadb-repl-2": {
"gtidCurrentPos": "0-10-155",
"gtidIOPos": "0-10-155",
"lastErrorTransitionTime": "2025-10-22T10:47:29Z",
"lastIOErrno": 0,
"lastIOError": "",
"lastSQLErrno": 0,
"lastSQLError": "",
"secondsBehindMaster": 0,
"slaveIORunning": true,
"slaveSQLRunning": true
}
},
"roles": {
"mariadb-repl-0": "Primary",
"mariadb-repl-1": "Replica",
"mariadb-repl-2": "Replica"
}
}apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-repl
spec:
replicas: 3
replication:
enabled: true
gtidStrictMode: true
semiSyncEnabled: true
semiSyncAckTimeout: 10s
semiSyncWaitPoint: AfterCommit
syncBinlog: 1
standaloneProbes: falseapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-repl
spec:
replicas: 3
replication:
enabled: true
replica:
replPasswordSecretKeyRef:
name: mariadb
key: password
gtid: CurrentPos
connectionRetrySeconds: 10
maxLagSeconds: 0
syncTimeout: 10sapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-repl
spec:
replicas: 3
replication:
enabled: true
primary:
podIndex: 1kubectl patch mariadb mariadb-repl \
--type='merge' \
-p '{"spec":{"replication":{"primary":{"podIndex":1}}}}'kubectl get mariadb
NAME READY STATUS PRIMARY UPDATES AGE
mariadb-repl False Switching primary to 'mariadb-repl-1' mariadb-repl-0 ReplicasFirstPrimaryLast 3d2hapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-repl
spec:
replicas: 3
replication:
enabled: true
primary:
autoFailover: true
autoFailoverDelay: 0skubectl get mariadb
NAME READY STATUS PRIMARY UPDATES AGE
mariadb-repl True Running mariadb-repl-0 ReplicasFirstPrimaryLast 3d2h
kubectl delete pod mariadb-repl-0
pod "mariadb-repl-0" deleted
kubectl get mariadb
NAME READY STATUS PRIMARY UPDATES AGE
mariadb-repl False Switching primary to 'mariadb-repl-1' mariadb-repl-0 ReplicasFirstPrimaryLast 3d2h
kubectl get mariadb
NAME READY STATUS PRIMARY UPDATES AGE
mariadb-repl True Running mariadb-repl-1 ReplicasFirstPrimaryLast 3d2hapiVersion: enterprise.mariadb.com/v1alpha1
kind: PhysicalBackup
metadata:
name: physicalbackup-tpl
spec:
mariaDbRef:
name: mariadb-repl
schedule:
suspend: true
storage:
s3:
bucket: scaleout
prefix: mariadb
endpoint: minio.minio.svc.cluster.local:9000
region: us-east-1
accessKeyIdSecretKeyRef:
name: minio
key: access-key-id
secretAccessKeySecretKeyRef:
name: minio
key: secret-access-key
tls:
enabled: true
caSecretKeyRef:
name: minio-ca
key: ca.crt
timeout: 1h
podAffinity: trueapiVersion: enterprise.mariadb.com/v1alpha1
kind: PhysicalBackup
metadata:
name: physicalbackup-tpl
spec:
mariaDbRef:
name: mariadb-repl
schedule:
suspend: true
storage:
volumeSnapshot:
volumeSnapshotClassName: csi-hostpath-snapclassapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-repl
spec:
replication:
enabled: true
replica:
bootstrapFrom:
physicalBackupTemplateRef:
name: physicalbackup-tplapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-repl
spec:
replicas: 4
replication:
enabled: true
replica:
bootstrapFrom:
physicalBackupTemplateRef:
name: physicalbackup-tplkubectl scale mariadb mariadb-repl --replicas=4kubectl scale mariadb mariadb-repl --replicas=4
mariadb.enterprise.mariadb.com/mariadb-repl scaled
kubectl get mariadb
NAME READY STATUS PRIMARY UPDATES AGE
mariadb-repl False Scaling out mariadb-repl-1 ReplicasFirstPrimaryLast 3d5h
kubectl get physicalbackups
NAME COMPLETE STATUS MARIADB LAST SCHEDULED AGE
mariadb-repl-physicalbackup-scale-out True Success mariadb-repl 14s 14s
physicalbackup-tpl False Suspended mariadb-repl 3d8h
kubectl get pods
NAME READY STATUS RESTARTS AGE
mariadb-repl-0 2/2 Running 0 137m
mariadb-repl-1 2/2 Running 0 3d5h
mariadb-repl-2 2/2 Running 0 3d5h
mariadb-repl-3 2/2 Running 0 40s
mariadb-repl-metrics-56865fff65-t72kc 1/1 Running 0 3d5h
kubectl get mariadb
NAME READY STATUS PRIMARY UPDATES AGE
mariadb-repl True Running mariadb-repl-1 ReplicasFirstPrimaryLast 3d5hapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-repl
spec:
replication:
enabled: true
replica:
bootstrapFrom:
physicalBackupTemplateRef:
name: physicalbackup-tpl
recovery:
enabled: true
errorDurationThreshold: 5mPRIMARY=$(kubectl get mariadb mariadb-repl -o jsonpath="{.status.currentPrimary}")
echo "Purging binary logs in primary $PRIMARY"
kubectl exec -it $PRIMARY -c mariadb -- mariadb -u root -p'MariaDB11!' --ssl=false -e "FLUSH LOGS;"
kubectl exec -it $PRIMARY -c mariadb -- mariadb -u root -p'MariaDB11!' --ssl=false -e "PURGE BINARY LOGS BEFORE NOW();"
kubectl exec -it $PRIMARY -c mariadb -- mariadb -u root -p'MariaDB11!' --ssl=false -e "SHOW BINARY LOGS;"REPLICA=$(kubectl get mariadb mariadb-repl -o jsonpath='{.status.replication.replicas}' | jq -r 'keys[]' | head -n1)
echo "Deleting PVC and restarting replica $REPLICA"
kubectl delete pvc storage-$REPLICA --wait=false
kubectl delete pod $REPLICA --wait=false kubectl get mariadb
NAME READY STATUS PRIMARY UPDATES AGE
mariadb-repl False Recovering replicas mariadb-repl-1 ReplicasFirstPrimaryLast 3d6h
kubectl get physicalbackups
NAME COMPLETE STATUS MARIADB LAST SCHEDULED AGE
mariadb-repl-physicalbackup-replica-recovery True Success mariadb-repl 31s 31s
physicalbackup-tpl False Suspended mariadb-repl 3d9h
kubectl get pods
NAME READY STATUS RESTARTS AGE
mariadb-repl-0 0/2 PodInitializing 0 22s
mariadb-repl-0-physicalbackup-init-qn79f 0/1 Completed 0 8s
mariadb-repl-1 2/2 Running 0 3d6h
mariadb-repl-2 2/2 Running 0 3d6h
mariadb-repl-metrics-56865fff65-t72kc 1/1 Running 0 3d6h
mariadb-repl-physicalbackup-replica-recovery-2025102020270r98zr 0/1 Completed 0 31s
kubectl get mariadb
NAME READY STATUS PRIMARY UPDATES AGE
mariadb-repl True Running mariadb-repl-1 ReplicasFirstPrimaryLast 3d6hkubectl get mariadb mariadb-repl -o jsonpath="{.status.replication}" | jq
{
"replicas": {
"mariadb-repl-1": {
"gtidCurrentPos": "0-10-155",
"gtidIOPos": "0-10-155",
"lastErrorTransitionTime": "2025-10-22T10:51:10Z",
"lastIOErrno": 0,
"lastIOError": "",
"lastSQLErrno": 0,
"lastSQLError": "",
"secondsBehindMaster": 0,
"slaveIORunning": true,
"slaveSQLRunning": true
},
"mariadb-repl-2": {
"gtidCurrentPos": "0-10-155",
"gtidIOPos": "0-10-155",
"lastErrorTransitionTime": "2025-10-22T10:47:29Z",
"lastIOErrno": 0,
"lastIOError": "",
"lastSQLErrno": 0,
"lastSQLError": "",
"secondsBehindMaster": 0,
"slaveIORunning": true,
"slaveSQLRunning": true
}
},
"roles": {
"mariadb-repl-0": "Primary",
"mariadb-repl-1": "Replica",
"mariadb-repl-2": "Replica"
}
}kubectl get mariadb mariadb-repl -o jsonpath="{.status.conditions}" | jq
[
{
"lastTransitionTime": "2025-10-20T20:28:09Z",
"message": "Running",
"reason": "StatefulSetReady",
"status": "True",
"type": "Ready"
},
{
"lastTransitionTime": "2025-10-17T14:17:43Z",
"message": "Updated",
"reason": "Updated",
"status": "True",
"type": "Updated"
},
{
"lastTransitionTime": "2025-10-17T14:17:58Z",
"message": "Replication configured",
"reason": "ReplicationConfigured",
"status": "True",
"type": "ReplicationConfigured"
},
{
"lastTransitionTime": "2025-10-20T17:14:38Z",
"message": "Switchover complete",
"reason": "SwitchPrimary",
"status": "True",
"type": "PrimarySwitched"
},
{
"lastTransitionTime": "2025-10-20T19:31:29Z",
"message": "Scaled out",
"reason": "ScaledOut",
"status": "True",
"type": "ScaledOut"
},
{
"lastTransitionTime": "2025-10-20T20:27:41Z",
"message": "Replica recovered",
"reason": "ReplicaRecovered",
"status": "True",
"type": "ReplicaRecovered"
}
]kubectl get events --field-selector involvedObject.name=mariadb-repl --sort-by='.lastTimestamp'
LAST SEEN TYPE REASON OBJECT MESSAGE
17s Normal PrimaryLock mariadb/mariadb-repl Locking primary with read lock
17s Normal PrimaryReadonly mariadb/mariadb-repl Enabling readonly mode in primary
17s Normal ReplicaSync mariadb/mariadb-repl Waiting for replicas to be synced with primary
17s Normal PrimaryNew mariadb/mariadb-repl Configuring new primary at index '0'
7s Normal ReplicaConn mariadb/mariadb-repl Connecting replicas to new primary at '0'
7s Normal PrimaryToReplica mariadb/mariadb-repl Unlocking primary '1' and configuring it to be a replica. New primary at '0'
7s Normal PrimaryLock mariadb/mariadb-repl Unlocking primary
7s Normal PrimarySwitched mariadb/mariadb-repl Primary switched from index '1' to index '0'Error 1236: Got fatal error from master when reading data from binary log.2025-10-27 15:17:11 error : [mariadbmon] 'mariadb-repl-1' is not a valid demotion target for switchover: it does not have a 'gtid_binlog_pos'.┌─────────────────────────────────────────────────────────────────────┐
│ Windows Host System │
│ │
│ ┌─────────────────────────────────────────────────────────────┐ │
│ │ Docker Desktop (WSL 2 Backend) │ │
│ │ │ │
│ │ ┌────────────────────────────────────────────────────────┐ │ │
│ │ │ Docker Network: ai-nexus-network │ │ │
│ │ │ (Bridge Driver) │ │ │
│ │ │ │ │ │
│ │ │ ┌──────────────────────────────────────────────────┐ │ │ │
│ │ │ │ ai-nexus Container (Ubuntu 24.04) │ │ │ │
│ │ │ │ │ │ │ │
│ │ │ │ ┌────────────────────────────────────────────┐ │ │ │ │
│ │ │ │ │ Process 1: RAG API (PID: dynamic) │ │ │ │ │
│ │ │ │ │ - Framework: FastAPI │ │ │ │ │
│ │ │ │ │ - Server: Uvicorn (ASGI) │ │ │ │ │
│ │ │ │ │ - Bind: 0.0.0.0:8000 │ │ │ │ │
│ │ │ │ │ - Workers: 1 │ │ │ │ │
│ │ │ │ │ - Binary: /opt/rag-in-a-box/bin/rag-api │ │ │ │ │
│ │ │ │ └────────────────────────────────────────────┘ │ │ │ │
│ │ │ │ │ │ │ │
│ │ │ │ ┌────────────────────────────────────────────┐ │ │ │ │
│ │ │ │ │ Process 2: MCP Server (PID: dynamic) │ │ │ │ │
│ │ │ │ │ - Framework: FastAPI │ │ │ │ │
│ │ │ │ │ - Server: Uvicorn (ASGI) │ │ │ │ │
│ │ │ │ │ - Bind: 0.0.0.0:8002 │ │ │ │ │
│ │ │ │ │ - Workers: 1 │ │ │ │ │
│ │ │ │ │ - Binary: /opt/rag-in-a-box/bin/mcp-server│ │ │ │ │
│ │ │ │ └────────────────────────────────────────────┘ │ │ │ │
│ │ │ │ │ │ │ │
│ │ │ │ Startup: start-services.sh │ │ │ │
│ │ │ │ Health Check: 180s timeout, 10s interval │ │ │ │
│ │ │ └──────────────────┬────────────────────────────┘ │ │ │
│ │ │ │ │ │ │
│ │ │ │ MySQL Protocol (Port 3306) │ │ │
│ │ │ │ │ │ │
│ │ │ ┌──────────────────▼────────────────────────────┐ │ │ │
│ │ │ │ mysql-db Container (MariaDB 11) │ │ │ │
│ │ │ │ │ │ │ │
│ │ │ │ ┌──────────────────────────────────────────┐ │ │ │ │
│ │ │ │ │ MariaDB Server │ │ │ │ │
│ │ │ │ │ - Version: 11.x │ │ │ │ │
│ │ │ │ │ - Storage Engine: InnoDB │ │ │ │ │
│ │ │ │ │ - Character Set: utf8mb4 │ │ │ │ │
│ │ │ │ │ - Collation: utf8mb4_unicode_ci │ │ │ │ │
│ │ │ │ │ - Page Size: 16KB │ │ │ │ │
│ │ │ │ │ - Row Format: Dynamic │ │ │ │ │
│ │ │ │ └──────────────────────────────────────────┘ │ │ │ │
│ │ │ │ │ │ │ │
│ │ │ │ ┌──────────────────────────────────────────┐ │ │ │ │
│ │ │ │ │ Persistent Volume: mysql_data │ │ │ │ │
│ │ │ │ │ - Database: kb_chunks │ │ │ │ │
│ │ │ │ │ - Tables: documents_*, vdb_tbl_* │ │ │ │ │
│ │ │ │ │ - Indexes: Vector indexes │ │ │ │ │
│ │ │ │ └──────────────────────────────────────────┘ │ │ │ │
│ │ │ └────────────────────────────────────────────┘ │ │ │
│ │ └─────────────────────────────────────────────────┘ │ │
│ └───────────────────────────────────────────────────────┘ │
│ │
│ Port Mappings (Host → Container): │
│ - 8000:8000 (RAG API) │
│ - 8002:8002 (MCP Server) │
│ - 3306:3306 (MariaDB) │
└─────────────────────────────────────────────────────────────────────┘
External Services (Internet):
┌─────────────────────────────────────────────────┐
│ Google Generative AI API │
│ - Endpoint: generativelanguage.googleapis.com │
│ - Embedding: text-embedding-004 │
│ - LLM: gemini-2.0-flash │
└─────────────────────────────────────────────────┘Start Order:
1. mysql-db (MariaDB)
├─ Health Check: 30s start period, 10s interval
└─ Condition: service_healthy
2. ai-nexus (Application)
├─ Depends on: mysql-db (healthy)
├─ Startup Script: start-services.sh
│ ├─ Start RAG API (background)
│ ├─ Wait for RAG API health (max 180s)
│ └─ Start MCP Server (foreground)
└─ Restart Policy: unless-stoppedAuthentication:
POST /token - Generate JWT token
Document Management:
POST /documents/ingest - Upload and process documents
GET /documents - List all documents
GET /documents/{id} - Get document details
DELETE /documents/{id} - Delete document
RAG Operations:
POST /generate - Generate RAG response
POST /search - Semantic search
GET /embeddings/{doc_id} - Get document embeddings
Health & Status:
GET /health - Health check
GET / - API info
GET /docs - Swagger UI
GET /openapi.json - OpenAPI specAPP_HOST=0.0.0.0
APP_PORT=8000
DB_HOST=mysql-db
DB_PORT=3306
DB_USER=root
DB_PASSWORD=your_secure_database_password
DB_NAME=kb_chunks
GEMINI_API_KEY=your_gemini_api_key
SECRET_KEY=your_generated_secret_key
JWT_SECRET_KEY=<secret>
EMBEDDING_PROVIDER=gemini
embedding_model=text-embedding-004
LLM_PROVIDER=gemini
LLM_MODEL=gemini-2.0-flash
DOCUMENTS_TABLE=documents_DEMO_gemini
VDB_TABLE=vdb_tbl_DEMO_gemini
CHUNK_SIZE=512
CHUNK_OVERLAP=128MCP_HOST=0.0.0.0
MCP_PORT=8002
MCP_MARIADB_HOST=mysql-db
MCP_MARIADB_PORT=3306
MCP_AUTH_SECRET_KEY=<secret>
MCP_ENABLE_AUTH=true
MCP_ENABLE_VECTOR_TOOLS=true
MCP_ENABLE_DATABASE_TOOLS=true
MCP_ENABLE_RAG_TOOLS=true
MCP_READ_ONLY=false
MCP_STANDALONE_MODE=false
MCP_RAG_HEALTHCHECK_ENABLED=true
MCP_LOG_LEVEL=INFOEnvironment:
MYSQL_ROOT_PASSWORD: your_secure_database_password
MYSQL_DATABASE: kb_chunks
Command:
--character-set-server=utf8mb4
--collation-server=utf8mb4_unicode_ci
--innodb-page-size=16k
--innodb-default-row-format=dynamic
Health Check:
Test: healthcheck.sh --connect --innodb_initialized
Interval: 10s
Timeout: 5s
Retries: 10
Start Period: 30s
Volume:
mysql_data:/var/lib/mysql (persistent)-- Documents Table
CREATE TABLE documents_DEMO_gemini (
id INT AUTO_INCREMENT PRIMARY KEY,
filename VARCHAR(255) NOT NULL,
content LONGTEXT,
metadata JSON,
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
INDEX idx_filename (filename),
INDEX idx_created_at (created_at)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
-- Vector Database Table
CREATE TABLE vdb_tbl_DEMO_gemini (
id INT AUTO_INCREMENT PRIMARY KEY,
document_id INT NOT NULL,
chunk_index INT NOT NULL,
chunk_text LONGTEXT NOT NULL,
embedding BLOB, -- 768-dimensional vector (3072 bytes)
metadata JSON,
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
FOREIGN KEY (document_id) REFERENCES documents_DEMO_gemini(id) ON DELETE CASCADE,
INDEX idx_document_id (document_id),
INDEX idx_chunk_index (chunk_index)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;User Upload
│
▼
┌───────────────────────────────────────┐
│ 1. RAG API - File Reception │
│ - Validate file type │
│ - Check file size (max 200MB) │
│ - Generate unique ID │
└───────────────┬───────────────────────┘
│
▼
┌───────────────────────────────────────┐
│ 2. Document Processing │
│ - Extract text from file │
│ - Clean and normalize text │
│ - Store in documents table │
└───────────────┬───────────────────────┘
│
▼
┌───────────────────────────────────────┐
│ 3. Text Chunking │
│ - Method: Recursive character split │
│ - Chunk size: 512 tokens │
│ - Overlap: 128 tokens │
│ - Generate chunk metadata │
└───────────────┬───────────────────────┘
│
▼
┌───────────────────────────────────────┐
│ 4. Embedding Generation │
│ - Batch size: 32 chunks │
│ - Call Gemini API │
│ - Model: text-embedding-004 │
│ - Dimensions: 768 │
└───────────────┬───────────────────────┘
│
▼
┌───────────────────────────────────────┐
│ 5. Vector Storage │
│ - Store in vdb_tbl_DEMO_gemini │
│ - Link to document_id │
│ - Store chunk text + embedding │
│ - Create indexes │
└───────────────┬───────────────────────┘
│
▼
┌───────────────────────────────────────┐
│ 6. Response to User │
│ - Document ID │
│ - Number of chunks │
│ - Processing status │
└───────────────────────────────────────┘User Query
│
▼
┌───────────────────────────────────────┐
│ 1. Query Reception │
│ - Validate JWT token │
│ - Parse query text │
└───────────────┬───────────────────────┘
│
▼
┌───────────────────────────────────────┐
│ 2. Query Embedding │
│ - Call Gemini API │
│ - Generate 768-dim vector │
└───────────────┬───────────────────────┘
│
▼
┌───────────────────────────────────────┐
│ 3. Similarity Search │
│ - Calculate cosine similarity │
│ - Filter by threshold (0.8) │
│ - Retrieve top-k chunks (default: 5) │
│ - Order by similarity score │
└───────────────┬───────────────────────┘
│
▼
┌───────────────────────────────────────┐
│ 4. Context Preparation │
│ - Combine retrieved chunks │
│ - Add source metadata │
│ - Format for LLM prompt │
└───────────────┬───────────────────────┘
│
▼
┌───────────────────────────────────────┐
│ 5. LLM Generation │
│ - Construct prompt: │
│ "Context: {chunks}" │
│ "Question: {query}" │
│ - Call Gemini LLM │
│ - Model: gemini-2.0-flash │
└───────────────┬───────────────────────┘
│
▼
┌───────────────────────────────────────┐
│ 6. Response Formatting │
│ - AI-generated answer │
│ - Source documents │
│ - Confidence scores │
│ - Metadata │
└───────────────┬───────────────────────┘
│
▼
Return to User┌─────────────────────────────────────────────────────────────┐
│ 1. Token Generation │
│ │
│ POST /token │
│ Body: {"username": "admin", "password": "password"} │
│ │
│ ┌────────────────────────────────────────────────────────┐ │
│ │ Server validates credentials │ │
│ │ Generates JWT with: │ │
│ │ - Header: {"alg": "HS256", "typ": "JWT"} │ │
│ │ - Payload: {"sub": "admin", "exp": <timestamp>} │ │
│ │ - Signature: HMAC-SHA256(header.payload, SECRET_KEY) │ │
│ └────────────────────────────────────────────────────────┘ │
│ │
│ Response: {"access_token": "eyJ...", "token_type": "bearer"}│
└─────────────────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────┐
│ 2. Authenticated Request │
│ │
│ GET /documents │
│ Headers: {"Authorization": "Bearer eyJ..."} │
│ │
│ ┌────────────────────────────────────────────────────────┐ │
│ │ Server extracts token │ │
│ │ Verifies signature with SECRET_KEY │ │
│ │ Checks expiration (30 minutes) │ │
│ │ Validates claims │ │
│ └────────────────────────────────────────────────────────┘ │
│ │
│ If valid: Process request │
│ If invalid: Return 401 Unauthorized │
└─────────────────────────────────────────────────────────────┘SECRET_KEY=<same-value>
JWT_SECRET_KEY=<same-value>
MCP_AUTH_SECRET_KEY=<same-value>import secrets
key = secrets.token_urlsafe(64)
# Use this key for all three variablesVAULT_ADDR=http://rag-vault:8200
VAULT_TOKEN=rag-root-token
VAULT_SECRET_PATH=rag-in-a-box
VAULT_MOUNT_POINT=secretGEMINI_API_KEY=op://Employee/RAG-API-Keys/gemini
DB_PASSWORD=op://Employee/RAG-Database/password{
"username": "admin",
"password": "your_password"
}{
"access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
"token_type": "bearer"
}Authorization: Bearer <token>
Content-Type: multipart/form-datafile: <binary-file-data>{
"document_id": 123,
"filename": "document.pdf",
"chunks_created": 45,
"status": "success"
}Authorization: Bearer <token>
Content-Type: application/json{
"query": "What is the main topic?",
"top_k": 5,
"threshold": 0.8
}{
"answer": "The main topic is...",
"sources": [
{
"document_id": 123,
"chunk_index": 5,
"similarity": 0.92,
"text": "..."
}
],
"metadata": {
"processing_time": 1.23,
"model": "gemini-2.0-flash"
}
}CREATE TABLE documents_DEMO_gemini (
id INT AUTO_INCREMENT PRIMARY KEY,
filename VARCHAR(255) NOT NULL,
content LONGTEXT,
metadata JSON,
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
INDEX idx_filename (filename),
INDEX idx_created_at (created_at)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;CREATE TABLE vdb_tbl_DEMO_gemini (
id INT AUTO_INCREMENT PRIMARY KEY,
document_id INT NOT NULL,
chunk_index INT NOT NULL,
chunk_text LONGTEXT NOT NULL,
embedding BLOB,
metadata JSON,
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
FOREIGN KEY (document_id) REFERENCES documents_DEMO_gemini(id) ON DELETE CASCADE,
INDEX idx_document_id (document_id),
INDEX idx_chunk_index (chunk_index)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;ai-nexus:
CPU: 1-2 cores
RAM: 2-4 GB
Disk: 1 GB (application)
mysql-db:
CPU: 1-2 cores
RAM: 2-4 GB
Disk: Variable (depends on data)Helm is the preferred way to install MariaDB Enterprise Kubernetes Operator in Kubernetes clusters. This documentation aims to provide guidance on how to manage the installation and upgrades of both the CRDs and the operator via Helm charts.
Configure your customer credentials as described in the documentation to be able to pull images.
MariaDB Enterprise Kubernetes Operator is splitted into two different helm charts for better convenience:
mariadb-enterprise-operator-crds: Bundles the required by the operator.
mariadb-enterprise-operator: Contains all the template manifests required to install the operator. Refer to the section for detailed information about the supported values.
The operator extends the Kubernetes control plane and consists of the following components deployed via Helm:
operator: The mariadb-enterprise-operator itself that performs the CRD reconciliation.
webhook: The Kubernetes control-plane delegates CRD validations to this HTTP server. Kubernetes requires TLS to communicate with the webhook server.
cert-controller: Provisions TLS certificates for the webhook. You can see it as a minimal that is intended to work only with the webhook. It is optional and can be replaced by cert-manager.
Helm has certain . To address this, we are providing the CRDs in a separate chart, . This allows us to manage the installation and updates of the CRDs independently from the operator. For example, you can uninstall the operator without impacting your existing MariaDB CRDs.
CRDs can be installed in your cluster by running the following commands
The first step is to prepare a values.yaml file to specify your previously configured :
Then, you can proceed to install the operator:
If you have the and already installed in your cluster, it is recommended to leverage them to scrape the operator metrics and provision the webhook certificate respectively:
Refer to the section for detailed information about the supported values.
MariaDB Enterprise Kubernetes Operator provides stable Long-Term Support (LTS) versions.
If you instead wish to install a specific LTS release, you can do:
Where: --version "25.10.*" installs the most recent available release within the 25.10 series.
The following deployment modes are supported:
The operator watches CRDs in all namespaces and requires cluster-wide RBAC permissions to operate. This is the default deployment mode, enabled through the default configuration values:
By setting currentNamespaceOnly=true, the operator will only watch CRDs within the namespace it is deployed in, and the RBAC permissions will be restricted to that namespace as well:
To install a version instead, replace <new-version> with your desired LTS release. For example: --version "25.10.*" will automatically install the latest available patch within that LTS series.
The first step is upgrading the CRDs that the operator depends on:
Once updated, you may proceed to upgrade the operator:
Whenever a new version of the operator is released, an upgrade guide is linked in the if additional upgrade steps are required. Be sure to review the and follow the version-specific upgrade guides accordingly.
The operator can run in high availability mode to prevent downtime during updates and ensure continuous reconciliation of your CRs, even if the node where the operator runs goes down. To achieve this, you need:
Multiple replicas
Configure Pod anti-affinity
Configure PodDisruptionBudgets
You can achieve this by providing the following values to the helm chart:
You may similarly configure the webhook and cert-controller components to run in high availability mode by providing the same values to their respective sections. Refer to the for detailed information.
Uninstalling the mariadb-enterprise-operator-crds Helm chart will remove the CRDs and their associated resources, resulting in downtime.
First, uninstall the mariadb-enterprise-operator Helm chart. This action will not delete your CRDs, so your operands (i.e. MariaDB and MaxScale) will continue to run without the operator's reconciliation.
At this point, if you also want to delete CRDs and the operands running in your cluster, you may proceed to uninstall the mariadb-enterprise-operator-crds Helm chart:
MariaDB Enterprise Kubernetes Operator supports issuing, configuring and rotating TLS certificates for both your MariaDB and MaxScale resources. It aims to be secure by default; for this reason, TLS certificates are issued and configured by the operator as a default behaviour.
MariaDB configurationTLS can be configured in MariaDB resources by setting tls.enabled=true:
As a result, the operator will generate a Certificate Authority (CA) and use it to issue the leaf certificates mounted by the instance. It is important to note that the TLS connections are not enforced in this case i.e. both TLS and non-TLS connections will be accepted. This is the default behaviour when no tls field is specified.
If you want to enforce TLS connections, you can set tls.required=true:
This approach ensures that any unencrypted connection will fail, effectively enforcing security best practices.
If you want to fully opt-out from TLS, you can set tls.enabled=false:
This will disable certificate issuance, resulting in all connections being unencrypted.
Refer to further sections for a more advanced TLS configuration.
MaxScale configurationTLS will be automatically enabled in MaxScale when the referred MariaDB (via mariaDbRef) has TLS enabled and enforced. Alternatively, you can explicitly enable TLS by setting tls.enabled=true:
As a result, the operator will generate a Certificate Authority (CA) and use it to issue the leaf certificates mounted by the instance. It is important to note that, unlike MariaDB, MaxScale does not support TLS and non-TLS connections simultaneously (see ). Therefore, TLS connections will be enforced in this case i.e. unencrypted connections will fail, ensuring security best practises.
If you want to fully opt-out from TLS, you can set tls.enabled=false. This should only be done when MariaDB TLS is not enforced or disabled:
This will disable certificate issuance, resulting in all connections being unencrypted.
Refer to further sections for a more advanced TLS configuration.
MariaDB certificate specificationThe MariaDB TLS setup consists of the following certificates:
Certificate Authority (CA) keypair to issue the server certificate.
Server leaf certificate used to encrypt server connections.
Certificate Authority (CA) keypair to issue the client certificate.
Client leaf certificate used to encrypt and authenticate client connections.
As a default behaviour, the operator generates a single CA to be used for issuing both the server and client certificates, but the user can decide to use dedicated CAs for each case. Root CAs, and in some cases, are supported, see for further detail.
The server certificate contains the following Subject Alternative Names (SANs):
<mariadb-name>.<namespace>.svc.<cluster-name>
<mariadb-name>.<namespace>.svc
<mariadb-name>.<namespace>
Whereas the client certificate is only valid for the <mariadb-name>-client SAN.
MaxScale certificate specificationThe MaxScale TLS setup consists of the following certificates:
Certificate Authority (CA) keypair to issue the admin certificate.
Admin leaf certificate used to encrypt the administrative REST API and GUI.
Certificate Authority (CA) keypair to issue the listener certificate.
Listener leaf certificate used to encrypt database connections to the listener.
As a default behaviour, the operator generates a single CA to be used for issuing both the admin and the listener certificates, but the user can decide to use dedicated CAs for each case. Client certificate and CA bundle configured in the referred MariaDB are used as server certificates by default, but the user is able to provide its own certificates. Root CAs, and in some cases, are supported, see for further detail.
Both the admin and listener certificates contain the following Subject Alternative Names (SANs):
<maxscale-name>.<namespace>.svc.<clusername>
<maxscale-name>.<namespace>.svc
<maxscale-name>.<namespace>
For details about the server certificate, see .
As you could appreciate in and , the TLS setup involves multiple CAs. In order to establish trust in a more convenient way, the operator groups the CAs together in a CA bundle that will need to be specified when . Every MariaDB and MaxScale resources have a dedicated bundle of its own available in a Secret named <instance-name>-ca-bundle.
These trust bundles contain non expired CAs needed to connect to the instances. New CAs are automatically added to the bundle after , whilst old CAs are removed after they expire. It is important to note that both the new and old CAs remain in the bundle for a while to ensure a smooth update when the new certificates are issued by the new CA.
By setting tls.enabled=true, the operator will generate a root CA for each instance, which will be used to issue the certificates described in the and sections:
To establish trust with the instances, the CA's public key will be added to the . If you need a different trust chain, please refer to the section.
The advantage of this approach is that the operator fully manages the Secrets that contain the certificates without depending on any third party dependency. Also, since the operator fully controls the renewal process, it is able to pause a leaf certificate renewal if the CA is being updated at that moment, as described in the section.
must be previously installed in the cluster in order to use this feature.
cert-manager is the de-facto standard for managing certificates in Kubernetes. It is a Kubernetes native certificate management controller that allows you to automatically provision, manage and renew certificates. It supports multiple (in-cluster, Hashicorp Vault...) which are configured as Issuer or ClusterIssuer resources.
As an example, we are going to setup an in-cluster root CA ClusterIssuer:
Then, you can reference the ClusterIssuer in the MariaDB and MaxScale resources:
The operator will create cert-manager's for each certificate, and will mount the resulting in the instances. These Secrets containing the certificates will be managed by cert-manager as well as its renewal process.
To establish trust with the instances, the in the Secret will be added to the . If you need a different trust chain, please refer to the section.
The advantage of this approach is that you can use any of the , such as the in-cluster CA or HashiCorp Vault, and potentially reuse the same Issuer/ClusterIssuer with multiple instances.
Providing your own certificates is as simple as creating the Secrets with the appropriate structure and referencing them in the MariaDB and MaxScale resources. The certificates must be compliant with the and .
The CA certificate must be provided as a Secret with the following structure:
The ca.key field is only required if you want to the operator to automatically re-issue certificates with this CA, see for further detail. In other words, if only ca.crt is provided, the operator will trust this CA by adding it to the , but no certificates will be issued with it, the user will responsible for upating the certificate Secret manually with renewed certificates.
The enterprise.mariadb.com/watch label is required only if you want the operator to automatically trigger an update when the CA is renewed, see for more detail.
The leaf certificate must match the previous CA's public key, and it should provided as a with the following structure:
The enterprise.mariadb.com/watch label is required only if you want the operator to automatically trigger an update when the certificate is renewed, see for more detail.
Once the certificate Secrets are available in the cluster, you can create the MariaDB and MaxScale resources referencing them:
If you already have a CA setup outside of Kubernetes, you can use it with the operator by providing the CA certificate as a Secret with the following structure:
Just by providing a reference to this Secret, the operator will use it to issue leaf certificates instead of generating a new CA:
Intermediate CAs are supported by the operator with . Leaf certificates issued by the intermediate CAs are slightly different, and include the intermediate CA public key as part of the certificate, in the following order: Leaf certificate -> Intermediate CA. This is a common practise to easily establish trust in complex PKI setups, where multiple CA are involved.
Many applications support this Leaf certificate -> Intermediate CA structure as a valid leaf certificate, and are able to establish trust with the intermediate CA. Normally, the intermediate CA will not be directly trusted, but used as a path to the root CA, which should be trusted by the application. If not trusted already, you can add the root CA to the by using a .
You are able to provide a set of CA public keys to be added to the by creating a Secret with the following structure:
And referencing it in the MariaDB and MaxScale resources, for instance:
This is specially useful when issuing certificates with an intermediate CA, see section for further detail.
Distributing the to your application namespace is out of the scope of this operator, the bundles will remain in the same namespace as the MariaDB and MaxScale instances.
If your application is in a different namespace, you can copy the CA bundle to the application namespace. Projects like can help you to automate this process and continously reconcile bundle changes.
You may configure the supported TLS versions in MariaDB by setting:
If not specified, the MariaDB's default TLS versions will be used. See .
Regarding MaxScale, you can also configure the supported TLS versions, both for the Admin REST API and MariaDB servers:
If not specified, the MaxScale's default TLS versions will be used. See MaxScale docs:
By default, CA certificates are valid for 3 years, while leaf certificates have a validity of 3 months. This lifetime can be customized in both MariaDB and MaxScale resources through the certificate configuration fields. For example:
When issuing certificates with cert-manager, you can specify the certificate configuration field alongside the issuer reference:
By default, private keys are generated with the ECDSA algorithm and a size of 256. You can customize the private key configuration in both MariaDB and MaxScale resources through the certificate configuration fields. For example:
When issuing certificates with cert-manager, you can specify the private key configuration field alongside the issuer reference:
The following set of algorithms and sizes are supported:
Depending on the setup, CAs can be managed and renewed by either MariaDB Enterprise Kubernetes Operator or cert-manager.
When managed by the operator, CAs have a lifetime of 3 years by default, and are marked for renewal after 66% of its lifetime has passed i.e. ~2 years. After being renewed, the operator will trigger an update of the instances to include the new CA in the bundle.
When managed by cert-manager, the renewal process is fully controlled by cert-manager, but the operator will also update the CA bundle after the CA is renewed.
You may choose any of the available to control the instance update process.
Depending on the setup, certificates can be managed and renewed by the operator or cert-manager. In either case, certificates have a lifetime of 90 days by default, and marked for renewal after 66% of its lifetime has passed i.e. ~60 days.
When the , the operator is able to pause a leaf certificate renewal if the CA is being updated at that same moment. This approach ensures a smooth update by avoiding the simultaneous rollout of the new CA and its associated certificates. Rolling them out together could be problematic, as all Pods need to trust the new CA before its issued certificates can be utilized.
When the , the renewal process is fully managed by cert-manager, and the operator will not interfere with it. The operator will only update the instances whenever the CA or the certificates get renewed.
You may choose any of the available to control the instance update process.
To have a high level picture of the certificates status, you can check the status.tls field of the MariaDB and MaxScale resources:
UsersYou are able to declaratively manage access to your MariaDB instances by creating . In particular, when TLS is enabled, you can provide additional requirements for the user when connecting over TLS.
For instance, if you want to require a valid x509 certificate for the user to be able o connect:
In order to restrict which subject the user certificate should have and/or require a particular issuer, you may set:
When any of these TLS requirements are not met, the user will not be able to connect to the instance.
See and the for further detail.
MariaDB Enterprise Cluster (Galera) supports multiple SSL modes to secure the communication between the nodes. For configuring the SSL enforcement level on the server i.e. WSREP, you can set:
The following values are supported: SERVER_X509, SERVER and PROVIDER. Refer to the for further detail about these modes.
You may also configure the SSL enforcement level used during Snapshot State Transfers(SST) by setting:
The following values are supported: VERIFY_IDENTITY, VERIFY, REQUIRED and DISABLED. Refer to the for further detail about these modes.
If you are willing to increase the enforcement level in an existing instance, make sure you follow the migration guide provided in the section.
In this guide, we will configure TLS for an application running in the app namespace to connect with MariaDB and MaxScale instances deployed in the default namespace. We assume that the following resources are already present in the default namespace with TLS enabled:
The first step is to create a User resource and grant the necessary permissions:
The app user will be able to connect to the MariaDB instance from the app namespace by providing a certificate with subject mariadb-galera-client and issued by the mariadb-galera-ca CA.
With the permissions in place, the next step is to prepare the certificates required for the application to connect:
CA Bundle: The trust bundle for MariaDB and MaxScale is available as a Secret named <instance-name>-ca-bundle in the default namespace. For more details, refer to the sections on and .
Client Certificate: MariaDB provides a default client certificate stored in a Secret named <mariadb-name>-client-cert
In this example, we assume that the following Secrets are available in the app namespace:
mariadb-bundle: CA bundle for the MariaDB and MaxScale instances.
mariadb-galera-client-cert: Client certificate required to connect to the MariaDB instance.
With these Secrets in place, we can proceed to define our application:
The application will connect to the MariaDB instance using the app user, and will execute a simple query to check the connection status. The --ssl-ca, --ssl-cert, --ssl-key and --ssl-verify-server-cert flags are used to provide the CA bundle, client certificate and key, and to verify the server certificate respectively.
If the connection is successful, the output should be:
You can also point the application to the MaxScale instance by updating the host to maxscale-galera.default.svc.cluster.local:
If successful, the expected output is:
ConnectionsIn order to validate your TLS setup, and to ensure that you TLS certificates are correctly issued and configured, you can use the Connection resource to test the connection to both your MariaDB and MaxScale instances:
If successful, the Connection resource will be in a Ready state, which means that your TLS setup is correctly configured:
This could be specially useful when and issuing certificates for your applications.
Leaf certificates issued by are not supported by Galera, see . This implies that a root CA must be used to issue the MariaDB certificates.
This doesn't affect MaxScale, as it is able to establish trust with intermediate CAs, and therefore you can still issue your application facing certificates (MaxScale listeners) with an intermediate CA, giving you more flexibility in your PKI setup.
Unlike MariaDB, TLS and non-TLS connections on the same port are not supported simultaneously.
TLS encryption must be enabled for listeners when they are created. For servers, the TLS can be enabled after creation but it cannot be disabled or altered.
Refer to the for further details.
certController.certLifetime
string
"2160h"
Certificate lifetime.
certController.enabled
bool
true
Specifies whether the cert-controller should be created.
certController.extrArgs
list
[]
Extra arguments to be passed to the cert-controller entrypoint
certController.extraVolumeMounts
list
[]
Extra volumes to mount to cert-controller container
certController.extraVolumes
list
[]
Extra volumes to pass to cert-controller Pod
certController.ha.enabled
bool
false
Enable high availability
certController.ha.replicas
int
3
Number of replicas
certController.image.pullPolicy
string
"IfNotPresent"
certController.image.repository
string
"docker.mariadb.com/mariadb-enterprise-operator"
certController.image.tag
string
""
Image tag to use. By default the chart appVersion is used
certController.imagePullSecrets
list
[]
certController.nodeSelector
object
{}
Node selectors to add to cert-controller container
certController.pdb.enabled
bool
false
Enable PodDisruptionBudget for the cert-controller.
certController.pdb.maxUnavailable
int
1
Maximum number of unavailable Pods. You may also give a percentage, like 50%
certController.podAnnotations
object
{}
Annotations to add to cert-controller Pod
certController.podSecurityContext
object
{}
Security context to add to cert-controller Pod
certController.priorityClassName
string
""
priorityClassName to add to cert-controller container
certController.privateKeyAlgorithm
string
"ECDSA"
Private key algorithm to be used for the CA and leaf certificate private keys. One of: ECDSA or RSA.
certController.privateKeySize
int
256
Private key size to be used for the CA and leaf certificate private keys. Supported values: ECDSA(256, 384, 521), RSA(2048, 3072, 4096)
certController.renewBeforePercentage
int
33
How long before the certificate expiration should the renewal process be triggered. For example, if a certificate is valid for 60 minutes, and renewBeforePercentage=25, cert-controller will begin to attempt to renew the certificate 45 minutes after it was issued (i.e. when there are 15 minutes (25%) remaining until the certificate is no longer valid).
certController.requeueDuration
string
"5m"
Requeue duration to ensure that certificate gets renewed.
certController.resources
object
{}
Resources to add to cert-controller container
certController.securityContext
object
{}
Security context to add to cert-controller Pod
certController.serviceAccount.annotations
object
{}
Annotations to add to the service account
certController.serviceAccount.automount
bool
true
Automounts the service account token in all containers of the Pod
certController.serviceAccount.enabled
bool
true
Specifies whether a service account should be created
certController.serviceAccount.extraLabels
object
{}
Extra Labels to add to the service account
certController.serviceAccount.name
string
""
The name of the service account to use. If not set and enabled is true, a name is generated using the fullname template
certController.serviceMonitor.additionalLabels
object
{}
Labels to be added to the cert-controller ServiceMonitor
certController.serviceMonitor.enabled
bool
true
Enable cert-controller ServiceMonitor. Metrics must be enabled
certController.serviceMonitor.interval
string
"30s"
Interval to scrape metrics
certController.serviceMonitor.metricRelabelings
list
[]
certController.serviceMonitor.relabelings
list
[]
certController.serviceMonitor.scrapeTimeout
string
"25s"
Timeout if metrics can't be retrieved in given time interval
certController.tolerations
list
[]
Tolerations to add to cert-controller container
certController.topologySpreadConstraints
list
[]
topologySpreadConstraints to add to cert-controller container
clusterName
string
"cluster.local"
Cluster DNS name
config.exporterImage
string
"mariadb/mariadb-prometheus-exporter-ubi:1.1.0"
Default MariaDB exporter image
config.exporterMaxscaleImage
string
"mariadb/maxscale-prometheus-exporter-ubi:1.1.0"
Default MaxScale exporter image
config.galeraLibPath
string
"/usr/lib64/galera/libgalera_enterprise_smm.so"
Galera Enterprise library path to be used with Galera
config.mariadbDefaultVersion
string
"11.8"
Default MariaDB Enterprise version to be used when unable to infer it via image tag
config.mariadbImage
string
"docker.mariadb.com/enterprise-server:11.8.3-1"
Default MariaDB Enterprise image
config.mariadbImageName
string
"docker.mariadb.com/enterprise-server"
Default MariaDB Enterprise image name
config.maxscaleImage
string
"docker.mariadb.com/maxscale:25.10.0"
Default MaxScale Enterprise image
crds
object
{"enabled":false}
CRDs
crds.enabled
bool
false
Whether the helm chart should create and update the CRDs. It is false by default, which implies that the CRDs must be managed independently with the mariadb-enterprise-operator-crds helm chart. WARNING This should only be set to true during the initial deployment. If this chart manages the CRDs and is later uninstalled, all MariaDB instances will be DELETED.
currentNamespaceOnly
bool
false
Whether the operator should watch CRDs only in its own namespace or not.
extrArgs
list
[]
Extra arguments to be passed to the controller entrypoint
extraEnv
list
[]
Extra environment variables to be passed to the controller
extraEnvFrom
list
[]
Extra environment variables from preexiting ConfigMap / Secret objects used by the controller using envFrom
extraVolumeMounts
list
[]
Extra volumes to mount to the container.
extraVolumes
list
[]
Extra volumes to pass to pod.
fullnameOverride
string
""
ha.enabled
bool
false
Enable high availability of the controller. If you enable it we recommend to set affinity and pdb
ha.replicas
int
3
Number of replicas
image.pullPolicy
string
"IfNotPresent"
image.repository
string
"docker.mariadb.com/mariadb-enterprise-operator"
image.tag
string
""
Image tag to use. By default the chart appVersion is used
imagePullSecrets
list
[]
logLevel
string
"INFO"
Controller log level
metrics.enabled
bool
false
Enable operator internal metrics. Prometheus must be installed in the cluster
metrics.serviceMonitor.additionalLabels
object
{}
Labels to be added to the controller ServiceMonitor
metrics.serviceMonitor.enabled
bool
true
Enable controller ServiceMonitor
metrics.serviceMonitor.interval
string
"30s"
Interval to scrape metrics
metrics.serviceMonitor.metricRelabelings
list
[]
metrics.serviceMonitor.relabelings
list
[]
metrics.serviceMonitor.scrapeTimeout
string
"25s"
Timeout if metrics can't be retrieved in given time interval
nameOverride
string
""
nodeSelector
object
{}
Node selectors to add to controller Pod
pdb.enabled
bool
false
Enable PodDisruptionBudget for the controller.
pdb.maxUnavailable
int
1
Maximum number of unavailable Pods. You may also give a percentage, like 50%
podAnnotations
object
{}
Annotations to add to controller Pod
podSecurityContext
object
{}
Security context to add to controller Pod
pprof.enabled
bool
false
Enable the pprof HTTP server.
pprof.port
int
6060
The port where the pprof HTTP server listens.
priorityClassName
string
""
priorityClassName to add to controller Pod
rbac.aggregation.enabled
bool
true
Specifies whether the cluster roles aggrate to view and edit predefinied roles
rbac.enabled
bool
true
Specifies whether RBAC resources should be created
resources
object
{}
Resources to add to controller container
securityContext
object
{}
Security context to add to controller container
serviceAccount.annotations
object
{}
Annotations to add to the service account
serviceAccount.automount
bool
true
Automounts the service account token in all containers of the Pod
serviceAccount.enabled
bool
true
Specifies whether a service account should be created
serviceAccount.extraLabels
object
{}
Extra Labels to add to the service account
serviceAccount.name
string
""
The name of the service account to use. If not set and enabled is true, a name is generated using the fullname template
tolerations
list
[]
Tolerations to add to controller Pod
topologySpreadConstraints
list
[]
topologySpreadConstraints to add to controller Pod
webhook.affinity
object
{}
Affinity to add to webhook Pod
webhook.annotations
object
{}
Annotations for webhook configurations.
webhook.cert.ca.key
string
""
File under 'ca.path' that contains the full CA trust chain.
webhook.cert.ca.path
string
""
Path that contains the full CA trust chain.
webhook.cert.certManager.duration
string
""
Duration to be used in the Certificate resource,
webhook.cert.certManager.enabled
bool
false
Whether to use cert-manager to issue and rotate the certificate. If set to false, mariadb-enterprise-operator's cert-controller will be used instead.
webhook.cert.certManager.issuerRef
object
{}
Issuer reference to be used in the Certificate resource. If not provided, a self-signed issuer will be used.
webhook.cert.certManager.privateKeyAlgorithm
string
"ECDSA"
Private key algorithm to be used for the CA and leaf certificate private keys. One of: ECDSA or RSA.
webhook.cert.certManager.privateKeySize
int
256
Private key size to be used for the CA and leaf certificate private keys. Supported values: ECDSA(256, 384, 521), RSA(2048, 3072, 4096)
webhook.cert.certManager.renewBefore
string
""
Renew before duration to be used in the Certificate resource.
webhook.cert.certManager.revisionHistoryLimit
int
3
The maximum number of CertificateRequest revisions that are maintained in the Certificate’s history.
webhook.cert.path
string
"/tmp/k8s-webhook-server/serving-certs"
Path where the certificate will be mounted. 'tls.crt' and 'tls.key' certificates files should be under this path.
webhook.cert.secretAnnotations
object
{}
Annotatioms to be added to webhook TLS secret.
webhook.cert.secretLabels
object
{}
Labels to be added to webhook TLS secret.
webhook.enabled
bool
true
Specifies whether the webhook should be created.
webhook.extrArgs
list
[]
Extra arguments to be passed to the webhook entrypoint
webhook.extraVolumeMounts
list
[]
Extra volumes to mount to webhook container
webhook.extraVolumes
list
[]
Extra volumes to pass to webhook Pod
webhook.ha.enabled
bool
false
Enable high availability
webhook.ha.replicas
int
3
Number of replicas
webhook.hostNetwork
bool
false
Expose the webhook server in the host network
webhook.image.pullPolicy
string
"IfNotPresent"
webhook.image.repository
string
"docker.mariadb.com/mariadb-enterprise-operator"
webhook.image.tag
string
""
Image tag to use. By default the chart appVersion is used
webhook.imagePullSecrets
list
[]
webhook.nodeSelector
object
{}
Node selectors to add to webhook Pod
webhook.pdb.enabled
bool
false
Enable PodDisruptionBudget for the webhook.
webhook.pdb.maxUnavailable
int
1
Maximum number of unavailable Pods. You may also give a percentage, like 50%
webhook.podAnnotations
object
{}
Annotations to add to webhook Pod
webhook.podSecurityContext
object
{}
Security context to add to webhook Pod
webhook.port
int
9443
Port to be used by the webhook server
webhook.priorityClassName
string
""
priorityClassName to add to webhook Pod
webhook.resources
object
{}
Resources to add to webhook container
webhook.securityContext
object
{}
Security context to add to webhook container
webhook.serviceAccount.annotations
object
{}
Annotations to add to the service account
webhook.serviceAccount.automount
bool
true
Automounts the service account token in all containers of the Pod
webhook.serviceAccount.enabled
bool
true
Specifies whether a service account should be created
webhook.serviceAccount.extraLabels
object
{}
Extra Labels to add to the service account
webhook.serviceAccount.name
string
""
The name of the service account to use. If not set and enabled is true, a name is generated using the fullname template
webhook.serviceMonitor.additionalLabels
object
{}
Labels to be added to the webhook ServiceMonitor
webhook.serviceMonitor.enabled
bool
true
Enable webhook ServiceMonitor. Metrics must be enabled
webhook.serviceMonitor.interval
string
"30s"
Interval to scrape metrics
webhook.serviceMonitor.metricRelabelings
list
[]
webhook.serviceMonitor.relabelings
list
[]
webhook.serviceMonitor.scrapeTimeout
string
"25s"
Timeout if metrics can't be retrieved in given time interval
webhook.tolerations
list
[]
Tolerations to add to webhook Pod
webhook.topologySpreadConstraints
list
[]
topologySpreadConstraints to add to webhook Pod
25.10
>=1.32.0-0 <= 1.34.0-0
LTS 25.10. It was tested to work up to kubernetes v1.34.
affinity
object
{}
Affinity to add to controller Pod
certController.affinity
object
{}
Affinity to add to cert-controller container
certController.caLifetime
string
"26280h"
CA certificate lifetime. It must be greater than certLifetime.
<mariadb-name>*.<mariadb-name>-internal.<namespace>.svc.<cluster-name>
*.<mariadb-name>-internal.<namespace>.svc
*.<mariadb-name>-internal.<namespace>
*.<mariadb-name>-internal
<mariadb-name>-primary.<namespace>.svc.<cluster-name>
<mariadb-name>-primary.<namespace>.svc
<mariadb-name>-primary.<namespace>
<mariadb-name>-primary
<mariadb-name>-secondary.<namespace>.svc.<cluster-name>
<mariadb-name>-secondary.<namespace>.svc
<mariadb-name>-secondary.<namespace>
<mariadb-name>-secondary
localhost
Server CA bundle used to establish trust with the MariaDB server.
Server leaf certificate used to connect to the MariaDB server.
<maxscale-name><maxscale-name>-gui.<namespace>.svc.<clusername>
<maxscale-name>-gui.<namespace>.svc
<maxscale-name>-gui.<namespace>
<maxscale-name>-gui
*.<maxscale-name>-internal.<namespace>.svc.<clusername>
*.<maxscale-name>-internal.<namespace>.svc
*.<maxscale-name>-internal.<namespace>
*.<maxscale-name>-internal
defaultSecretmariadb-galera-clientmariadb-galera-caRSA
2048, 3072, 4096
ECDSA
256, 384, 521
helm repo add mariadb-enterprise-operator https://operator.mariadb.com
helm install mariadb-enterprise-operator-crds mariadb-enterprise-operator/mariadb-enterprise-operator-crdsimagePullSecrets:
- name: mariadb-enterprise
webhook:
imagePullSecrets:
- name: mariadb-enterprise
certController:
imagePullSecrets:
- name: mariadb-enterprisehelm repo add mariadb-enterprise-operator https://operator.mariadb.com
helm install mariadb-enterprise-operator mariadb-enterprise-operator/mariadb-enterprise-operator \
-f values.yamlhelm repo add mariadb-enterprise-operator https://operator.mariadb.com
helm install mariadb-enterprise-operator mariadb-enterprise-operator/mariadb-enterprise-operator \
-f values.yaml \
--set metrics.enabled=true --set webhook.cert.certManager.enabled=truehelm install --version "25.10.*" mariadb-enterprise-operator-crds mariadb-enterprise-operator/mariadb-enterprise-operator-crds
helm install mariadb-enterprise-operator mariadb-enterprise-operator/mariadb-enterprise-operator \
-f values.yaml \
--version "25.10.*"helm repo add mariadb-enterprise-operator https://operator.mariadb.com
helm install mariadb-enterprise-operator mariadb-enterprise-operator/mariadb-enterprise-operatorhelm repo add mariadb-enterprise-operator https://operator.mariadb.com
helm install mariadb-enterprise-operator \
-n databases --create-namespace \
-f values.yaml \
--set currentNamespaceOnly=true \
mariadb-enterprise-operator/mariadb-enterprise-operatorhelm repo update mariadb-enterprise-operator
helm upgrade --install mariadb-enterprise-operator-crds \
--version <new-version> \
mariadb-enterprise-operator/mariadb-enterprise-operator-crdshelm repo update mariadb-enterprise-operator
helm upgrade --install mariadb-enterprise-operator \
--version <new-version> \
mariadb-enterprise-operator/mariadb-enterprise-operatorha:
enabled: true
replicas: 3
affinity:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchExpressions:
- key: app.kubernetes.io/name
operator: In
values:
- mariadb-enterprise-operator
- key: app.kubernetes.io/instance
operator: In
values:
- mariadb-enterprise-operator
topologyKey: kubernetes.io/hostname
pdb:
enabled: true
maxUnavailable: 1helm uninstall mariadb-enterprise-operatorhelm uninstall mariadb-enterprise-operator-crdsapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
...
tls:
enabled: trueapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
...
tls:
enabled: true
required: trueapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
...
tls:
enabled: falseapiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale-galera
spec:
...
mariaDbRef:
name: mariadb-galera
tls:
enabled: trueapiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale-galera
spec:
...
mariaDbRef:
name: mariadb-galera
tls:
enabled: falseapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb
spec:
...
tls:
enabled: trueapiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale
spec:
...
tls:
enabled: trueapiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: selfsigned
spec:
selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: root-ca
namespace: default
spec:
duration: 52596h # 6 years
commonName: root-ca
usages:
- digital signature
- key encipherment
- cert sign
issuerRef:
name: selfsigned
kind: ClusterIssuer
isCA: true
privateKey:
encoding: PKCS1
algorithm: ECDSA
size: 256
secretTemplate:
labels:
enterprise.mariadb.com/watch: ""
secretName: root-ca
revisionHistoryLimit: 10
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: root-ca
spec:
ca:
secretName: root-caapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
...
tls:
enabled: true
serverCertIssuerRef:
name: root-ca
kind: ClusterIssuer
clientCertIssuerRef:
name: root-ca
kind: ClusterIssuerapiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale-galera
spec:
...
tls:
enabled: true
adminCertIssuerRef:
name: root-ca
kind: ClusterIssuer
listenerCertIssuerRef:
name: root-ca
kind: ClusterIssuerapiVersion: v1
kind: Secret
type: Opaque
metadata:
name: mariadb-galera-server-ca
labels:
enterprise.mariadb.com/watch: ""
data:
ca.crt:
-----BEGIN CERTIFICATE-----
<public-key>
-----END CERTIFICATE-----
ca.key:
-----BEGIN EC PRIVATE KEY-----
<private-key>
-----END EC PRIVATE KEY-----apiVersion: v1
kind: Secret
type: kubernetes.io/tls
metadata:
name: mariadb-galera-server-tls
labels:
enterprise.mariadb.com/watch: ""
data:
tls.crt:
-----BEGIN CERTIFICATE-----
<public-key>
-----END CERTIFICATE-----
tls.key:
-----BEGIN EC PRIVATE KEY-----
<private-key>
-----END EC PRIVATE KEY-----apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
...
tls:
enabled: true
serverCASecretRef:
name: mariadb-server-ca
serverCertSecretRef:
name: mariadb-galera-server-tls
clientCASecretRef:
name: mariadb-client-ca
clientCertSecretRef:
name: mariadb-galera-client-tlsapiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale-galera
spec:
...
tls:
enabled: true
adminCASecretRef:
name: maxscale-admin-ca
adminCertSecretRef:
name: maxscale-galera-admin-tls
listenerCASecretRef:
name: maxscale-listener-ca
listenerCertSecretRef:
name: maxscale-galera-listener-tls
serverCASecretRef:
name: mariadb-galera-ca-bundle
serverCertSecretRef:
name: mariadb-galera-client-tlsapiVersion: v1
kind: Secret
type: Opaque
metadata:
name: mariadb-ca
labels:
enterprise.mariadb.com/watch: ""
data:
ca.crt:
-----BEGIN CERTIFICATE-----
<public-key>
-----END CERTIFICATE-----
ca.key:
-----BEGIN EC PRIVATE KEY-----
<private-key>
-----END EC PRIVATE KEY-----apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
...
tls:
enabled: true
serverCASecretRef:
name: mariadb-server-ca
clientCASecretRef:
name: mariadb-client-caapiVersion: v1
kind: Secret
type: Opaque
metadata:
name: custom-trust
labels:
enterprise.mariadb.com/watch: ""
data:
ca.crt:
-----BEGIN CERTIFICATE-----
<my-org-root-ca>
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<root-ca>
-----END CERTIFICATE-----apiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale-galera
spec:
...
tls:
enabled: true
adminCASecretRef:
name: custom-trust
adminCertIssuerRef:
name: my-org-intermediate-ca
kind: ClusterIssuer
listenerCASecretRef:
name: custom-trust
listenerCertIssuerRef:
name: intermediate-ca
kind: ClusterIssuerapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
tls:
versions:
- TLSv1.3
- TLSv1.2
- TLSv1.1
- TLSv1.0apiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale-galera
spec:
...
tls:
adminVersions:
- TLSv13
- TLSv12
- TLSv11
- TLSv10
serverVersions:
- TLSv13
- TLSv12
- TLSv11
- TLSv10apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
tls:
enabled: true
required: true
serverCertConfig:
caLifetime: 8766h # 1 year
certLifetime: 720h # 1 month
clientCertConfig:
caLifetime: 8766h # 1 year
certLifetime: 720h # 1 monthapiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale-galera
spec:
tls:
enabled: true
adminCertConfig:
caLifetime: 8766h # 1 year
certLifetime: 1h # 1 month
listenerCertConfig:
caLifetime: 8766h # 1 year
certLifetime: 720h # 1 monthapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
tls:
enabled: true
required: true
serverCertIssuerRef:
name: root-ca
kind: ClusterIssuer
serverCertConfig:
caLifetime: 8766h # 1 year
certLifetime: 720h # 1 month
clientCertIssuerRef:
name: root-ca
kind: ClusterIssuer
clientCertConfig:
caLifetime: 8766h # 1 year
certLifetime: 720h # 1 monthapiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale-galera
spec:
tls:
enabled: true
adminCertIssuerRef:
name: root-ca
kind: ClusterIssuer
adminCertConfig:
caLifetime: 8766h # 1 year
certLifetime: 1h # 1 month
listenerCertIssuerRef:
name: root-ca
kind: ClusterIssuer
listenerCertConfig:
caLifetime: 8766h # 1 year
certLifetime: 720h # 1 monthapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
tls:
enabled: true
required: true
serverCertConfig:
privateKeyAlgorithm: RSA
privateKeySize: 2048
clientCertConfig:
privateKeyAlgorithm: RSA
privateKeySize: 2048apiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale-galera
spec:
tls:
enabled: true
adminCertConfig:
privateKeyAlgorithm: RSA
privateKeySize: 2048
listenerCertConfig:
privateKeyAlgorithm: RSA
privateKeySize: 2048apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
tls:
enabled: true
required: true
serverCertIssuerRef:
name: root-ca
kind: ClusterIssuer
serverCertConfig:
privateKeyAlgorithm: ECDSA
privateKeySize: 256
clientCertIssuerRef:
name: root-ca
kind: ClusterIssuer
clientCertConfig:
privateKeyAlgorithm: ECDSA
privateKeySize: 256apiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale-galera
spec:
tls:
enabled: true
adminCertIssuerRef:
name: root-ca
kind: ClusterIssuer
adminCertConfig:
privateKeyAlgorithm: ECDSA
privateKeySize: 256
listenerCertIssuerRef:
name: root-ca
kind: ClusterIssuer
listenerCertConfig:
privateKeyAlgorithm: ECDSA
privateKeySize: 256kubectl get mariadb mariadb-galera -o jsonpath="{.status.tls}" | jq
{
"caBundle": [
{
"issuer": "CN=mariadb-galera-ca",
"notAfter": "2028-01-20T14:26:50Z",
"notBefore": "2025-01-20T13:26:50Z",
"subject": "CN=mariadb-galera-ca"
}
],
"clientCert": {
"issuer": "CN=mariadb-galera-ca",
"notAfter": "2025-04-20T14:26:50Z",
"notBefore": "2025-01-20T13:26:50Z",
"subject": "CN=mariadb-galera-client"
},
"serverCert": {
"issuer": "CN=mariadb-galera-ca",
"notAfter": "2025-04-20T14:26:50Z",
"notBefore": "2025-01-20T13:26:50Z",
"subject": "CN=mariadb-galera.default.svc.cluster.local"
}
}kubectl get maxscale maxscale-galera -o jsonpath="{.status.tls}" | jq
{
"adminCert": {
"issuer": "CN=maxscale-galera-ca",
"notAfter": "2025-04-20T14:33:09Z",
"notBefore": "2025-01-20T13:33:09Z",
"subject": "CN=maxscale-galera.default.svc.cluster.local"
},
"caBundle": [
{
"issuer": "CN=maxscale-galera-ca",
"notAfter": "2028-01-20T14:33:09Z",
"notBefore": "2025-01-20T13:33:09Z",
"subject": "CN=maxscale-galera-ca"
},
{
"issuer": "CN=mariadb-galera-ca",
"notAfter": "2028-01-20T14:28:46Z",
"notBefore": "2025-01-20T13:28:46Z",
"subject": "CN=mariadb-galera-ca"
}
],
"listenerCert": {
"issuer": "CN=maxscale-galera-ca",
"notAfter": "2025-04-20T14:33:09Z",
"notBefore": "2025-01-20T13:33:09Z",
"subject": "CN=maxscale-galera.default.svc.cluster.local"
},
"serverCert": {
"issuer": "CN=mariadb-galera-ca",
"notAfter": "2025-04-20T14:28:46Z",
"notBefore": "2025-01-20T13:28:46Z",
"subject": "CN=mariadb-galera-client"
}
}apiVersion: enterprise.mariadb.com/v1alpha1
kind: User
metadata:
name: user
spec:
...
require:
x509: trueapiVersion: enterprise.mariadb.com/v1alpha1
kind: User
metadata:
name: user
spec:
...
require:
issuer: "/CN=mariadb-galera-ca"
subject: "/CN=mariadb-galera-client"apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
tls:
enabled: true
galeraServerSSLMode: SERVER_X509apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
tls:
enabled: true
galeraSSTEnabled: true
galeraClientSSLMode: VERIFY_IDENTITYapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb-galera
spec:
rootPasswordSecretKeyRef:
name: mariadb
key: root-password
storage:
size: 1Gi
replicas: 3
galera:
enabled: true
tls:
enabled: true
required: true
---
apiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale-galera
spec:
replicas: 2
mariaDbRef:
name: mariadb-galera
tls:
enabled: trueapiVersion: enterprise.mariadb.com/v1alpha1
kind: User
metadata:
name: app
namespace: app
spec:
mariaDbRef:
name: mariadb-galera
namespace: default
require:
issuer: "/CN=mariadb-galera-ca"
subject: "/CN=mariadb-galera-client"
host: "%"
---
apiVersion: enterprise.mariadb.com/v1alpha1
kind: Grant
metadata:
name: grant-app
namespace: app
spec:
mariaDbRef:
name: mariadb-galera
namespace: default
privileges:
- "ALL PRIVILEGES"
database: "*"
table: "*"
username: app
host: "%"apiVersion: batch/v1
kind: CronJob
metadata:
name: mariadb-client
namespace: app
spec:
schedule: "*/1 * * * *"
jobTemplate:
spec:
template:
spec:
containers:
- name: mariadb-client
image: mariadb:11.4.4
command:
- bash
args:
- -c
- >
mariadb -u app -h mariadb-galera-primary.default.svc.cluster.local
--ssl-ca=/etc/pki/ca.crt --ssl-cert=/etc/pki/tls.crt
--ssl-key=/etc/pki/tls.key --ssl-verify-server-cert
-e "SELECT 'MariaDB connection successful!' AS Status;" -t
volumeMounts:
- name: pki
mountPath: /etc/pki
readOnly: true
volumes:
- name: pki
projected:
sources:
- secret:
name: mariadb-bundle
items:
- key: ca.crt
path: ca.crt
- secret:
name: mariadb-galera-client-cert
items:
- key: tls.crt
path: tls.crt
- key: tls.key
path: tls.key
restartPolicy: Never+---------------------------------+
| Status |
+---------------------------------+
| MariaDB connection successful! |
+---------------------------------+apiVersion: batch/v1
kind: CronJob
metadata:
name: maxscale-client
namespace: app
spec:
schedule: "*/1 * * * *"
jobTemplate:
spec:
template:
spec:
containers:
- name: maxscale-client
image: mariadb:11.4.4
command:
- bash
args:
- -c
- >
mariadb -u app -h maxscale-galera.default.svc.cluster.local
--ssl-ca=/etc/pki/ca.crt --ssl-cert=/etc/pki/tls.crt
--ssl-key=/etc/pki/tls.key --ssl-verify-server-cert
-e "SELECT 'MaxScale connection successful!' AS Status;" -t
volumeMounts:
- name: pki
mountPath: /etc/pki
readOnly: true
volumes:
- name: pki
projected:
sources:
- secret:
name: mariadb-bundle
items:
- key: ca.crt
path: ca.crt
- secret:
name: mariadb-galera-client-cert
items:
- key: tls.crt
path: tls.crt
- key: tls.key
path: tls.key
restartPolicy: Never+---------------------------------+
| Status |
+---------------------------------+
| MaxScale connection successful! |
+---------------------------------+apiVersion: enterprise.mariadb.com/v1alpha1
kind: Connection
metadata:
name: connection
spec:
mariaDbRef:
name: mariadb-galera
username: mariadb
passwordSecretKeyRef:
name: mariadb
key: password
tlsClientCertSecretRef:
name: mariadb-galera-client-cert
database: mariadb
healthCheck:
interval: 30sapiVersion: enterprise.mariadb.com/v1alpha1
kind: Connection
metadata:
name: connection-maxscale
spec:
maxScaleRef:
name: maxscale-galera
username: mariadb
passwordSecretKeyRef:
name: mariadb
key: password
tlsClientCertSecretRef:
name: mariadb-galera-client-cert
database: mariadb
healthCheck:
interval: 30skubectl get connections
NAME READY STATUS SECRET AGE
connection True Healthy connection 2m8s
connection-maxscale True Healthy connection-maxscale 97s
WEBINAR
New innovations in MaxScale 25.01 and Enterprise Platform
MariaDB Enterprise Kubernetes Operator is able to configure Prometheus operator resources to scrape metrics from MariaDB and MaxScale instances. These metrics can be used later on to build Grafana dashboards or trigger Alertmanager alerts.
In order to expose the operator internal metrics, you can install the operator Helm chart passing the metrics.enabled = true value. Refer to the Helm documentation for further detail.
The operator configures exporters to query MariaDB and MaxScale, exposing metrics in Prometheus format through an HTTP endpoint.
It is important to note that these exporters run as standalone Deployments rather than as sidecars for each data-plane replica. Since they can communicate with all replicas of MariaDB and MaxScale, there is no need to run a separate exporter for each replica.
As a result, the lifecycle of MariaDB and MaxScale remains independent from the exporters, allowing for upgrades without impacting the availability of either component.
ServiceMonitorOnce the exporter Deployment is ready, the operator creates a object that will be eventually reconciled by the , resulting in the Prometheus instance being configured to scrape the exporter endpoint.
As you scale MariaDB and MaxScale by adjusting the number of replicas, the operator will reconcile the ServiceMonitor to dynamically add or remove targets corresponding to the updated instances.
The easiest way to setup metrics in your MariaDB and MaxScale instances is just by setting spec.metrics.enabled = true:
The rest of the fields are defaulted by the operator. If you need a more fine grained configuration, refer to the and the following examples:
The following community dashboards available on are compatible with the , and therefore they can be used to monitor MariaDB instances:
The following metrics are available for MariaDB instances:
The following metrics are available for MaxScale instances:
mysql_galera_evs_repl_latency_max_seconds
PXC/Galera group communication latency. Max value.
GAUGE
mysql_galera_evs_repl_latency_min_seconds
PXC/Galera group communication latency. Min value.
GAUGE
mysql_galera_evs_repl_latency_sample_size
PXC/Galera group communication latency. Sample Size.
GAUGE
mysql_galera_evs_repl_latency_stdev
PXC/Galera group communication latency. Standard Deviation.
GAUGE
mysql_galera_gcache_size_bytes
PXC/Galera gcache size.
GAUGE
mysql_galera_status_info
PXC/Galera status information.
GAUGE
mysql_galera_variables_info
PXC/Galera variables information.
GAUGE
mysql_global_status_aborted_clients
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_aborted_connects
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_aborted_connects_preauth
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_access_denied_errors
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_acl_column_grants
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_acl_database_grants
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_acl_function_grants
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_acl_package_body_grants
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_acl_package_spec_grants
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_acl_procedure_grants
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_acl_proxy_users
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_acl_role_grants
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_acl_roles
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_acl_table_grants
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_acl_users
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_aria_pagecache_blocks_not_flushed
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_aria_pagecache_blocks_unused
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_aria_pagecache_blocks_used
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_aria_pagecache_read_requests
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_aria_pagecache_reads
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_aria_pagecache_write_requests
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_aria_pagecache_writes
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_aria_transaction_log_syncs
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_binlog_bytes_written
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_binlog_cache_disk_use
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_binlog_cache_use
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_binlog_commits
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_binlog_disk_use
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_binlog_group_commit_trigger_count
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_binlog_group_commit_trigger_lock_wait
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_binlog_group_commit_trigger_timeout
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_binlog_group_commits
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_binlog_gtid_index_hit
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_binlog_gtid_index_miss
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_binlog_snapshot_position
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_binlog_stmt_cache_disk_use
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_binlog_stmt_cache_use
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_buffer_pool_dirty_pages
Innodb buffer pool dirty pages.
GAUGE
mysql_global_status_buffer_pool_page_changes_total
Innodb buffer pool page state changes.
COUNTER
mysql_global_status_buffer_pool_pages
Innodb buffer pool pages by state.
GAUGE
mysql_global_status_busy_time
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_bytes_received
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_bytes_sent
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_column_compressions
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_column_decompressions
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_commands_total
Total number of executed MySQL commands.
COUNTER
mysql_global_status_compression
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_connection_errors_total
Total number of MySQL connection errors.
COUNTER
mysql_global_status_connections
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_cpu_time
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_created_tmp_disk_tables
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_created_tmp_files
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_created_tmp_tables
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_delayed_errors
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_delayed_insert_threads
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_delayed_writes
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_delete_scan
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_empty_queries
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_executed_events
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_executed_triggers
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_feature_application_time_periods
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_feature_check_constraint
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_feature_custom_aggregate_functions
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_feature_delay_key_write
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_feature_dynamic_columns
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_feature_fulltext
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_feature_gis
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_feature_insert_returning
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_feature_into_outfile
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_feature_into_variable
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_feature_invisible_columns
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_feature_json
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_feature_locale
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_feature_subquery
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_feature_system_versioning
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_feature_timezone
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_feature_trigger
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_feature_window_functions
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_feature_xml
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_handlers_total
Total number of executed MySQL handlers.
COUNTER
mysql_global_status_innodb_adaptive_hash_hash_searches
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_adaptive_hash_non_hash_searches
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_available_undo_logs
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_background_log_sync
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_buffer_pool_bytes_data
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_buffer_pool_bytes_dirty
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_buffer_pool_load_incomplete
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_buffer_pool_read_ahead
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_buffer_pool_read_ahead_evicted
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_buffer_pool_read_ahead_rnd
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_buffer_pool_read_requests
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_buffer_pool_reads
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_buffer_pool_wait_free
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_buffer_pool_write_requests
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_bulk_operations
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_checkpoint_age
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_checkpoint_max_age
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_data_fsyncs
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_data_pending_fsyncs
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_data_pending_reads
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_data_pending_writes
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_data_read
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_data_reads
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_data_writes
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_data_written
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_dblwr_pages_written
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_dblwr_writes
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_deadlocks
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_encryption_n_merge_blocks_decrypted
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_encryption_n_merge_blocks_encrypted
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_encryption_n_rowlog_blocks_decrypted
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_encryption_n_rowlog_blocks_encrypted
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_encryption_n_temp_blocks_decrypted
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_encryption_n_temp_blocks_encrypted
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_encryption_num_key_requests
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_encryption_rotation_estimated_iops
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_encryption_rotation_pages_flushed
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_encryption_rotation_pages_modified
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_encryption_rotation_pages_read_from_cache
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_encryption_rotation_pages_read_from_disk
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_have_bzip2
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_have_lz4
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_have_lzma
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_have_lzo
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_have_punch_hole
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_have_snappy
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_history_list_length
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_instant_alter_column
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_log_waits
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_log_write_requests
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_log_writes
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_lsn_current
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_lsn_flushed
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_lsn_last_checkpoint
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_master_thread_active_loops
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_master_thread_idle_loops
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_max_trx_id
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_mem_adaptive_hash
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_mem_dictionary
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_num_open_files
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_num_page_compressed_trim_op
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_num_pages_decrypted
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_num_pages_encrypted
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_num_pages_page_compressed
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_num_pages_page_compression_error
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_num_pages_page_decompressed
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_onlineddl_pct_progress
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_onlineddl_rowlog_pct_used
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_onlineddl_rowlog_rows
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_os_log_written
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_page_compression_saved
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_page_size
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_pages_created
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_pages_read
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_pages_written
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_row_lock_current_waits
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_row_lock_time
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_row_lock_time_avg
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_row_lock_time_max
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_row_lock_waits
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_truncated_status_writes
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_innodb_undo_truncations
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_key_blocks_not_flushed
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_key_blocks_unused
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_key_blocks_used
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_key_blocks_warm
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_key_read_requests
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_key_reads
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_key_write_requests
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_key_writes
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_last_query_cost
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_master_gtid_wait_count
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_master_gtid_wait_time
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_master_gtid_wait_timeouts
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_max_statement_time_exceeded
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_max_tmp_space_used
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_max_used_connections
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_max_used_connections_time
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_memory_used
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_memory_used_initial
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_not_flushed_delayed_rows
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_open_files
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_open_streams
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_open_table_definitions
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_open_tables
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_opened_files
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_opened_plugin_libraries
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_opened_table_definitions
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_opened_tables
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_opened_views
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_optimizer_join_prefixes_check_calls
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_performance_schema_lost_total
Total number of MySQL instrumentations that could not be loaded or created due to memory constraints.
COUNTER
mysql_global_status_prepared_stmt_count
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_qcache_free_blocks
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_qcache_free_memory
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_qcache_hits
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_qcache_inserts
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_qcache_lowmem_prunes
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_qcache_not_cached
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_qcache_queries_in_cache
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_qcache_total_blocks
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_queries
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_questions
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_resultset_metadata_skipped
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_rows_read
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_rows_sent
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_rows_tmp_read
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_rpl_semi_sync_master_clients
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_rpl_semi_sync_master_get_ack
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_rpl_semi_sync_master_net_avg_wait_time
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_rpl_semi_sync_master_net_wait_time
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_rpl_semi_sync_master_net_waits
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_rpl_semi_sync_master_no_times
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_rpl_semi_sync_master_no_tx
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_rpl_semi_sync_master_request_ack
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_rpl_semi_sync_master_status
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_rpl_semi_sync_master_timefunc_failures
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_rpl_semi_sync_master_tx_avg_wait_time
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_rpl_semi_sync_master_tx_wait_time
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_rpl_semi_sync_master_tx_waits
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_rpl_semi_sync_master_wait_pos_backtraverse
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_rpl_semi_sync_master_wait_sessions
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_rpl_semi_sync_master_yes_tx
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_rpl_semi_sync_slave_send_ack
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_rpl_semi_sync_slave_status
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_rpl_transactions_multi_engine
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_select_full_join
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_select_full_range_join
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_select_range
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_select_range_check
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_select_scan
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_server_audit_active
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_server_audit_writes_failed
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_slave_connections
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_slave_heartbeat_period
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_slave_open_temp_tables
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_slave_received_heartbeats
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_slave_retried_transactions
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_slave_running
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_slave_skipped_errors
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_slaves_connected
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_slaves_running
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_slow_launch_threads
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_slow_queries
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_sort_merge_passes
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_sort_priority_queue_sorts
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_sort_range
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_sort_rows
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_sort_scan
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_ssl_accept_renegotiates
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_ssl_accepts
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_ssl_callback_cache_hits
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_ssl_client_connects
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_ssl_connect_renegotiates
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_ssl_ctx_verify_depth
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_ssl_ctx_verify_mode
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_ssl_default_timeout
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_ssl_finished_accepts
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_ssl_finished_connects
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_ssl_session_cache_hits
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_ssl_session_cache_misses
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_ssl_session_cache_overflows
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_ssl_session_cache_size
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_ssl_session_cache_timeouts
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_ssl_sessions_reused
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_ssl_used_session_cache_entries
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_ssl_verify_depth
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_ssl_verify_mode
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_subquery_cache_hit
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_subquery_cache_miss
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_syncs
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_table_locks_immediate
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_table_locks_waited
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_table_open_cache_active_instances
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_table_open_cache_hits
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_table_open_cache_misses
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_table_open_cache_overflows
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_tc_log_max_pages_used
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_tc_log_page_size
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_tc_log_page_waits
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_threadpool_idle_threads
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_threadpool_threads
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_threads_cached
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_threads_connected
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_threads_created
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_threads_running
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_tmp_space_used
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_transactions_gtid_foreign_engine
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_transactions_multi_engine
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_update_scan
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_uptime
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_uptime_since_flush_status
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_applier_thread_count
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_apply_oooe
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_apply_oool
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_apply_waits
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_apply_window
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_causal_reads
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_cert_deps_distance
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_cert_index_size
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_cert_interval
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_cluster_conf_id
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_cluster_size
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_cluster_status
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_cluster_weight
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_commit_oooe
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_commit_oool
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_commit_window
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_connected
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_desync_count
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_flow_control_paused
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_flow_control_paused_ns
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_flow_control_recv
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_flow_control_sent
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_gmcast_segment
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_last_committed
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_local_bf_aborts
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_local_cached_downto
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_local_cert_failures
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_local_commits
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_local_index
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_local_recv_queue
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_local_recv_queue_avg
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_local_recv_queue_max
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_local_recv_queue_min
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_local_replays
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_local_send_queue
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_local_send_queue_avg
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_local_send_queue_max
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_local_send_queue_min
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_local_state
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_open_connections
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_open_transactions
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_protocol_version
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_ready
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_received
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_received_bytes
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_repl_data_bytes
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_repl_keys
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_repl_keys_bytes
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_repl_other_bytes
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_replicated
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_replicated_bytes
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_rollbacker_thread_count
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_status_wsrep_thread_count
Generic metric from SHOW GLOBAL STATUS.
UNTYPED
mysql_global_variables_allow_suspicious_udfs
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_analyze_sample_percentage
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_aria_block_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_aria_checkpoint_interval
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_aria_checkpoint_log_activity
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_aria_encrypt_tables
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_aria_force_start_after_recovery_failures
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_aria_group_commit_interval
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_aria_log_file_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_aria_max_sort_file_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_aria_page_checksum
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_aria_pagecache_age_threshold
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_aria_pagecache_buffer_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_aria_pagecache_division_limit
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_aria_pagecache_file_hash_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_aria_repair_threads
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_aria_sort_buffer_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_aria_used_for_temp_tables
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_auto_increment_increment
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_auto_increment_offset
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_autocommit
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_automatic_sp_privileges
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_back_log
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_big_tables
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_binlog_alter_two_phase
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_binlog_annotate_row_events
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_binlog_cache_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_binlog_commit_wait_count
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_binlog_commit_wait_usec
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_binlog_direct_non_transactional_updates
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_binlog_expire_logs_seconds
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_binlog_file_cache_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_binlog_gtid_index
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_binlog_gtid_index_page_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_binlog_gtid_index_span_min
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_binlog_legacy_event_pos
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_binlog_optimize_thread_scheduling
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_binlog_row_event_max_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_binlog_space_limit
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_binlog_stmt_cache_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_bulk_insert_buffer_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_check_constraint_checks
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_column_compression_threshold
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_column_compression_zlib_level
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_column_compression_zlib_wrap
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_connect_timeout
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_core_file
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_deadlock_search_depth_long
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_deadlock_search_depth_short
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_deadlock_timeout_long
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_deadlock_timeout_short
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_default_password_lifetime
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_default_week_format
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_delay_key_write
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_delayed_insert_limit
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_delayed_insert_timeout
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_delayed_queue_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_disconnect_on_expired_password
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_div_precision_increment
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_encrypt_binlog
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_encrypt_tmp_disk_tables
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_encrypt_tmp_files
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_eq_range_index_dive_limit
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_event_scheduler
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_expensive_subquery_limit
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_expire_logs_days
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_explicit_defaults_for_timestamp
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_extra_max_connections
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_extra_port
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_flush
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_flush_time
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_foreign_key_checks
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_ft_max_word_len
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_ft_min_word_len
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_ft_query_expansion_limit
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_general_log
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_group_concat_max_len
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_gtid_cleanup_batch_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_gtid_domain_id
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_gtid_ignore_duplicates
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_gtid_strict_mode
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_have_compress
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_have_crypt
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_have_dynamic_loading
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_have_geometry
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_have_openssl
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_have_profiling
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_have_query_cache
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_have_rtree_keys
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_have_ssl
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_have_symlink
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_histogram_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_host_cache_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_idle_readonly_transaction_timeout
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_idle_transaction_timeout
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_idle_write_transaction_timeout
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_ignore_builtin_innodb
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_in_predicate_conversion_threshold
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_adaptive_flushing
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_adaptive_flushing_lwm
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_adaptive_hash_index
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_adaptive_hash_index_parts
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_alter_copy_bulk
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_autoextend_increment
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_autoinc_lock_mode
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_buf_dump_status_frequency
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_buffer_pool_chunk_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_buffer_pool_dump_at_shutdown
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_buffer_pool_dump_now
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_buffer_pool_dump_pct
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_buffer_pool_load_abort
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_buffer_pool_load_at_startup
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_buffer_pool_load_now
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_buffer_pool_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_cmp_per_index_enabled
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_compression_default
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_compression_failure_threshold_pct
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_compression_level
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_compression_pad_pct_max
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_data_file_buffering
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_data_file_write_through
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_deadlock_detect
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_default_encryption_key_id
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_disable_sort_file_cache
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_doublewrite
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_encrypt_log
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_encrypt_tables
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_encrypt_temporary_tables
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_encryption_rotate_key_age
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_encryption_rotation_iops
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_encryption_threads
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_fast_shutdown
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_fatal_semaphore_wait_threshold
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_file_per_table
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_fill_factor
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_flush_log_at_timeout
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_flush_log_at_trx_commit
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_flush_neighbors
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_flush_sync
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_flushing_avg_loops
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_force_primary_key
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_force_recovery
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_ft_cache_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_ft_enable_diag_print
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_ft_enable_stopword
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_ft_max_token_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_ft_min_token_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_ft_num_word_optimize
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_ft_result_cache_limit
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_ft_sort_pll_degree
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_ft_total_cache_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_immediate_scrub_data_uncompressed
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_io_capacity
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_io_capacity_max
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_lock_wait_timeout
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_log_buffer_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_log_file_buffering
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_log_file_mmap
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_log_file_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_log_file_write_through
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_log_spin_wait_delay
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_log_write_ahead_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_lru_flush_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_lru_scan_depth
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_max_dirty_pages_pct
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_max_dirty_pages_pct_lwm
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_max_purge_lag
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_max_purge_lag_delay
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_max_purge_lag_wait
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_max_undo_log_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_old_blocks_pct
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_old_blocks_time
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_online_alter_log_max_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_open_files
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_optimize_fulltext_only
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_page_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_prefix_index_cluster_optimization
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_print_all_deadlocks
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_purge_batch_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_purge_rseg_truncate_frequency
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_purge_threads
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_random_read_ahead
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_read_ahead_threshold
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_read_io_threads
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_read_only
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_read_only_compressed
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_rollback_on_timeout
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_snapshot_isolation
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_sort_buffer_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_spin_wait_delay
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_stats_auto_recalc
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_stats_include_delete_marked
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_stats_modified_counter
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_stats_on_metadata
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_stats_persistent
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_stats_persistent_sample_pages
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_stats_traditional
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_stats_transient_sample_pages
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_status_output
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_status_output_locks
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_strict_mode
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_sync_spin_loops
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_table_locks
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_truncate_temporary_tablespace_now
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_undo_log_truncate
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_undo_tablespaces
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_use_atomic_writes
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_use_native_aio
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_innodb_write_io_threads
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_interactive_timeout
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_join_buffer_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_join_buffer_space_limit
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_join_cache_level
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_keep_files_on_create
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_key_buffer_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_key_cache_age_threshold
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_key_cache_block_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_key_cache_division_limit
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_key_cache_file_hash_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_key_cache_segments
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_large_files_support
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_large_page_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_large_pages
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_local_infile
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_lock_wait_timeout
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_locked_in_memory
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_log_bin
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_log_bin_compress
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_log_bin_compress_min_len
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_log_bin_trust_function_creators
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_log_queries_not_using_indexes
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_log_slave_updates
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_log_slow_admin_statements
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_log_slow_max_warnings
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_log_slow_min_examined_row_limit
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_log_slow_query
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_log_slow_query_time
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_log_slow_rate_limit
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_log_slow_slave_statements
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_log_tc_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_log_warnings
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_long_query_time
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_low_priority_updates
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_lower_case_file_system
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_lower_case_table_names
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_master_verify_checksum
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_max_allowed_packet
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_max_binlog_cache_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_max_binlog_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_max_binlog_stmt_cache_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_max_binlog_total_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_max_connect_errors
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_max_connections
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_max_delayed_threads
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_max_digest_length
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_max_error_count
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_max_heap_table_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_max_insert_delayed_threads
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_max_join_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_max_length_for_sort_data
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_max_password_errors
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_max_prepared_stmt_count
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_max_recursive_iterations
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_max_relay_log_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_max_rowid_filter_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_max_seeks_for_key
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_max_session_mem_used
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_max_sort_length
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_max_sp_recursion_depth
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_max_statement_time
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_max_tmp_session_space_usage
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_max_tmp_total_space_usage
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_max_user_connections
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_max_write_lock_count
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_metadata_locks_cache_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_metadata_locks_hash_instances
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_min_examined_row_limit
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_mrr_buffer_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_myisam_block_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_myisam_data_pointer_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_myisam_max_sort_file_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_myisam_mmap_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_myisam_repair_threads
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_myisam_sort_buffer_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_myisam_use_mmap
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_mysql56_temporal_format
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_net_buffer_length
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_net_read_timeout
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_net_retry_count
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_net_write_timeout
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_old
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_old_passwords
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_open_files_limit
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_optimizer_adjust_secondary_key_costs
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_optimizer_disk_read_cost
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_optimizer_disk_read_ratio
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_optimizer_extra_pruning_depth
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_optimizer_index_block_copy_cost
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_optimizer_join_limit_pref_ratio
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_optimizer_key_compare_cost
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_optimizer_key_copy_cost
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_optimizer_key_lookup_cost
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_optimizer_key_next_find_cost
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_optimizer_max_sel_arg_weight
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_optimizer_max_sel_args
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_optimizer_prune_level
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_optimizer_row_copy_cost
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_optimizer_row_lookup_cost
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_optimizer_row_next_find_cost
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_optimizer_rowid_compare_cost
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_optimizer_rowid_copy_cost
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_optimizer_scan_setup_cost
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_optimizer_search_depth
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_optimizer_selectivity_sampling_limit
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_optimizer_trace_max_mem_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_optimizer_use_condition_selectivity
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_optimizer_where_cost
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_accounts_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_digests_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_events_stages_history_long_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_events_stages_history_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_events_statements_history_long_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_events_statements_history_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_events_transactions_history_long_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_events_transactions_history_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_events_waits_history_long_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_events_waits_history_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_hosts_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_max_cond_classes
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_max_cond_instances
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_max_digest_length
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_max_file_classes
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_max_file_handles
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_max_file_instances
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_max_index_stat
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_max_memory_classes
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_max_metadata_locks
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_max_mutex_classes
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_max_mutex_instances
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_max_prepared_statements_instances
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_max_program_instances
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_max_rwlock_classes
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_max_rwlock_instances
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_max_socket_classes
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_max_socket_instances
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_max_sql_text_length
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_max_stage_classes
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_max_statement_classes
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_max_statement_stack
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_max_table_handles
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_max_table_instances
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_max_table_lock_stat
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_max_thread_classes
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_max_thread_instances
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_session_connect_attrs_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_setup_actors_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_setup_objects_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_performance_schema_users_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_port
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_preload_buffer_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_profiling
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_profiling_history_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_progress_report_time
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_protocol_version
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_query_alloc_block_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_query_cache_limit
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_query_cache_min_res_unit
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_query_cache_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_query_cache_strip_comments
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_query_cache_type
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_query_cache_wlock_invalidate
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_query_prealloc_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_range_alloc_block_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_read_binlog_speed_limit
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_read_buffer_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_read_only
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_read_rnd_buffer_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_relay_log_purge
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_relay_log_recovery
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_relay_log_space_limit
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_replicate_annotate_row_events
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_report_port
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_require_secure_transport
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_rowid_merge_buff_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_rpl_semi_sync_master_enabled
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_rpl_semi_sync_master_timeout
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_rpl_semi_sync_master_trace_level
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_rpl_semi_sync_master_wait_no_slave
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_rpl_semi_sync_slave_delay_master
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_rpl_semi_sync_slave_enabled
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_rpl_semi_sync_slave_kill_conn_timeout
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_rpl_semi_sync_slave_trace_level
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_secure_auth
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_secure_timestamp
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_server_audit_file_rotate_now
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_server_audit_file_rotate_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_server_audit_file_rotations
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_server_audit_load_on_error
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_server_audit_logging
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_server_audit_mode
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_server_audit_query_log_limit
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_server_audit_reload_filters
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_server_id
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_session_track_schema
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_session_track_state_change
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_session_track_transaction_info
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_shutdown_wait_for_slaves
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_simple_password_check_digits
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_simple_password_check_letters_same_case
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_simple_password_check_minimal_length
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_simple_password_check_other_characters
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_skip_external_locking
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_skip_grant_tables
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_skip_name_resolve
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_skip_networking
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_skip_show_database
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_slave_compressed_protocol
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_slave_connections_needed_for_purge
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_slave_domain_parallel_threads
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_slave_max_allowed_packet
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_slave_max_statement_time
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_slave_net_timeout
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_slave_parallel_max_queued
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_slave_parallel_threads
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_slave_parallel_workers
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_slave_run_triggers_for_rbr
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_slave_skip_errors
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_slave_sql_verify_checksum
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_slave_transaction_retries
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_slave_transaction_retry_interval
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_slow_launch_time
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_slow_query_log
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_sort_buffer_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_sql_auto_is_null
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_sql_big_selects
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_sql_buffer_result
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_sql_if_exists
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_sql_log_bin
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_sql_log_off
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_sql_notes
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_sql_quote_show_create
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_sql_safe_updates
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_sql_select_limit
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_sql_slave_skip_counter
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_sql_warnings
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_standard_compliant_cte
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_stored_program_cache
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_strict_password_validation
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_sync_binlog
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_sync_frm
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_sync_master_info
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_sync_relay_log
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_sync_relay_log_info
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_system_versioning_insert_history
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_table_definition_cache
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_table_open_cache
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_table_open_cache_instances
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_tcp_keepalive_interval
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_tcp_keepalive_probes
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_tcp_keepalive_time
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_tcp_nodelay
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_thread_cache_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_thread_pool_dedicated_listener
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_thread_pool_exact_stats
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_thread_pool_idle_timeout
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_thread_pool_max_threads
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_thread_pool_oversubscribe
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_thread_pool_prio_kickup_timer
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_thread_pool_reshuffle_group_period
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_thread_pool_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_thread_pool_stall_limit
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_thread_stack
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_tmp_disk_table_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_tmp_memory_table_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_tmp_table_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_transaction_alloc_block_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_transaction_prealloc_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_transaction_read_only
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_tx_read_only
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_unique_checks
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_updatable_views_with_limit
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_userstat
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wait_timeout
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_auto_increment_control
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_black_box_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_certificate_expiration_hours_warning
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_certify_nonpk
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_convert_lock_to_trx
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_desync
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_dirty_reads
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_drupal_282555_workaround
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_gtid_domain_id
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_gtid_mode
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_ignore_apply_errors
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_load_data_splitting
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_log_conflicts
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_max_ws_rows
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_max_ws_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_mysql_replication_bundle
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_on
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_base_port
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_cert_log_conflicts
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_cert_optimistic_pa
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_debug
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_evs_auto_evict
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_evs_causal_keepalive_period
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_evs_delay_margin
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_evs_delayed_keep_period
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_evs_inactive_check_period
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_evs_inactive_timeout
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_evs_info_log_mask
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_evs_install_timeout
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_evs_join_retrans_period
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_evs_keepalive_period
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_evs_max_install_timeouts
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_evs_send_window
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_evs_stats_report_period
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_evs_suspect_timeout
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_evs_use_aggregate
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_evs_user_send_window
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_evs_version
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_evs_view_forget_timeout
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_gcache_keep_pages_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_gcache_keep_plaintext_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_gcache_mem_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_gcache_page_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_gcache_recover
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_gcache_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_gcs_fc_debug
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_gcs_fc_factor
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_gcs_fc_limit
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_gcs_fc_master_slave
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_gcs_fc_single_primary
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_gcs_max_packet_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_gcs_max_throttle
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_gcs_recv_q_hard_limit
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_gcs_recv_q_soft_limit
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_gcs_sync_donor
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_gcs_vote_policy
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_gmcast_mcast_ttl
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_gmcast_peer_timeout
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_gmcast_segment
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_gmcast_time_wait
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_gmcast_version
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_pc_announce_timeout
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_pc_bootstrap
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_pc_checksum
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_pc_ignore_quorum
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_pc_ignore_sb
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_pc_linger
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_pc_npvo
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_pc_recovery
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_pc_version
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_pc_wait_prim
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_pc_wait_prim_timeout
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_pc_weight
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_protonet_version
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_repl_causal_read_timeout
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_repl_commit_order
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_repl_max_ws_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_repl_proto_max
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_socket_checksum
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_socket_dynamic
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_socket_ssl
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_socket_ssl_cipher
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_socket_ssl_compression
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_provider_socket_ssl_reload
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_recover
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_restart_slave
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_retry_autocommit
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_slave_fk_checks
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_slave_threads
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_slave_uk_checks
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_sst_donor_rejects_queries
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_sync_wait
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_global_variables_wsrep_trx_fragment_size
Generic gauge metric from SHOW GLOBAL VARIABLES.
GAUGE
mysql_info_schema_innodb_cmp_compress_ops_ok_total
Number of times a B-tree page of the size PAGE_SIZE has been successfully compressed.
COUNTER
mysql_info_schema_innodb_cmp_compress_ops_total
Number of times a B-tree page of the size PAGE_SIZE has been compressed.
COUNTER
mysql_info_schema_innodb_cmp_compress_time_seconds_total
Total time in seconds spent in attempts to compress B-tree pages.
COUNTER
mysql_info_schema_innodb_cmp_uncompress_ops_total
Number of times a B-tree page of the size PAGE_SIZE has been uncompressed.
COUNTER
mysql_info_schema_innodb_cmp_uncompress_time_seconds_total
Total time in seconds spent in uncompressing B-tree pages.
COUNTER
mysql_info_schema_innodb_cmpmem_pages_free_total
Number of blocks of the size PAGE_SIZE that are currently available for allocation.
COUNTER
mysql_info_schema_innodb_cmpmem_pages_used_total
Number of blocks of the size PAGE_SIZE that are currently in use.
COUNTER
mysql_info_schema_innodb_cmpmem_relocation_ops_total
Number of times a block of the size PAGE_SIZE has been relocated.
COUNTER
mysql_info_schema_innodb_cmpmem_relocation_time_seconds_total
Total time in seconds spent in relocating blocks.
COUNTER
mysql_transaction_isolation
MySQL transaction isolation.
GAUGE
mysql_up
Whether the MySQL server is up.
GAUGE
mysql_version_info
MySQL version and distribution.
GAUGE
maxscale_logging_level
The current logging levels active.
GAUGE
maxscale_logging_maxlog
Whether maxlog is active.
GAUGE
maxscale_logging_syslog
Whether syslog is active.
GAUGE
maxscale_logging_throttling_count
The number of logging throttling.
GAUGE
maxscale_logging_throttling_suppress_milliseconds
The value of throttling suppress_ms.
GAUGE
maxscale_logging_throttling_suppress_window_milliseconds
The value of throttling window_ms.
GAUGE
maxscale_modules
Maxscale modules currently enabled.
GAUGE
maxscale_monitor
Maxscale Monitor.
GAUGE
maxscale_server_active_operations
The number of active operations.
GAUGE
maxscale_server_adaptive_avg_select_time
The adaptive average select time. This is always zero.
GAUGE
maxscale_server_connection_pool_empty
The current connection pool empty
GAUGE
maxscale_server_connections
The current number of connections to the server.
GAUGE
maxscale_server_max_connections
The max number of connections.
GAUGE
maxscale_server_max_pool_size
The current max pool size,
GAUGE
maxscale_server_persistent_connections
The number of persistent connections to the server.
GAUGE
maxscale_server_reused_connections
The number of Re-used Connections by the server.
GAUGE
maxscale_server_routed_packets
The number of routed packets to the server,
GAUGE
maxscale_server_state
The current state of the server.
GAUGE
maxscale_server_total_connections
The total number of connections to the server.
COUNTER
maxscale_service_active_connections
The total number of active operations to the service.
GAUGE
maxscale_service_connections
The current number of connections to the server.
GAUGE
maxscale_service_state
The current state of each service.
GAUGE
maxscale_service_statistics_connections
The total number of connections to the service.
GAUGE
maxscale_service_statistics_failed_auths
The total number of failed authentications to the service.
COUNTER
maxscale_service_statistics_max_connections
The max number of connections to the service.
GAUGE
maxscale_service_statistics_routed_packets
The total number of routed packets to the service.
GAUGE
maxscale_service_statistics_total_connections
The total number of connections to the service.
COUNTER
maxscale_service_total_connections
The total number of connections to the server.
COUNTER
maxscale_threads_accepts
The number of accept events.
COUNTER
maxscale_threads_blocking_polls
The number of non-blocking poll cycles that will be done before a blocking poll takes place.
GAUGE
maxscale_threads_count
The number of threads
GAUGE
maxscale_threads_current_descriptors
The current number of descriptors handled by each thread.
GAUGE
maxscale_threads_errors
The number of error events.
COUNTER
maxscale_threads_event_queue_length
The amount of I/O events returned by one call to epoll_wait().
GAUGE
maxscale_threads_hangups
The number of hangup events.
COUNTER
maxscale_threads_load_last_hour
The load during the last 60m.
GAUGE
maxscale_threads_load_last_minute
The load during the last 60s.
GAUGE
maxscale_threads_load_last_second
The load during the last second.
GAUGE
maxscale_threads_max_event_queue_length
The maximum amount of I/O events returned by one call to epoll_wait().
GAUGE
maxscale_threads_max_exec_time
The maximum time it took to process an I/O event.
GAUGE
maxscale_threads_max_queue_time
The maximum time it took before an I/O event became ready for processing (ms).
GAUGE
maxscale_threads_reads
The number of read events.
COUNTER
maxscale_threads_stack_size
The stack size of each worker.
GAUGE
maxscale_threads_total_descriptors
The total number of descriptors handled by each thread since MaxScale startup.
GAUGE
maxscale_threads_writes
The number of write events.
COUNTER
maxscale_up
Whether the Maxscale server is up.
GAUGE
maxscale_uptime_seconds
Maxscale uptime in seconds
GAUGE
maxscale_version
Maxscale Version
GAUGE
Metric Name
Description
Type
mysql_exporter_collector_duration_seconds
Collector time duration.
GAUGE
mysql_exporter_collector_success
mysqld_exporter: Whether a collector succeeded.
GAUGE
mysql_galera_evs_repl_latency_avg_seconds
PXC/Galera group communication latency. Avg value.
GAUGE
maxscale_exporter_collector_duration_seconds
Collector time duration.
GAUGE
maxscale_exporter_last_scrape_error
Whether the last scrape of metrics from MariaDB resulted in an error (1 for error, 0 for success).
GAUGE
maxscale_exporter_scrapes_total
Total number of times MariaDB was scraped for metrics.
COUNTER
maxscale_logging_high_precision
Whether high precision logging is active.
GAUGE
apiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb
spec:
...
metrics:
enabled: trueapiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale
spec:
...
metrics:
enabled: trueapiVersion: enterprise.mariadb.com/v1alpha1
kind: MariaDB
metadata:
name: mariadb
spec:
...
metrics:
enabled: true
exporter:
image: mariadb/mariadb-prometheus-exporter-ubi:v0.0.2
resources:
requests:
cpu: 50m
memory: 64Mi
limits:
cpu: 300m
memory: 512Mi
port: 9104
serviceMonitor:
prometheusRelease: kube-prometheus-stack
jobLabel: mariadb-monitoring
interval: 10s
scrapeTimeout: 10s
username: monitoring
passwordSecretKeyRef:
name: mariadb
key: passwordapiVersion: enterprise.mariadb.com/v1alpha1
kind: MaxScale
metadata:
name: maxscale
spec:
...
auth:
metricsUsername: metrics
metricsPasswordSecretKeyRef:
key: password
name: maxscale-galera-metrics
metrics:
enabled: true
exporter:
image: mariadb/maxscale-prometheus-exporter-ubi:v0.0.2
resources:
requests:
cpu: 50m
memory: 64Mi
limits:
cpu: 300m
memory: 512Mi
port: 9105
serviceMonitor:
prometheusRelease: kube-prometheus-stack
jobLabel: mariadb-monitoring
interval: 10s
scrapeTimeout: 10sPackage v1alpha1 contains API Schema definitions for the v1alpha1 API group
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#affinity-v1-core.
Appears in:
AffinityConfig defines policies to schedule Pods in Nodes.
Appears in:
Agent is a sidecar agent that co-operates with mariadb-enterprise-operator.
Appears in:
Backup is the Schema for the backups API. It is used to define backup jobs and its storage.
Underlying type: string
BackupContentType defines the backup content type.
Appears in:
BackupSpec defines the desired state of Backup
Appears in:
BackupStagingStorage defines the temporary storage used to keep external backups (i.e. S3) while they are being processed.
Appears in:
BackupStorage defines the final storage for backups.
Appears in:
BasicAuth refers to the basic authentication mechanism utilized for establishing a connection from the operator to the agent.
Appears in:
BootstrapFrom defines a source to bootstrap MariaDB from.
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#csivolumesource-v1-core.
Appears in:
Underlying type: string
CleanupPolicy defines the behavior for cleaning up a resource.
Appears in:
Underlying type: string
CompressAlgorithm defines the compression algorithm for a Backup resource.
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#configmapkeyselector-v1-core.
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#configmapvolumesource-v1-core.
Appears in:
Connection is the Schema for the connections API. It is used to configure connection strings for the applications connecting to MariaDB.
ConnectionSpec defines the desired state of Connection
Appears in:
ConnectionTemplate defines a template to customize Connection objects.
Appears in:
Container object definition.
Appears in:
ContainerTemplate defines a template to configure Container objects.
Appears in:
Underlying type: string
CooperativeMonitoring enables coordination between multiple MaxScale instances running monitors. See: https://mariadb.com/docs/server/architecture/components/maxscale/monitors/mariadbmon/use-cooperative-locking-ha-maxscale-mariadb-monitor/
Appears in:
CronJobTemplate defines parameters for configuring CronJob objects.
Appears in:
Database is the Schema for the databases API. It is used to define a logical database as if you were running a 'CREATE DATABASE' statement.
DatabaseSpec defines the desired state of Database
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#emptydirvolumesource-v1-core.
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#envfromsource-v1-core.
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#envvarsource-v1-core.
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#envvarsource-v1-core.
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#execaction-v1-core.
Appears in:
Exporter defines a metrics exporter container.
Appears in:
ExternalMariaDB is the Schema for the external MariaDBs API. It is used to define external MariaDB server.
ExternalMariaDBSpec defines the desired state of an External MariaDB
Appears in:
Galera allows you to enable multi-master HA via Galera in your MariaDB cluster.
Appears in:
GaleraConfig defines storage options for the Galera configuration files.
Appears in:
GaleraInitJob defines a Job used to be used to initialize the Galera cluster.
Appears in:
GaleraRecovery is the recovery process performed by the operator whenever the Galera cluster is not healthy. More info: https://galeracluster.com/library/documentation/crash-recovery.html.
Appears in:
GaleraRecoveryJob defines a Job used to be used to recover the Galera cluster.
Appears in:
GaleraSpec is the Galera desired state specification.
Appears in:
GeneratedSecretKeyRef defines a reference to a Secret that can be automatically generated by mariadb-enterprise-operator if needed.
Appears in:
Grant is the Schema for the grants API. It is used to define grants as if you were running a 'GRANT' statement.
GrantSpec defines the desired state of Grant
Appears in:
Underlying type: string
Gtid indicates which Global Transaction ID (GTID) position mode should be used when connecting a replica to the master. See: https://mariadb.com/kb/en/gtid/#using-current_pos-vs-slave_pos.
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#httpgetaction-v1-core.
Appears in:
HealthCheck defines intervals for performing health checks.
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#hostpathvolumesource-v1-core
Appears in:
InitContainer is an init container that runs in the MariaDB Pod and co-operates with mariadb-enterprise-operator.
Appears in:
Job defines a Job used to be used with MariaDB.
Appears in:
JobContainerTemplate defines a template to configure Container objects that run in a Job.
Appears in:
JobPodTemplate defines a template to configure Container objects that run in a Job.
Appears in:
KubernetesAuth refers to the Kubernetes authentication mechanism utilized for establishing a connection from the operator to the agent. The agent validates the legitimacy of the service account token provided as an Authorization header by creating a TokenReview resource.
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#labelselector-v1-meta
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#labelselectorrequirement-v1-meta
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#localobjectreference-v1-core.
Appears in:
MariaDB is the Schema for the mariadbs API. It is used to define MariaDB clusters.
MariaDBMaxScaleSpec defines a reduced version of MaxScale to be used with the current MariaDB.
Appears in:
MariaDBRef is a reference to a MariaDB object.
Appears in:
MariaDBSpec defines the desired state of MariaDB
Appears in:
MariadbMetrics defines the metrics for a MariaDB.
Appears in:
MaxScale is the Schema for the maxscales API. It is used to define MaxScale clusters.
MaxScaleAdmin configures the admin REST API and GUI.
Appears in:
MaxScaleAuth defines the credentials required for MaxScale to connect to MariaDB.
Appears in:
MaxScaleConfig defines the MaxScale configuration.
Appears in:
MaxScaleConfigSync defines how the config changes are replicated across replicas.
Appears in:
MaxScaleListener defines how the MaxScale server will listen for connections.
Appears in:
MaxScaleMetrics defines the metrics for a Maxscale.
Appears in:
MaxScaleMonitor monitors MariaDB server instances
Appears in:
MaxScalePodTemplate defines a template for MaxScale Pods.
Appears in:
MaxScaleServer defines a MariaDB server to forward traffic to.
Appears in:
Services define how the traffic is forwarded to the MariaDB servers.
Appears in:
MaxScaleSpec defines the desired state of MaxScale.
Appears in:
TLS defines the PKI to be used with MaxScale.
Appears in:
Metadata defines the metadata to added to resources.
Appears in:
Underlying type: string
MonitorModule defines the type of monitor module
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#nfsvolumesource-v1-core.
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#nodeaffinity-v1-core
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#nodeselector-v1-core
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#nodeselectorrequirement-v1-core
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#nodeselectorterm-v1-core
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#objectfieldselector-v1-core.
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#objectreference-v1-core.
Appears in:
PasswordPlugin defines the password plugin and its arguments.
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#persistentvolumeclaimspec-v1-core.
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#persistentvolumeclaimvolumesource-v1-core.
Appears in:
PhysicalBackup is the Schema for the physicalbackups API. It is used to define physical backup jobs and its storage.
PhysicalBackupPodTemplate defines a template to configure Container objects that run in a PhysicalBackup.
Appears in:
PhysicalBackupSchedule defines when the PhysicalBackup will be taken.
Appears in:
PhysicalBackupSpec defines the desired state of PhysicalBackup.
Appears in:
PhysicalBackupStorage defines the storage for physical backups.
Appears in:
PhysicalBackupVolumeSnapshot defines parameters for the VolumeSnapshots used as physical backups.
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#podaffinityterm-v1-core.
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#podantiaffinity-v1-core.
Appears in:
PodDisruptionBudget is the Pod availability bundget for a MariaDB
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#podsecuritycontext-v1-core
Appears in:
PodTemplate defines a template to configure Container objects.
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#preferredschedulingterm-v1-core
Appears in:
PrimaryGalera is the Galera configuration for the primary node.
Appears in:
PrimaryReplication is the replication configuration and operation parameters for the primary.
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#probe-v1-core.
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#probe-v1-core.
Appears in:
ReplicaBootstrapFrom defines the sources for bootstrapping new relicas.
Appears in:
ReplicaRecovery defines how the replicas should be recovered after they enter an error state.
Appears in:
ReplicaReplication is the replication configuration and operation parameters for the replicas.
Appears in:
Replication defines replication configuration for a MariaDB cluster.
Appears in:
ReplicationSpec is the replication desired state.
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#resourcerequirements-v1-core.
Appears in:
Restore is the Schema for the restores API. It is used to define restore jobs and its restoration source.
RestoreSource defines a source for restoring a logical backup.
Appears in:
RestoreSpec defines the desired state of restore
Appears in:
Appears in:
SQLTemplate defines a template to customize SQL objects.
Appears in:
Underlying type: string
SST is the Snapshot State Transfer used when new Pods join the cluster. More info: https://galeracluster.com/library/documentation/sst.html.
Appears in:
Schedule contains parameters to define a schedule
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#secretkeyselector-v1-core.
Appears in:
SecretTemplate defines a template to customize Secret objects.
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#secretvolumesource-v1-core.
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#securitycontext-v1-core.
Appears in:
ServiceMonitor defines a prometheus ServiceMonitor object.
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#serviceport-v1-core
Appears in:
Underlying type: string
ServiceRouter defines the type of service router.
Appears in:
ServiceTemplate defines a template to customize Service objects.
Appears in:
SqlJob is the Schema for the sqljobs API. It is used to run sql scripts as jobs.
SqlJobSpec defines the desired state of SqlJob
Appears in:
Storage defines the storage options to be used for provisioning the PVCs mounted by MariaDB.
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#volume-v1-core.
Appears in:
SuspendTemplate indicates whether the current resource should be suspended or not.
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#tcpsocketaction-v1-core.
Appears in:
TLS defines the PKI to be used with MariaDB.
Appears in:
TLSConfig defines parameters to configure a certificate.
Appears in:
TLSRequirements specifies TLS requirements for the user to connect. See: https://mariadb.com/kb/en/securing-connections-for-client-and-server/#requiring-tls.
Appears in:
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#topologyspreadconstraint-v1-core.
Appears in:
TypedLocalObjectReference is a reference to a specific object type.
Appears in:
UpdateStrategy defines how a MariaDB resource is updated.
Appears in:
Underlying type: string
UpdateType defines the type of update for a MariaDB resource.
Appears in:
User is the Schema for the users API. It is used to define grants as if you were running a 'CREATE USER' statement.
UserSpec defines the desired state of User
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#volume-v1-core.
Appears in:
VolumeClaimTemplate defines a template to customize PVC objects.
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#volumemount-v1-core.
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#volume-v1-core.
Appears in:
Underlying type: string
WaitPoint defines whether the transaction should wait for ACK before committing to the storage engine. More info: https://mariadb.com/kb/en/semisynchronous-replication/#rpl_semi_sync_master_wait_point.
Appears in:
Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#weightedpodaffinityterm-v1-core.
Appears in:
envFrom array
EnvFrom represents the references (via ConfigMap and Secrets) to environment variables to be injected in the container.
volumeMounts array
VolumeMounts to be used in the Container.
livenessProbe
LivenessProbe to be used in the Container.
readinessProbe
ReadinessProbe to be used in the Container.
startupProbe
StartupProbe to be used in the Container.
resources
Resources describes the compute resource requirements.
securityContext
SecurityContext holds security configuration that will be applied to a container.
image string
Image name to be used by the MariaDB instances. The supported format is <image>:<tag>.
imagePullPolicy
ImagePullPolicy is the image pull policy. One of Always, Never or IfNotPresent. If not defined, it defaults to IfNotPresent.
Enum: [Always Never IfNotPresent]
port integer
Port where the agent will be listening for API connections.
probePort integer
Port where the agent will be listening for probe connections.
kubernetesAuth
KubernetesAuth to be used by the agent container
basicAuth
BasicAuth to be used by the agent container
gracefulShutdownTimeout
GracefulShutdownTimeout is the time we give to the agent container in order to gracefully terminate in-flight requests.
spec
podMetadata
PodMetadata defines extra metadata for the Pod.
imagePullSecrets array
ImagePullSecrets is the list of pull Secrets to be used to pull the image.
podSecurityContext
SecurityContext holds pod-level security attributes and common container settings.
serviceAccountName string
ServiceAccountName is the name of the ServiceAccount to be used by the Pods.
affinity
Affinity to be used in the Pod.
nodeSelector object (keys:string, values:string)
NodeSelector to be used in the Pod.
tolerations array
Tolerations to be used in the Pod.
priorityClassName string
PriorityClassName to be used in the Pod.
successfulJobsHistoryLimit integer
SuccessfulJobsHistoryLimit defines the maximum number of successful Jobs to be displayed.
Minimum: 0
failedJobsHistoryLimit integer
FailedJobsHistoryLimit defines the maximum number of failed Jobs to be displayed.
Minimum: 0
timeZone string
TimeZone defines the timezone associated with the cron expression.
mariaDbRef
MariaDBRef is a reference to a MariaDB object.
Required: {}
compression
Compression algorithm to be used in the Backup.
Enum: [none bzip2 gzip]
stagingStorage
StagingStorage defines the temporary storage used to keep external backups (i.e. S3) while they are being processed. It defaults to an emptyDir volume, meaning that the backups will be temporarily stored in the node where the Backup Job is scheduled. The staging area gets cleaned up after each backup is completed, consider this for sizing it appropriately.
storage
Storage defines the final storage for backups.
Required: {}
schedule
Schedule defines when the Backup will be taken.
maxRetention
MaxRetention defines the retention policy for backups. Old backups will be cleaned up by the Backup Job. It defaults to 30 days.
databases string array
Databases defines the logical databases to be backed up. If not provided, all databases are backed up.
ignoreGlobalPriv boolean
IgnoreGlobalPriv indicates to ignore the mysql.global_priv in backups. If not provided, it will default to true when the referred MariaDB instance has Galera enabled and otherwise to false.
logLevel string
LogLevel to be used n the Backup Job. It defaults to 'info'.
info
backoffLimit integer
BackoffLimit defines the maximum number of attempts to successfully take a Backup.
restartPolicy
RestartPolicy to be added to the Backup Pod.
OnFailure
Enum: [Always OnFailure Never]
inheritMetadata
InheritMetadata defines the metadata to be inherited by children resources.
s3
S3 defines the configuration to restore backups from a S3 compatible storage. This field takes precedence over the Volume source.
volume
Volume is a Kubernetes Volume object that contains a backup.
targetRecoveryTime
TargetRecoveryTime is a RFC3339 (1970-01-01T00:00:00Z) date and time that defines the point in time recovery objective. It is used to determine the closest restoration source in time.
stagingStorage
StagingStorage defines the temporary storage used to keep external backups (i.e. S3) while they are being processed. It defaults to an emptyDir volume, meaning that the backups will be temporarily stored in the node where the Job is scheduled.
restoreJob
RestoreJob defines additional properties for the Job used to perform the restoration.
volumeAttributes object (keys:string, values:string)
nodePublishSecretRef
spec
params object (keys:string, values:string)
Params to be used in the Connection.
serviceName string
ServiceName to be used in the Connection.
port integer
Port to connect to. If not provided, it defaults to the MariaDB port or to the first MaxScale listener.
mariaDbRef
MariaDBRef is a reference to the MariaDB to connect to. Either MariaDBRef or MaxScaleRef must be provided.
maxScaleRef
MaxScaleRef is a reference to the MaxScale to connect to. Either MariaDBRef or MaxScaleRef must be provided.
username string
Username to use for configuring the Connection.
Required: {}
passwordSecretKeyRef
PasswordSecretKeyRef is a reference to the password to use for configuring the Connection. Either passwordSecretKeyRef or tlsClientCertSecretRef must be provided as client credentials. If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the password.
tlsClientCertSecretRef
TLSClientCertSecretRef is a reference to a Kubernetes TLS Secret used as authentication when checking the connection health. Either passwordSecretKeyRef or tlsClientCertSecretRef must be provided as client credentials. If not provided, the client certificate provided by the referred MariaDB is used if TLS is enabled. If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the client certificate.
host string
Host to connect to. If not provided, it defaults to the MariaDB host or to the MaxScale host.
database string
Database to use when configuring the Connection.
params object (keys:string, values:string)
Params to be used in the Connection.
serviceName string
ServiceName to be used in the Connection.
port integer
Port to connect to. If not provided, it defaults to the MariaDB port or to the first MaxScale listener.
command string array
Command to be used in the Container.
args string array
Args to be used in the Container.
env array
Env represents the environment variables to be injected in a container.
volumeMounts array
VolumeMounts to be used in the Container.
resources
Resources describes the compute resource requirements.
envFrom array
EnvFrom represents the references (via ConfigMap and Secrets) to environment variables to be injected in the container.
volumeMounts array
VolumeMounts to be used in the Container.
livenessProbe
LivenessProbe to be used in the Container.
readinessProbe
ReadinessProbe to be used in the Container.
startupProbe
StartupProbe to be used in the Container.
resources
Resources describes the compute resource requirements.
securityContext
SecurityContext holds security configuration that will be applied to a container.
spec
mariaDbRef
MariaDBRef is a reference to a MariaDB object.
Required: {}
characterSet string
CharacterSet to use in the Database.
utf8
collate string
Collate to use in the Database.
utf8_general_ci
name string
Name overrides the default Database name provided by metadata.name.
MaxLength: 80
args string array
Args to be used in the Container.
port integer
Port where the exporter will be listening for connections.
resources
Resources describes the compute resource requirements.
podMetadata
PodMetadata defines extra metadata for the Pod.
securityContext
SecurityContext holds container-level security attributes.
podSecurityContext
SecurityContext holds pod-level security attributes and common container settings.
affinity
Affinity to be used in the Pod.
nodeSelector object (keys:string, values:string)
NodeSelector to be used in the Pod.
tolerations array
Tolerations to be used in the Pod.
priorityClassName string
PriorityClassName to be used in the Pod.
spec
inheritMetadata
InheritMetadata defines the metadata to be inherited by children resources.
host string
Hostname of the external MariaDB.
Required: {}
port integer
Port of the external MariaDB.
3306
username string
Username is the username to connect to the external MariaDB.
Required: {}
passwordSecretKeyRef
PasswordSecretKeyRef is a reference to the password to connect to the external MariaDB.
tls
TLS defines the PKI to be used with the external MariaDB.
connection
Connection defines a template to configure a Connection for the external MariaDB.
galeraLibPath string
GaleraLibPath is a path inside the MariaDB image to the wsrep provider plugin. It is defaulted if not provided. More info: https://galeracluster.com/library/documentation/mysql-wsrep-options.html#wsrep-provider.
replicaThreads integer
ReplicaThreads is the number of replica threads used to apply Galera write sets in parallel. More info: https://mariadb.com/kb/en/galera-cluster-system-variables/#wsrep_slave_threads.
providerOptions object (keys:string, values:string)
ProviderOptions is map of Galera configuration parameters. More info: https://mariadb.com/kb/en/galera-cluster-system-variables/#wsrep_provider_options.
agent
Agent is a sidecar agent that co-operates with mariadb-enterprise-operator.
recovery
GaleraRecovery is the recovery process performed by the operator whenever the Galera cluster is not healthy. More info: https://galeracluster.com/library/documentation/crash-recovery.html.
initContainer
InitContainer is an init container that runs in the MariaDB Pod and co-operates with mariadb-enterprise-operator.
initJob
InitJob defines a Job that co-operates with mariadb-enterprise-operator by performing initialization tasks.
config
GaleraConfig defines storage options for the Galera configuration files.
clusterName string
ClusterName is the name of the cluster to be used in the Galera config file.
enabled boolean
Enabled is a flag to enable Galera.
clusterHealthyTimeout
ClusterHealthyTimeout represents the duration at which a Galera cluster, that consistently failed health checks, is considered unhealthy, and consequently the Galera recovery process will be initiated by the operator.
clusterBootstrapTimeout
ClusterBootstrapTimeout is the time limit for bootstrapping a cluster. Once this timeout is reached, the Galera recovery state is reset and a new cluster bootstrap will be attempted.
clusterUpscaleTimeout
ClusterUpscaleTimeout represents the maximum duration for upscaling the cluster's StatefulSet during the recovery process.
clusterDownscaleTimeout
ClusterDownscaleTimeout represents the maximum duration for downscaling the cluster's StatefulSet during the recovery process.
podRecoveryTimeout
PodRecoveryTimeout is the time limit for recevorying the sequence of a Pod during the cluster recovery.
podSyncTimeout
PodSyncTimeout is the time limit for a Pod to join the cluster after having performed a cluster bootstrap during the cluster recovery.
forceClusterBootstrapInPod string
ForceClusterBootstrapInPod allows you to manually initiate the bootstrap process in a specific Pod. IMPORTANT: Use this option only in exceptional circumstances. Not selecting the Pod with the highest sequence number may result in data loss. IMPORTANT: Ensure you unset this field after completing the bootstrap to allow the operator to choose the appropriate Pod to bootstrap from in an event of cluster recovery.
job
Job defines a Job that co-operates with mariadb-enterprise-operator by performing the Galera cluster recovery .
galeraLibPath string
GaleraLibPath is a path inside the MariaDB image to the wsrep provider plugin. It is defaulted if not provided. More info: https://galeracluster.com/library/documentation/mysql-wsrep-options.html#wsrep-provider.
replicaThreads integer
ReplicaThreads is the number of replica threads used to apply Galera write sets in parallel. More info: https://mariadb.com/kb/en/galera-cluster-system-variables/#wsrep_slave_threads.
providerOptions object (keys:string, values:string)
ProviderOptions is map of Galera configuration parameters. More info: https://mariadb.com/kb/en/galera-cluster-system-variables/#wsrep_provider_options.
agent
Agent is a sidecar agent that co-operates with mariadb-enterprise-operator.
recovery
GaleraRecovery is the recovery process performed by the operator whenever the Galera cluster is not healthy. More info: https://galeracluster.com/library/documentation/crash-recovery.html.
initContainer
InitContainer is an init container that runs in the MariaDB Pod and co-operates with mariadb-enterprise-operator.
initJob
InitJob defines a Job that co-operates with mariadb-enterprise-operator by performing initialization tasks.
config
GaleraConfig defines storage options for the Galera configuration files.
clusterName string
ClusterName is the name of the cluster to be used in the Galera config file.
spec
mariaDbRef
MariaDBRef is a reference to a MariaDB object.
Required: {}
privileges string array
Privileges to use in the Grant.
MinItems: 1 Required: {}
database string
Database to use in the Grant.
*
table string
Table to use in the Grant.
*
username string
Username to use in the Grant.
Required: {}
host string
Host to use in the Grant. It can be localhost, an IP or '%'.
grantOption boolean
GrantOption to use in the Grant.
false
scheme
envFrom array
EnvFrom represents the references (via ConfigMap and Secrets) to environment variables to be injected in the container.
volumeMounts array
VolumeMounts to be used in the Container.
livenessProbe
LivenessProbe to be used in the Container.
readinessProbe
ReadinessProbe to be used in the Container.
startupProbe
StartupProbe to be used in the Container.
resources
Resources describes the compute resource requirements.
securityContext
SecurityContext holds security configuration that will be applied to a container.
image string
Image name to be used by the MariaDB instances. The supported format is <image>:<tag>.
Required: {}
imagePullPolicy
ImagePullPolicy is the image pull policy. One of Always, Never or IfNotPresent. If not defined, it defaults to IfNotPresent.
Enum: [Always Never IfNotPresent]
tolerations array
Tolerations to be used in the Pod.
resources
Resources describes the compute resource requirements.
args string array
Args to be used in the Container.
serviceAccountName string
ServiceAccountName is the name of the ServiceAccount to be used by the Pods.
affinity
Affinity to be used in the Pod.
nodeSelector object (keys:string, values:string)
NodeSelector to be used in the Pod.
tolerations array
Tolerations to be used in the Pod.
priorityClassName string
PriorityClassName to be used in the Pod.
spec
services array
Services define how the traffic is forwarded to the MariaDB servers.
monitor
Monitor monitors MariaDB server instances.
admin
Admin configures the admin REST API and GUI.
config
Config defines the MaxScale configuration.
auth
Auth defines the credentials required for MaxScale to connect to MariaDB.
metrics
Metrics configures metrics and how to scrape them.
tls
TLS defines the PKI to be used with MaxScale.
connection
Connection provides a template to define the Connection for MaxScale.
replicas integer
Replicas indicates the number of desired instances.
podDisruptionBudget
PodDisruptionBudget defines the budget for replica availability.
updateStrategy
UpdateStrategy defines the update strategy for the StatefulSet object.
kubernetesService
KubernetesService defines a template for a Kubernetes Service object to connect to MaxScale.
guiKubernetesService
GuiKubernetesService define a template for a Kubernetes Service object to connect to MaxScale's GUI.
requeueInterval
RequeueInterval is used to perform requeue reconciliations.
waitForIt boolean
WaitForIt indicates whether the controller using this reference should wait for MariaDB to be ready.
true
envFrom array
EnvFrom represents the references (via ConfigMap and Secrets) to environment variables to be injected in the container.
volumeMounts array
VolumeMounts to be used in the Container.
livenessProbe
LivenessProbe to be used in the Container.
readinessProbe
ReadinessProbe to be used in the Container.
startupProbe
StartupProbe to be used in the Container.
resources
Resources describes the compute resource requirements.
securityContext
SecurityContext holds security configuration that will be applied to a container.
podMetadata
PodMetadata defines extra metadata for the Pod.
imagePullSecrets array
ImagePullSecrets is the list of pull Secrets to be used to pull the image.
initContainers array
InitContainers to be used in the Pod.
sidecarContainers array
SidecarContainers to be used in the Pod.
podSecurityContext
SecurityContext holds pod-level security attributes and common container settings.
serviceAccountName string
ServiceAccountName is the name of the ServiceAccount to be used by the Pods.
affinity
Affinity to be used in the Pod.
nodeSelector object (keys:string, values:string)
NodeSelector to be used in the Pod.
tolerations array
Tolerations to be used in the Pod.
volumes array
Volumes to be used in the Pod.
priorityClassName string
PriorityClassName to be used in the Pod.
topologySpreadConstraints array
TopologySpreadConstraints to be used in the Pod.
suspend boolean
Suspend indicates whether the current resource should be suspended or not. This can be useful for maintenance, as disabling the reconciliation prevents the operator from interfering with user operations during maintenance activities.
false
image string
Image name to be used by the MariaDB instances. The supported format is <image>:<tag>.
Only MariaDB official images are supported.
imagePullPolicy
ImagePullPolicy is the image pull policy. One of Always, Never or IfNotPresent. If not defined, it defaults to IfNotPresent.
Enum: [Always Never IfNotPresent]
inheritMetadata
InheritMetadata defines the metadata to be inherited by children resources.
rootPasswordSecretKeyRef
RootPasswordSecretKeyRef is a reference to a Secret key containing the root password.
rootEmptyPassword boolean
RootEmptyPassword indicates if the root password should be empty. Don't use this feature in production, it is only intended for development and test environments.
database string
Database is the name of the initial Database.
username string
Username is the initial username to be created by the operator once MariaDB is ready. The initial User will have ALL PRIVILEGES in the initial Database.
passwordSecretKeyRef
PasswordSecretKeyRef is a reference to a Secret that contains the password to be used by the initial User. If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the password.
passwordHashSecretKeyRef
PasswordHashSecretKeyRef is a reference to the password hash to be used by the initial User. If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the password hash. It requires the 'skip-strict-password-validation' option to be set. See: https://mariadb.com/docs/server/ref/mdb/cli/mariadbd/strict-password-validation/.
passwordPlugin
PasswordPlugin is a reference to the password plugin and arguments to be used by the initial User. It requires the 'skip-strict-password-validation' option to be set. See: https://mariadb.com/docs/server/ref/mdb/cli/mariadbd/strict-password-validation/.
myCnf string
MyCnf allows to specify the my.cnf file mounted by Mariadb. Updating this field will trigger an update to the Mariadb resource.
myCnfConfigMapKeyRef
MyCnfConfigMapKeyRef is a reference to the my.cnf config file provided via a ConfigMap. If not provided, it will be defaulted with a reference to a ConfigMap containing the MyCnf field. If the referred ConfigMap is labeled with "enterprise.mariadb.com/watch", an update to the Mariadb resource will be triggered when the ConfigMap is updated.
timeZone string
TimeZone sets the default timezone. If not provided, it defaults to SYSTEM and the timezone data is not loaded.
bootstrapFrom
BootstrapFrom defines a source to bootstrap from.
storage
Storage defines the storage options to be used for provisioning the PVCs mounted by MariaDB.
metrics
Metrics configures metrics and how to scrape them.
tls
TLS defines the PKI to be used with MariaDB.
replication
Replication configures high availability via replication. This feature is still in alpha, use Galera if you are looking for a more production-ready HA.
galera
Galera configures high availability via Galera.
maxScaleRef
MaxScaleRef is a reference to a MaxScale resource to be used with the current MariaDB. Providing this field implies delegating high availability tasks such as primary failover to MaxScale.
maxScale
MaxScale is the MaxScale specification that defines the MaxScale resource to be used with the current MariaDB. When enabling this field, MaxScaleRef is automatically set.
replicas integer
Replicas indicates the number of desired instances.
1
replicasAllowEvenNumber boolean
disables the validation check for an odd number of replicas.
false
port integer
Port where the instances will be listening for connections.
3306
servicePorts array
ServicePorts is the list of additional named ports to be added to the Services created by the operator.
podDisruptionBudget
PodDisruptionBudget defines the budget for replica availability.
updateStrategy
UpdateStrategy defines how a MariaDB resource is updated.
service
Service defines a template to configure the general Service object. The network traffic of this Service will be routed to all Pods.
connection
Connection defines a template to configure the general Connection object. This Connection provides the initial User access to the initial Database. It will make use of the Service to route network traffic to all Pods.
primaryService
PrimaryService defines a template to configure the primary Service object. The network traffic of this Service will be routed to the primary Pod.
primaryConnection
PrimaryConnection defines a template to configure the primary Connection object. This Connection provides the initial User access to the initial Database. It will make use of the PrimaryService to route network traffic to the primary Pod.
secondaryService
SecondaryService defines a template to configure the secondary Service object. The network traffic of this Service will be routed to the secondary Pods.
secondaryConnection
SecondaryConnection defines a template to configure the secondary Connection object. This Connection provides the initial User access to the initial Database. It will make use of the SecondaryService to route network traffic to the secondary Pods.
username string
Username is the username of the monitoring user used by the exporter.
passwordSecretKeyRef
PasswordSecretKeyRef is a reference to the password of the monitoring user used by the exporter. If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the password.
spec
deleteDefaultAdmin boolean
DeleteDefaultAdmin determines whether the default admin user should be deleted after the initial configuration. If not provided, it defaults to true.
metricsUsername string
MetricsUsername is an metrics username to call the REST API. It is defaulted if metrics are enabled.
metricsPasswordSecretKeyRef
MetricsPasswordSecretKeyRef is Secret key reference to the metrics password to call the admib REST API. It is defaulted if metrics are enabled.
clientUsername string
ClientUsername is the user to connect to MaxScale. It is defaulted if not provided.
clientPasswordSecretKeyRef
ClientPasswordSecretKeyRef is Secret key reference to the password to connect to MaxScale. It is defaulted if not provided. If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the password.
clientMaxConnections integer
ClientMaxConnections defines the maximum number of connections that the client can establish. If HA is enabled, make sure to increase this value, as more MaxScale replicas implies more connections. It defaults to 30 times the number of MaxScale replicas.
serverUsername string
ServerUsername is the user used by MaxScale to connect to MariaDB server. It is defaulted if not provided.
serverPasswordSecretKeyRef
ServerPasswordSecretKeyRef is Secret key reference to the password used by MaxScale to connect to MariaDB server. It is defaulted if not provided. If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the password.
serverMaxConnections integer
ServerMaxConnections defines the maximum number of connections that the server can establish. If HA is enabled, make sure to increase this value, as more MaxScale replicas implies more connections. It defaults to 30 times the number of MaxScale replicas.
monitorUsername string
MonitorUsername is the user used by MaxScale monitor to connect to MariaDB server. It is defaulted if not provided.
monitorPasswordSecretKeyRef
MonitorPasswordSecretKeyRef is Secret key reference to the password used by MaxScale monitor to connect to MariaDB server. It is defaulted if not provided. If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the password.
monitorMaxConnections integer
MonitorMaxConnections defines the maximum number of connections that the monitor can establish. If HA is enabled, make sure to increase this value, as more MaxScale replicas implies more connections. It defaults to 30 times the number of MaxScale replicas.
syncUsername string
MonitoSyncUsernamerUsername is the user used by MaxScale config sync to connect to MariaDB server. It is defaulted when HA is enabled.
syncPasswordSecretKeyRef
SyncPasswordSecretKeyRef is Secret key reference to the password used by MaxScale config to connect to MariaDB server. It is defaulted when HA is enabled. If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the password.
syncMaxConnections integer
SyncMaxConnections defines the maximum number of connections that the sync can establish. If HA is enabled, make sure to increase this value, as more MaxScale replicas implies more connections. It defaults to 30 times the number of MaxScale replicas.
protocol string
Protocol is the MaxScale protocol to use when communicating with the client. If not provided, it defaults to MariaDBProtocol.
params object (keys:string, values:string)
Params defines extra parameters to pass to the listener. Any parameter supported by MaxScale may be specified here. See reference: https://mariadb.com/kb/en/mariadb-maxscale-2308-mariadb-maxscale-configuration-guide/#listener_1.
interval
Interval used to monitor MariaDB servers. It is defaulted if not provided.
cooperativeMonitoring
CooperativeMonitoring enables coordination between multiple MaxScale instances running monitors. It is defaulted when HA is enabled.
Enum: [majority_of_all majority_of_running]
params object (keys:string, values:string)
Params defines extra parameters to pass to the monitor. Any parameter supported by MaxScale may be specified here. See reference: https://mariadb.com/kb/en/mariadb-maxscale-2308-common-monitor-parameters/. Monitor specific parameter are also supported: https://mariadb.com/kb/en/mariadb-maxscale-2308-galera-monitor/#galera-monitor-optional-parameters. https://mariadb.com/kb/en/mariadb-maxscale-2308-mariadb-monitor/#configuration.
serviceAccountName string
ServiceAccountName is the name of the ServiceAccount to be used by the Pods.
affinity
Affinity to be used in the Pod.
nodeSelector object (keys:string, values:string)
NodeSelector to be used in the Pod.
tolerations array
Tolerations to be used in the Pod.
priorityClassName string
PriorityClassName to be used in the Pod.
topologySpreadConstraints array
TopologySpreadConstraints to be used in the Pod.
protocol string
Protocol is the MaxScale protocol to use when communicating with this MariaDB server. If not provided, it defaults to MariaDBBackend.
maintenance boolean
Maintenance indicates whether the server is in maintenance mode.
params object (keys:string, values:string)
Params defines extra parameters to pass to the server. Any parameter supported by MaxScale may be specified here. See reference: https://mariadb.com/kb/en/mariadb-maxscale-2308-mariadb-maxscale-configuration-guide/#server_1.
listener
MaxScaleListener defines how the MaxScale server will listen for connections.
Required: {}
params object (keys:string, values:string)
Params defines extra parameters to pass to the service. Any parameter supported by MaxScale may be specified here. See reference: https://mariadb.com/kb/en/mariadb-maxscale-2308-mariadb-maxscale-configuration-guide/#service_1. Router specific parameter are also supported: https://mariadb.com/kb/en/mariadb-maxscale-2308-readwritesplit/#configuration. https://mariadb.com/kb/en/mariadb-maxscale-2308-readconnroute/#configuration.
envFrom array
EnvFrom represents the references (via ConfigMap and Secrets) to environment variables to be injected in the container.
volumeMounts array
VolumeMounts to be used in the Container.
livenessProbe
LivenessProbe to be used in the Container.
readinessProbe
ReadinessProbe to be used in the Container.
startupProbe
StartupProbe to be used in the Container.
resources
Resources describes the compute resource requirements.
securityContext
SecurityContext holds security configuration that will be applied to a container.
podMetadata
PodMetadata defines extra metadata for the Pod.
imagePullSecrets array
ImagePullSecrets is the list of pull Secrets to be used to pull the image.
podSecurityContext
SecurityContext holds pod-level security attributes and common container settings.
serviceAccountName string
ServiceAccountName is the name of the ServiceAccount to be used by the Pods.
affinity
Affinity to be used in the Pod.
nodeSelector object (keys:string, values:string)
NodeSelector to be used in the Pod.
tolerations array
Tolerations to be used in the Pod.
priorityClassName string
PriorityClassName to be used in the Pod.
topologySpreadConstraints array
TopologySpreadConstraints to be used in the Pod.
suspend boolean
Suspend indicates whether the current resource should be suspended or not. This can be useful for maintenance, as disabling the reconciliation prevents the operator from interfering with user operations during maintenance activities.
false
mariaDbRef
MariaDBRef is a reference to the MariaDB that MaxScale points to. It is used to initialize the servers field.
primaryServer string
PrimaryServer specifies the desired primary server. Setting this field triggers a switchover operation in MaxScale to the desired server. This option is only valid when using monitors that support switchover, currently limited to the MariaDB monitor.
servers array
Servers are the MariaDB servers to forward traffic to. It is required if 'spec.mariaDbRef' is not provided.
image string
Image name to be used by the MaxScale instances. The supported format is <image>:<tag>.
Only MaxScale official images are supported.
imagePullPolicy
ImagePullPolicy is the image pull policy. One of Always, Never or IfNotPresent. If not defined, it defaults to IfNotPresent.
Enum: [Always Never IfNotPresent]
inheritMetadata
InheritMetadata defines the metadata to be inherited by children resources.
services array
Services define how the traffic is forwarded to the MariaDB servers. It is defaulted if not provided.
monitor
Monitor monitors MariaDB server instances. It is required if 'spec.mariaDbRef' is not provided.
admin
Admin configures the admin REST API and GUI.
config
Config defines the MaxScale configuration.
auth
Auth defines the credentials required for MaxScale to connect to MariaDB.
metrics
Metrics configures metrics and how to scrape them.
tls
TLS defines the PKI to be used with MaxScale.
connection
Connection provides a template to define the Connection for MaxScale.
replicas integer
Replicas indicates the number of desired instances.
1
podDisruptionBudget
PodDisruptionBudget defines the budget for replica availability.
updateStrategy
UpdateStrategy defines the update strategy for the StatefulSet object.
kubernetesService
KubernetesService defines a template for a Kubernetes Service object to connect to MaxScale.
guiKubernetesService
GuiKubernetesService defines a template for a Kubernetes Service object to connect to MaxScale's GUI.
requeueInterval
RequeueInterval is used to perform requeue reconciliations. If not defined, it defaults to 10s.
adminCASecretRef
AdminCASecretRef is a reference to a Secret containing the admin certificate authority keypair. It is used to establish trust and issue certificates for the MaxScale's administrative REST API and GUI. One of: - Secret containing both the 'ca.crt' and 'ca.key' keys. This allows you to bring your own CA to Kubernetes to issue certificates. - Secret containing only the 'ca.crt' in order to establish trust. In this case, either adminCertSecretRef or adminCertIssuerRef fields must be provided. If not provided, a self-signed CA will be provisioned to issue the server certificate.
adminCertSecretRef
AdminCertSecretRef is a reference to a TLS Secret used by the MaxScale's administrative REST API and GUI.
adminCertIssuerRef
AdminCertIssuerRef is a reference to a cert-manager issuer object used to issue the MaxScale's administrative REST API and GUI certificate. cert-manager must be installed previously in the cluster. It is mutually exclusive with adminCertSecretRef. By default, the Secret field 'ca.crt' provisioned by cert-manager will be added to the trust chain. A custom trust bundle may be specified via adminCASecretRef.
adminCertConfig
AdminCertConfig allows configuring the admin certificates, either issued by the operator or cert-manager. If not set, the default settings will be used.
listenerCASecretRef
ListenerCASecretRef is a reference to a Secret containing the listener certificate authority keypair. It is used to establish trust and issue certificates for the MaxScale's listeners. One of: - Secret containing both the 'ca.crt' and 'ca.key' keys. This allows you to bring your own CA to Kubernetes to issue certificates. - Secret containing only the 'ca.crt' in order to establish trust. In this case, either listenerCertSecretRef or listenerCertIssuerRef fields must be provided. If not provided, a self-signed CA will be provisioned to issue the listener certificate.
listenerCertSecretRef
ListenerCertSecretRef is a reference to a TLS Secret used by the MaxScale's listeners.
listenerCertIssuerRef
ListenerCertIssuerRef is a reference to a cert-manager issuer object used to issue the MaxScale's listeners certificate. cert-manager must be installed previously in the cluster. It is mutually exclusive with listenerCertSecretRef. By default, the Secret field 'ca.crt' provisioned by cert-manager will be added to the trust chain. A custom trust bundle may be specified via listenerCASecretRef.
listenerCertConfig
ListenerCertConfig allows configuring the listener certificates, either issued by the operator or cert-manager. If not set, the default settings will be used.
serverCASecretRef
ServerCASecretRef is a reference to a Secret containing the MariaDB server CA certificates. It is used to establish trust with MariaDB servers. The Secret should contain a 'ca.crt' key in order to establish trust. If not provided, and the reference to a MariaDB resource is set (mariaDbRef), it will be defaulted to the referred MariaDB CA bundle.
serverCertSecretRef
ServerCertSecretRef is a reference to a TLS Secret used by MaxScale to connect to the MariaDB servers. If not provided, and the reference to a MariaDB resource is set (mariaDbRef), it will be defaulted to the referred MariaDB client certificate (clientCertSecretRef).
verifyPeerCertificate boolean
VerifyPeerCertificate specifies whether the peer certificate's signature should be validated against the CA. It is disabled by default.
verifyPeerHost boolean
VerifyPeerHost specifies whether the peer certificate's SANs should match the peer host. It is disabled by default.
replicationSSLEnabled boolean
ReplicationSSLEnabled specifies whether the replication SSL is enabled. If enabled, the SSL options will be added to the server configuration. It is enabled by default when the referred MariaDB instance (via mariaDbRef) has replication enabled. If the MariaDB servers are manually provided by the user via the 'servers' field, this must be set by the user as well.
storageClassName string
spec
serviceAccountName string
ServiceAccountName is the name of the ServiceAccount to be used by the Pods.
tolerations array
Tolerations to be used in the Pod.
priorityClassName string
PriorityClassName to be used in the Pod.
podMetadata
PodMetadata defines extra metadata for the Pod.
imagePullSecrets array
ImagePullSecrets is the list of pull Secrets to be used to pull the image.
podSecurityContext
SecurityContext holds pod-level security attributes and common container settings.
serviceAccountName string
ServiceAccountName is the name of the ServiceAccount to be used by the Pods.
tolerations array
Tolerations to be used in the Pod.
priorityClassName string
PriorityClassName to be used in the Pod.
mariaDbRef
MariaDBRef is a reference to a MariaDB object.
Required: {}
compression
Compression algorithm to be used in the Backup.
Enum: [none bzip2 gzip]
stagingStorage
StagingStorage defines the temporary storage used to keep external backups (i.e. S3) while they are being processed. It defaults to an emptyDir volume, meaning that the backups will be temporarily stored in the node where the PhysicalBackup Job is scheduled. The staging area gets cleaned up after each backup is completed, consider this for sizing it appropriately.
storage
Storage defines the final storage for backups.
Required: {}
schedule
Schedule defines when the PhysicalBackup will be taken.
maxRetention
MaxRetention defines the retention policy for backups. Old backups will be cleaned up by the Backup Job. It defaults to 30 days.
timeout
Timeout defines the maximum duration of a PhysicalBackup job or snapshot. If this duration is exceeded, the job or snapshot is considered expired and is deleted by the operator. A new job or snapshot will then be created according to the schedule. It defaults to 1 hour.
podAffinity boolean
PodAffinity indicates whether the Jobs should run in the same Node as the MariaDB Pods to be able to attach the PVC. It defaults to true.
backoffLimit integer
BackoffLimit defines the maximum number of attempts to successfully take a PhysicalBackup.
restartPolicy
RestartPolicy to be added to the PhysicalBackup Pod.
OnFailure
Enum: [Always OnFailure Never]
inheritMetadata
InheritMetadata defines the metadata to be inherited by children resources.
successfulJobsHistoryLimit integer
SuccessfulJobsHistoryLimit defines the maximum number of successful Jobs to be displayed. It defaults to 5.
Minimum: 0
volumeSnapshot
VolumeSnapshot is a Kubernetes VolumeSnapshot specification.
runAsNonRoot boolean
supplementalGroups integer array
fsGroup integer
fsGroupChangePolicy
seccompProfile
appArmorProfile
sidecarContainers array
SidecarContainers to be used in the Pod.
podSecurityContext
SecurityContext holds pod-level security attributes and common container settings.
serviceAccountName string
ServiceAccountName is the name of the ServiceAccount to be used by the Pods.
affinity
Affinity to be used in the Pod.
nodeSelector object (keys:string, values:string)
NodeSelector to be used in the Pod.
tolerations array
Tolerations to be used in the Pod.
volumes array
Volumes to be used in the Pod.
priorityClassName string
PriorityClassName to be used in the Pod.
topologySpreadConstraints array
TopologySpreadConstraints to be used in the Pod.
initialDelaySeconds integer
timeoutSeconds integer
periodSeconds integer
successThreshold integer
failureThreshold integer
maxLagSeconds integer
MaxLagSeconds is the maximum number of seconds that replicas are allowed to lag behind the primary. If a replica exceeds this threshold, it is marked as not ready and read queries will no longer be forwarded to it. If not provided, it defaults to 0, which means that replicas are not allowed to lag behind the primary (recommended). Lagged replicas will not be taken into account as candidates for the new primary during failover, and they will block other operations, such as switchover and upgrade. This field is not taken into account by MaxScale, you can define the maximum lag as router parameters. See: https://mariadb.com/docs/maxscale/reference/maxscale-routers/maxscale-readwritesplit#max_replication_lag.
syncTimeout
SyncTimeout defines the timeout for the synchronization phase during switchover and failover operations. During switchover, all replicas must be synced with the current primary before promoting the new primary. During failover, the new primary must be synced before being promoted as primary. This implies processing all the events in the relay log. When the timeout is reached, the operator restarts the operation from the beginning. It defaults to 10s. See: https://mariadb.com/docs/server/reference/sql-functions/secondary-functions/miscellaneous-functions/master_gtid_wait
bootstrapFrom
ReplicaBootstrapFrom defines the data sources used to bootstrap new replicas. This will be used as part of the scaling out and recovery operations, when new replicas are created. If not provided, scale out and recovery operations will return an error.
recovery
ReplicaRecovery defines how the replicas should be recovered after they enter an error state. This process deletes data from faulty replicas and recreates them using the source defined in the bootstrapFrom field. It is disabled by default, and it requires the bootstrapFrom field to be set.
semiSyncEnabled boolean
SemiSyncEnabled determines whether semi-synchronous replication is enabled. Semi-synchronous replication requires that at least one replica should have sent an ACK to the primary node before committing the transaction back to the client. See: https://mariadb.com/docs/server/ha-and-performance/standard-replication/semisynchronous-replication It is enabled by default
semiSyncAckTimeout
SemiSyncAckTimeout for the replica to acknowledge transactions to the primary. It requires semi-synchronous replication to be enabled. See: https://mariadb.com/docs/server/ha-and-performance/standard-replication/semisynchronous-replication#rpl_semi_sync_master_timeout
semiSyncWaitPoint
SemiSyncWaitPoint determines whether the transaction should wait for an ACK after having synced the binlog (AfterSync) or after having committed to the storage engine (AfterCommit, the default). It requires semi-synchronous replication to be enabled. See: https://mariadb.com/kb/en/semisynchronous-replication/#rpl_semi_sync_master_wait_point.
Enum: [AfterSync AfterCommit]
syncBinlog integer
SyncBinlog indicates after how many events the binary log is synchronized to the disk. See: https://mariadb.com/docs/server/ha-and-performance/standard-replication/replication-and-binary-log-system-variables#sync_binlog
initContainer
InitContainer is an init container that runs in the MariaDB Pod and co-operates with mariadb-enterprise-operator.
agent
Agent is a sidecar agent that runs in the MariaDB Pod and co-operates with mariadb-enterprise-operator.
standaloneProbes boolean
StandaloneProbes indicates whether to use the default non-HA startup and liveness probes. It is disabled by default
enabled boolean
Enabled is a flag to enable replication.
semiSyncEnabled boolean
SemiSyncEnabled determines whether semi-synchronous replication is enabled. Semi-synchronous replication requires that at least one replica should have sent an ACK to the primary node before committing the transaction back to the client. See: https://mariadb.com/docs/server/ha-and-performance/standard-replication/semisynchronous-replication It is enabled by default
semiSyncAckTimeout
SemiSyncAckTimeout for the replica to acknowledge transactions to the primary. It requires semi-synchronous replication to be enabled. See: https://mariadb.com/docs/server/ha-and-performance/standard-replication/semisynchronous-replication#rpl_semi_sync_master_timeout
semiSyncWaitPoint
SemiSyncWaitPoint determines whether the transaction should wait for an ACK after having synced the binlog (AfterSync) or after having committed to the storage engine (AfterCommit, the default). It requires semi-synchronous replication to be enabled. See: https://mariadb.com/kb/en/semisynchronous-replication/#rpl_semi_sync_master_wait_point.
Enum: [AfterSync AfterCommit]
syncBinlog integer
SyncBinlog indicates after how many events the binary log is synchronized to the disk. See: https://mariadb.com/docs/server/ha-and-performance/standard-replication/replication-and-binary-log-system-variables#sync_binlog
initContainer
InitContainer is an init container that runs in the MariaDB Pod and co-operates with mariadb-enterprise-operator.
agent
Agent is a sidecar agent that runs in the MariaDB Pod and co-operates with mariadb-enterprise-operator.
standaloneProbes boolean
StandaloneProbes indicates whether to use the default non-HA startup and liveness probes. It is disabled by default
spec
targetRecoveryTime
TargetRecoveryTime is a RFC3339 (1970-01-01T00:00:00Z) date and time that defines the point in time recovery objective. It is used to determine the closest restoration source in time.
stagingStorage
StagingStorage defines the temporary storage used to keep external backups (i.e. S3) while they are being processed. It defaults to an emptyDir volume, meaning that the backups will be temporarily stored in the node where the Restore Job is scheduled.
podMetadata
PodMetadata defines extra metadata for the Pod.
imagePullSecrets array
ImagePullSecrets is the list of pull Secrets to be used to pull the image.
podSecurityContext
SecurityContext holds pod-level security attributes and common container settings.
serviceAccountName string
ServiceAccountName is the name of the ServiceAccount to be used by the Pods.
affinity
Affinity to be used in the Pod.
nodeSelector object (keys:string, values:string)
NodeSelector to be used in the Pod.
tolerations array
Tolerations to be used in the Pod.
priorityClassName string
PriorityClassName to be used in the Pod.
backupRef
BackupRef is a reference to a Backup object. It has priority over S3 and Volume.
s3
S3 defines the configuration to restore backups from a S3 compatible storage. It has priority over Volume.
volume
Volume is a Kubernetes Volume object that contains a backup.
targetRecoveryTime
TargetRecoveryTime is a RFC3339 (1970-01-01T00:00:00Z) date and time that defines the point in time recovery objective. It is used to determine the closest restoration source in time.
stagingStorage
StagingStorage defines the temporary storage used to keep external backups (i.e. S3) while they are being processed. It defaults to an emptyDir volume, meaning that the backups will be temporarily stored in the node where the Restore Job is scheduled.
mariaDbRef
MariaDBRef is a reference to a MariaDB object.
Required: {}
database string
Database defines the logical database to be restored. If not provided, all databases available in the backup are restored. IMPORTANT: The database must previously exist.
logLevel string
LogLevel to be used n the Backup Job. It defaults to 'info'.
info
backoffLimit integer
BackoffLimit defines the maximum number of attempts to successfully perform a Backup.
5
restartPolicy
RestartPolicy to be added to the Backup Job.
OnFailure
Enum: [Always OnFailure Never]
inheritMetadata
InheritMetadata defines the metadata to be inherited by children resources.
prefix string
Prefix indicates a folder/subfolder in the bucket. For example: mariadb/ or mariadb/backups. A trailing slash '/' is added if not provided.
accessKeyIdSecretKeyRef
AccessKeyIdSecretKeyRef is a reference to a Secret key containing the S3 access key id.
secretAccessKeySecretKeyRef
AccessKeyIdSecretKeyRef is a reference to a Secret key containing the S3 secret key.
sessionTokenSecretKeyRef
SessionTokenSecretKeyRef is a reference to a Secret key containing the S3 session token.
tls
TLS provides the configuration required to establish TLS connections with S3.
usernameKey string
UsernameKey to be used in the Secret.
passwordKey string
PasswordKey to be used in the Secret.
hostKey string
HostKey to be used in the Secret.
portKey string
PortKey to be used in the Secret.
databaseKey string
DatabaseKey to be used in the Secret.
runAsGroup integer
runAsNonRoot boolean
readOnlyRootFilesystem boolean
allowPrivilegeEscalation boolean
scrapeTimeout string
ScrapeTimeout defines the timeout for scraping metrics.
loadBalancerSourceRanges string array
LoadBalancerSourceRanges Service field.
externalTrafficPolicy
ExternalTrafficPolicy Service field.
sessionAffinity
SessionAffinity Service field.
allocateLoadBalancerNodePorts boolean
AllocateLoadBalancerNodePorts Service field.
spec
podMetadata
PodMetadata defines extra metadata for the Pod.
imagePullSecrets array
ImagePullSecrets is the list of pull Secrets to be used to pull the image.
podSecurityContext
SecurityContext holds pod-level security attributes and common container settings.
serviceAccountName string
ServiceAccountName is the name of the ServiceAccount to be used by the Pods.
affinity
Affinity to be used in the Pod.
nodeSelector object (keys:string, values:string)
NodeSelector to be used in the Pod.
tolerations array
Tolerations to be used in the Pod.
priorityClassName string
PriorityClassName to be used in the Pod.
successfulJobsHistoryLimit integer
SuccessfulJobsHistoryLimit defines the maximum number of successful Jobs to be displayed.
Minimum: 0
failedJobsHistoryLimit integer
FailedJobsHistoryLimit defines the maximum number of failed Jobs to be displayed.
Minimum: 0
timeZone string
TimeZone defines the timezone associated with the cron expression.
mariaDbRef
MariaDBRef is a reference to a MariaDB object.
Required: {}
schedule
Schedule defines when the SqlJob will be executed.
username string
Username to be impersonated when executing the SqlJob.
Required: {}
passwordSecretKeyRef
UserPasswordSecretKeyRef is a reference to the impersonated user's password to be used when executing the SqlJob.
Required: {}
tlsCASecretRef
TLSCACertSecretRef is a reference toa CA Secret used to establish trust when executing the SqlJob. If not provided, the CA bundle provided by the referred MariaDB is used.
tlsClientCertSecretRef
TLSClientCertSecretRef is a reference to a Kubernetes TLS Secret used as authentication when executing the SqlJob. If not provided, the client certificate provided by the referred MariaDB is used.
database string
Username to be used when executing the SqlJob.
dependsOn array
DependsOn defines dependencies with other SqlJob objectecs.
sql string
Sql is the script to be executed by the SqlJob.
sqlConfigMapKeyRef
SqlConfigMapKeyRef is a reference to a ConfigMap containing the Sql script. It is defaulted to a ConfigMap with the contents of the Sql field.
backoffLimit integer
BackoffLimit defines the maximum number of attempts to successfully execute a SqlJob.
5
restartPolicy
RestartPolicy to be added to the SqlJob Pod.
OnFailure
Enum: [Always OnFailure Never]
inheritMetadata
InheritMetadata defines the metadata to be inherited by children resources.
resizeInUseVolumes boolean
ResizeInUseVolumes indicates whether the PVCs can be resized. The 'StorageClassName' used should have 'allowVolumeExpansion' set to 'true' to allow resizing. It defaults to true.
waitForVolumeResize boolean
WaitForVolumeResize indicates whether to wait for the PVCs to be resized before marking the MariaDB object as ready. This will block other operations such as cluster recovery while the resize is in progress. It defaults to true.
volumeClaimTemplate
VolumeClaimTemplate provides a template to define the PVCs.
hostPath
persistentVolumeClaim
serverCASecretRef
ServerCASecretRef is a reference to a Secret containing the server certificate authority keypair. It is used to establish trust and issue server certificates. One of: - Secret containing both the 'ca.crt' and 'ca.key' keys. This allows you to bring your own CA to Kubernetes to issue certificates. - Secret containing only the 'ca.crt' in order to establish trust. In this case, either serverCertSecretRef or serverCertIssuerRef must be provided. If not provided, a self-signed CA will be provisioned to issue the server certificate.
serverCertSecretRef
ServerCertSecretRef is a reference to a TLS Secret containing the server certificate. It is mutually exclusive with serverCertIssuerRef.
serverCertIssuerRef
ServerCertIssuerRef is a reference to a cert-manager issuer object used to issue the server certificate. cert-manager must be installed previously in the cluster. It is mutually exclusive with serverCertSecretRef. By default, the Secret field 'ca.crt' provisioned by cert-manager will be added to the trust chain. A custom trust bundle may be specified via serverCASecretRef.
serverCertConfig
ServerCertConfig allows configuring the server certificates, either issued by the operator or cert-manager. If not set, the default settings will be used.
clientCASecretRef
ClientCASecretRef is a reference to a Secret containing the client certificate authority keypair. It is used to establish trust and issue client certificates. One of: - Secret containing both the 'ca.crt' and 'ca.key' keys. This allows you to bring your own CA to Kubernetes to issue certificates. - Secret containing only the 'ca.crt' in order to establish trust. In this case, either clientCertSecretRef or clientCertIssuerRef fields must be provided. If not provided, a self-signed CA will be provisioned to issue the client certificate.
clientCertSecretRef
ClientCertSecretRef is a reference to a TLS Secret containing the client certificate. It is mutually exclusive with clientCertIssuerRef.
clientCertIssuerRef
ClientCertIssuerRef is a reference to a cert-manager issuer object used to issue the client certificate. cert-manager must be installed previously in the cluster. It is mutually exclusive with clientCertSecretRef. By default, the Secret field 'ca.crt' provisioned by cert-manager will be added to the trust chain. A custom trust bundle may be specified via clientCASecretRef.
clientCertConfig
ClientCertConfig allows configuring the client certificates, either issued by the operator or cert-manager. If not set, the default settings will be used.
galeraSSTEnabled boolean
GaleraSSTEnabled determines whether Galera SST connections should use TLS. It disabled by default.
galeraServerSSLMode string
GaleraServerSSLMode defines the server SSL mode for a Galera Enterprise cluster. This field is only supported and applicable for Galera Enterprise >= 10.6 instances. Refer to the MariaDB Enterprise docs for more detail: https://mariadb.com/docs/galera-cluster/galera-security/mariadb-enterprise-cluster-security#wsrep-tls-modes
Enum: [PROVIDER SERVER SERVER_X509]
galeraClientSSLMode string
GaleraClientSSLMode defines the client SSL mode for a Galera Enterprise cluster. This field is only supported and applicable for Galera Enterprise >= 10.6 instances. Refer to the MariaDB Enterprise docs for more detail: https://mariadb.com/docs/galera-cluster/galera-security/mariadb-enterprise-cluster-security#sst-tls-modes
Enum: [DISABLED REQUIRED VERIFY_CA VERIFY_IDENTITY]
privateKeySize integer
PrivateKeyAlgorithm is the key size to be used for the CA and leaf certificate private keys. Supported values: ECDSA(256, 384, 521), RSA(2048, 3072, 4096)
subject string
Subject indicates that the TLS certificate provided by the user must have a specific subject.
labelSelector
minDomains integer
nodeAffinityPolicy
nodeTaintsPolicy
matchLabelKeys string array
spec
mariaDbRef
MariaDBRef is a reference to a MariaDB object.
Required: {}
passwordSecretKeyRef
PasswordSecretKeyRef is a reference to the password to be used by the User. If not provided, the account will be locked and the password will expire. If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the password.
passwordHashSecretKeyRef
PasswordHashSecretKeyRef is a reference to the password hash to be used by the User. If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the password hash. It requires the 'skip-strict-password-validation' option to be set. See: https://mariadb.com/docs/server/ref/mdb/cli/mariadbd/strict-password-validation/.
passwordPlugin
PasswordPlugin is a reference to the password plugin and arguments to be used by the User. It requires the 'skip-strict-password-validation' option to be set. See: https://mariadb.com/docs/server/ref/mdb/cli/mariadbd/strict-password-validation/.
require
Require specifies TLS requirements for the user to connect. See: https://mariadb.com/kb/en/securing-connections-for-client-and-server/#requiring-tls.
maxUserConnections integer
MaxUserConnections defines the maximum number of simultaneous connections that the User can establish.
10
name string
Name overrides the default name provided by metadata.name.
MaxLength: 80
host string
Host related to the User.
MaxLength: 255
csi
hostPath
persistentVolumeClaim
secret
configMap
storageClassName string
metadata
Refer to Kubernetes API documentation for fields of metadata.
subPath string
hostPath
persistentVolumeClaim
secret
configMap
podAntiAffinity PodAntiAffinity
nodeAffinity NodeAffinity
podAntiAffinity PodAntiAffinity
nodeAffinity NodeAffinity
antiAffinityEnabled boolean
AntiAffinityEnabled configures PodAntiAffinity so each Pod is scheduled in a different Node, enabling HA. Make sure you have at least as many Nodes available as the replicas to not end up with unscheduled Pods.
command string array
Command to be used in the Container.
args string array
Args to be used in the Container.
env EnvVar array
Env represents the environment variables to be injected in a container.
apiVersion string
enterprise.mariadb.com/v1alpha1
kind string
Backup
metadata ObjectMeta
Refer to Kubernetes API documentation for fields of metadata.
Logical
BackupContentTypeLogical represents a logical backup created using mariadb-dump.
Physical
BackupContentTypePhysical represents a physical backup created using mariadb-backup.
args string array
Args to be used in the Container.
resources ResourceRequirements
Resources describes the compute resource requirements.
securityContext SecurityContext
SecurityContext holds security configuration that will be applied to a container.
persistentVolumeClaim PersistentVolumeClaimSpec
PersistentVolumeClaim is a Kubernetes PVC specification.
volume StorageVolumeSource
Volume is a Kubernetes volume specification.
s3 S3
S3 defines the configuration to store backups in a S3 compatible storage.
persistentVolumeClaim PersistentVolumeClaimSpec
PersistentVolumeClaim is a Kubernetes PVC specification.
volume StorageVolumeSource
Volume is a Kubernetes volume specification.
enabled boolean
Enabled is a flag to enable BasicAuth
username string
Username to be used for basic authentication
passwordSecretKeyRef GeneratedSecretKeyRef
PasswordSecretKeyRef to be used for basic authentication
backupRef TypedLocalObjectReference
BackupRef is reference to a backup object. If the Kind is not specified, a logical Backup is assumed. This field takes precedence over S3 and Volume sources.
volumeSnapshotRef LocalObjectReference
VolumeSnapshotRef is a reference to a VolumeSnapshot object. This field takes precedence over S3 and Volume sources.
backupContentType BackupContentType
BackupContentType is the backup content type available in the source to bootstrap from. It is inferred based on the BackupRef and VolumeSnapshotRef fields. If inference is not possible, it defaults to Logical. Set this field explicitly when using physical backups from S3 or Volume sources.
driver string
readOnly boolean
fsType string
Skip
CleanupPolicySkip indicates that the resource will NOT be deleted from the database after the CR is deleted.
Delete
CleanupPolicyDelete indicates that the resource will be deleted from the database after the CR is deleted.
none
No compression
bzip2
Bzip2 compression. Good compression ratio, but slower compression/decompression speed compared to gzip.
gzip
Gzip compression. Good compression/decompression speed, but worse compression ratio compared to bzip2.
name string
key string
name string
defaultMode integer
apiVersion string
enterprise.mariadb.com/v1alpha1
kind string
Connection
metadata ObjectMeta
Refer to Kubernetes API documentation for fields of metadata.
secretName string
SecretName to be used in the Connection.
secretTemplate SecretTemplate
SecretTemplate to be used in the Connection.
healthCheck HealthCheck
HealthCheck to be used in the Connection.
secretName string
SecretName to be used in the Connection.
secretTemplate SecretTemplate
SecretTemplate to be used in the Connection.
healthCheck HealthCheck
HealthCheck to be used in the Connection.
name string
Name to be given to the container.
image string
Image name to be used by the container. The supported format is <image>:<tag>.
Required: {}
imagePullPolicy PullPolicy
ImagePullPolicy is the image pull policy. One of Always, Never or IfNotPresent. If not defined, it defaults to IfNotPresent.
command string array
Command to be used in the Container.
args string array
Args to be used in the Container.
env EnvVar array
Env represents the environment variables to be injected in a container.
majority_of_all
CooperativeMonitoringMajorityOfAll requires a lock from the majority of the MariaDB servers, even the ones that are down.
majority_of_running
CooperativeMonitoringMajorityOfRunning requires a lock from the majority of the MariaDB servers.
successfulJobsHistoryLimit integer
SuccessfulJobsHistoryLimit defines the maximum number of successful Jobs to be displayed.
Minimum: 0
failedJobsHistoryLimit integer
FailedJobsHistoryLimit defines the maximum number of failed Jobs to be displayed.
Minimum: 0
timeZone string
TimeZone defines the timezone associated with the cron expression.
apiVersion string
enterprise.mariadb.com/v1alpha1
kind string
Database
metadata ObjectMeta
Refer to Kubernetes API documentation for fields of metadata.
requeueInterval Duration
RequeueInterval is used to perform requeue reconciliations.
retryInterval Duration
RetryInterval is the interval used to perform retries.
cleanupPolicy CleanupPolicy
CleanupPolicy defines the behavior for cleaning up a SQL resource.
medium StorageMedium
sizeLimit Quantity
prefix string
configMapRef LocalObjectReference
secretRef LocalObjectReference
name string
Name of the environment variable. Must be a C_IDENTIFIER.
value string
valueFrom EnvVarSource
fieldRef ObjectFieldSelector
configMapKeyRef ConfigMapKeySelector
secretKeyRef SecretKeySelector
command string array
image string
Image name to be used as metrics exporter. The supported format is <image>:<tag>.
imagePullPolicy PullPolicy
ImagePullPolicy is the image pull policy. One of Always, Never or IfNotPresent. If not defined, it defaults to IfNotPresent.
Enum: [Always Never IfNotPresent]
imagePullSecrets LocalObjectReference array
ImagePullSecrets is the list of pull Secrets to be used to pull the image.
apiVersion string
enterprise.mariadb.com/v1alpha1
kind string
ExternalMariaDB
metadata ObjectMeta
Refer to Kubernetes API documentation for fields of metadata.
image string
Image name to be used to perform operations on the external MariaDB, for example, for taking backups.
The supported format is <image>:<tag>. Only MariaDB official images are supported.
If not provided, the MariaDB image version be inferred by the operator in runtime. The default MariaDB image will be used in this case,
imagePullPolicy PullPolicy
ImagePullPolicy is the image pull policy. One of Always, Never or IfNotPresent. If not defined, it defaults to IfNotPresent.
Enum: [Always Never IfNotPresent]
imagePullSecrets LocalObjectReference array
ImagePullSecrets is the list of pull Secrets to be used to pull the image.
primary PrimaryGalera
Primary is the Galera configuration for the primary node.
sst SST
SST is the Snapshot State Transfer used when new Pods join the cluster. More info: https://galeracluster.com/library/documentation/sst.html.
Enum: [rsync mariabackup mysqldump]
availableWhenDonor boolean
AvailableWhenDonor indicates whether a donor node should be responding to queries. It defaults to false.
reuseStorageVolume boolean
ReuseStorageVolume indicates that storage volume used by MariaDB should be reused to store the Galera configuration files. It defaults to false, which implies that a dedicated volume for the Galera configuration files is provisioned.
volumeClaimTemplate VolumeClaimTemplate
VolumeClaimTemplate is a template for the PVC that will contain the Galera configuration files shared between the InitContainer, Agent and MariaDB.
metadata Metadata
Refer to Kubernetes API documentation for fields of metadata.
resources ResourceRequirements
Resources describes the compute resource requirements.
enabled boolean
Enabled is a flag to enable GaleraRecovery.
minClusterSize IntOrString
MinClusterSize is the minimum number of replicas to consider the cluster healthy. It can be either a number of replicas (1) or a percentage (50%). If Galera consistently reports less replicas than this value for the given 'ClusterHealthyTimeout' interval, a cluster recovery is initiated. It defaults to '1' replica, and it is highly recommendeded to keep this value at '1' in most cases. If set to more than one replica, the cluster recovery process may restart the healthy replicas as well.
clusterMonitorInterval Duration
ClusterMonitorInterval represents the interval used to monitor the Galera cluster health.
metadata Metadata
Refer to Kubernetes API documentation for fields of metadata.
resources ResourceRequirements
Resources describes the compute resource requirements.
podAffinity boolean
PodAffinity indicates whether the recovery Jobs should run in the same Node as the MariaDB Pods. It defaults to true.
primary PrimaryGalera
Primary is the Galera configuration for the primary node.
sst SST
SST is the Snapshot State Transfer used when new Pods join the cluster. More info: https://galeracluster.com/library/documentation/sst.html.
Enum: [rsync mariabackup mysqldump]
availableWhenDonor boolean
AvailableWhenDonor indicates whether a donor node should be responding to queries. It defaults to false.
name string
key string
generate boolean
Generate indicates whether the Secret should be generated if the Secret referenced is not present.
false
apiVersion string
enterprise.mariadb.com/v1alpha1
kind string
Grant
metadata ObjectMeta
Refer to Kubernetes API documentation for fields of metadata.
requeueInterval Duration
RequeueInterval is used to perform requeue reconciliations.
retryInterval Duration
RetryInterval is the interval used to perform retries.
cleanupPolicy CleanupPolicy
CleanupPolicy defines the behavior for cleaning up a SQL resource.
CurrentPos
GtidCurrentPos indicates the union of gtid_binlog_pos and gtid_slave_pos will be used when replicating from master.
SlavePos
GtidSlavePos indicates that gtid_slave_pos will be used when replicating from master.
path string
port IntOrString
host string
interval Duration
Interval used to perform health checks.
retryInterval Duration
RetryInterval is the interval used to perform health check retries.
path string
type string
command string array
Command to be used in the Container.
args string array
Args to be used in the Container.
env EnvVar array
Env represents the environment variables to be injected in a container.
metadata Metadata
Refer to Kubernetes API documentation for fields of metadata.
affinity AffinityConfig
Affinity to be used in the Pod.
nodeSelector object (keys:string, values:string)
NodeSelector to be used in the Pod.
args string array
Args to be used in the Container.
resources ResourceRequirements
Resources describes the compute resource requirements.
securityContext SecurityContext
SecurityContext holds security configuration that will be applied to a container.
podMetadata Metadata
PodMetadata defines extra metadata for the Pod.
imagePullSecrets LocalObjectReference array
ImagePullSecrets is the list of pull Secrets to be used to pull the image.
podSecurityContext PodSecurityContext
SecurityContext holds pod-level security attributes and common container settings.
enabled boolean
Enabled is a flag to enable KubernetesAuth
authDelegatorRoleName string
AuthDelegatorRoleName is the name of the ClusterRoleBinding that is associated with the "system:auth-delegator" ClusterRole. It is necessary for creating TokenReview objects in order for the agent to validate the service account token.
matchLabels object (keys:string, values:string)
matchExpressions LabelSelectorRequirement array
key string
operator LabelSelectorOperator
values string array
name string
apiVersion string
enterprise.mariadb.com/v1alpha1
kind string
MariaDB
metadata ObjectMeta
Refer to Kubernetes API documentation for fields of metadata.
enabled boolean
Enabled is a flag to enable a MaxScale instance to be used with the current MariaDB.
image string
Image name to be used by the MaxScale instances. The supported format is <image>:<tag>.
Only MariaDB official images are supported.
imagePullPolicy PullPolicy
ImagePullPolicy is the image pull policy. One of Always, Never or IfNotPresent. If not defined, it defaults to IfNotPresent.
name string
namespace string
kind string
Kind of the referent.
command string array
Command to be used in the Container.
args string array
Args to be used in the Container.
env EnvVar array
Env represents the environment variables to be injected in a container.
enabled boolean
Enabled is a flag to enable Metrics
exporter Exporter
Exporter defines the metrics exporter container.
serviceMonitor ServiceMonitor
ServiceMonitor defines the ServiceMonior object.
apiVersion string
enterprise.mariadb.com/v1alpha1
kind string
MaxScale
metadata ObjectMeta
Refer to Kubernetes API documentation for fields of metadata.
port integer
Port where the admin REST API and GUI will be exposed.
guiEnabled boolean
GuiEnabled indicates whether the admin GUI should be enabled.
generate boolean
Generate defies whether the operator should generate users and grants for MaxScale to work. It only supports MariaDBs specified via spec.mariaDbRef.
adminUsername string
AdminUsername is an admin username to call the admin REST API. It is defaulted if not provided.
adminPasswordSecretKeyRef GeneratedSecretKeyRef
AdminPasswordSecretKeyRef is Secret key reference to the admin password to call the admin REST API. It is defaulted if not provided.
params object (keys:string, values:string)
Params is a key value pair of parameters to be used in the MaxScale static configuration file. Any parameter supported by MaxScale may be specified here. See reference: https://mariadb.com/kb/en/mariadb-maxscale-2308-mariadb-maxscale-configuration-guide/#global-settings.
volumeClaimTemplate VolumeClaimTemplate
VolumeClaimTemplate provides a template to define the PVCs for storing MaxScale runtime configuration files. It is defaulted if not provided.
sync MaxScaleConfigSync
Sync defines how to replicate configuration across MaxScale replicas. It is defaulted when HA is enabled.
database string
Database is the MariaDB logical database where the 'maxscale_config' table will be created in order to persist and synchronize config changes. If not provided, it defaults to 'mysql'.
interval Duration
Interval defines the config synchronization interval. It is defaulted if not provided.
timeout Duration
Interval defines the config synchronization timeout. It is defaulted if not provided.
suspend boolean
Suspend indicates whether the current resource should be suspended or not. This can be useful for maintenance, as disabling the reconciliation prevents the operator from interfering with user operations during maintenance activities.
false
name string
Name is the identifier of the listener. It is defaulted if not provided
port integer
Port is the network port where the MaxScale server will listen.
enabled boolean
Enabled is a flag to enable Metrics
exporter Exporter
Exporter defines the metrics exporter container.
serviceMonitor ServiceMonitor
ServiceMonitor defines the ServiceMonior object.
suspend boolean
Suspend indicates whether the current resource should be suspended or not. This can be useful for maintenance, as disabling the reconciliation prevents the operator from interfering with user operations during maintenance activities.
false
name string
Name is the identifier of the monitor. It is defaulted if not provided.
module MonitorModule
Module is the module to use to monitor MariaDB servers. It is mandatory when no MariaDB reference is provided.
podMetadata Metadata
PodMetadata defines extra metadata for the Pod.
imagePullSecrets LocalObjectReference array
ImagePullSecrets is the list of pull Secrets to be used to pull the image.
podSecurityContext PodSecurityContext
SecurityContext holds pod-level security attributes and common container settings.
name string
Name is the identifier of the MariaDB server.
Required: {}
address string
Address is the network address of the MariaDB server.
Required: {}
port integer
Port is the network port of the MariaDB server. If not provided, it defaults to 3306.
suspend boolean
Suspend indicates whether the current resource should be suspended or not. This can be useful for maintenance, as disabling the reconciliation prevents the operator from interfering with user operations during maintenance activities.
false
name string
Name is the identifier of the MaxScale service.
Required: {}
router ServiceRouter
Router is the type of router to use.
command string array
Command to be used in the Container.
args string array
Args to be used in the Container.
env EnvVar array
Env represents the environment variables to be injected in a container.
enabled boolean
Enabled indicates whether TLS is enabled, determining if certificates should be issued and mounted to the MaxScale instance. It is enabled by default when the referred MariaDB instance (via mariaDbRef) has TLS enabled and enforced.
adminVersions string array
Versions specifies the supported TLS versions in the MaxScale REST API. By default, the MaxScale's default supported versions are used. See: https://mariadb.com/kb/en/mariadb-maxscale-25-mariadb-maxscale-configuration-guide/#admin_ssl_version
items:Enum: [TLSv10 TLSv11 TLSv12 TLSv13 MAX]
serverVersions string array
ServerVersions specifies the supported TLS versions in both the servers and listeners managed by this MaxScale instance. By default, the MaxScale's default supported versions are used. See: https://mariadb.com/kb/en/mariadb-maxscale-25-mariadb-maxscale-configuration-guide/#ssl_version.
labels object (keys:string, values:string)
Labels to be added to children resources.
annotations object (keys:string, values:string)
Annotations to be added to children resources.
mariadbmon
MonitorModuleMariadb is a monitor to be used with MariaDB servers.
galeramon
MonitorModuleGalera is a monitor to be used with Galera servers.
server string
path string
readOnly boolean
requiredDuringSchedulingIgnoredDuringExecution NodeSelector
preferredDuringSchedulingIgnoredDuringExecution PreferredSchedulingTerm array
nodeSelectorTerms NodeSelectorTerm array
key string
operator NodeSelectorOperator
values string array
matchExpressions NodeSelectorRequirement array
matchFields NodeSelectorRequirement array
apiVersion string
fieldPath string
name string
namespace string
pluginNameSecretKeyRef SecretKeySelector
PluginNameSecretKeyRef is a reference to the authentication plugin to be used by the User. If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the authentication plugin.
pluginArgSecretKeyRef SecretKeySelector
PluginArgSecretKeyRef is a reference to the arguments to be provided to the authentication plugin for the User. If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the authentication plugin arguments.
accessModes PersistentVolumeAccessMode array
selector LabelSelector
resources VolumeResourceRequirements
claimName string
readOnly boolean
apiVersion string
enterprise.mariadb.com/v1alpha1
kind string
PhysicalBackup
metadata ObjectMeta
Refer to Kubernetes API documentation for fields of metadata.
podMetadata Metadata
PodMetadata defines extra metadata for the Pod.
imagePullSecrets LocalObjectReference array
ImagePullSecrets is the list of pull Secrets to be used to pull the image.
podSecurityContext PodSecurityContext
SecurityContext holds pod-level security attributes and common container settings.
cron string
Cron is a cron expression that defines the schedule.
suspend boolean
Suspend defines whether the schedule is active or not.
false
immediate boolean
Immediate indicates whether the first backup should be taken immediately after creating the PhysicalBackup.
args string array
Args to be used in the Container.
resources ResourceRequirements
Resources describes the compute resource requirements.
securityContext SecurityContext
SecurityContext holds security configuration that will be applied to a container.
s3 S3
S3 defines the configuration to store backups in a S3 compatible storage.
persistentVolumeClaim PersistentVolumeClaimSpec
PersistentVolumeClaim is a Kubernetes PVC specification.
volume StorageVolumeSource
Volume is a Kubernetes volume specification.
metadata Metadata
Refer to Kubernetes API documentation for fields of metadata.
volumeSnapshotClassName string
VolumeSnapshotClassName is the VolumeSnapshot class to be used to take snapshots.
Required: {}
labelSelector LabelSelector
topologyKey string
requiredDuringSchedulingIgnoredDuringExecution PodAffinityTerm array
preferredDuringSchedulingIgnoredDuringExecution WeightedPodAffinityTerm array
minAvailable IntOrString
MinAvailable defines the number of minimum available Pods.
maxUnavailable IntOrString
MaxUnavailable defines the number of maximum unavailable Pods.
seLinuxOptions SELinuxOptions
runAsUser integer
runAsGroup integer
podMetadata Metadata
PodMetadata defines extra metadata for the Pod.
imagePullSecrets LocalObjectReference array
ImagePullSecrets is the list of pull Secrets to be used to pull the image.
initContainers Container array
InitContainers to be used in the Pod.
weight integer
preference NodeSelectorTerm
podIndex integer
PodIndex is the StatefulSet index of the primary node. The user may change this field to perform a manual switchover.
autoFailover boolean
AutoFailover indicates whether the operator should automatically update PodIndex to perform an automatic primary failover.
podIndex integer
PodIndex is the StatefulSet index of the primary node. The user may change this field to perform a manual switchover.
autoFailover boolean
AutoFailover indicates whether the operator should automatically update PodIndex to perform an automatic primary failover. It is enabled by default.
autoFailoverDelay Duration
AutoFailoverDelay indicates the duration before performing an automatic primary failover. By default, no extra delay is added.
exec ExecAction
httpGet HTTPGetAction
tcpSocket TCPSocketAction
exec ExecAction
httpGet HTTPGetAction
tcpSocket TCPSocketAction
physicalBackupTemplateRef LocalObjectReference
PhysicalBackupTemplateRef is a reference to a PhysicalBackup object that will be used as template to create a new PhysicalBackup object used synchronize the data from an up to date replica to the new replica to be bootstrapped.
Required: {}
restoreJob Job
RestoreJob defines additional properties for the Job used to perform the restoration.
enabled boolean
Enabled is a flag to enable replica recovery.
Required: {}
errorDurationThreshold Duration
ErrorDurationThreshold defines the time duration after which, if a replica continues to report errors, the operator will initiate the recovery process for that replica. This threshold applies only to error codes not identified as recoverable by the operator. Errors identified as recoverable will trigger the recovery process immediately. It defaults to 5 minutes.
replPasswordSecretKeyRef GeneratedSecretKeyRef
ReplPasswordSecretKeyRef provides a reference to the Secret to use as password for the replication user. By default, a random password will be generated.
gtid Gtid
Gtid indicates which Global Transaction ID (GTID) position mode should be used when connecting a replica to the master. By default, CurrentPos is used. See: https://mariadb.com/docs/server/reference/sql-statements/administrative-sql-statements/replication-statements/change-master-to#master_use_gtid.
Enum: [CurrentPos SlavePos]
connectionRetrySeconds integer
ConnectionRetrySeconds is the number of seconds that the replica will wait between connection retries. See: https://mariadb.com/docs/server/reference/sql-statements/administrative-sql-statements/replication-statements/change-master-to#master_connect_retry.
primary PrimaryReplication
Primary is the replication configuration for the primary node.
replica ReplicaReplication
ReplicaReplication is the replication configuration for the replica nodes.
gtidStrictMode boolean
GtidStrictMode determines whether the GTID strict mode is enabled. See: https://mariadb.com/docs/server/ha-and-performance/standard-replication/gtid#gtid_strict_mode. It is enabled by default.
primary PrimaryReplication
Primary is the replication configuration for the primary node.
replica ReplicaReplication
ReplicaReplication is the replication configuration for the replica nodes.
gtidStrictMode boolean
GtidStrictMode determines whether the GTID strict mode is enabled. See: https://mariadb.com/docs/server/ha-and-performance/standard-replication/gtid#gtid_strict_mode. It is enabled by default.
apiVersion string
enterprise.mariadb.com/v1alpha1
kind string
Restore
metadata ObjectMeta
Refer to Kubernetes API documentation for fields of metadata.
backupRef LocalObjectReference
BackupRef is a reference to a Backup object. It has priority over S3 and Volume.
s3 S3
S3 defines the configuration to restore backups from a S3 compatible storage. It has priority over Volume.
volume StorageVolumeSource
Volume is a Kubernetes Volume object that contains a backup.
args string array
Args to be used in the Container.
resources ResourceRequirements
Resources describes the compute resource requirements.
securityContext SecurityContext
SecurityContext holds security configuration that will be applied to a container.
bucket string
Bucket is the name Name of the bucket to store backups.
Required: {}
endpoint string
Endpoint is the S3 API endpoint without scheme.
Required: {}
region string
Region is the S3 region name to use.
requeueInterval Duration
RequeueInterval is used to perform requeue reconciliations.
retryInterval Duration
RetryInterval is the interval used to perform retries.
cleanupPolicy CleanupPolicy
CleanupPolicy defines the behavior for cleaning up a SQL resource.
rsync
SSTRsync is an SST based on rsync.
mariabackup
SSTMariaBackup is an SST based on mariabackup. It is the recommended SST.
mysqldump
SSTMysqldump is an SST based on mysqldump.
cron string
Cron is a cron expression that defines the schedule.
Required: {}
suspend boolean
Suspend defines whether the schedule is active or not.
false
name string
key string
metadata Metadata
Refer to Kubernetes API documentation for fields of metadata.
key string
Key to be used in the Secret.
format string
Format to be used in the Secret.
secretName string
defaultMode integer
capabilities Capabilities
privileged boolean
runAsUser integer
prometheusRelease string
PrometheusRelease is the release label to add to the ServiceMonitor object.
jobLabel string
JobLabel to add to the ServiceMonitor object.
interval string
Interval for scraping metrics.
name string
port integer
readwritesplit
ServiceRouterReadWriteSplit splits the load based on the queries. Write queries are performed on master and read queries on the replicas.
readconnroute
ServiceRouterReadConnRoute splits the load based on the connections. Each connection is assigned to a server.
type ServiceType
Type is the Service type. One of ClusterIP, NodePort or LoadBalancer. If not defined, it defaults to ClusterIP.
ClusterIP
Enum: [ClusterIP NodePort LoadBalancer]
metadata Metadata
Refer to Kubernetes API documentation for fields of metadata.
loadBalancerIP string
LoadBalancerIP Service field.
apiVersion string
enterprise.mariadb.com/v1alpha1
kind string
SqlJob
metadata ObjectMeta
Refer to Kubernetes API documentation for fields of metadata.
args string array
Args to be used in the Container.
resources ResourceRequirements
Resources describes the compute resource requirements.
securityContext SecurityContext
SecurityContext holds security configuration that will be applied to a container.
ephemeral boolean
Ephemeral indicates whether to use ephemeral storage in the PVCs. It is only compatible with non HA MariaDBs.
size Quantity
Size of the PVCs to be mounted by MariaDB. Required if not provided in 'VolumeClaimTemplate'. It supersedes the storage size specified in 'VolumeClaimTemplate'.
storageClassName string
StorageClassName to be used to provision the PVCS. It supersedes the 'StorageClassName' specified in 'VolumeClaimTemplate'. If not provided, the default 'StorageClass' configured in the cluster is used.
emptyDir EmptyDirVolumeSource
nfs NFSVolumeSource
csi CSIVolumeSource
suspend boolean
Suspend indicates whether the current resource should be suspended or not. This can be useful for maintenance, as disabling the reconciliation prevents the operator from interfering with user operations during maintenance activities.
false
port IntOrString
host string
enabled boolean
Enabled indicates whether TLS is enabled, determining if certificates should be issued and mounted to the MariaDB instance. It is enabled by default.
required boolean
Required specifies whether TLS must be enforced for all connections. User TLS requirements take precedence over this. It disabled by default.
versions string array
Versions specifies the supported TLS versions for this MariaDB instance. By default, the MariaDB's default supported versions are used. See: https://mariadb.com/kb/en/ssltls-system-variables/#tls_version.
caLifetime Duration
CALifetime defines the CA certificate validity.
certLifetime Duration
CertLifetime defines the certificate validity.
privateKeyAlgorithm string
PrivateKeyAlgorithm is the algorithm to be used for the CA and leaf certificate private keys. One of: ECDSA or RSA
ssl boolean
SSL indicates that the user must connect via TLS.
x509 boolean
X509 indicates that the user must provide a valid x509 certificate to connect.
issuer string
Issuer indicates that the TLS certificate provided by the user must be issued by a specific issuer.
enabled boolean
Enabled is a flag to enable TLS.
caSecretKeyRef SecretKeySelector
CASecretKeyRef is a reference to a Secret key containing a CA bundle in PEM format used to establish TLS connections with S3. By default, the system trust chain will be used, but you can use this field to add more CAs to the bundle.
maxSkew integer
topologyKey string
whenUnsatisfiable UnsatisfiableConstraintAction
name string
Name of the referent.
kind string
Kind of the referent.
type UpdateType
Type defines the type of updates. One of ReplicasFirstPrimaryLast, RollingUpdate or OnDelete. If not defined, it defaults to ReplicasFirstPrimaryLast.
ReplicasFirstPrimaryLast
Enum: [ReplicasFirstPrimaryLast RollingUpdate OnDelete Never]
rollingUpdate RollingUpdateStatefulSetStrategy
RollingUpdate defines parameters for the RollingUpdate type.
autoUpdateDataPlane boolean
AutoUpdateDataPlane indicates whether the Galera data-plane version (agent and init containers) should be automatically updated based on the operator version. It defaults to false. Updating the operator will trigger updates on all the MariaDB instances that have this flag set to true. Thus, it is recommended to progressively set this flag after having updated the operator.
ReplicasFirstPrimaryLast
ReplicasFirstPrimaryLastUpdateType indicates that the update will be applied to all replica Pods first and later on to the primary Pod. The updates are applied one by one waiting until each Pod passes the readiness probe i.e. the Pod gets synced and it is ready to receive traffic.
RollingUpdate
RollingUpdateUpdateType indicates that the update will be applied by the StatefulSet controller using the RollingUpdate strategy. This strategy is unaware of the roles that the Pod have (primary or replica) and it will perform the update following the StatefulSet ordinal, from higher to lower.
OnDelete
OnDeleteUpdateType indicates that the update will be applied by the StatefulSet controller using the OnDelete strategy. The update will be done when the Pods get manually deleted by the user.
Never
NeverUpdateType indicates that the StatefulSet will never be updated. This can be used to roll out updates progressively to a fleet of instances.
apiVersion string
enterprise.mariadb.com/v1alpha1
kind string
User
metadata ObjectMeta
Refer to Kubernetes API documentation for fields of metadata.
requeueInterval Duration
RequeueInterval is used to perform requeue reconciliations.
retryInterval Duration
RetryInterval is the interval used to perform retries.
cleanupPolicy CleanupPolicy
CleanupPolicy defines the behavior for cleaning up a SQL resource.
name string
emptyDir EmptyDirVolumeSource
nfs NFSVolumeSource
accessModes PersistentVolumeAccessMode array
selector LabelSelector
resources VolumeResourceRequirements
name string
This must match the Name of a Volume.
readOnly boolean
mountPath string
emptyDir EmptyDirVolumeSource
nfs NFSVolumeSource
csi CSIVolumeSource
AfterSync
WaitPointAfterSync indicates that the primary waits for the replica ACK before committing the transaction to the storage engine. It trades off performance for consistency.
AfterCommit
WaitPointAfterCommit indicates that the primary commits the transaction to the storage engine and waits for the replica ACK afterwards. It trades off consistency for performance.
weight integer
podAffinityTerm PodAffinityTerm
Enum: [Logical Physical]
Enum: [Always Never IfNotPresent]
Enum: [Skip Delete]
Enum: [Skip Delete]
Enum: [Always Never IfNotPresent]
Required: {}
Enum: [readwritesplit readconnroute] Required: {}
items:Enum: [TLSv10 TLSv11 TLSv12 TLSv13 MAX]
Enum: [Skip Delete]
items:Enum: [TLSv1.0 TLSv1.1 TLSv1.2 TLSv1.3]
Enum: [ECDSA RSA]
Enum: [Skip Delete]
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.
This page is: Copyright © 2025 MariaDB. All rights reserved.