Only this pageAll pages
Powered by GitBook
Couldn't generate the PDF for 109 pages, generation stopped at 100.
Extend with 50 more pages.
1 of 100

Tools

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Loading...

Tools

This space includes documentation for clients, utilities, and applications, including AI-focused ones, designed to help you manage, monitor, back up, and interact with your MariaDB Server deployment.

MariaDB Enterprise Manager

MariaDB Enterprise Manager is a comprehensive observability and management solution designed for your entire database fleet. It provides advanced, topology-aware monitoring and a powerful suite of visual tools for query development and schema management, all from a single, centralized interface.

MariaDB Enterprise Operator

MariaDB Enterprise Operator provides a seamless way to run and operate containerized versions of MariaDB Enterprise Server and MaxScale on Kubernetes, allowing you to leverage Kubernetes orchestration and automation capabilities. This document outlines the features and advantages of using Kubernetes and the MariaDB Enterprise Operator to streamline the deployment and management of MariaDB and MaxScale instances.

MariaDB Enterprise MCP Server

MariaDB Enterprise MCP (Model Context Protocol) Server is a secure, enterprise-grade application designed to act as the primary interface between AI assistants and MariaDB data ecosystems. This product solves a key challenge: how to allow powerful AI agents to safely and efficiently leverage an organization's most valuable asset—its data.

MariaDB AI RAG

MariaDB AI RAG is an enterprise-grade Retrieval-Augmented Generation (RAG) solution that integrates with MariaDB to provide AI-powered document processing, semantic search, and natural language generation capabilities.

MariaDB Enterprise Manager

MariaDB Enterprise Manager is a comprehensive observability and management solution designed for your entire database fleet. It provides advanced, topology-aware monitoring and a powerful suite of visual tools for query development and schema management, all from a single, centralized interface.

At its core, Enterprise Manager uses lightweight agents to collect deep telemetry from your standalone databases, replicated topologies, and MaxScale clusters via the OpenTelemetry standard. This foundation powers the integrated Grafana dashboards, which come pre-packaged with production-ready visualizations and alerts. Beyond monitoring, the provides a shared environment for developers and DBAs with an advanced Query Editor and a visual ERD Designer. The entire system is secured with role-based access control, audit logging, and can integrate with your corporate identity provider (OIDC) for single sign-on.

Architecture Overview

MariaDB Enterprise Manager is a client/server application for monitoring and managing MariaDB deployments. It provides topology-aware monitoring, visual schema management, and query editing across multiple database connections.

The architecture consists of two primary components: a central Enterprise Manager Server that aggregates data and hosts the user interface, and an Enterprise Manager Agent that is deployed on each monitored host.

Enterprise Manager Server

The Enterprise Manager Server runs on a dedicated host and acts as the central command center. It is delivered as a suite of Docker containers managed by Docker Compose.

MariaDB Enterprise Manager
MariaDB Enterprise Kubernetes Operator
MariaDB Enterprise MCP Server
MariaDB AI RAG

Usage

Dashboards

Topologies

Different topologies supported by the operator.

MariaDB Enterprise Kubernetes Operator

MariaDB Enterprise Kubernetes Operator automates provisioning, scaling, backups, and high availability, making cloud-native database operations efficient and reliable.

Example

Key Capabilities at a Glance

Advanced Monitoring

Leverage the power of a built-in Grafana instance, complete with pre-packaged dashboards and production-ready alerts. The platform provides the flexibility to create custom dashboards, define unique alert rules, and route notifications to a wide range of destinations.

Integration with Other Observability Solutions

Built on open standards, Enterprise Manager uses OpenTelemetry for metrics collection. Its integrated Prometheus time-series database exposes a query API, allowing you to seamlessly export metrics and integrate with your existing observability stack.

Centralized Management

Gain a topology-based, centralized view of your entire database fleet. Enterprise Manager discovers and visualizes your replication and clustering setups, providing the ability to drill down into a specific through a seamless single sign-on (SSO) experience.

Workspace

The Workspace provides a powerful suite of tools for developers and DBAs. It features a rich Query Editor for running and debugging SQL and a visual ERD Designer for schema management and modeling across multiple database connections.

Enterprise Security

Secure your management layer with robust security features. Authenticate users with your corporate identity provider (OIDC), enforce granular permissions with role-based access control (RBAC), and maintain compliance with a comprehensive audit log for all administrative actions.

Workspace

The core components are the following:

Component
Description

Supermax

The primary backend application that serves the main web UI for management, server registration, and configuration.

Grafana

Provides powerful, pre-built dashboards for visualizing time-series performance metrics.

Prometheus

The time-series database that ingests and stores all monitoring data collected from the agents.

OpenTelemetry Collector

The central endpoint that receives telemetry data (metrics, logs, traces) from all agents.

Nginx

A web server that acts as a reverse proxy, directing browser traffic to the appropriate service (Supermax or Grafana).

Enterprise Manager Agent

The Enterprise Manager Agent is installed on each MariaDB Server and MaxScale host that you want to monitor. Its job is to collect data and forward it to the central server.

These components are installed via the mema-agent package (RPM or DEB) and include:

  • Prometheus Exporters: These are the primary data gatherers.

    • Node Exporter: Collects system-level metrics (CPU, RAM, disk usage).

    • Mysqld Exporter: Collects detailed metrics from the MariaDB database itself.

  • OpenTelemetry Collector: This local collector pulls data from the Prometheus exporters and pushes it to the central collector on the Enterprise Manager Server.

  • mema-agent CLI: A setup utility used to register the host with the Enterprise Manager Server and configure the local agent services.

Networking Requirements

For the system to function correctly, the following firewall ports must be open on the Enterprise Manager Server host:

  • 8090 (HTTP/S): The main entry point for the web UI. Nginx listens on this port and proxies requests to Supermax and Grafana.

  • 4318 (HTTP/S): Agents on monitored nodes push telemetry data to this port.

SSO to MaxScale (Single Sign-On)

For topologies managed by MaxScale, you can seamlessly access the MaxScale GUI directly from Enterprise Manager using Single Sign-On.SSO to MaxScale requires MaxScale 25.10.0 or higher.1

1

Accessing the MaxScale GUI

  1. Click the three-dot menu (⋮) next to a MaxScale node.

  2. Select "Manage MaxScale".

2

Configuring SSO in maxscale.cnf

To enable SSO, add the following parameters to your MaxScale configuration file (maxscale.cnf) on the MaxScale host:

Parameter
Description

Add Multiple MaxScale Monitors

MariaDB Enterprise Manager allows you to monitor multiple logical databases or clusters that are managed by the same set of high-availability MaxScale instances. After adding your first MaxScale instance, you can easily add more monitors to track different services without re-entering the connection details.

Default Monitor Behavior

If you add a database from a MaxScale setup that has multiple monitors and do not explicitly select one, Enterprise Manager will automatically assign the first available monitor by default. To ensure you are tracking the correct service, it's best to specify the monitor manually.

Network and Firewall Requirements

It's recommended to run MariaDB Enterprise Manager on an internal, secured network. Direct public exposure is not recommended.

Before installing MariaDB Enterprise Manager, ensure that your firewall and network rules allow traffic on all required ports. Proper connectivity is essential for the system to function correctly.

The following table details the necessary ports and their purposes.

Service/Component
Port
Protocol
Traffic Direction

Deployment

This section provides an overview of the deployment process for MariaDB Enterprise Manager, covering installation and upgrades for both the central server and the monitoring agents.

MariaDB Enterprise Manager is designed for a streamlined deployment experience. You can launch the main server with a single-line command for a quick start, and a UI-integrated helper tool simplifies the process of installing and registering agents on your monitored databases.

Installing the Enterprise Manager Server

The Enterprise Manager Server is a Docker-based application installed on a dedicated host. The installation is handled by the installer script, which pulls the necessary container images and starts the application.

As a first step review the hardware, system, and network requirements:

Monitoring

Installation

Installation instructions for MariaDB Enterprise Kubernetes Operator in Kubernetes and OpenShift

Plugins

Learn about the plugins supported by the MariaDB Enterprise Kubernetes Operator and how to configure them.

Administration

Backup and Restore

Configure multiple backup strategies and perform restoration.

MariaDB Enterprise MCP Server

Migrations

Learn about migrations with MariaDB Enterprise Kubernetes Operator. This section covers strategies and procedures for smoothly migrating your MariaDB databases within Kubernetes environments.

admin_oidc_url

Hostname or IP address of your Enterprise Manager server.

admin_host

Must be set to 0.0.0.0 to allow external connections from Enterprise Manager.

admin_oidc_client_id

Default credentials used by Enterprise Manager to request the access token.

admin_oidc_client_secret

Default credentials used by Enterprise Manager to request the access token.

Adding an Additional Monitor

Follow these steps to add another logical database that is monitored by the same MaxScale deployment.

1

Add a new monitored logical database

  1. Navigate to your main database inventory page.

  2. Locate the existing logical database that is associated with your MaxScale deployment.

  3. Click the three-dot menu icon (⋮) on the right side of the database entry to open the context menu and select Add Monitor.

2

Configure the new monitor

  1. In the dialog box that appears, provide a new Logical Database Name and select the specific MaxScale Monitor you wish to track from the dropdown list.

Changing the Monitor for an Existing Database

If you need to change which MaxScale monitor an existing logical database is tracking, follow these steps.

1

Open the database edit menu

  1. Navigate to your main database inventory page and locate the logical database you wish to edit.

  2. Click the three-dot menu icon (⋮) on the right side of the database entry.

  3. Select the Edit option from the menu.\

2

Select a different monitor

  1. In the configuration window, scroll down to the Advanced section.

Purpose

Enterprise Manager Server

8090

HTTP/S

Inbound

User Access: Allows users to access the Enterprise Manager UI.

Enterprise Manager Server

4318

HTTP/S

Inbound

Agent Metrics: Receives metrics data pushed from the Enterprise Manager Agents.

Enterprise Manager Agent

4318

HTTP/S

Outbound

Agent Metrics: Pushes metrics data to the Enterprise Manager Server.

All ports listed are TCP. Ensure your firewall rules explicitly allow TCP traffic for the specified ports.

Summary of Required Firewall Rules

For the current version of MariaDB Enterprise Manager, ensure the following rules are in place:

  • From user workstations, allow traffic to the Enterprise Manager Server on TCP port 8090.

  • From agent hosts, allow traffic to the Enterprise Manager Server on TCP port 4318.

  • Hardware and System Requirements

  • Network and Firewall Requirements

  • After confirming your hardware, system, and network are compliant, proceed with the installation instructions: Installing MariaDB Enterprise Manager

    Installing Enterprise Manager Agents

    To monitor a MariaDB Server and MaxScale host, install agent on it. Then, use the Enterprise Manager UI to add the database topology and generate the agent setup command. This command includes the correct metric labels for that host.

    Quick start

    You can quickly set up and launch MariaDB Enterprise Manager with a single-line command. This allows you to start exploring its capabilities without extensive configuration.

    Enterprise Manager includes a helper tool, integrated in the UI, for adding agents. The helper prompts you to download a small (< 50M) binary and then provides command-line instructions to install and register agents, enabling quick and seamless addition of new MariaDB databases to Enterprise Manager.

    Hardware and System Requirements

    This guide outlines the system and hardware requirements for deploying the Enterprise Manager Server and the Enterprise Manager Agent.

    Enterprise Manager Server 🖥️

    The Enterprise Manager Server is the central component that hosts the UI and stores monitoring data.

    Hardware Sizing Guide

    Monitored Servers
    CPU
    Memory (RAM)
    Storage (SSD)

    Tip: Adjust storage size depending on your requirements for metrics retention.

    System Requirements

    • CPU Architecture: x86-64

    • Operating System: 64-bit Linux with Docker support.

    • Software: Docker Engine and Docker Compose must be installed.

    Enterprise Manager Agent🕵

    The agent must be installed on each and instance you wish to monitor. Below are the supported operating systems.

    Supported Platforms for MariaDB Server

    MariaDB Server Version
    Supported OS (x86_64, ARM64)

    Supported Platforms for MariaDB MaxScale

    MaxScale Version
    Supported OS (x86_64, ARM64)

    * Monitoring and Single Sign-On(SSO) are only supported for MaxScale versions 25.10 and Above

    Agent Installation

    To install mema-agent, you need to setup

    The mema-agent is a small application that must be installed on every server you wish to monitor with MariaDB Enterprise Manager, including MariaDB Server nodes and MaxScale nodes.

    This guide covers the recommended installation method using a package manager.

    Prerequisite: Create the Local Monitor User

    Before installing the agent on a MariaDB Server host, you must create a local user that the agent will use to connect to the database and collect metrics.

    Log in to your MariaDB Server and run the following:

    Replace <password> with a secure password. You will need these credentials later when linking the agent in the Enterprise Manager UI.

    Installation via Package Manager (Recommended)

    This method uses your OS's native package manager (dnf, apt, zypper) to install the agent from the MariaDB Enterprise repository.

    Step 1: Configure the MariaDB Enterprise Repository

    If you haven't already configured the MariaDB Enterprise repository on the server, follow these steps.

    1

    Get your Customer Download Token

    • Navigate to the and log in.

    Step 2: Install the Agent Package

    Once the repository is configured, use your system's package manager to install the agent.

    The agent is now installed and running as a service.

    Next Steps: Linking the Agent 🔗

    After the agent is installed, it is running but not yet configured or linked to your MariaDB Enterprise Manager server.

    The final step is to link the agent, which is done from the Enterprise Manager UI. Please refer to the for the specific steps to generate the linking command.

    Alerts and Notifications

    MariaDB Enterprise Manager provides a powerful and flexible alerting system, built on the capabilities of the integrated Grafana Alerting engine. It allows you to proactively monitor your entire database fleet, define custom rules for potential issues, and receive notifications through various channels to ensure you can respond quickly.

    All persistent Grafana settings are managed through the MariaDB Enterprise Manager configuration files. Changes made directly in the Grafana UI will be lost upon restart.

    How It Works: The Alerting Flow

    The alerting process in MariaDB Enterprise Manager follows a clear, four-step flow from detection to notification.

    1

    Alert Rule is Defined

    An alert rule contains a query (what to measure, e.g., disk usage), a condition (the threshold, e.g., > 90%), and labels for routing (e.g., type = server disk).

    2

    Key Alerting Concepts

    To configure alerting effectively, it's helpful to understand these core concepts from Grafana:

    Term
    Description

    For a deep dive into advanced topics like custom message templating, alert grouping, and more complex routing, see the .

    Standalone

    This operator allows you to configure standalone MariaDB Enterprise Server instances. To achieve this, you can either omit the replicas field or set it to 1:

    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb
    spec:
      rootPasswordSecretKeyRef:
        name: mariadb
        key: password
    
      replicas: 1
    
      port: 3306
    
      storage:
        size: 1Gi
    
      myCnf: |
        [mariadb]
        bind-address=*
        default_storage_engine=InnoDB
        binlog_format=row
        innodb_autoinc_lock_mode=2
        innodb_buffer_pool_size=800M
        max_allowed_packet=256M
    
      resources:
        requests:
          cpu: 500m
          memory: 1Gi
        limits:
          memory: 1Gi
    
      metrics:
        enabled: true

    Whilst this can be useful for development and testing, it is not recommended for production use because of the following reasons:

    • Single point of failure

    • Upgrades require downtime

    • Only vertical scaling is possible

    For achieving high availability, we recommend deploying a highly available topology as described in the .

    Database Administration

    The MariaDB Enterprise Manager Workspace includes a powerful set of integrated tools that allow DBAs and developers to perform common administrative tasks graphically, without needing to write raw SQL commands. These features are primarily accessed through the Schemas Sidebar and dedicated tabs in the main worksheet area.

    Schema Inspector

    The Schema Inspector provides detailed, read-only metadata views for any selected schema object. This allows you to quickly understand the structure, data types, constraints, and dependencies of your tables, views, and other objects without querying the information_schema. To use it, simply click on an object in the Object Browser.

    Object Browser

    The Object Browser is the hierarchical tree view located in the Schemas Sidebar on the left side of the Workspace. It is your primary tool for navigating and exploring your database instances. You can expand databases to see their tables, views, stored procedures, and triggers, and use the filter box at the top to quickly locate specific objects.

    Object Editor

    The Object Editor allows you to create, modify, and delete schema objects using graphical forms and dialogs. You can access these functions by right-clicking on an object (or object type) in the Object Browser. This will open a context menu with actions such as:

    • CREATE TABLE, CREATE VIEW

    • ALTER TABLE

    • DROP TABLE

    User Management

    This dedicated tab provides a grid-based interface for managing database users and their privileges directly, without writing GRANT or CREATE USER statements.

    From this interface, you can:

    • View a list of all database users and their assigned global privileges.

    • Create new database users using a simple form.

    • Edit an existing user's password or modify their privileges.

    • Delete users who no longer require access.

    Process List Viewer

    The Processlist tab provides a real-time view of the database server's active sessions and the commands they are executing, equivalent to running SHOW FULL PROCESSLIST. This is an essential tool for diagnosing performance issues.

    Using the Processlist Viewer, you can:

    • Monitor all active connections, their current status (e.g., Query, Sleep), and how long they have been running.

    • Identify long-running or problematic queries that may be impacting server performance.

    • Manage live sessions, which may include the ability to terminate (kill) a specific process.

    Examples Catalog

    The examples catalog contains a number of sample manifests that aim to show the operator functionality in a practical way. Follow these instructions for getting started:

    • Download the examples catalog:

    curl -sLO https://operator.mariadb.com/examples/manifests.tar.gz
    mkdir -p examples
    tar -xzf manifests.tar.gz -C examples
    • Install the configuration shared by all the examples:

    • Start deploying examples:

    Some examples rely on external dependencies for specific tasks, make sure to install them when it applies:

    • for metrics

    • for TLS certificates

    • for S3 object storage

    It is recommended to complement the examples with the documentation to understand the full range of configuration options available.

    If you are looking for production-grade examples, you can check the following manifests:

    • mariadb_replication_production.yaml and maxscale_replication_production.yaml for

    • mariadb_galera_production.yaml and maxscale_galera_production.yaml for

    Supported Docker Images

    The following is a list of images that have plugins installed and available to use.

    Even though these images have plugins installed, that doesn't necessarily mean that they are enabled by default. You may need to install them. The recommended operator native way to do so is to use:

    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb
    spec:
      # ....
      myCnf: |
        [mariadb]
        plugin_load_add = auth_pam # Load auth plugin
      # ....

    Each supported plugin will have a section on how to install it.

    Component
    Image
    Supported Tags
    CPU Architecture

    Usage Examples

    Standard SQL Query

    { "tool": "execute_sql", "parameters": { "database_name": "test_db", "sql_query": "SELECT * FROM users WHERE id = %s", "parameters": [123] } }

    Create Vector Store

    { "tool": "create_vector_store", "parameters": { "database_name": "test_db", "vector_store_name": "my_vectors", "model_name": "text-embedding-3-small", "distance_function": "cosine" } }

    Insert Documents into Vector Store

    Semantic Search

    RAG Generation

    Service Management

    MariaDB AI RAG runs as a web service using Uvicorn/FastAPI. You can manage the service using standard system commands.

    Starting the Service

    # Start the service using the executable directly
    ./databridge

    Viewing Logs

    Logs are stored in the logs directory within the installation path:

    Quickstart Guide

    MariaDB Enterprise Manager installation and configuration guide

    MariaDB Enterprise Manager is a database management and observability solution that provides advanced topology-aware monitoring coupled with visual schema management, query editing, and ERD design across multiple database connections.

    This guide describes steps to install MariaDB Enterprise Manager for evaluation purposes.

    Prerequisites

    1

    Migrate external MariaDB into Kubernetes

    In this guide, we will be migrating an external MariaDB into a new MariaDB instance running in Kubernetes and managed by MariaDB Enterprise Kubernetes Operator. We will be using for achieving this migration.

    Ensure you understand the in the MariaDB Enterprise Kubernetes Operator.

    1. Take a logical backup of your external MariaDB using one of the commands below:

    If you are currently using or migrating to a Galera instance, use the following command instead:

    2. Ensure that your backup file matches the following format: backup.2024-08-26T12:24:34Z.sql

    25.10 LTS version update guide

    This guide illustrates, step by step, how to update to 25.10.2 from previous versions.

    • The Galera data-plane must be updated to the 25.10.2 version. You must set updateStrategy.autoUpdateDataPlane=true in your MariaDB resources before updating the operator. Then, once updated, the operator will also be updating the data-plane based on its version:

    MariaDB Galera Cluster

    The dashboard mirrors most sections from the dashboard extending it with Galera Metrics section and the Galera Nodes table. Use this dashboard when you need Galera-specific cluster health alongside the familiar server views.

    Galera Metrics

    Insights into Galera Cluster health with critical metrics and node-specific status details.

    Metric

    Backup & Restore of Enterprise Manager

    Note: This is about backing up the data, configuration and collected metrics of the Enterprise Manager (EM), not the databases.

    Backing up Enterprise Manager Server

    1

    Stop the Enterprise Manager

    Overview

    "Model Context Protocol" (MCP) is a standard or interface designed to bridge the gap between AI development tools (like copilots in your code editor) and your project's specific environment.

    In simple terms, it's a way for an AI to understand the context of what you're working on.

    The MariaDB Enterprise MCP (Model Context Protocol) Server is a secure, enterprise-grade application designed to act as the primary interface between AI assistants and MariaDB data ecosystems. This product solves a key challenge: how to allow powerful AI agents to safely and efficiently leverage an organization's most valuable asset—its data.

    It achieves this by providing a single, hardened endpoint that offers not only standard database operations but also advanced AI workflow orchestration and integration with industry-standard authentication systems.

    Change Hostname or IP Address

    To set the hostname or IP address for an existing MariaDB Enterprise Management instance, follow these instructions. Changing the hostname or IP address is useful if your server's IP changed or if you need to switch from an IP address to a public DNS name.

    1

    Connect to your server

    SSH into the server where your Enterprise Manager is running:

    Frequently Asked Questions

    Where do you get MCP Server from and what are the installation requirements?

    The MCP Server can be launched individually or as part of the RAG-in-a-box system. It is distributed as pre-compiled binaries that can run on various operating systems, including:

    • Windows

    SMTP Server Configuration

    This page explains how to configure email alerting for MariaDB Enterprise Manager using Grafana's integrated alerting engine. Configure SMTP credentials and server details in the main environment file so Enterprise Manager can send alert notifications via email.

    This is an advanced draft.

    1

    Edit the environment file

    Token Management

    Token management is a critical part of the system's security, handled primarily by the RAG API.

    Token Generation

    The process involves two main steps:

    Installation

    System Requirements

    • Operating System: Linux (Debian/Ubuntu/RHEL), macOS 10.15+, or Windows 10/11

    • CPU: 4+ cores recommended

    [maxscale]
    # ... other settings ...
    admin_host=0.0.0.0
    admin_oidc_url=<Enterprise Manager Host Name>
    admin_oidc_client_id=admin
    admin_oidc_client_secret=mariadb
    kubectl apply -f examples/config
    kubectl apply -f examples/mariadb.yaml

    Click the Confirm button to add the new monitored database.

    From the Monitor name dropdown, select the new MaxScale monitor you want this logical database to track.\
  • Click the Confirm button to save your changes.

  • Copy your Customer Download Token. You will need this for the script.

    2

    Download the repository setup script

    In your server's terminal, download the official setup script:

    3

    Run the script

    Make the script executable, then run it with your download token:

    Replace YOUR_TOKEN_HERE with the token you copied from the Customer Portal.

    MariaDB Customer Portal
    "Adding Databases to MariaDB Enterprise Manager" guide

    Instances are Evaluated

    Grafana periodically runs the query against your monitored targets. It creates an Alert Instance for each distinct entity (e.g., one for Server 01, one for Server 02, etc.).

    3

    An Instance "Fires"

    If the condition is met for a specific instance (e.g., Server 01's disk usage is over 90%), that instance enters a "firing" state.

    4

    Notifications are Sent

    The firing alert is routed through a Notification Policy. The policy matches the alert's labels (e.g., type = server disk) and sends a notification to the configured Contact Point (such as Email, Slack, or PagerDuty).

    Alert Rules

    The combination of a data query and a threshold condition defining what to measure and when it's a problem.

    Alert Instances

    Generated from an alert rule for each monitored entity, showing individual statuses.

    Contact Points

    Destinations for notifications, such as email, Slack, PagerDuty, or webhooks.

    Notification Policies

    Uses labels to route alerts to contact points, facilitating team-specific alerting.

    Silences and Mute Timings

    Allow temporary notification pauses without halting alerts. Silences cover single events, like maintenance, while Mute Timings are for recurring periods, such as at night or weekends.

    official Grafana documentation
    Managing constraints and relationships
  • Renaming or copying objects

  • Prepare a machine for Enterprise Manager installation

    Machine requirements (minimal hardware resources for evaluation):

    • CPU: 2 cores (or 2 vCPUs) with x86-64 architecture

    • RAM: 4 GB

    • Storage: 100 GB

    Other requirements:

    • 64-bit Linux OS with installed Docker engine and Docker Compose: https://docs.docker.com/engine/install/

    • Network ports 8090 and 4318 opened for inbound traffic

    2

    Obtain MariaDB Customer Download Token

    1. Navigate to the Customer Download Token at the MariaDB Customer Portal

    2. Log in using your

    3. Copy the Customer Download Token — you will use it as the password when logging in to the MariaDB Enterprise Docker Registry

    3

    Setup MariaDB Enterprise Repository - "MariaDB Enterprise Tools"

    Step 1: Install Enterprise Manager

    1

    Login to the MariaDB Enterprise Docker Registry

    Use your MariaDB ID as username and Customer Download Token as password:

    2

    Download the installation script

    Insert your Customer Download Token into the download URL and download the installation script:

    3

    Make the installation script executable

    4

    Run the installer with default options

    5

    Access Enterprise Manager UI

    Open in a browser:

    https://<Enterprise_Manager_IP>:8090

    At the login screen, use the default username admin and the generated password displayed after the installation script finishes.

    Step 2: Register database topology in Enterprise Manager and enable monitoring

    Below are procedures for topologies without and with MaxScale.

    Topology without MaxScale

    1

    Create monitoring user for each MariaDB Server (Enterprise Manager access)

    Run on each MariaDB server (replace <Enterprise_Manager_IP> ):

    2

    Add database topology in Enterprise Manager UI

    Add each MariaDB Server in the Enterprise Manager UI, providing access details for each server.

    3

    Install agent on each MariaDB Server to enable metrics collection

    On each MariaDB server install the .

    • RedHat-based (RHEL, CentOS, Rocky Linux):

    4

    Create monitoring user for agent access (on each MariaDB Server)

    Run on each MariaDB server:

    5

    Setup agent using the command generated in Enterprise Manager UI

    1. In the UI, click the three dots beside the server you want to install the Agent on.\

    6

    Wait for metrics to appear

    Wait 1–2 minutes for to start populating in Enterprise Manager from the agents (default collection interval is 1 minute).

    Topology with MaxScale

    1

    Add MaxScale instances to Enterprise Manager

    Add each MaxScale instance in the Enterprise Manager UI, providing access details.

    2

    Install agent on each MaxScale and MariaDB Server

    On each MaxScale and each MariaDB server install the mema-agent package.

    • RedHat-based (RHEL, CentOS, Rocky Linux):

    • Debian-based (Ubuntu, Debian):

    3

    Create monitoring user for agent access (on each MariaDB Server)

    Run on each MariaDB server:

    4

    Setup agent using the command generated in Enterprise Manager UI

    1. Click the three dots beside the server or MaxScale instance you want to install the Agent on and click Install Agent.

    5

    Wait for metrics to appear

    Wait 1–2 minutes for metrics to start populating in Enterprise Manager from the agents (default collection interval is 1 minute).

    . If the file name does not follow this format, it will be ignored by the operator.

    3. Upload the backup file to one of the supported storage types. We recommend using S3.

    4. Create your MariaDB resource declaring that you want to bootstrap from the previous backup and providing a root password Secret that matches the backup:

    5. If you are using Galera in your new instance, migrate your previous users and grants to use the User and Grant CRs. Refer to the SQL resource documentation for further detail.

    mariadb-dump --user=${MARIADB_USER} --password=${MARIADB_PASSWORD} --host=${MARIADB_HOST} --single-transaction --events --routines --all-databases > backup.2024-08-26T12:24:34Z.sql
    mariadb-dump --user=${MARIADB_USER} --password=${MARIADB_PASSWORD} --host=${MARIADB_HOST} --single-transaction --events --routines --all-databases --skip-add-locks --ignore-table=mysql.global_priv > backup.2024-08-26T12:24:34Z.sql
    logical backups
    key considerations and limitations of the Backup and Restore resources
    Once set, you may proceed to update the operator. If you are using
    Helm
    :

    Upgrade the mariadb-enterprise-operator-crds helm chart to 25.10.2:

    Upgrade the mariadb-enterprise-operator helm chart to 25.10.2:

    As part of the 25.10 LTS release, we have introduced support for LTS versions. Refer to the Helm docs for sticking to LTS versions.

    • If you are on OpenShift:

    If you are on the stable channel using installPlanApproval=Automatic in your Subscription object, then the operator will be automatically updated. If you use installPlanApproval=Manual, you should have a new InstallPlan which needs to be approved to update the operator:

    As part of the 25.10 LTS release, we have introduced new release channels. Consider switching to the stable-v25.10 if you are willing to stay in the 25.10.x version:

    • Consider reverting updateStrategy.autoUpdateDataPlane back to false in your MariaDB object to avoid unexpected updates:

    helm repo update mariadb-enterprise-operator
    helm upgrade --install mariadb-enterprise-operator-crds  mariadb-enterprise-operator/mariadb-enterprise-operator-crds --version 25.10.2
    Description

    Flow Control Pause %

    Percent of time a node is paused due to Galera flow control backpressure.

    Flow Control Messages Sent

    "Slow-down" signals sent per second when a node is under pressure.

    Replication Queue Depth Received

    Size of the receive/apply queue; growth indicates apply lag.

    Write Conflicts

    Certification conflicts per second (failed concurrent writes on hot rows).

    Max Galera Replication Latency (s)

    Maximum observed replication/EVS latency per node.

    Transactions

    Per-node throughput: transactions received from peers and/or replicated out.

    Writeset Traffic

    Bytes/s of Galera writesets per node (inbound vs outbound).

    Galera Nodes

    Per-node status summary with short state logic

    Attribute
    Description

    Instance / Status

    Is the server up? (Based on mariadb_up)

    Accept Queries

    Can this node take client traffic right now? (Based on wsrep_ready)

    Local State

    Where is the node in the Galera lifecycle? (Based on wsrep_local_state)

    Flow Control

    Is this node throttling or being throttled? (wsrep_flow_control_* rate > 0 → ON, otherwise OFF)

    Cluster Status

    Is the node in the Primary component? (Based on wsrep_cluster_status)

    Connected

    Is the node linked to the group? (Based on wsrep_connected)

    MariaDB Server

    Go to the Enterprise Manager installation directory

  • Run docker compose stop to stop the Enterprise Manager

  • 2

    Create a directory for backups

    3

    Take a backup of all the volumes

    The backups directory now contains the data from the Enterprise Manager.

    4

    Start the Enterprise Manager

    1. Go to the Enterprise Manager installation directory

    2. Run docker compose up -d to start the Enterprise Manager

    Restoring Enterprise Manager Server

    1

    Stop the Enterprise Manager

    1. Go to the Enterprise Manager installation directory

    2. Run docker compose stop to stop the Enterprise Manager

    2

    Restore the backup of all volumes

    The backups are stored in the ~/backups/ directory.

    3

    Start the Enterprise Manager

    1. Go to the Enterprise Manager installation directory

    What is a Model Context Protocol (MCP) Server?

    MCP provides a standardized, model-agnostic way for language models and other AI systems to interact with external tools and data sources. The MCP Server implements this protocol, ensuring a consistent and reliable method for AI applications to request information and perform operations. This streamlined communication layer accelerates the development and deployment of AI-integrated systems.

    The Value of an MCP Server for Databases

    Connecting AI directly to a production database is both risky and inefficient. An MCP server provides a critical abstraction layer that delivers three key benefits:

    1. Security and Governance: It acts as a single, hardened chokepoint for all AI-driven data interactions. Instead of embedding credentials across numerous applications, the MCP Server manages access centrally, enabling robust auditing, permission enforcement, and integration with enterprise secret managers.

    2. Abstraction and Simplicity: Developers building AI applications do not need to be database experts. They can interact with a simple, well-defined set of tools (e.g., list_tables, execute_sql) without writing complex connection logic or security checks, dramatically accelerating development cycles.

    3. Standardization and Interoperability: By adhering to the MCP standard, your data infrastructure can seamlessly connect with a growing ecosystem of AI assistants and development frameworks—such as Cursor, Windsurf, and VSCode plugins—without requiring bespoke integrations for each one.

    The Objective of an MCP Server

    The primary goal of the MariaDB Enterprise MCP Server is to enable the secure and scalable deployment of AI agents within enterprise environments.

    Key objectives include:

    • Enhance Security and Compliance: Integrate with centralized secret management platforms like HashiCorp Vault and 1Password to eliminate static credentials and meet stringent enterprise security policies.

    • Streamline Complex AI Workflows: Provide a unified endpoint for orchestrating multi-step RAG (Retrieval-Augmented Generation) pipelines, from data ingestion to final response generation.

    • Improve Manageability: Offer a robust, configurable, and observable server that can be reliably deployed and managed by platform engineering and DBA teams.

    • Accelerate AI Application Development: Provide a standardized protocol that simplifies how developers connect AI agents to MariaDB data.

    2

    Navigate to the directory

    Change into the enterprise-manager directory, where your Docker Compose files are located:

    3

    Edit the .env file

    Open the environment file with a text editor (for example nano):

    Find the line that begins with MEMA_HOSTNAME= and update it with the new hostname or IP address. Example:

    4

    Save the file

    Save the file and exit the editor.

    5

    Restart the services

    Restart the MEM services so the new environment variable takes effect. The --force-recreate flag ensures the containers are rebuilt using the updated environment variables:

    After the restart, your Enterprise Manager will be accessible at the new hostname or IP address.

    RHEL (Red Hat Enterprise Linux)
  • Ubuntu

  • Is MCP Server a command-line tool, or does it have a GUI?

    The MCP Server is a network service that runs as an HTTP server; it does not have a graphical user interface (GUI) or a direct command-line interface (CLI) for tools. It's designed to be a backend service that is:

    • Accessed programmatically via the Model Context Protocol.

    • Integrated into AI assistants and clients like Claude Desktop, Cursor, or Windsurf.

    You interact with the server by configuring a client application to communicate with it. For example, here is how you might configure a client like Windsurf:

    How do you configure the MCP Server and connect it to MariaDB?

    The MCP Server does not include its own database. It acts as a client and requires a connection to an external, pre-existing MariaDB server.

    The system components are connected as follows:

    MCP Server (Port 8002) ---------> MariaDB Server (Port 3306)
                             (connects via MySQL protocol)

    Configuration is managed through environment files where you specify the connection details for your MariaDB instance.

    How are tools like list_databases executed?

    Tools are not typed into a command line. Instead, they are executed programmatically by a Large Language Model (LLM) in response to a user's query in natural language.

    The process works like this:

    1. A user asks a question in an integrated client (e.g., "Can you show me what databases are available?").

    2. The LLM interprets the request and determines that the list_databases tool is needed.

    3. The LLM calls the list_databases tool by sending a JSON-RPC request to the MCP Server.

    4. The MCP Server executes the tool against the connected MariaDB database.

    5. The results are sent back to the LLM, which formats them into a natural language response for the user.

    What are the JSON snippets in the documentation for?

    The JSON snippets shown in the documentation are examples of the "behind-the-scenes" communication between a client, the LLM, and the MCP Server. They are not meant to be copied and pasted into a CLI but serve to illustrate how the protocol functions.

    Navigate to your MariaDB Enterprise Manager installation directory:

    1. Open the .env file in a text editor (example uses nano):

    1. Add the following block of variables to the file, filling in values for your SMTP server:

    1. Save the file and exit the editor.

    2

    Restart the Grafana service

    The new settings are applied only after Grafana restarts.

    From the enterprise-manager/ directory, restart only the Grafana container so other Enterprise Manager components are not affected:

    3

    Verify the configuration in Grafana

    After Grafana restarts:

    1. Open the Grafana UI.

    2. Create a new "Contact point".

    3. Use the "Test" button to send a test email and confirm that SMTP settings are correct and Enterprise Manager can send alerts.

    Step 1: User Registration

    Step 2: User Login & Token Generation

    Token Usage

    Once a client has a JWT, it includes it in the Authorization header of every request to the MCP Server. The server then validates the token before processing the request.

    Key Security Measures

    • Signature Verification: Prevents token tampering.

    • Expiration Check: Tokens have a limited lifetime (e.g., 30 minutes).

    • Database Validation: Ensures the user associated with the token still exists and is active.

    • Issuer/Audience Validation: Prevents a token from one system from being used on another.

    • Not-Before Check: Prevents a token from being used before it is valid

    RAM: Minimum 8GB, 16GB+ recommended

  • Storage: 10GB for installation, additional space for document storage

  • Database: MariaDB 10.6+ or compatible MySQL 8.0+

  • Python: Version 3.9+ (included in the installation package)

  • Installation Procedure

    Debian/Ubuntu Installation

    1. Download the Debian / Ubuntu .deb installation package from:

      • https://mariadb.com/downloads/enterprise-tooling/ai-rag/

    2. Install the package:

    3. Install dependencies:

    RHEL (and equivalents) Installation

    1. Download the RHEL .rpm installation package from:

    Windows Installation

    1. Download the Windows .msi installation package from:

    50

    4 cores

    8 GB

    200 GB

    200

    16 cores

    32 GB

    800 GB

    500+

    48 cores

    96 GB

    10.6, 11.4, 11.8

    RHEL/Rocky/AlmaLinux/Oracle Linux 8, 9, 10

    Ubuntu LTS 22.04, 24.04

    Debian 11, 12, 13

    23.02*, 23.08*, 24.02*, 25.01*, 25.10

    RHEL/Rocky/AlmaLinux 8, 9, 10

    Ubuntu LTS 22.04, 24.04

    Debian 11, 12, 13

    MaxScale

    2000 GB

    MariaDB Enterprise Server (ppc64le support)

    docker.mariadb.com/enterprise-server

    11.8.3-1 11.4.8-5 11.4.7-4.3 11.4.7-4.2 11.4.7-4.1 11.4 10.6.23-19 10.6.22-18.1 10.6

    amd64 arm64 ppc64le

    { "tool": "insert_docs_vector_store", "parameters": { "database_name": "test_db", "vector_store_name": "my_vectors", "documents": ["Sample text 1", "Sample text 2"], "metadata": [{"source": "doc1"}, {"source": "doc2"}] } }
    { "tool": "search_vector_store", "parameters": { "database_name": "test_db", "vector_store_name": "my_vectors", "user_query": "What is the capital of France?", "k": 5 } }
    # View API logs
    cat logs/api.log
    
    # View ingestion logs
    cat logs/ingestion.log
    high availability guide
    prometheus-operator
    cert-manager
    minio
    API reference
    asynchronous replication
    Galera

    Metrics Retention Configuration

    By default, MariaDB Enterprise Manager retains detailed metrics for 30 days. You can configure this data retention period to balance your need for historical data with storage costs.

    This guide explains how to change the retention period and how the underlying storage system works.

    How to Change the Retention Period

    Changing the retention time is done by editing the environment file for Enterprise Manager and then restarting the services.

    1

    Locate and edit the .env file

    Navigate to your Enterprise Manager installation directory and open the .env file in a text editor.

    2

    Modify the retention time variable

    Find the line containing PROMETHEUS_RETENTION_TIME and change its value. The change will only take effect after the Prometheus service is restarted.

    Examples:

    3

    Restart services to apply the change

    You must restart the services for the new retention period to be applied.

    Data Retention Policy

    Prometheus, the time-series database used by Enterprise Manager, does not delete expired data instantly.

    • Block-Based Storage: Prometheus stores metrics data in blocks, which are typically two-hour chunks of time. In the background, these small blocks are compacted into larger ones.

    • Delayed Cleanup: Data is not deleted on a sample-by-sample basis. Instead, Prometheus removes an entire block once all the data within it has passed the retention period. This cleanup process runs in the background and may not be immediate.

    Delayed metrics removal for deleted databases

    After you delete a database from MariaDB Enterprise Manager, you may continue to see its historical metrics in Grafana dashboards for a period of time.

    This is expected behavior. Enterprise Manager does not immediately delete a database's metric history from Prometheus. Instead, the data is removed automatically by Prometheus's own cleanup process once it passes the configured retention period.

    These old metrics will no longer receive new data and will eventually disappear from the dashboards on their own.

    Valid Retention Time Units

    When setting PROMETHEUS_RETENTION_TIME, you can use the following units:

    • y - years

    • w - weeks

    • d - days

    MariaDB MaxScale

    This dashboard shows MaxScale’s health and load, how backend servers are seen by each MaxScale, and the traffic/query volume flowing through it—plus cache efficiency from the Query Classifier.

    Topology Overview

    Provides a visual representation of the entire system's architecture and connectivity.

    Section
    Description

    System Metrics

    System Metrics provide comprehensive insights into the performance and health of individual system resources.

    Metric
    Description

    MaxScale Metrics

    Query Classifier Cache Metrics help in analyzing and optimizing query routing efficiency by tracking cache hits/misses and monitoring cache size.

    Metric
    Description

    Query Classifier Cache Metrics

    Evaluate query routing efficiency by tracking and optimizing cache metrics like hits, misses, and cache size.

    Metric
    Description

    Quickstart

    This guide aims to provide a quick way to get started with the MariaDB Enterprise Kubernetes Operator for Kubernetes. It will walk you through the process of deploying a MariaDB Enterprise Cluster and MaxScale via the MariaDB and MaxScale CRs (Custom Resources) respectively.

    Before you begin, ensure you meet the following prerequisites:

    • Configure your customer access for docker.mariadb.com

    • Install the MariaDB Enterprise Kubernetes Operator

    The first step will be configuring a Secret with the credentials used by the MariaDB CR:

    Next, we will deploy a MariaDB Enterprise Cluster (Galera) using the following CR:

    Let's break it down:

    • rootPasswordSecretKeyRef: A reference to a Secret containing the root password.

    • imagePullSecrets: The name of the Secret containing the customer credentials to pull the MariaDB Enterprise Server image.

    • maxScaleRef: The name of the

    After applying the CR, we can observe the MariaDB Pods being created:

    Now, let's deploy a MaxScale CR:

    Again, let's break it down:

    • imagePullSecrets: The name of the Secret containing the customer credentials to pull the MaxScale image.

    • mariaDbRef: A reference to the MariaDB CR that we want to connect to.

    • replicas: The number of MaxScale instances to deploy.

    After applying the CR, we can observe the MaxScale Pods being created, and that both the MariaDB and MaxScale CRs will become ready eventually:

    To conclude, let's connect to the MariaDB Enterprise Cluster through MaxScale using the initial user and database we initially defined in the MariaDB CR:

    You have successfully deployed a MariaDB Enterprise Cluster with MaxScale in Kubernetes using the MariaDB Enterprise Kubernetes Operator!

    Refer to the , the and the for further detail.

    Data Plane

    In order to effectively manage the full lifecycle of both replication and Galera topologies, the operator relies on a set of components that run alonside the MariaDB instances and expose APIs for remote management. These components are collectively referred to as the "data-plane".

    Components

    The mariadb-enterprise-operator data-plane components are implemented as lightweight containers that run alongside the MariaDB instances within the same Pod. These components are available in the operator image. More preciselly, they are subcommands of the CLI shipped as binary inside the image.

    Init container

    The init container is reponsible for dynamically generating the Pod-specifc configuration files before the MariaDB container starts. It also plays a crucial role in the MariaDB container startup, enabling replica recovery for the replication topolology and guaranteeing ordered deployment of Pods for the Galera topology.

    Agent sidecar

    The agent sidecar provides an HTTP API that enables the operator to remotely manage MariaDB instances. Through this API, the operator is able to remotely operate the data directory and handle the instance lifecycle, including operations such as replica recovery for replication and cluster recovery for the Galera topology.

    It supports methods to ensure that only the operator is able to call the agent API.

    Agent auth methods

    As previously mentioned, the agent exposes an API to remotely manage the replication and Galera clusters. The following authentication methods are supported to ensure that only the operator is able to call the agent:

    ServiceAccount based authentication

    The operator uses its ServiceAccount token as a mean of authentication for communicating with the agent, which subsequently verifies the token by creating a . This is the default authentication method and will be automatically applied by setting:

    This Kubernetes-native authentication mechanism eliminates the need for the operator to manage credentials, as it relies entirely on Kubernetes for this purpose. However, the drawback is that the agent requires cluster-wide permissions to impersonate the ClusterRole and to create , which are cluster-scoped objects.

    Basic authentication

    As an alternative, the agent also supports basic authentication:

    Unlike the , the operator needs to explicitly generate credentials to authenticate. The advantage of this approach is that it is entirely decoupled from Kubernetes and it does not require cluster-wide permissions on the Kubernetes API.

    Updates

    Please refer to the updates documentation for more information about .

    Getting Started

    Welcome to MariaDB AI RAG! This section will guide you through installing, configuring, and running the MariaDB AI RAG API and MCP Server.

    Documentation in This Section

    Overview

    Learn about the MariaDB AI RAG system architecture and components:

    • System architecture

    • Core modules (Ingestion, Chunking, Retrieval, Generation)

    • Data flow and processing pipeline

    • Integration with MariaDB vector database

    Step-by-step installation instructions for all supported platforms:

    • Linux (Ubuntu/Debian - .deb packages)

    • Linux (RHEL/Fedora - .rpm packages)

    • Windows (.msi installer)

    • System requirements and prerequisites

    Configure the RAG API and MCP Server:

    • Environment variables

    • Configuration file setup

    • Database connection settings

    • API keys and authentication

    Manage the RAG API and MCP Server services:

    • Starting and stopping services

    • Service status monitoring

    • Log file locations

    • Troubleshooting service issues

    Quick Start Guide

    1. Install the package for your platform (see )

    2. Configure your environment with database credentials and API keys (see )

    3. Start the services using the service management commands

    4. Verify installation by accessing the API health endpoint:

    Next Steps

    After completing the getting started guide:

    • Explore the for detailed endpoint documentation

    • Learn about for user management

    • Review for optimization

    Suspend Reconciliation

    Suspended state

    When a resource is suspended, all operations performed by the operator are disabled, including but not limited to:

    • Provisioning

    • Upgrades

    • Volume resize

    • Galera cluster recovery

    More specifically, the reconciliation loop of the operator is omitted, anything part of it will not happen while the resource is suspended. This could be useful in maintenance scenarios, where manual operations need to be performed, as it helps prevent conflicts with the operator.

    Suspend a resource

    Currently, only MariaDB and MaxScale resources support suspension. You can enable it by setting suspend=true:

    This results in the reconciliation loop being disabled and the status being marked as Suspended:

    To re-enable it, simply remove the suspend setting or set it to suspend=false.

    Metrics

    MariaDB Server Metrics

    MariaDB Server metrics are gathered with the Prometheus exporter for MySQL and stored in Enterprise Manager’s Prometheus with the mariadb prefix. The agent runs the exporter with the following collector flags:

    Collector name
    Description

    MaxScale Metrics

    MariaDB Enterprise Manager collects a wide range of time-series metrics from your MariaDB MaxScale instances to provide deep insight into their performance, health, and activity. Monitoring these metrics is crucial for diagnosing performance bottlenecks, ensuring high availability, and understanding how your database proxy is handling application traffic.

    Here is the list of available collected by Enterprise Manager.

    Node Metrics

    Node metrics provide crucial information about the health and performance of the underlying hardware and operating system on each monitored host. These metrics are essential for diagnosing infrastructure bottlenecks, understanding resource utilization, and planning for future capacity.

    MariaDB Enterprise Manager gathers these metrics using Prometheus Node Exporter, which includes a default set of collectors.

    Key metrics collected by default include:

    • CPU Usage: Overall and per-core utilization, load average, and context switching.

    • Memory: Total, used, free, and cached memory, including swap space.

    • Disk I/O: Read/write operations, throughput (bytes per second), and I/O time.

    • Filesystem Usage: Total, used, and available space for each mounted filesystem.

    For a complete and detailed list of all metrics gathered by the default collectors, please refer to the official .

    API Reference

    The MariaDB AI RAG API provides a comprehensive RESTful interface for document ingestion, chunking, retrieval, and AI-powered generation. All endpoints require JWT authentication except for the login endpoint.

    Available API Documentation

    API Reference

    Complete reference for all API endpoints including:

    • Document ingestion and management

    • Chunking operations

    • Retrieval and search

    • AI generation

    Authentication and authorization documentation:

    • JWT-based authentication

    • User management endpoints

    • Role-based access control

    • Document sharing and permissions

    Direct database ingestion capabilities:

    • SQL query ingestion

    • Table and view ingestion

    • Role-based database access

    • Structured data processing

    High-level workflow endpoints:

    • Full pipeline orchestration

    • Ingestion orchestration

    • Generation orchestration

    • Multi-step RAG workflows

    Quick Start

    All API requests require authentication. First, obtain a JWT token:

    Then include the token in subsequent requests:

    Base URL

    The default base URL for the API is:

    For production deployments, replace with your configured host and port.

    Configure OpenID Connect Identity Provider

    MariaDB Enterprise Manager can be integrated with external identity providers (like Okta, Keycloak, or Azure AD) using OpenID Connect (OIDC). This allows you to centralize user authentication, enforce your organization's security policies, and enable single sign-on (SSO).

    Integrating with an external Identity Provider is an optional feature. MariaDB Enterprise Manager includes a built-in that works out-of-the-box.

    Built-in Alert Rules

    MariaDB Enterprise Manager includes a comprehensive set of pre-configured alert rules to provide production-ready monitoring for your entire database stack out-of-the-box. These alerts are built on the integrated Grafana Alerting engine and are designed to detect common issues across your MariaDB Servers, Galera Clusters, MaxScale instances, and the underlying operating systems.

    A key feature of these rules is the use of a "sustained for" duration. This means a condition must remain true for a specified period (e.g., 3 minutes) before an alert will fire. This prevents alert fatigue from brief, transient spikes and ensures you are only notified of persistent, actionable problems.

    MariaDB Server

    Alert name

    Installing MariaDB Enterprise Manager

    Prerequisites

    • Prepare a machine for Enterprise Manager installation that complies with

    • Make sure that you have required network ports opened:

    Metadata

    This documentation shows how to configure metadata in the MariaDB Enterprise Kubernetes Operator CRs.

    Children object metadata

    MariaDB and MaxScale resources allow you to propagate metadata to all the children objects by specifying the inheritMetadata field:

    This means that all the reconciled objects will inherit these labels and annotations. For instance, see the Services

    External MariaDB

    mariadb-enterprise-operator supports managing resources in external MariaDB instances i.e running outside of the Kubernetes cluster where the operator runs. This feature allows to manage users, privileges, databases, run SQL jobs declaratively and taking backups using the same CRs that you use to manage internal MariaDB instances.

    ExternalMariaDB configuration

    The ExternalMariaDB resource is similar to the internal MariaDB resource, but we need to provide a host

    Introduction

    MariaDB Enterprise Kubernetes Operator provides a seamless way to run and operate containerized versions of MariaDB Enterprise Server and MaxScale on Kubernetes, allowing you to leverage Kubernetes orchestration and automation capabilities. This document outlines the features and advantages of using Kubernetes and the MariaDB Enterprise Kubernetes Operator to streamline the deployment and management of MariaDB and MaxScale instances.

    What is Kubernetes?

    Kubernetes is more than just a container orchestrator; it is a comprehensive platform that provides APIs for managing both applications and the underlying infrastructure. It automates key aspects of container management, including deployment, scaling, and monitoring, while also handling essential infrastructure needs such as networking and storage. By unifying the management of applications and infrastructure, Kubernetes simplifies operations and improves efficiency in cloud-native environments.

    Database Fleet Overview

    The "fleet" dashboard is the central inventory for all your monitored database topologies. It provides a hierarchical, at-a-glance overview of the health, status, and configuration of your entire database environment.

    Understanding the Dashboard Columns

    Security in Enterprise Manager

    MariaDB Enterprise Manager provides security at multiple levels, including transport-layer encryption for all components, secure authentication, and a detailed audit log.

    This guide covers the primary security configurations. For Users, Roles and Permissions, see .

    SSL/TLS Certificate Management

    Node and Operating System

    The Node Dashboard pane provides detailed visibility into the health and performance of individual nodes that run MariaDB Server and MaxScale. It combines uptime, system capacity, operating system details, and hardware utilization with disk and network activity. This view helps administrators ensure each node has sufficient resources and can support the workloads running on it.

    Node Information

    Provides a high-level, at-a-glance summary of a specific server node's status, configuration, and capacity.

    Metric

    Customer access to docker.mariadb.com

    This documentation aims to provide guidance on how to configure access to docker.mariadb.com in your MariaDB Enterprise Kubernetes Operator resources.

    Customer credentials

    MariaDB Corporation requires customers to authenticate when logging in to the . A Customer Download Token must be provided as the password. Customer Download Tokens are available through the MariaDB Customer Portal. To retrieve the customer download token for your account:

    Troubleshooting Enterprise Manager

    Troubleshooting installation/deployment issues for Enterprise Manager and Agent

    Is the MariaDB Enterprise repository configured correctly?

    The agent is distributed as a native OS package that can be installed from the MariaDB Enterprise repositories. The repositories can be installed by following the .

    Make sure to use the mariadb_es_repo_setup script with your Customer Download Token.

    25.08 version update guide

    This guide illustrates, step by step, how to update to 25.8.0 from previous versions.

    • Uninstall you current mariadb-enterprise-operator for preventing conflicts:

    Alternatively, you may only downscale and delete the webhook configurations:

    • Upgrade mariadb-enterprise-operator-crds to 25.8.0

    MariaDB AI RAG

    MariaDB AI RAG is an enterprise-grade Retrieval-Augmented Generation (RAG) solution that integrates with MariaDB to provide AI-powered document processing, semantic search, and natural language generation capabilities.

    Documentation Contents

    Getting Started

    Storage

    This operator gives you flexibility to define the storage that will back the /var/lib/mysql data directory mounted by MariaDB.

    Configuration

    The simplest way to configure storage for your MariaDB is:

    This will make use of the default StorageClass available in your cluster, but you can also provide a different one:

    Configuration

    Overview

    This guide covers the basic configuration of the MariaDB AI RAG system. For production deployments and advanced configuration scenarios, please refer to the .

    See Also:

    • - Production configuration for Ubuntu/Debian

    curl -LsSO https://dlm.mariadb.com/enterprise-release-helpers/mariadb_es_repo_setup
    # Make script executable and run
    chmod +x mariadb_es_repo_setup
    sudo ./mariadb_es_repo_setup --token="YOUR_TOKEN_HERE" --apply
    Create monitor user
    CREATE USER 'monitor'@'localhost' IDENTIFIED BY '<password>';
    GRANT SELECT, PROCESS, REPLICATION CLIENT, RELOAD, REPLICA MONITOR, REPLICATION MASTER ADMIN ON *.* TO 'monitor'@'localhost';
    sudo dnf install mema-agent
    sudo apt-get install mema-agent
    docker login docker.mariadb.com
    CREATE USER 'monitor'@'<Enterprise_Manager_IP>' IDENTIFIED BY '<password>';
    GRANT REPLICA MONITOR ON *.* TO 'monitor'@'<Enterprise_Manager_IP>';
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      rootPasswordSecretKeyRef:
        name: mariadb
        key: root-password
      replicas: 3
      galera:
        enabled: true
      storage:
        size: 1Gi
      bootstrapFrom:
        s3:
          bucket: backups
          prefix: mariadb
          endpoint: minio.minio.svc.cluster.local:9000
          accessKeyIdSecretKeyRef:
            name: minio
            key: access-key-id
          secretAccessKeySecretKeyRef:
            name: minio
            key: secret-access-key
          tls:
            enabled: true
            caSecretKeyRef:
              name: minio-ca
              key: tls.crt
        targetRecoveryTime: 2024-08-26T12:24:34Z
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      updateStrategy:
    +   autoUpdateDataPlane: true
    helm repo update mariadb-enterprise-operator
    helm upgrade --install mariadb-enterprise-operator mariadb-enterprise-operator/mariadb-enterprise-operator --version 25.10.2
    oc get installplan
    NAME            CSV                                     APPROVAL   APPROVED
    install-sjgcs   mariadb-enterprise-operator.v25.10.2    Manual     false
    
    oc patch installplan install-sjgcs --type merge -p '{"spec":{"approved":true}}'
    
    installplan.operators.coreos.com/install-sjgcs patched
    apiVersion: operators.coreos.com/v1alpha1
    kind: Subscription
    metadata:
      name: mariadb-enterprise-operator
      namespace: openshift-operators
    spec:
      channel: stable-v25.10
      installPlanApproval: Automatic
      name: mariadb-enterprise-operator
      source: certified-operators
      sourceNamespace: openshift-marketplace
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      updateStrategy:
    +   autoUpdateDataPlane: false
    -   autoUpdateDataPlane: true
    Create the `backups` directory
    mkdir backups
    Back up all volumes
    docker run --rm --volumes-from enterprise-manager-grafana -v $(pwd)/backups/:/backups/ alpine:latest tar -czf /backups/grafana-backup.tar.gz /var/lib/grafana/
    docker run --rm --volumes-from enterprise-manager-prometheus -v $(pwd)/backups/:/backups/ alpine:latest tar -czf /backups/prometheus-backup.tar.gz /prometheus/
    docker run --rm --volumes-from enterprise-manager-supermax -v $(pwd)/backups/:/backups/ alpine:latest tar -czf /backups/supermax-backup.tar.gz /var/lib/supermax/
    cd enterprise-manager
    nano .env
    MEMA_HOSTNAME=your.new.hostname.or.ip
    docker compose up -d --force-recreate
    ssh user@your-server-ip
    Restart Grafana container
    # Take down the existing Grafana container
    docker compose down grafana
    
    # Start a new Grafana container with the updated configuration
    docker compose up -d grafana
    cd enterprise-manager/
    nano .env
    # --- Grafana SMTP Email Settings ---
    # Set to true to enable email alerting
    GF_SMTP_ENABLED=true
    
    # Your SMTP server hostname and port
    GF_SMTP_HOST=smtp.example.com:587
    
    # Credentials for your SMTP user
    GF_SMTP_USER=my-email-user
    GF_SMTP_PASSWORD=my-super-secret-password
    
    # Set to true if your server uses a self-signed certificate
    GF_SMTP_SKIP_VERIFY=false
    
    # The "From" address that will appear on alert emails
    GF_SMTP_FROM_ADDRESS=alerts@my-domain.com
    
    # The display name for the sender
    GF_SMTP_FROM_NAME=MariaDB Enterprise Manager
    { "tool": "rag_generation", "parameters": { "database_name": "test_db", "vector_store_name": "my_vectors", "user_query": "What is the capital of France?", "k": 5, "temperature": 0.9 } }
  • Debian-based (Ubuntu, Debian):

  • The UI will generate a unique setup command for that specific server with the username and password you provide.

  • Copy and run the command on that specific server.

  • Repeat for all servers in the database fleet.\

  • The UI will generate a unique setup command for that specific server/MaxScale instance with the username and password you provide. Copy the command.

  • On that specific server/MaxScale instance, paste and run the command in your terminal.

  • Repeat for all MaxScale and MariaDB servers.

  • MariaDB ID
    mema-agent package
    metrics
    Run docker compose up -d to start the Enterprise Manager

    Install the package:

    sudo rpm -i ai-rag-*.rpm

    Run the .msi installer.

  • Follow the installation wizard instructions.

  • https://mariadb.com/downloads/enterprise-tooling/ai-rag/
    https://mariadb.com/downloads/enterprise-tooling/ai-rag/
    sudo dpkg -i ai-rag-*.deb	
    sudo apt-get install -f

    Changes to PROMETHEUS_RETENTION_TIME take effect only after the Prometheus service is restarted.

    h
    - hours
  • m - minutes

  • s - seconds

  • MaxScale
    CR that we will be creating right after.
  • username, passwordSecretKeyRef and database: The initial user and database to create.

  • storage: The size of the volume that will back the data directory.

  • replicas: The number of MariaDB Enterprise Server instances to deploy.

  • galera: Configuration for the Galera clustering.

  • documentation
    API reference
    examples catalog
    Embedding and LLM provider configuration
    Installation
    Configuration
    Service Management
    Installation
    Configuration
    API Reference
    Access Control
    Performance Tuning

    Network Traffic: Data sent and received, packets, and network interface errors.

    collect.binlog_size

    Reports binary log files and their sizes to track binlog count and total disk usage/growth.

    collect.engine_innodb_status

    Parses SHOW ENGINE INNODB STATUS to expose InnoDB internals (waits, deadlocks, transaction and I/O snapshots).

    collect.info_schema.innodb_metrics

    Reads INFORMATION_SCHEMA.INNODB_METRICS for detailed InnoDB counters (buffer pool, I/O, log, lock, purge, recovery, etc.).

    collect.info_schema.innodb_tablespaces

    Exposes per-tablespace/file size and allocation details from Information Schema for space-usage monitoring.

    collect.info_schema.processlist

    Exposes current session/thread activity (users, hosts, commands, states, runtimes) based on the process list.

    collect.info_schema.replica_host

    Discovers replica hosts via Information Schema (MariaDB-friendly alternative to SHOW SLAVE HOSTS) for topology visibility.

    collect.slave_hosts

    Emits replica host topology using SHOW SLAVE HOSTS/SHOW REPLICA HOSTS (note: MariaDB expects the legacy SHOW SLAVE HOSTS syntax).

    collect.slave_status

    Exposes replication status from SHOW SLAVE/REPLICA STATUS (I/O/SQL thread states, positions/GTID, seconds behind, etc.).

    MaxScale metrics
    Prometheus Node Exporter documentation
    Batch operations
    User directory management
    Access Control
    Database Integration
    Orchestration
    Before You Begin

    Before configuring OIDC in Enterprise Manager, you must first register Enterprise Manager as a client application within your Identity Provider's administrative console and obtain the necessary credentials.

    1

    Configure client settings in your identity provider

    In your Identity Provider's client configuration screen, you will need to provide several URLs that point back to your MariaDB Enterprise Manager instance. These URLs tell the provider where to send the user after authentication and what origins are allowed to make requests.

    While the exact field names may vary, you must configure the following endpoints, replacing <Your_Enterprise_Manager_Address> with the actual address of your instance:

    • Root / Home URL: https://<Your_Enterprise_Manager_Address>:8090

    • Valid Redirect URI: https://<Your_Enterprise_Manager_Address>:8090/landing

    • Valid Post Logout Redirect URI: https://<Your_Enterprise_Manager_Address>:8090/

    2

    Obtain your credentials

    Once the client application is saved in your Identity Provider, find and copy the following values:

    • Authentication URL: The provider's endpoint for authentication requests.

    3

    Configure role mapping in your identity provider

    Finally, you must configure your Identity Provider to pass the user's role in the JWT token. This is explained in the "Mapping IDP Roles" section further down this page.

    Configuration Steps in Enterprise Manager

    1

    Navigate to Identity Provider settings

    • From the main UI, click the Settings icon (⚙️) in the left navigation bar.

    • On the Settings page, click the Identity Provider card.

    2

    Enter your OIDC provider details

    On the OpenID Connect (OIDC) configuration page, fill in the details from your provider:

    • Authentication URL: The full URL for your OIDC provider's authentication endpoint.

    3

    Save the configuration

    • Click the Save button to apply the settings.

    OIDC Using Keycloak

    Here is an example of what the filled-in fields might look like if you are using Keycloak.

    • Authentication URL: This is the URL to your specific Keycloak realm: http://<keycloak_ip>:<port>/realms/<your_realm>

    • Authentication Flow: The default auto flow is recommended for Keycloak.

    • Client ID: The Client ID you configured for the application within your Keycloak realm: enterprise-manager

    • Client Secret: This secret is generated by Keycloak and found in the 'Credentials' tab of your client configuration in the Keycloak admin console: 12345ab-c67d-89e0-f123-456789abcdef

    Mapping IDP Roles to Enterprise Manager Permissions

    For Enterprise Manager to assign the correct permissions to a user logging in via OIDC, it expects the JWT token from your provider to contain a specific field (claim) named account.

    The value of this account field must exactly match the name of a role that exists in MariaDB Enterprise Manager (for example, admin, viewer, or a custom role).

    Example JWT payload showing the account claim

    { "account": "admin", "aud": "admin", "exp": 1760133641, "iat": 1760104841, "iss": "maxscale", "jti": "0780a545-bb7a-404d-a384-64d04557801d", "sub": "admin" }

    This token's account claim value "admin" would grant the user the admin role upon login.

    1

    Resetting the OIDC Configuration

    To restore the default settings:

    1. Click the Reset Configuration button.\

    2. In the confirmation dialog, click Reset.\

    2

    A success message will confirm the reset.

    user management system
    Description

    MariadbInstanceDown

    MariaDB instance down for 3 minutes (sustained for 3m). Triggers when the exporter reports the instance as down (mariadb_up = 0) or when no sample from mariadb_up has been received for more than 120 seconds.

    ReplicaProcessDown

    MariaDB instance has a Replica process Down (sustained for 3m). Triggers when replication is unhealthy: the I/O or SQL thread is stopped, or Seconds_Behind_Master is missing (replica not reporting progress).

    ReplicaSecondsBehindPrimary

    MariaDB replica is more than 600s behind primary (sustained for 3m). Triggers when replication lag exceeds 600 seconds.

    HighUtilizationMaxConnections

    MariaDB instance has high connection utilization (sustained for 5m). Triggers when Threads_connected exceeds ~80% of max_connections.

    MariaDBInstanceRestart

    MariaDB instance restarted recently (sustained for 5m). Triggers when server uptime is below 1 hour, indicating a recent restart.

    MariaDBDeadlockFound

    MariaDB Deadlock found in the last 15m (sustained for 5m). Triggers when the count of InnoDB deadlocks increases compared to 15 minutes ago.

    Galera Cluster

    Alert name
    Description

    GaleraClusterDown

    Galera instance down for 5 minutes (sustained for 5m). Triggers when the cluster is not in Primary state (wsrep_cluster_status ≠ 1) or the node is not ready (wsrep_ready ≠ 1).

    GaleraNodeNotReady

    Galera node not ready (state ≠ 4) for 5m (sustained for 5m). Triggers when the node is not in Synced state and it’s not a temporary DESYNC (desync counter did not change in the last 5 minutes).

    GaleraInWrongState

    Galera instance is in an unexpected state (sustained for 5m). Triggers when the node’s state comment isn’t one of the normal values (Synced / Donor / Joining / Joined / Waiting for SST).

    GaleraClusterDonorFallingBehind

    Galera donor lagging (recv queue > 100) for 5m (sustained for 5m). Triggers when a Donor node (state=2) accumulates a large receive queue, indicating it’s falling behind replication.

    GaleraClusterSizeChanged

    Galera cluster size changed in last 15m (sustained for 5m). Triggers when the cluster size increases within 15 minutes.

    MaxScale

    Alert name
    Description

    MaxScaleInstanceDown

    MaxScale down for 3 minutes (sustained for 3m). Triggers when no recent MaxScale metrics have been received for more than 120 seconds (e.g., MaxScale down or exporter/scrape pipeline issue).

    MaxScaleNoPrimary

    MaxScale has no primary for 3 minutes (sustained for 3m). Triggers when MaxScale reports zero servers with role = Primary/Master.

    Node/OS

    Alert name
    Description

    NodeFilesystemSpaceUsage

    Filesystem disk space is above 90% (sustained for 1h). Triggers when disk space used exceeds 90% on a writable filesystem.

    NodeFilesystemSpaceFillingUp

    Filesystem predicted to run out of space within ~24h (sustained for 1h). Triggers when usage is above 80% and the trend (predictive model) indicates free space will reach zero within ~24 hours; excludes read-only filesystems.

    NodeMemoryHighUtilization

    Instance is running out of memory > 95% (sustained for 15m). Triggers when memory utilization exceeds 95%.

    NodeCPUHighUtilization

    Instance is running out of CPU > 90% (sustained for 15m). Triggers when CPU utilization exceeds 90% over a 5-minute window.

    NodeFilesystemAlmostOutOfFiles

    Filesystem has less than 3% inodes left (sustained for 1h). Triggers when available inodes drop below 3% on a writable filesystem.

    NodeNetworkReceiveErrs

    Network interface has a high receive-error rate (sustained for 1h). Triggers when receive errors exceed 1% of total received packets over a 2-minute rate window.

    Obtain MariaDB Customer Download Token

    • Navigate to the Customer Download Token at the MariaDB Customer Portal

    • Log in using your MariaDB ID

    • Copy the Customer Download Token to use as the password when logging in to the MariaDB Enterprise Docker Registry

  • Set up MariaDB Enterprise Repository - MariaDB Enterprise Tools for each monitored MariaDB Server and MaxScale

    • https://mariadb.com/docs/server/server-management/install-and-upgrade-mariadb/installing-mariadb/binary-packages/mariadb-package-repository-setup-and-usage

  • Standard Installation

    1

    Log in to Docker registry

    Login to the MariaDB Enterprise Docker Registry providing your MariaDB ID as a username and Customer Download Token as a password:

    2

    Download the installation script

    Insert your Customer Download Token into the download URL and download the installation script:

    3

    Make the installer executable

    4

    Run the installer

    Install Enterprise Manager by running the script:

    The script prompts you to enter IP address and port number on which Enterprise Manager should listen to for incoming connections. Verify the auto-detected value and correct it if it's wrong.

    This address and port must be reachable from all monitored MariaDB Server and MaxScale hosts.

    After you provide the details, the script launches Enterprise Manager.

    5

    Verify containers

    Run docker compose ps in the enterprise-manager directory to check that all of the constituent Docker containers are running. The containers are:

    • enterprise-manager-grafana

    6

    Access the UI

    Access Enterprise Manager UI at:

    https://<Enterprise_Manager_IP>:8090

    At the login screen, use the default username admin and the generated password displayed after the installation script finishes.

    The installer generates a self-signed TLS certificate for Enterprise Manager. To change the certificate, follow instructions at Security in Enterprise Manager.

    To modify metrics retention time, see Metrics retention configuration.

    Enterprise Manager Server Air-Gapped Installation

    Installing Enterprise Manager to a machine without an Internet connection is possible by manually copying the Docker images and related settings from an Internet-connected machine to the final target machine.

    Follow these steps:

    1

    Install on an Internet-connected machine

    First, install Enterprise Manager on an Internet-connected machine as explained in the normal installation section. When the installation script asks for the address and port that Enterprise Manager should listen at for incoming connections, enter the values for the final target machine.

    2

    Save images and settings

    Once installation is complete, save all related Docker images and settings by running the following commands from the directory that contains the enterprise-manager folder:

    The resulting archive enterprise-manager.tar.gz contains all components of Enterprise Manager.

    3

    Transfer archive to target machine

    Copy enterprise-manager.tar.gz to the target (air-gapped) machine into the directory under which you want to install Enterprise Manager.

    4

    Extract and load images on target machine

    On the target machine, extract the archive and load the Docker images:

    5

    Start Enterprise Manager

    Start Enterprise Manager with:

    Hardware and System Requirements
    Network and Firewall Requirements
    and
    Pods
    :

    Pod metadata

    You have the ability to provide dedicated metadata for Pods by specifying the podMetadata field in any CR that reconciles a Pod, for instance: MariaDB, MaxScale, Backup, Restore and SqlJobs:

    It is important to note that the podMetadata field supersedes the inheritMetadata field, therefore the labels and annotations provided in the former will override the ones in the latter.

    Service metadata

    Provision dedicated metadata for Services in the MariaDB resources can be done via the service, primaryService and secondaryService fields:

    In the case of MaxScale, you can also do this via the kubernetesService field.

    Refer to the to know more about the Service fields and MaxScale.

    PVC metadata

    Both MariaDB and MaxScale allow you to define a volumeClaimTemplate to be used by the underlying StatefulSet. You may also define metadata for it:

    Use cases

    Being able to provide metadata allows you to integrate with other CNCF landscape projects:

    Metallb

    If you run on bare metal and you use Metallb for managing the LoadBalancer objects, you can declare its IPs via annotations:

    Istio

    Istio injects the data-plane container to all Pods, but you might want to opt-out of this feature in some cases:

    For instance, you probably don't want to inject the Istio sidecar to Backup Pods, as it will prevent the Jobs from finishing and therefore your backup process will hang.

    ,
    username
    and a reference to a
    Secret
    containing the user password. These will be the connection details that the operator will use to connect to the external MariaDB in order to manage resources, make sure that the specified user has enough privileges:

    If you need to use TLS to connect to the external MariaDB, you can provide the server CA certificate and the client certificate Secrets via the tls field:

    As a result, you will be able to specify the ExternalMariaDB as a reference in multiple objects, the same way you would do for a internal MariaDB resource.

    As part of the ExternalMariaDB reconciliation, a Connection will be created whenever the connection template is specified. This could be handy to track the external connection status and declaratively create a connection string in a Secret to be consumed by applications to connect to the external MariaDB.

    Supported objects

    Currently, the ExternalMariaDB resource is supported by the following objects:

    • Connection

    • User

    • Grant

    • Database

    • Backup

    • SqlJob

    You can use it as an internal MariaDB resource, just by setting kind to ExternalMariaDB in the mariaDBRef field:

    When the previous example gets reconciled, an user will be created in the referred external MariaDB instance.

    Why Kubernetes?

    Kubernetes brings several key benefits to the table when managing applications in a containerized environment:

    • Standardization: Kubernetes relies on standard APIs for managing applications and infrastructure, making it easier to ensure uniformity across various environments. It acts as a common denominator across cloud providers and on-premises.

    • Automation: Kubernetes APIs encapsulate operational best practises, minimizing the need for manual intervention and improving the efficiency of operations.

    • Cost Effectiveness: Having an standarized way to manage infrastructure across cloud providers and automation to streamline operations, Kubernetes helps reducing the infrastructure and operational costs.

    What is a Kubernetes Operator?

    Kubernetes has been designed with flexibility in mind, allowing developers to extend its capabilities through custom resources and operators.

    In particular, MariaDB Enterprise Kubernetes Operator, watches the desired state defined by users via MariaDB and MaxScale resources, and takes actions to ensure that the actual state of the system matches the desired state. This includes managing compute, storage and network resources, as well as the full lifecycle of the MariaDB and MaxScale instances. Whenever the desired state changes or the underlying infrastructure is modified, the Operator takes the necessary actions to reconcile the actual state with the desired state.

    Operational expertise is baked into the MariaDB and MaxScale APIs and seamlessly managed by the Operator. This includes automated backups, restores, upgrades, monitoring, and other critical lifecycle tasks, ensuring reliability in Day 2 operations.

    MariaDB Enterprise Kubernetes Operator Features

    • Provision and Configure MariaDB and MaxScale Declaratively: Define MariaDB Enterprise Server and MaxScale clusters in YAML manifests and deploy them with ease in Kubernetes.

    • Multiple Highly Available Topologies supported:

      • Asynchronous Replication

      • Synchronous Multi-Master with Galera

      • as a Database proxy to load balance requests and perform failover/switchover operations.

    • Cluster-Aware Rolling Updates: Perform rolling updates on MariaDB and MaxScale clusters, ensuring zero-downtime upgrades with no disruptions to your applications.

    • Flexible Storage Configuration and Volume Expansion: Easily configure storage for MariaDB instances, including the ability to expand volumes as needed.

    • Physical Backups based on and . By leveraging the feature, backups are taken without long read locks or service interruptions.

    • Logical Backups based on .

    • Backup Management: Take, restore, and schedule backups with multiple storage types supported: S3, PVCs, Kubernetes volumes and VolumeSnapshots..

    • Policy-Driven Backup Retention: Implement backup retention policies with bzip2 and gzip compression.

    • Target Recovery Time: Restore your database to the closest available backup based on a specified recovery time.

    • Bootstrap New Instances: Initialize new MariaDB instances from backups, S3, PVCs or VolumeSnapshots to quickly spin up new clusters.

    • TLS Certificate Management: Issue, configure, and rotate TLS certificates and Certificate Authorities (CAs) for secure connections.

    • Advanced TLS Support: customize certificate lifetime, private key algorithm and TLS version.

    • Native Integration with cert-manager: Leverage , the de-facto standard for managing certificates in Kubernetes, to enable issuance with private CAs, public CAs and HashiCorp Vault.

    • Prometheus Metrics: Expose metrics using the MariaDB and MaxScale Prometheus exporters.

    • Native Integration with prometheus-operator: Leverage to scrape metrics from MariaDB and MaxScale instances.

    • Declarative User and Database Management: Manage users, grants, and logical databases in a declarative manner using Kubernetes resources.

    • Secure, immutable and lightweight images based on Red Hat UBI, available for multiple architectires (amd64, arm64 and ppc64le).

    • by Red Hat.

    NAME Column

    This column displays the logical names of your databases and the individual server nodes within each topology. It also contains important status and quick-access icons.

    Status Icons

    Icon
    Applies To
    Meaning

    🟢 Green

    Aggregated Topology, Server, MaxScale

    The component and all its members are running correctly.

    🔴 Red

    Aggregated Topology, Server, MaxScale

    One or more members in the topology are down or not functioning properly.

    ⚫ Gray

    Server

    The server's status is unknown. This typically happens if the MaxScale node managing it is down.

    Quick-Access Icons

    This icon () is a shortcut that takes you directly to the detailed Grafana monitoring dashboard for that specific node or topology.

    TYPE Column

    This column shows the role of each node as automatically detected by Enterprise Manager (e.g., Primary, Replica, MaxScale, Galera Node, Standalone Server).

    If this column shows '-', it indicates an issue. For instance, in a Primary/Replica topology, a server expected to be a Replica that shows '-' is likely not replicating correctly from the primary.

    LAST METRIC AGE Column

    This column shows the time elapsed since the agent on that node last reported metrics.

    If the age is 5 minutes or greater, it indicates a problem. Verify that the mema-agent is installed, running, and can communicate with the Enterprise Manager server on that host.

    Interacting with Your Databases

    You can perform actions on your databases and nodes using the three-dot menu (⋮) on the far right of each row.

    1

    Accessing the MaxScale GUI

    • Click the three-dot menu (⋮) next to a MaxScale node.

    • Select "Manage MaxScale".

    2

    Configuring SSO in maxscale.cnf

    To enable SSO, add the following parameters to your MaxScale configuration file (maxscale.cnf) on the MaxScale host:

    Parameter
    The Enterprise Manager installation generates a self-signed TLS certificate and key for immediate use. For production environments, you should use your own custom certificates.
    1

    Place custom certificates

    Copy your custom certificate and private key files into the enterprise-manager/certs/ directory on the host machine.

    2

    Update the configuration

    Open the enterprise-manager/.env file and modify the MEMA_TLS_CERTPATH and MEMA_TLS_KEYPATH variables to point to your new files.

    Example: if your files are my-host.crt and my-host.key, your configuration should be:

    The path you provide must begin with /certs/. This is because the host's certs/ directory is mounted inside the Docker containers at the /certs path.

    3

    Restart Enterprise Manager

    To apply the changes, restart the services:

    Enabling the Audit Log

    The audit log records all REST API requests made to MariaDB Enterprise Manager, providing a clear trail of administrative actions for security and compliance.

    1

    Step: Navigate to the directory

    Open a terminal and change into your MariaDB Enterprise Manager installation directory.

    2

    Step: Edit the .env file

    Open the environment file using a text editor.

    3

    Step: Update the audit log variable

    Inside the editor, locate the line for the audit API setting.

    • Find this line:

    4

    Step: Save and exit

    Save the changes and exit the editor.

    5

    Step: Restart Enterprise Manager

    The change requires a restart to take effect.

    Configuring Secure Connections

    Agent to Enterprise Manager Connections

    The connection from the mema-agent to the Enterprise Manager server is secured using HTTPS.

    • To enable encryption: ensure the URL provided in the agent setup command uses https://.

    • To bypass certificate checks: if you are using a self-signed or non-trusted TLS certificate on the Enterprise Manager server, you can add the --otlp-insecure flag to the agent setup command. This is recommended only for testing environments.

    Enterprise Manager to Monitored Databases

    You can configure secure TLS connections from Enterprise Manager to your monitored MariaDB Servers and MaxScale instances when you first add them.

    In the "Add Database" page:

    1. Toggle the SSL/TLS option to ON.

    2. To validate the server's certificate against your Certificate Authority (CA), provide the path to your CA file in the Certificate Authority field. The file must be located in the enterprise-manager/certs/ directory and the path must begin with /certs/.

    3. Check Verify peer certificate to enable validation.

    4. (Optional) Check Verify peer host to ensure the server's hostname matches the certificate.

    5. If the database requires client-side certificates for authentication, provide the paths to your client certificate and key in the Certificate and Key fields, respectively. These files must also be in the enterprise-manager/certs/ directory.

    All certificate and key files referenced for server validation or client authentication must be placed in the enterprise-manager/certs/ directory on the host and referenced with a path beginning with /certs/.

    User Management
    Description

    Node Uptime

    Shows the total amount of time the server node has been running since its last restart.

    Topology Info

    Displays the node's current role or state within its database topology (e.g., Primary, Replica).

    Node Allocatable Capacity

    Details the compute resources allocated to the node, such as the number of CPU cores available.

    Node Disk Capacity

    Shows the total size of the key mounted filesystems, such as /boot and /home.

    OS Info

    Provides details about the node's OS, including architecture, distribution (e.g., CentOS Stream 9), and kernel release.

    Node System Information

    Tracks memory usage, CPU performance, system load, and resource consumption at the process level.

    Metric
    Description

    Memory Usage

    Percentage of physical memory in use.

    CPU

    Graph showing CPU usage distribution across user, system, idle, iowait, and kernel.

    Memory Stack

    Breakdown of memory allocation: applications, cache, buffers, swap, etc.

    Network Traffic

    Inbound and outbound network throughput per interface.

    CPU Utilisation

    Effective CPU usage and number of cores for the node.

    System Load

    Load averages for the last 1, 5, and 15 minutes.

    Filesystem Section

    Monitors disk performance and utilization for the node’s storage devices.

    Metric
    Description

    Disk Throughput

    Read and write throughput (bytes per second) per device.

    Disk IOPS

    Number of input/output operations per second for reads and writes.

    Disk Utilisation

    Percentage of time that disk devices are busy handling I/O requests.

    Navigate to the Customer Download Token at the MariaDB Customer Portal.
  • Log in using your MariaDB ID.

  • Copy the Customer Download Token to use as the password when logging in to the MariaDB Enterprise Docker Registry.

  • Then, configure a Kubernetes kubernetes.io/dockerconfigjson Secret to authenticate:

    Openshift

    If you are running in Openshift, it is recommended to use the global pull secret to configure customer credentials. The global pull secret is automatically used by all Pods in the cluster, without having to specify imagePullSecrets explicitly.

    To configure the global pull secret, you can use the following commands:

    • Extract your Openshift global pull secret:

    • Login in the MariaDB registry providing the customer download token as password:

    • Update the global pull secret:

    Alternatively, you can also create a dedicated Secret for authenticating:

    MariaDB

    In order to configure access to docker.mariadb.com in your MariaDB resources, you can use the imagePullSecrets field to specify your customer credentials:

    As a result, the Pods created as part of the reconciliation process will have the imagePullSecrets.

    MaxScale

    Similarly to MariaDB, you are able to configure access to docker.mariadb.com in your MaxScale resources:

    Backup, Restore and SqlJob

    The batch Job resources will inherit the imagePullSecrets from the referred MariaDB, as they also make use of its image. However, you are also able to provide dedicated imagePullSecrets for these resources:

    When the resources from the previous examples are created, a Job with both mariadb-enterprise and backup-registry imagePullSecrets will be reconciled.

    Was the agent installed successfully?

    The agent installation can be done with the native package manager for your OS.

    # For Red Hat/CentOS/Rocky
    sudo dnf install -y mema-agent
    
    # For Debian/Ubuntu
    sudo apt install -y mema-agent
    Did the agent setup complete successfully without errors?

    The mema-agent setup command should produce no errors if it is successful. You can always run the setup again by generating the installation command from the GUI and then executing it again on the target server.

    Did the setup fail on a MariaDB node?

    Make sure that MariaDB is listening on the loopback adapter address. If MariaDB cannot be accessed on port 3306 on localhost, the setup command should define the port with --mariadb-port and the host with --mariadb-host. To use a UNIX domain socket, use --mariadb-socket instead.

    Did the setup fail on a MaxScale node?

    Make sure that the --maxscale-host uses the correct protocol. If MaxScale REST-API is configured to use HTTPS use --maxscale-host=https://127.0.0.1:8989. If the TLS certificates used in the MaxScale REST-API are self-signed, you can disable TLS certificate verification by adding the --maxscale-insecure option to the setup command.

    Did the agent processes start up successfully?

    The agent processes run as systemd services. Use normal systemd commands to inspect the state of the agent.

    Show the agent status

    Show status
    sudo systemctl status mema-agent.slice

    If the agent didn't start, errors will be shown in the status output. Once errors are fixed, start the agent again.

    Start agent
    sudo systemctl start mema-agent.target

    For a more detailed analysis of errors, inspect the agent logs.

    Show the agent logs

    The agent uses the systemd journal for logging:

    Agent logs
    sudo journalctl -u mema-agent.slice --no-pager
    Can the agent collect MariaDB metrics?

    The credentials that the agent uses to connect to MariaDB require certain grants in order to collect all metrics. Check the Quickstart Guide for the set of grants and verify that the user provided with --mariadb-user has the necessary grants.

    If the MariaDB metrics agent is working correctly, the logs should not have any errors. Check the logs with:

    MariaDB exporter logs
    sudo journalctl -u mema-agent-mariadb-exporter.service

    To verify the MariaDB metrics agent is running, inspect the raw metrics output:

    Raw metrics check
    curl -s http://127.0.0.1:18902/metrics | wc -l

    The output should contain about 3000 lines if everything is working.

    Is MaxScale able to send metrics?

    Make sure that the version of MaxScale you have installed is 25.10 or greater. Older versions do not support sending metrics.

    Any errors in metrics exporting are logged on the info level in MaxScale. To enable info logging, run:

    Info level logging is verbose and may cause large log volumes. Once issues are resolved, disable info logging:

    Can the agent connect to the Enterprise Manager?

    To check connectivity between the agent host and the Enterprise Manager, use curl. If your Enterprise Manager is at 192.168.122.16, the following commands show the expected responses:

    • The first command should report an HTTP-to-HTTPS error.

    • The second command should return 404 page not found.

    If there are errors, check that port 4318 is open on the Enterprise Manager server and that network connectivity between the agent host and the Enterprise Manager is working.

    If the curl commands produce the expected output and the agent status does not report errors after five minutes of startup, the agent is successfully sending metrics to the Enterprise Manager.

    Are the metrics available in the Enterprise Manager?

    To verify metrics are stored in the time series database, query a system OS metric. Example (assumes Enterprise Manager at 192.168.122.16 and default admin:mariadb credentials):

    The result should be a JSON object with one object per node in the data.result array.

    Is the time synchronized between Enterprise Manager and agents?

    When agents push metrics they include the agent’s timestamp and Enterprise Manager assumes those timestamps are accurate. If Enterprise Manager and monitored instances are not time-synchronized, you can observe:

    • Misaligned graphs

    • Missed alerts

    • Dropped/future/old samples that create “no data” gaps

    • Poor alignment with logs/traces/events

    Ensure clocks are synchronized (for example using NTP/chrony) to avoid these issues.

    repository installation instructions
    :
    • The Galera data-plane must be updated to the 25.8.0 version.

    If you want the operator to automatically update the data-plane (i.e. init and agent containers), you can set updateStrategy.autoUpdateDataPlane=true in your MariaDB resources:

    Alternatively, you can also do this manually:

    • Upgrade mariadb-enterprise-operator to 25.8.0:

    • If you previously decided to downscale the operator, make sure you upscale it back:

    • If you previously set updateStratety.autoUpdateDataPlane=true, you may consider reverting the changes once the upgrades have finished:

    helm uninstall mariadb-enterprise-operator
    kubectl scale deployment mariadb-enterprise-operator --replicas=0
    kubectl scale deployment mariadb-enterprise-operator-webhook --replicas=0
    kubectl delete validatingwebhookconfiguration mariadb-enterprise-operator-webhook
    kubectl delete mutatingwebhookconfiguration mariadb-enterprise-operator-webhook
  • Overview and Architecture

  • Installation Guide

  • Configuration

  • Service Management

  • API Reference

    • API Reference

    • Database Integration

    • Access Control

    • Orchestration

    Deployment

    • Deployment Overview

    • Ubuntu Deployment Guide

    • Docker Deployment Guide

    • Technical Architecture

    Performance and Troubleshooting

    • Performance Tuning

    • Troubleshooting

    Reference

    • Environment Variables

    • Supported File Formats

    • Integration

    About MariaDB AI RAG

    MariaDB AI RAG enables organizations to leverage their document repositories and databases for AI-powered search and generation. By combining the reliability of MariaDB with modern AI capabilities, AI RAG provides accurate, context-aware responses based on your organization's proprietary data.

    Key Features

    • Document ingestion and processing

    • Semantic chunking and embedding

    • Vector-based similarity search

    • AI-powered response generation

    • Database integration

    • Fine-grained access control

    • Comprehensive REST API

    For detailed information on each component, please refer to the specific documentation sections.

    Under the scenes, the operator is configuring the StatefulSet's volumeClaimTemplate property, which you are also able to provide yourself:

    Volume resize

    The StorageClass used for volume resizing must define allowVolumeExpansion = true.

    It is possible to resize your storage after having provisioned a MariaDB. We need to distinguish between:

    • PVCs already in use.

    • StatefulSet storage size, which will be used when provisioning new replicas.

    It is important to note that, for the first case, your StorageClass must support volume expansion by declaring the allowVolumeExpansion = true. In such case, it will be safe to expand the storage by increasing the size and setting resizeInUseVolumes = true:

    Depending on your storage provider, this operation might take a while, and you can decide to wait for this operation before the MariaDB becomes ready by setting waitForVolumeResize = true. Operations such as Galera cluster recovery and will not be performed if the MariaDB resource is not ready.

    Ephemeral storage

    Provisioning standalone MariaDB instances with ephemeral storage can be done by setting ephemeral = true:

    This may be useful for multiple use cases, like provisioning ephemeral MariaDBs for the integration tests of your CI.

    Docker Deployment Guide - Container-based deployment configuration

  • Deployment Checklist - Configuration validation checklist

  • Technical Architecture - System architecture and configuration details

  • Configuration File

    MariaDB AI RAG uses a .env configuration file located in the installation directory. A template is provided at config.env.template. Copy this file to .env and modify the parameters according to your environment.

    Database Initialization

    MariaDB AI RAG requires a properly configured database. The system can automatically initialize the database schema during first startup, or you can manually initialize it using the provided SQL script:

    Security Configuration

    Authentication

    MariaDB AI RAG implements JWT-based authentication. Configure the following parameters in your .env file:

    For production environments, it is strongly recommended to use a properly generated secure random string for the SECRET_KEY.

    API Key Management

    External service API keys should be securely stored in the .env file. In production environments, consider using a secure vault solution or environment variable management system.

    Deployment Documentation
    Ubuntu Deployment Guide

    Project

    Displays the currently selected project label.

    Name

    Shows the selected database/topology name.

    Version

    Shows MaxScale version.

    Topology Info

    Count of nodes grouped by type (e.g., server, MaxScale).

    Backend Server States

    Timeline of each backend server’s role and health as seen by each MaxScale. Values are color-mapped to: Read, Write, Up, Down. Use this to spot failovers, read/write role flips, or outages over time.

    Maxscale Uptime by Instance

    Uptime in seconds for each MaxScale instance.

    CPU Utilisation

    Effective CPU usage (%) per instance, excluding idle/iowait/guest time.

    Memory Usage

    Working memory in use (%) per instance (total minus free/buffers/cache/slab).

    Network Traffic

    Per-interface throughput (bits/s). Transmit is plotted below the axis (negative-Y), receive above—making direction easy to read.

    MaxScale Processing Load

    Percentage of total CPU time consumed by the MaxScale process over time (a direct view of router load).

    Connections

    Active backend connections per server as observed by MaxScale.

    Operations

    Active operations per backend server (ongoing requests tracked by MaxScale).

    Packets Read/Writes

    Per-server packet read and write rates (packets/s). Useful for spotting uneven load distribution.

    QPS

    Queries per second passing through MaxScale across the selected instances (overall routing throughput).

    Cache Hits vs Misses

    Per-second hits and misses in the Query Classifier cache. Analyze the relationship to assess effectiveness.

    Cache Size

    Current size of the Query Classifier cache (bytes). Monitor growth with Hits/Misses for tuning insights.

    multiple authentication
    TokenReview object
    system:auth-delegator
    TokenReviews
    ServiceAccount based authentication
    how to update the data-plane
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      suspend: true
    {
      "mcpServers": {
        "rag-mcp": {
          "serverUrl": "http://localhost:8002/mcp",
          "headers": {
            "Authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.xyz.abc"
          }
        }
      }
    }

    Export metrics

    MariaDB Enterprise Manager provides two primary methods for exporting metrics, allowing you to integrate with external observability platforms for aggregation or long-term retention.

    1

    Scraping the built-in Prometheus endpoint (Server-to-Server)

    The Prometheus server integrated within MariaDB Enterprise Manager exposes its metrics via a standard federation endpoint. You can configure your own external Prometheus server (or any Prometheus-compatible system) to "scrape" these metrics.

    Identify the Federation Endpoint

    The endpoint is located on your MariaDB Enterprise Manager server at the /prometheus/federate path. The full URL will be:

    https://<Enterprise_Manager_IP>:8090/prometheus/federate

    Configure Your External Prometheus

    In your external Prometheus server's configuration file (prometheus.yml), add a new scrape job to target the Enterprise Manager endpoint.

    After adding this configuration and restarting your external Prometheus, it will begin scraping and storing all metrics from your MariaDB Enterprise Manager instance.

    2

    Pushing metrics with the OpenTelemetry agent (Agent-to-External)

    The mema-agent can be configured to push metrics directly to a third-party monitoring system that supports the OpenTelemetry Protocol (OTLP). This method sends data straight from the agent to your external endpoint, bypassing the built-in Prometheus server.

    To configure this, run the mema-agent setup command on your MariaDB Server or MaxScale host with the appropriate flags.

    ERD Designer

    Enterprise manager provides a visual interface for creating entity relationship diagrams (ERD) and for observing existing database schemas, so you can quickly understand table relationships, identify dependencies, and visually assess the impact of schema changes before implementation.

    This procedure outlines the steps required to access and utilize the ERD Designer within the Workspace section of Enterprise Manager UI.

    1. From the main Workspace screen, click the "Run Queries" card.\

    2. In the "Connect to..." dialog, select your target server, enter your credentials, and click Connect.\

    3. Upon successful connection, the main ERD worksheet will appear.\

    Creating ERD diagram

    1

    Initiate generation

    1. From the ERD Worksheet On ERD Designer worksheet, click Generate ERD

    ERD Worksheet Features

    The core of the designer is a visual canvas where you can build and manage your database structures.

    Model Tables, Indexes, and Relationships

    You can graphically manage all core MariaDB schema objects.

    Create New Tables

    Use the toolbar or right-click on the canvas to add new table entities to your diagram.

    Edit Entities

    Double-click any table to open the Entity Editor at the bottom of the screen.

    Here, you can define and modify columns (including data types and NOT NULL constraints), indexes, and foreign keys through an intuitive interface.

    Draw Foreign Keys

    To create a new relationship, simply click the connection point on a column in one table and drag it to the column it references in another table.

    Auto Layout

    For large or complex schemas, the diagram can become cluttered. Use the Auto Arrange Entities feature, typically found in the top toolbar, to automatically rearrange the tables and relationships into a clean, organized, and easily navigable diagram.

    Working with the ERD Worksheet

    The ERD worksheet provides several tools and shortcuts to streamline your workflow.

    Managing Foreign Keys

    Right-click on a relationship link between two tables to open a context menu with quick actions, such as editing or removing the foreign key, toggling the relationship type (e.g., one-to-one vs. one-to-many), and changing NOT NULL constraints.

    Exporting Your Model

    Once your design is complete, you can export it for documentation or deployment. The export options, found in the toolbar or by right-clicking the canvas, include the following:

    • Export as SQL Script: Generates the CREATE TABLE and ALTER TABLE statements for your entire diagram.

    • Export as JPEG: Creates an image of your diagram for use in presentations or other documents.

    • Copy script to clipboard: A quick way to get the SQL for pasting elsewhere.

    Applying Changes to a Database

    Click the "Apply Script" button (▶) in the toolbar to execute the generated SQL against your connected database. This allows you to deploy your new or modified schema directly from the designer.

    Database Integration

    Database Integration Endpoints

    Ingest from Database Table

    Purpose: Ingests data directly from a MariaDB table or view, treating it as a CSV data source. This allows for seamless integration with existing database content.

    Request body:

    Response:

    Usage Example: Use this endpoint to ingest structured data from your database tables or views. The system will process each row as a document, with specified columns as content and metadata.

    Ingest from SQL Query

    Purpose: Executes a SELECT query and ingests the results as a CSV document. The query results are stored as a document that can be chunked and searched. This provides a way to make database query results searchable via RAG.

    Request body:

    Request Parameters:

    • sql_query (required): A SELECT query to execute (only SELECT queries are allowed)

    • role (optional): Database role to use for query execution (default: from DEFAULT_SQL_ROLE environment variable)

    • document_name (optional): Name for the generated CSV document (default: "query_results")

    Security Notes:

    • Only SELECT queries are allowed (enforced by regex validation)

    • Multiple statements are not allowed (no semicolons outside of quoted strings)

    • User must have permission to use the specified role

    • Query is executed using MariaDB's role-based access control

    Response:

    Usage Example: Query database and ingest results for RAG search.

    Note: The query results are converted to CSV format and stored as a document. You can then chunk this document using the chunking endpoints to make the data searchable.

    Check Database Ingestion Status

    Purpose: Checks the status of a database ingestion job.

    Response:

    Usage Example: Use this endpoint to monitor the progress of database ingestion jobs.

    Deployment

    This section provides comprehensive guides for deploying the MariaDB AI RAG system in various environments.

    Documentation in This Section

    Deployment Overview

    High-level overview of deployment options and considerations:

    • Deployment architecture options

    • System requirements

    • Prerequisites

    • Security considerations

    Step-by-step guide for deploying on Ubuntu/Debian systems:

    • Installing the .deb package

    • System configuration

    • Service setup

    • Database initialization

    Complete guide for Docker-based deployments:

    • Docker image setup

    • Docker Compose configuration

    • Container orchestration

    • Volume management

    Detailed technical architecture documentation:

    • System components and interactions

    • Data flow diagrams

    • Database schema

    • API architecture

    Pre-deployment and post-deployment checklists:

    • Pre-deployment verification

    • Configuration validation

    • Security hardening steps

    • Performance optimization

    Quick Deployment Paths

    For Development/Testing

    1. Use for quick setup

    2. Configure minimal settings (database, API keys)

    3. Start services with docker-compose

    4. Verify with health checks

    For Production

    1. Review for architecture planning

    2. Follow platform-specific guide ( or )

    3. Complete

    4. Configure monitoring and backups

    Deployment Best Practices

    Security

    • Use strong JWT secrets and API keys

    • Enable HTTPS/TLS for production

    • Implement network security (firewalls, VPNs)

    • Regular security updates

    Performance

    • Allocate sufficient resources (CPU, RAM, storage)

    • Configure connection pooling appropriately

    • Use SSD storage for database

    • Enable caching where appropriate

    Reliability

    • Set up automated backups

    • Configure health checks

    • Implement logging and monitoring

    • Plan for disaster recovery

    Scalability

    • Design for horizontal scaling

    • Use load balancers for high availability

    • Separate database and API servers

    • Consider read replicas for database

    Related Documentation

    • - Detailed configuration options

    • - Managing services

    • - Optimization

    • - Common issues

    Architecture

    The MariaDB MCP (Model Context Protocol) Server is a modular, multi-layered system designed to provide secure, scalable, and extensible AI-powered tools and services. Its architecture is centered around a primary gateway (MCP Server), an optional specialized microservice for Retrieval-Augmented Generation (RAG API), and a Shared MariaDB Database that serves as the single source of truth for all components.

    This design prioritizes security through multi-layered token validation and promotes flexibility with an adaptive tool registration system, allowing services to be enabled or disabled dynamically.

    Architectural Diagram

    The following diagram illustrates the flow of a request from a client application through the various components of the MCP ecosystem.

    Component Breakdown

    Client Applications

    These are the consumers of the MCP Server's services. They are responsible for acquiring a JWT Bearer Token and including it in the Authorization header of every request.

    • Examples: AI assistants, custom applications using the REST API, and dedicated MCP clients.

    MCP Server (Port 8002)

    The MCP Server acts as the primary gateway and orchestrator. All client requests must pass through it. It performs two critical functions:

    Token Extraction & Validation

    This is the first layer of security. The MCP Server validates the identity and legitimacy of every incoming request through a three-step process:

    1. Extract Token: It retrieves the JWT from the Authorization header.

    2. Verify Signature: It cryptographically verifies the token's signature to ensure it hasn't been tampered with.

    3. Validate User: It queries the Users table in the shared database to confirm the user exists and is active.

    Adaptive Tool Registration

    A key feature of the MCP Server is its ability to dynamically adjust the tools it offers based on the availability of dependent services.

    • Core, Database, & Vector Tools: These are foundational toolsets and are always registered and available.

    • RAG Tools: These tools, which rely on the RAG API, are only registered if the MCP Server can successfully connect to the RAG API. This makes the RAG component an optional, plug-in extension.

    RAG API (Port 8000)

    This is a specialized microservice designed for complex, knowledge-based tasks using the Retrieval-Augmented Generation pattern. It operates as a distinct service that the MCP Server communicates with.

    Authentication & Authorization

    The RAG API implements a second, more granular layer of security. After receiving a forwarded request from the MCP Server, it re-verifies the JWT and performs deeper authorization checks:

    • Verify JWT Token: Ensures the token is still valid.

    • Check User Roles: Examines the user's roles and permissions to determine if they are authorized to perform the requested RAG operation.

    • Enforce Permissions: Applies access control rules, for example, restricting document access based on ownership or group membership.

    RAG Pipeline

    This is the core logic of the RAG API. It transforms a user's query into a knowledge-rich response.

    1. Document Ingestion: The process of adding new documents to the knowledge base.

    2. Vector Embedding: Documents are converted into numerical representations (vectors) and stored in the Vector Store within the MariaDB database.

    3. Retrieval: When a query is received, the API searches the Vector Store to find the most semantically relevant document chunks.

    Shared MariaDB Database

    The database is the foundation of the entire architecture, providing a single, consistent source of data for all services.

    • Users: Stores user credentials, roles, and metadata required for authentication and authorization across both the MCP Server and RAG API.

    • Documents: Contains the raw content (e.g., text, metadata) that the RAG pipeline uses for retrieval.

    • Vector Store: A dedicated table or set of tables within MariaDB that stores the vector embeddings of the documents, enabling efficient similarity searches.

    Request and Data Flow

    1. Request Initiation: A client application sends a request to the MCP Server (:8002) with a JWT in the Authorization header.

    2. MCP Server Authentication: The MCP Server validates the JWT against the shared database. If invalid, the request is rejected with a 401 Unauthorized error.

    3. Tool Dispatching: The server identifies that the request requires a RAG tool. It's checks if the RAG API is available.

    This architecture ensures a clear separation of concerns, enhances security with multiple checkpoints, and provides a highly extensible platform for building advanced AI tools.

    Migrate Community operator to Enterprise operator

    In this guide, we will be migrating from the MariaDB Community Operator to the MariaDB Enterprise Kubernetes Operator without downtime. This guide assumes:

    • 0.37.1 version of the MariaDB Community Operator is installed in the cluster.

    • MariaDB community resources will be migrated to its counterpart MariaDB enterprise resource. In this case, we will be using 11.4.4 version, which is supported in both community and enterprise versions. Check the supported MariaDB Enterprise images and migrate to a counterpart community version first if needed.

    • MaxScale resources cannot be migrated in a similar way, they need to be recreated. To avoid downtime, temporarily point your applications to MariaDB directly during the migration.

    1. Install the Enterprise CRDs as described in the .

    2. Get the and grant execute permissions:

    3. Migrate MariaDB resources using the migration script. Make sure you set <mariadb-name> with the name of the MariaDB resource to be migrated and <operator-version> with the version of the Enterprise operator you will be installing:

    4. Update the apiVersion of the rest of CRs to enterprise.mariadb.com/v1alpha1.

    5. Uninstall the Community operator:

    6. If your MariaDB Community had Galera enabled, delete the <mariadb-name> Role, as it will be specyfing the Community CRDs:

    7. Install the Enterprise operator as described in the . This will trigger a rolling upgrade, make sure it finishes successfully before proceeding with the next step.

    8. Delete the finalizers and uninstall the Community CRDs:

    9. Run mariadb-upgrade in all Pods. Make sure you set <mariadb-name> with the name of the MariaDB resource:

    10. Restart the Enterprise operator:

    User Management

    MariaDB Enterprise Manager uses a Role-Based Access Control (RBAC) system to manage user permissions. This guide explains how to manage users and create custom roles to fit your organization's security needs.

    Accessing User Management

    1

    OpenShift

    This documentation provides guidance on installing the MariaDB Enterprise Kubernetes Operator operator in OpenShift. This operator has been and it is available in the OpenShift console.

    Operators are deployed into OpenShift with the , which facilitates the installation, updates, and overall management of their lifecycle.

    Prerequisites

    Configure your to be able to pull images.

    The recommended way to configure credentials is to use the provided by OpenShift, as described . Alternatively, the operator bundle has a mariadb-enterprise

    Adding Databases

    To install mema-agent, you need to setup

    This guide outlines the two primary methods for registering and monitoring your database topologies in MariaDB Enterprise Manager: adding a standalone server directly or adding a full topology via its MaxScale instance.

    Workspace

    Workspace enhances MariaDB Enterprise Manager by adding query editing, visual schema management, and ERD design. It provides a collaborative environment for DBAs, developers, and analysts.

    Query Editor

    Feature
    Description

    Enabling TLS in existing instances

    In this guide, we will be migrating existing MariaDB Galera and MaxScale instances to without downtime.

    1. Ensure that MariaDB has TLS enabled and not enforced. Set the following options if needed:

    By setting these options, the operator will issue and configure certificates for MariaDB, but TLS will not be enforced in the connections i.e. both TLS and non-TLS connections will be accepted. TLS enforcement will be optionally configured at the end of the migration process.

    This will trigger a rolling upgrade, make sure it finishes successfully before proceeding with the next step. Refer to the for further information about update strategies.

    2. If you are currently using MaxScale

    Authentication

    A cornerstone of the Enterprise edition is its ability to integrate with centralized secret managers, eliminating the need for static credentials stored in local or .env files. The server dynamically fetches database credentials and API keys at startup, ensuring a secure and compliant operational posture.

    Key Features

    • Multi-layered Authentication: JWT-based authentication (HS256/RS256) with bcrypt password hashing

    Overview

    Introduction to MariaDB AI RAG

    MariaDB AI RAG is an enterprise-grade Retrieval-Augmented Generation (RAG) solution that integrates with MariaDB to provide AI-powered document processing, semantic search, and natural language generation capabilities.

    The system enables organizations to leverage their document repositories and databases for AI-powered search and generation. By combining the reliability of MariaDB with modern AI capabilities, AI RAG provides accurate, context-aware responses based on your organization's proprietary data.

    Updates

    By leveraging the automation provided by MariaDB Enterprise Kubernetes Operator, you can declaratively manage large fleets of databases using CRs. This also covers day two operations, such as upgrades, which can be risky when rolling out updates to thousands of instances simultaneously.

    To mitigate this, and to give you full control on the upgrade process, you are able to choose between multiple update strategies described in the following sections.

    Update strategies

    In order to provide you with flexibility for updating MariaDB reliably, this operator supports multiple update strategies:

    Features

    The MariaDB Enterprise MCP Server offers a comprehensive suite of tools, categorized into standard database operations, advanced vector functionalities, and workflow orchestration.

    Standard Database Operations

    These tools provide fundamental control and insight into your MariaDB environment. By default, operations are read-only (MCP_READ_ONLY = true) but can be configured for write access (MCP_READ_ONLY = false).

    wget https://dlm.mariadb.com/<Customer_Download_Token>/enterprise-release-helpers/install-enterprise-manager.sh
    chmod +x install-enterprise-manager.sh
    ./install-enterprise-manager.sh
    sudo yum install -y mema-agent
    CREATE USER 'monitor'@'localhost' IDENTIFIED BY '<password>';
    GRANT PROCESS, BINLOG MONITOR, REPLICA MONITOR, REPLICATION MASTER ADMIN ON *.* TO 'monitor'@'localhost';
    sudo yum install -y mema-agent
    sudo apt install -y mema-agent
    CREATE USER 'monitor'@'localhost' IDENTIFIED BY '<password>';
    GRANT PROCESS, BINLOG MONITOR, REPLICA MONITOR, REPLICATION MASTER ADMIN ON *.* TO 'monitor'@'localhost';
    sudo apt install -y mema-agent
    Restore backup to all volumes
    # Clear out any existing data first
    docker run --rm --volumes-from enterprise-manager-grafana -v $(pwd)/backups/:/backups/ alpine:latest find /var/lib/grafana/ -delete -mindepth 1
    docker run --rm --volumes-from enterprise-manager-prometheus -v $(pwd)/backups/:/backups/ alpine:latest find /prometheus/ -delete -mindepth 1
    docker run --rm --volumes-from enterprise-manager-supermax -v $(pwd)/backups/:/backups/ alpine:latest find /var/lib/supermax/ -delete -mindepth 1
    
    # Restore the data from the backups
    docker run --rm --volumes-from enterprise-manager-grafana -v $(pwd)/backups/:/backups/ alpine:latest tar -C / -xzf /backups/grafana-backup.tar.gz
    docker run --rm --volumes-from enterprise-manager-prometheus -v $(pwd)/backups/:/backups/ alpine:latest tar -C / -xzf /backups/prometheus-backup.tar.gz
    docker run --rm --volumes-from enterprise-manager-supermax -v $(pwd)/backups/:/backups/ alpine:latest tar -C / -xzf /backups/supermax-backup.tar.gz
    # .env location
    cd enterprise-manager/
    vim .env
    # Set retention to 90 days
    PROMETHEUS_RETENTION_TIME=90d
    # Set retention to 52 weeks (one year)
    PROMETHEUS_RETENTION_TIME=52w
    # Restart services
    docker compose up -d
    apiVersion: v1
    kind: Secret
    metadata:
      name: mariadb
    stringData:
      password: MariaDB11!
    kubectl apply -f secret.yaml
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      rootPasswordSecretKeyRef:
        name: mariadb
        key: password
      imagePullSecrets:
      -  name: mariadb-enterprise
      maxScaleRef:
        name: maxscale-galera
      username: mariadb
      passwordSecretKeyRef:
        name: mariadb
        key: password
      database: mariadb
      storage:
        size: 1Gi
      replicas: 3
      galera:
        enabled: true
    kubectl apply -f mariadb-galera.yaml
    ❯ kubectl get pods
    NAME                                                           READY   STATUS    RESTARTS      AGE
    mariadb-galera-0                                               2/2     Running   0             101s
    mariadb-galera-1                                               2/2     Running   0             101s
    mariadb-galera-2                                               2/2     Running   0             101s
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale-galera
    spec:
      imagePullSecrets:
       -  name: mariadb-enterprise
      mariaDbRef:
        name: mariadb-galera
      replicas: 2
    kubectl apply -f maxscale-galera.yaml
    ❯ kubectl get pods
    mariadb-galera-0                                               2/2     Running   0             10m
    mariadb-galera-1                                               2/2     Running   0             10m
    mariadb-galera-2                                               2/2     Running   0             10m
    maxscale-galera-0                                              1/1     Running   0             81s
    maxscale-galera-1                                              1/1     Running   0             81s
    
    ❯ kubectl get maxscale
    NAME              READY   STATUS    PRIMARY            AGE
    maxscale-galera   True    Running   mariadb-galera-0   65s
    
    ❯ kubectl get mariadb
    NAME             READY   STATUS    PRIMARY            UPDATES                    AGE
    mariadb-galera   True    Running   mariadb-galera-0   ReplicasFirstPrimaryLast   10m
    ❯ kubectl run mariadb-connect --rm -it --image=docker.mariadb.com/enterprise-server:11.4 -- bash -c "mariadb -u mariadb -p'MariaDB11!' --ssl=false -h maxscale-galera"
    If you don't see a command prompt, try pressing enter.
    MariaDB [(none)]> SHOW DATABASES;
    +--------------------+
    | Database           |
    +--------------------+
    | information_schema |
    | mariadb            |
    +--------------------+
    2 rows in set (0.001 sec)
    curl http://localhost:8000/health
    curl -X POST "http://localhost:8000/token" \
      -H "Content-Type: application/x-www-form-urlencoded" \
      -d "username=user@example.com&password=your_password"
    curl -X GET "http://localhost:8000/documents" \
      -H "Authorization: Bearer YOUR_TOKEN"
    http://localhost:8000
    # Login
    docker login docker.mariadb.com
    # Download installer
    wget https://dlm.mariadb.com/<Customer_Download_Token>/enterprise-release-helpers/install-enterprise-manager.sh
    # Save images and archive
    cd enterprise-manager
    docker compose images | awk 'p{print $2 ":" $3} {p=1}' | xargs docker image save -o images.tar
    cd ..
    tar -czvf enterprise-manager.tar.gz enterprise-manager
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      inheritMetadata:
        labels:
          database.myorg.io: mariadb
        annotations:
          database.myorg.io: mariadb
    apiVersion: v1
    kind: Service
    metadata:
      annotations:
        database.myorg.io: mariadb
      labels:
        database.myorg.io: mariadb
      name: mariadb-galera-primary
    apiVersion: v1
    kind: Pod
    metadata:
      annotations:
        database.myorg.io: mariadb
      labels:
        database.myorg.io: mariadb
      name: mariadb-galera-0
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: Backup
    metadata:
      name: backup
    spec:
      inheritMetadata:
        labels:
          sidecar.istio.io/inject: "true"
        annotations:
          database.myorg.io: mariadb
      podMetadata:
        labels:
          sidecar.istio.io/inject: "false"
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      service:
        type: LoadBalancer
        metadata:
          annotations:
            metallb.universe.tf/loadBalancerIPs: 172.18.0.150
    
      primaryService:
        type: LoadBalancer
        metadata:
          annotations:
            metallb.universe.tf/loadBalancerIPs: 172.18.0.160
    
      secondaryService:
        type: LoadBalancer
        metadata:
          annotations:
            metallb.universe.tf/loadBalancerIPs: 172.18.0.161
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      storage:
        size: 1Gi
        volumeClaimTemplate:
          metadata:
            annotations:
              database.myorg.io: mariadb
            labels:
              database.myorg.io: mariadb
          accessModes:
          - ReadWriteOnce
          resources:
            requests:
              storage: 1Gi
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      service:
        type: LoadBalancer
        metadata:
          annotations:
            metallb.universe.tf/loadBalancerIPs: 172.18.0.150
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: Backup
    metadata:
      name: backup
    spec:
      podMetadata:
        labels:
          sidecar.istio.io/inject: "false"
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: ExternalMariaDB
    metadata:
      name: external-mariadb
    spec:
      host: mariadb.example.com
      port: 3306
      username: root
      passwordSecretKeyRef:
        name: mariadb
        key: password
      connection:
        secretName: external-mariadb
        healthCheck:
          interval: 5s
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: ExternalMariaDB
    metadata:
      name: external-mariadb
    spec:
      host: mariadb.example.com
      port: 3306
      username: root
      passwordSecretKeyRef:
        name: mariadb
        key: password
      tls:
        enabled: true
        clientCertSecretRef:
          name: client-cert-secret
        serverCASecretRef:
          name: ca-cert-secret
      connection:
        secretName: external-mariadb
        healthCheck:
          interval: 5s
          retryInterval: 10s
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: User
    metadata:
      name: user-external
    spec:
      name: user
      mariaDbRef:
        name: external-mariadb
        kind: ExternalMariaDB
      passwordSecretKeyRef:
        name: mariadb
        key: password
      maxUserConnections: 20
      host: "%"
      cleanupPolicy: Delete
      requeueInterval: 10h
      retryInterval: 30s
    cd enterprise-manager/
    mema-agent setup --endpoint=https://<MEM_Address> ...
    kubectl create secret docker-registry mariadb-enterprise \
       --docker-server=docker.mariadb.com \
       --docker-username=<email> \
       --docker-password=<customer-download-token>
    oc extract secret/pull-secret -n openshift-config --confirm
    oc registry login \
      --registry="docker.mariadb.com" \
      --auth-basic="<email>:<customer-download-token>" \
      --to=.dockerconfigjson
    oc set data secret/pull-secret -n openshift-config --from-file=.dockerconfigjson
    oc create secret docker-registry mariadb-enterprise \
       --docker-server=docker.mariadb.com \
       --docker-username=<email> \
       --docker-password=<customer-download-token>
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb
    spec:
      ...
      image: docker.mariadb.com/enterprise-server:11.4.4-2
      imagePullPolicy: IfNotPresent
      imagePullSecrets:
        - name: mariadb-enterprise
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale
    spec:
      ...
      image: docker.mariadb.com/maxscale-enterprise:25.01.1
      imagePullPolicy: IfNotPresent
      imagePullSecrets:
        - name: mariadb-enterprise
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb
    spec:
      ...
      image: docker.mariadb.com/enterprise-server:11.4.4-2
      imagePullPolicy: IfNotPresent
      imagePullSecrets:
        - name: mariadb-enterprise
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: Backup
    metadata:
      name: backup
    spec:
      ...
      mariaDbRef:
        name: mariadb
      imagePullSecrets:
        - name: backup-registry
    Enable MaxScale info logging
    maxctrl alter maxscale log_info=true
    Disable MaxScale info logging
    maxctrl alter maxscale log_info=false
    Expected curl checks
    $ curl http://192.168.122.16:4318
    Client sent an HTTP request to an HTTPS server.
    
    $ curl -k https://192.168.122.16:4318
    404 page not found
    Query metric
    curl -u admin:mariadb -k "https://192.168.122.16:8090/prometheus/api/v1/query?query=node_os_info"
    helm repo update mariadb-enterprise-operator
    helm upgrade --install mariadb-enterprise-operator-crds  mariadb-enterprise-operator/mariadb-enterprise-operator-crds --version 25.8.0
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      updateStrategy:
    +   autoUpdateDataPlane: true
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb
    spec:
      galera:
        agent:
    -      image: docker.mariadb.com/mariadb-enterprise-operator:1.0.0
    +      image: docker.mariadb.com/mariadb-enterprise-operator:25.8.0
        initContainer:
    -      image: docker.mariadb.com/mariadb-enterprise-operator:1.0.0
    +      image: docker.mariadb.com/mariadb-enterprise-operator:25.8.0
    helm repo update mariadb-enterprise-operator
    helm upgrade --install mariadb-enterprise-operator mariadb-enterprise-operator/mariadb-enterprise-operator --version 25.8.0 
    kubectl scale deployment mariadb-enterprise-operator --replicas=1
    kubectl scale deployment mariadb-enterprise-operator-webhook --replicas=1
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      updateStrategy:
    +   autoUpdateDataPlane: false
    -   autoUpdateDataPlane: true
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      ...
      storage:
        size: 1Gi
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      ...
      storage:
        size: 1Gi
        storageClassName: gp3
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      ...
      storage:
        size: 1Gi
        storageClassName: gp3
        volumeClaimTemplate:
          accessModes:
          - ReadWriteOnce
          resources:
            requests:
              storage: 1Gi
          storageClassName: gp3
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      ...
      storage:
        size: 2Gi
        resizeInUseVolumes: true
        waitForVolumeResize: true
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      ...
      storage:
        ephemeral: true
    # Database Configuration (Required)
    DB_HOST=localhost
    DB_PORT=3306
    DB_USER=your_mysql_username
    DB_PASSWORD=your_mysql_password
    DB_NAME=rag_db
    
    # Authentication (Required)
    SECRET_KEY=your_secret_key_here_generate_a_secure_random_string
    
    # Embedding Configuration (Required)
    EMBEDDING_PROVIDER=openai
    EMBEDDING_MODEL=text-embedding-3-small
    
    # API Keys (Set based on your embedding/LLM provider)
    OPENAI_API_KEY=your_openai_api_key
    GEMINI_API_KEY=your_gemini_api_key
    VOYAGE_API_KEY=your_voyage_api_key
    COHERE_API_KEY=your_cohere_api_key
    mysql -u username -p database_name < init-db.sql
    SECRET_KEY=your_secure_random_string
    ACCESS_TOKEN_EXPIRE_MINUTES=60
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-repl
    spec:
      replication:
        agent:
          kubernetesAuth:
            enabled: true
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-repl
    spec:
      replication:
        agent:
          basicAuth:
            enabled: true
    kubectl get mariadbs
    NAME             READY   STATUS      PRIMARY           UPDATES                   AGE
    mariadb-galera   True    Suspended   mariadb-galera-0  ReplicasFirstPrimaryLast  12m
    POST /documents/ingest-from-table
    Web Origins: https://<Your_Enterprise_Manager_Address>:8090

    Client ID: The unique ID for the Enterprise Manager application.

  • Client Secret: The secret key for the Enterprise Manager application.

  • Authentication Flow: Choose the OIDC flow. auto is the default and recommended for most providers.

  • Client ID: The Client ID you obtained from your provider.

  • Client Secret: The Client Secret you obtained from your provider.

  • enterprise-manager-nginx
  • enterprise-manager-otelcol

  • enterprise-manager-prometheus

  • enterprise-manager-supermax

  • Description

    admin_oidc_url

    URL for Enterprise Manager server that includes hostname or IP address and port.

    admin_host

    Must be set to 0.0.0.0 to allow external connections from Enterprise Manager.

    admin_oidc_client_id

    Default credentials used by Enterprise Manager to request the access token.

    admin_oidc_client_secret

    Default credentials used by Enterprise Manager to request the access token.

    admin_oidc_ssl_insecure

    Skip TLS certificate verification in case certificates aren't configured

    Change it to:

    Command examples

    • For a MariaDB Server host:

    • For a MaxScale host:

    Flag descriptions

    Flag
    Description

    --endpoint

    The address of your external OTLP-compatible monitoring system.

    --otlp-port

    The port on the external system that accepts OTLP data.

    --cluster-name

    An informational name for the cluster this host belongs to.

    --host-name

    An informational name for this specific host.

    --mariadb-user

    The database user for scraping MariaDB Server metrics.

    --mariadb-password

    The password for the MariaDB user.

    For a full list of all available flags and their descriptions, run mema-agent help setup on the host where the agent is installed.

    From the Query Editor In the Query Editor, right-click on a schema name in the Schemas Sidebar and select the "Generate ERD" option.

    2

    Select schema, and tables

    A dialog will appear. Choose the specific schema you want to visualize. You may select which tables within that schema to include in the diagram.

    3

    Visualize

    Click the Visualize button to generate and display the ERD on the worksheet canvas.

    Scalability planning
    Production deployment best practices
    Network configuration
  • Multi-container deployments

  • Security architecture
  • Performance considerations

  • Monitoring setup
  • Backup and recovery planning

  • Review Technical Architecture for optimization

    Secure database credentials
    Monitor resource usage
    Test failover procedures
    Monitor and plan capacity
    Ubuntu Deployment Guide
    Docker Deployment Guide
    Technical Architecture
    Deployment Checklist
    Docker Deployment
    Deployment Overview
    Ubuntu
    Docker
    Deployment Checklist
    Configuration Guide
    Service Management
    Performance Tuning
    Troubleshooting

    Generation: The retrieved chunks are combined with the original query and fed to a language model to generate a comprehensive, context-aware answer.

    Request Forwarding: The MCP Server forwards the original request, including the JWT, to the RAG API (:8000).

  • RAG API Authorization: The RAG API performs its own validation of the JWT and checks the user's permissions for the requested action. If unauthorized, it returns an error.

  • RAG Pipeline Execution: The RAG API executes its pipeline, querying the Documents and Vector Store tables in the MariaDB database to retrieve relevant context.

  • Response Generation: The RAG API generates a final response.

  • Response Relay: The response is sent back to the MCP Server, which in turn relays it to the client application.

  • Open Settings

    Click the Settings icon (⚙️) in the left navigation bar.

    2

    Open User Management

    Select User management.

    Permissions, Roles & Users

    In MariaDB Enterprise Manager, permissions, roles, and users are organized in a clear structure:

    • Permissions define specific actions a user can perform (viewing data, editing settings, accessing the SQL editor).

    • Roles are collections of one or more permissions grouped together. They can be pre-configured (for example admin, monitoring-admin, viewer) or custom-defined.

    • Users are assigned one or more roles and inherit the associated permissions.

    This structure allows administrators to manage access by assigning roles to users rather than setting individual permissions per user.

    The Admin Permission

    Access to the User Management page is restricted based on a user's assigned permissions.

    • ✅ Only users with admin permissions (assigned via a role) can add, modify, or remove other users and roles.

    • ❌ Non-admin users cannot access or change these settings, but they can update their own password via their Profile page.\

    Default Roles

    Enterprise Manager ships with three pre-configured roles:

    • admin: Has all permissions. Can do everything, including managing other users.

    • monitoring-admin: Can manage databases and monitoring, but cannot manage users or roles.

    • viewer: Has read-only access to monitoring data and can use the Workspace.

    Create custom roles instead of editing pre-configured ones

    While it's possible to edit or delete the pre-configured roles (admin, viewer, etc.), the recommended best practice is to create a new custom role to fit your specific permission requirements.

    Leaving the pre-configured roles unmodified ensures you always have a known, baseline configuration to reference or fall back on.

    Roles (pre-configured or custom) are built from combinations of the following base permissions:

    Base Permission in MariaDB Enterprise Manager

    Permission
    Description

    admin

    Can view and manage all users and roles.

    edit

    Can manage databases and monitoring settings. Requires the view permission to be selected as well.

    view

    Can view dashboards and monitoring data.

    sql

    Can access the Query Editor and ERD tools in the Workspace. Enabling this allows you to set a query row limit for the role.

    Managing Roles

    Only users with the admin permission can create or modify roles.

    Creating a Custom Role

    1

    Roles tab

    From the User Management page, select the Roles tab.

    2

    Add role

    Click the Add button.

    3

    Name role

    Enter a name for your new role (e.g., "Developer" or "Auditor").

    4

    Select base permissions

    Select the checkboxes for the Base Permissions you want to grant.

    5

    Confirm

    Click Add.

    Modifying or Deleting a Role

    1

    Locate role

    From the Roles tab, locate the custom role you wish to change.

    2

    Open role menu

    Click the three-dot menu (⋮) on the right side of the role's row.

    3

    Choose action

    Select one of the following options:

    • Update: Opens the "Edit Role" dialog where you can change the role's name or its assigned permissions.

    Managing Users

    Adding a User

    1

    Users tab

    From the User Management page, ensure you are on the Users tab.

    Users tab show the list of User associated with your Enterprise Manager instance.

    The User you're logged in with to Enterprise Manager is shown in bold.

    2

    Add user

    Click the Add button.

    3

    Enter credentials

    Enter a unique Username and a secure Password.

    4

    Assign role

    Select a Role for the user from the dropdown menu.

    5

    Confirm

    Click Add.

    Modifying or Deleting a User

    1

    Locate user

    From the Users tab, locate the user you wish to change.

    2

    Open user menu

    Click the three-dot menu (⋮) on the right side of the user's row.

    3

    Choose action

    Select one of the following options:

    • Update: Opens the "Edit User" dialog where you can change the user's assigned role or update their password.

    The Default Admin User

    Upon installation of MariaDB Enterprise Manager, a default admin user is created with an automatically generated password.

    imagePullSecret
    configured by default. This means that you can configure a
    Secret
    named
    mariadb-enterprise
    in same namespace where the operator will be installed in order to pull images from the MariaDB Enterprise registry.

    PackageManifest

    You can install the certified operator in OpenShift clusters that have the mariadb-enterprise-operator packagemanifest available. In order to check this, run the following command:

    SecurityContextConstraints

    Both the operator and the operand Pods run with the restricted-v2 SecurityContextConstraint, the most restrictive SCC in OpenShift in terms of container permissions. This implies that OpenShift automatically assigns a SecurityContext for the Pods with minimum permissions, for example:

    OpenShift does not assign SecurityContexts in the default and kube-system namespaces. Please refrain from deploying operands on them, as it will result in permission errors when trying to write to the filesystem.

    You can read more about SecurityContextConstraints in the OpenShift documentation.

    Installation in all namespaces

    To install the operator watching resources on all namespaces, you need to create a Subscription object for mariadb-enterprise-operator using the stable channel in the openshift-operators namespace:

    This will use the global-operators OperatorGroup that is created by default in the openshift-operators namespace. This OperatorGroup will watch all namespaces in the cluster, and the operator will be able to manage resources across all namespaces.

    You can read more about OperatorGroups in the OpenShift documentation.

    Installation in specific namespaces

    In order to define which namespaces the operator will be watching, you need to create an OperatorGroup in the namespace where the operator will be installed:

    This OperatorGroup will watch the namespaces defined in the targetNamespaces field. The operator will be able to manage resources only in these namespaces.

    Then, the operator can be installed by creating a Subscription object in the same namespace as the OperatorGroup:

    Release channels

    We maintain support across a variety of OpenShift channels to ensure compatibility with different release schedules and stability requirements. Below, you will find an overview of the specific OpenShift channels we support.

    Channel
    Supported OpenShift Versions
    Description

    stable

    4.18, 4.16

    Points to the latest stable version of the operator. This channel may span multiple major versions.

    stable-v25.10

    4.18, 4.16

    v25.10.x is an LTS release. This channel points to the latest patch release of 25.10. Use this if you require version pinning to a stable version of the operator without necessarily looking for newer features.

    An example Subscription would look like this:

    Updates

    Updates are fully managed by OLM and controlled by the installPlanApproval field in the Subscription object. The default value is Automatic, which means that OLM will automatically update the operator to the latest version available in the channel. If you want to control the updates, you can set this field to Manual, and OLM will only update the operator when you approve the update.

    Uninstalling

    The first step for uninstalling the operator is to delete the Subscription object. This will not remove the operator, but it will stop OLM from managing the operator:

    After that, you can uninstall the ClusterServiceVersion (CSV) object that was created by OLM. This will remove the operator from the cluster:

    OpenShift console

    As an alternative to create Subscription objects via the command line, you can install operators by using the OpenShift console. Go to the Operators > OperatorHub section and search by mariadb enterprise:

    Select MariaDB Enterprise Kubernetes Operator, click on install, and you will be able to create a Subscription object via the UI.

    Once deployed, the operator comes with example resources that can be deployed from the console directly. For instance, to create a MariaDB:

    As you can see in the previous screenshot, the form view that the OpenShift console offers is limited, we recommend using the YAML view:

    certified by Red Hat
    Operator Lifecycle Manager (OLM)
    customer credentials as described in the documentation
    global pull secret
    in this section
    Option 1: Adding a Standalone Server or Topology (Without MaxScale)

    Use this method for a single MariaDB Server or to manually define a Primary/Replica or Galera cluster.

    1

    Prepare your server(s)

    First, perform these actions on each MariaDB Server you plan to add.

    1. Install the Agent package.

    1. Create the Enterprise Manager user (allows the Enterprise Manager server to connect remotely):

    Replace <Enterprise_Manager_IP> with the IP of your Enterprise Manager server and <password> with a secure password.

    1. Create the Local Agent user (required for the agent to collect detailed metrics from the local database instance):

    Replace <password> with a secure password.

    2

    Register in the UI

    1. Go to your MariaDB Enterprise Manager web interface (for example https://<Enterprise_Manager_IP>:8090).

    3

    Standalone server or a Topology

    To add a Standalone Server: Click Add and proceed to the next step (4).

    To create a Topology:

    4

    Link the Agent(s) 🔗

    For each server added, link its agent:

    1. Find the server in the inventory list, click the three-dot menu (⋮), and select Install Agent.\

    Option 2: Adding a Topololgy (With MaxScale)

    Use this method to add a complete primary/replica or Galera cluster that is managed by one or more MaxScale instances.

    1

    Prepare all servers in the topology

    Perform these actions on every server in the topology: the MaxScale instance(s) and each backend MariaDB Server attached.

    • Install the Agent package on all servers.

    • Create a Local Agent user on each backend MariaDB Server:

    Replace <password> with a secure password.

    2

    Register the MaxScale instance in the UI 🖥️

    1. Begin the Add Database process:

    3

    Link all a 🔗

    You must link the agent on every server in the topology to Enterprise Manager. The UI will show the MaxScale instance and discovered backend servers marked as "Not Registered."

    For each server in the list (start with the MaxScale instance, then each MariaDB server):

    Context-sensitive suggestions for keywords and objects to speed authoring and reduce errors.

    SQL Code Formatter

    Automatically formats SQL for readability and consistent style.

    SQL Syntax Highlighting

    Color syntax highlighting for quicker scanning and fewer mistakes.

    SQL Snippets

    Save and reuse your favorite SQL blocks across sessions and teams.

    SQL History

    Running history of executed SQL with quick replay into the editor.

    Multiple Connections

    Open simultaneous connections (dev/test/prod) and work in parallel, tab-isolated.

    Open/Edit/Save SQL Files

    Load scripts, edit, and save changes without leaving the workspace.

    Export Result Sets

    Export results as CSV, JSON, or SQL for hand-offs and audits.

    Display multiple Result Sets

    View multiple result sets in the same window.

    Vertical Results Mode

    Columnar display for wide rows to improve readability of tall/wide data.

    Result Set Limits

    Cap returned rows to keep queries responsive and safe in production.

    Result Visualizations

    Visualize results as line, bar, or scatter charts for quick trend checks.

    Grid Operations

    Search, filter, group, and control column visibility directly in the result sets.

    ERD Designer

    Feature
    Description

    ER Diagramming

    Build complete entity-relationship diagrams from your database structures.

    Auto Layout

    Automatically arrange large models for clear, navigable diagrams.

    Model Tables, Indexes

    Manage MariaDB data-related objects.

    Create from Live Databases

    Generate ERD models directly from live schemas.

    Database Administration

    Feature
    Description

    Schema Inspector

    Detailed metadata views for all schema objects to understand structure and dependencies.

    Object Browser

    Navigate and explore databases, tables, views, routines, and triggers.

    Object Editor

    Create, modify, and delete schema objects together with managing constraints, renaming, copying objects relationships.

    User Management

    View, edit, create, delete database users and privileges.

    Process List Viewer

    View and manage live sessions/commands.

    SQL Editor

    Write, run, and debug SQL with parallel query execution in multi-tab sessions.

    SQL Code Completion

    , it is important to note that, unlike
    MariaDB
    , it does not support TLS and non-TLS connections simultaneously (see
    ). For this reason, you must temporarily point your applications to MariaDB during the migration process. You can achieve this by configuring your application to use the
    . At the end of the MariaDB migration process, the MaxScale instance will need to be recreated in order to use TLS, and then you will be able to point your application back to MaxScale. Ensure that all applications are pointing to MariaDB before moving on to the next step.

    3. MariaDB is now accepting TLS connections. The next step is migrating your applications to use TLS by pointing them to MariaDB securely. Ensure that all applications are connecting to MariaDB via TLS before proceeding to the next step.

    4. If you are currently using MaxScale, and you are planning to connect via TLS through it, you should now delete your MaxScale instance. If needed, keep a copy of the MaxScale manifest, as we will need to recreate it with TLS enabled in further steps:

    It is very important that you wait until your old MaxScale instance is fully terminated to make sure that the old configuration is cleaned up by the operator.

    5. For enhanced security, it is recommended to enforce TLS in all MariaDB connections by setting the following options. This will trigger a rolling upgrade, make sure it finishes successfully before proceeding with the next step:

    6. For improved security, you can optionally configure TLS for Galera SSTs by following the steps below:

    • Get the migration script and grant execute permissions:

    • Run the migration script. Make sure you set <mariadb-name> with the name of the MariaDB resource:

    • Set the following option to enable TLS for Galera SSTs:

    This will trigger a rolling upgrade, make sure it finishes successfully before proceeding with the next step

    7. As mentioned in step 4, recreate your MaxScale instance with tls.enabled=true if needed:

    8. MaxScale is now accepting TLS connections. Next, you need to migrate your applications to use TLS by pointing them back to MaxScale securely. You have done this previously for MariaDB, you just need to update your application configuration to use the MaxScale Service and its CA bundle.

    TLS
    updates documentation
    limitations

    Adaptive Architecture: Intelligent tool registration based on service availability

  • Role-Based Access Control (RBAC): Fine-grained permission management

  • Multiple Deployment Modes: Standalone, 1Password, Local Vault, and HCP Vault

  • Database-Enforced User Validation: Shared database ensures only registered users can access services

  • Authentication Flow

    1. User Registration

    2. User Login

    3. Authenticated Request

    Deployment Modes

    1. Standalone

    Purpose: Simple deployment with direct environment variables

    Configuration: Direct environment variables

    Key Settings:

    When to Use: Development, testing, small deployments, No external secret management available

    Startup:

    2. 1Password

    Purpose: Secure secret management using 1Password CLI

    Configuration: op:// secret references

    Key Settings:

    Prerequisites:

    1. Install 1Password CLI

    2. Authenticate: op signin

    3. Create vault and items with required secrets

    Startup:

    When to Use: Team environments, shared secrets, Production

    3. Local Vault

    Purpose: Development with local HashiCorp Vault

    Configuration: Local Vault server

    Key Settings:

    Setup:

    Startup:

    When to Use: Development, Production with proper vault setup

    4. HCP Vault

    Purpose: Production deployment with HashiCorp Cloud Platform Vault

    Configuration: HCP Vault cluster

    Key Settings:

    Setup:

    1. Create HCP Vault cluster

    2. Configure AppRole authentication

    3. Create policies for application access

    4. Store secrets in Vault

    5. Generate role_id and secret_id

    Startup:

    When to Use: Production, enterprise deployments


    System Architecture

    MariaDB AI RAG follows a modular architecture with the following key components:

    Core Components

    1. Document Ingestion Module

      • Handles document uploads and text extraction

      • Supports multiple file formats (PDF, DOCX, TXT, etc.)

      • Processes metadata extraction

      • Manages document storage and versioning

    2. Chunking Module

      • Divides documents into semantically meaningful segments

      • Supports multiple chunking strategies (fixed size, recursive, semantic)

      • Optimizes chunk size and overlap for retrieval quality

    3. Vector Database Integration

      • Creates and stores vector embeddings for document chunks

      • Integrates with MariaDB's vector search capabilities

      • Enables efficient similarity search

    4. Retrieval Module

      • Converts queries into vector embeddings

      • Performs semantic similarity search

      • Ranks and filters results based on relevance

    5. Generation Module

      • Integrates with multiple LLM providers (OpenAI, Google, Anthropic)

      • Constructs prompts with retrieved context

      • Generates natural language responses

    6. Orchestration Module

      • Coordinates the end-to-end RAG pipeline

      • Manages asynchronous processing

      • Handles error recovery and retries

    7. API Interface

      • Exposes RESTful endpoints for all functionality

      • Implements JWT-based authentication

      • Manages user permissions and access control

    Architecture Diagram

    Data Flow

    1. Document Processing Flow

      • Documents are uploaded via the API

      • Text is extracted based on document format

      • Documents are divided into chunks

      • Chunks are converted to vector embeddings

      • Embeddings are stored in the vector database

    2. Query Processing Flow

      • User submits a query via the API

      • Query is converted to a vector embedding

      • Similar document chunks are retrieved

    3. Database Integration Flow

      • Database table/view is selected for ingestion

      • Rows are processed as individual documents

      • Column mapping defines content and metadata

    System Requirements

    • Database: MariaDB 10.6+ or MySQL 8.0+

    • Operating System: Linux (Debian/Ubuntu, RHEL/CentOS), Windows Server

    • Hardware: Minimum 4 CPU cores, 8GB RAM, 100GB storage

    • Network: Internet connectivity for external AI services

    • Dependencies: Python 3.9+, FastAPI, SQLAlchemy, PyTorch (optional for local embeddings)

    For detailed installation instructions, see the Installation Guide.

    ReplicasFirstPrimaryLast: Roll out replica Pods one by one, wait for each of them to become ready, and then proceed with the primary Pod.

  • RollingUpdate: Utilize the rolling update strategy from Kubernetes.

  • OnDelete: Updates are performed manually by deleting Pods.

  • Never: Pause updates.

  • Configuration

    The update strategy can be configured in the updateStrategy field of the MariaDB resource:

    It defaults to ReplicasFirstPrimaryLast if not provided.

    Trigger updates

    Updates are not limited to updating the image field in the MariaDB resource, an update will be triggered whenever any field of the Pod template is changed. This translates into making changes to MariaDB fields that map directly or indirectly to the Pod template, for instance, the CPU and memory resources:

    Once the update is triggered, the operator manages it differently based on the selected update strategy.

    ReplicasFirstPrimaryLast

    This role-aware update strategy consists in rolling out the replica Pods one by one first, waiting for each of them become ready (i.e. readiness probe passed), and then proceed with the primary Pod. This is the default update strategy, as it can potentially meet various reliability requirements and minimize the risks associated with updates:

    • Write operations won't be affected until all the replica Pods have been rolled out. If something goes wrong in the update, such as an update to an incompatible MariaDB version, this is detected early when the replicas are being rolled out and the update operation will be paused at that point.

    • Read operations impact is minimized by only rolling one replica Pod at a time.

    • Waiting for every Pod to be synced minimizes the impact in the clustering protocols and the network.

    RollingUpdate

    This strategy leverages the rolling update strategy from the StatefulSet resource, which, unlike ReplicasFirstPrimaryLast, does not take into account the role of the Pods(primary or replica). Instead, it rolls out the Pods one by one, from the highest to the lowest StatefulSet index.

    You are able to pass extra parameters to this strategy via the rollingUpdate object:

    OnDelete

    This strategy aims to provide a method to update MariaDB resources manually by allowing the user to restart the Pods individually. This way, the user has full control over the update process and can decide which Pods are rolled out at any given time.

    Whenever an update is triggered, the MariaDB will be marked as pending to update:

    From this point, you are able to delete the Pods to trigger the update, which will result the MariaDB marked as updating:

    Once all the Pods have been rolled out, the MariaDB resource will be back to a ready state:

    Never

    The operator will not perform updates on the StatefulSet whenever this update strategy is configured. This could be useful in multiple scenarios:

    • Progressive fleet upgrades: If you're managing large fleets of databases, you likely prefer to roll out updates progressively rather than simultaneously across all instances.

    • Operator upgrades: When upgrading the operator, changes to the StatefulSet or the Pod template may occur from one version to another, which could trigger a rolling update of your MariaDB instances.

    Data-plane updates

    Highly available topologies rely on data-plane containers that run alongside MariaDB to enable the remote management of the database instances. These containers use the mariadb-enterprise-operator image, which can be automatically updated by the operator based on its image version:

    By default, updateStrategy.autoUpdateDataPlane is false, which means that no automatic upgrades will be performed, but you can opt-in/opt-out from this feature at any point in time by updating this field. For instance, you may want to selectively enable updateStrategy.autoUpdateDataPlane in a subset of your MariaDB instances after the operator has been upgraded to a newer version, and then disable it once the upgrades are completed.

    It is important to note that this feature is fully compatible with the Never strategy: no upgrades will happen when updateStrategy.autoUpdateDataPlane=true and updateStrategy.type=Never.

    list_databases: Discovers all accessible databases.

  • list_tables: Enumerates all tables within a specified database.

  • get_table_schema: Retrieves the detailed schema for a specific table, including column names, data types, keys, and default values.

  • execute_sql: Executes read-only SQL queries like SELECT, SHOW, and DESCRIBE. Supports parameterized queries for enhanced security.

  • create_database: Creates a new database if it does not already exist.

  • Harnessing the Power of Vectors: Advanced AI Functionality

    The server’s integrated vector functionality enables semantic search and other embedding-based operations directly within your database.

    Vector Store Management

    • create_vector_store: Creates a new table optimized as a vector store. The schema includes columns for id, document, embedding (VECTOR type), and metadata (JSON). Users can specify the embedding model and distance function (e.g., cosine, euclidean) at creation.

    • list_vector_stores: Lists all tables in a database that are identified as vector stores.

    • delete_vector_store: Securely removes a vector store table.

    Embedding and Search Operations

    • insert_docs_vector_store: Inserts documents and associated metadata into a vector store. The server manages the generation of embeddings using a configured service.

    • search_vector_store: Performs semantic similarity searches by generating an embedding for a user query and finding the 'k' most similar documents in the specified vector store.

    Workflow Orchestration

    The server exposes powerful orchestration endpoints that allow an AI agent to execute an entire RAG pipeline through a single, secure interface.

    • Ingestion (/orchestrate/ingestion): Triggers the ingestion of documents into a specified vector store, including the chunking and embedding processes.

    • Generation (/orchestrate/generation): Executes a query against a set of documents, performing retrieval and generating a final, context-aware response from an LLM.


    Tool Summary

    Tool Name
    Description
    Category

    list_databases

    Discovers all accessible databases.

    Standard Database Operations

    list_tables

    Enumerates all tables within a specified database.

    Standard Database Operations

    get_table_schema

    Retrieves the detailed schema for a specific table.

    Standard Database Operations

    execute_sql

    Executes read-only SQL queries.

    NodeFileDescriptorLimit

    Kernel is predicted to exhaust file descriptors soon (sustained for 15m). Triggers when allocated file descriptors exceed 70% of the kernel limit.

    NodeFileDescriptorLimit

    Kernel is close to exhausting file descriptors (sustained for 15m). Triggers when allocated file descriptors exceed 90% of the kernel limit.

    File Descriptors

    Current vs. maximum number of open file descriptors.

    Filesystem Type

    Table of filesystem types and mount points on the node.

    Helm documentation
    migration script
    Helm documentation
    MaxScale
    mariadb-backup
    Kubernetes VolumeSnapshots
    BACKUP STAGE
    mariadb-dump
    cert-manager
    prometheus-operator
    Operator certified
    Deployment Checklist

    Query Editor

    The Query Editor is a powerful, integrated environment for database developers and administrators. It provides a comprehensive set of tools for writing and debugging SQL and analyzing query results, all from a single interface.

    This procedure outlines the steps required to access and utilize the Query Editor within the Workspace section of Enterprise Manager UI.

    1. From the main Workspace screen, click the "Run Queries" card.\

    2. In the "Connect to..." dialog, select your target server, enter your credentials, and click Connect.\

    SQL Resources

    MariaDB Operator Enterprise enables you to manage SQL resources declaratively through CRs. By SQL resources, we refer to users, grants, and databases that are typically created using SQL statements.

    The key advantage of this approach is that, unlike executing SQL statements manually, which is a one-time operation, declaring a SQL resource via a CR ensures that the resource is periodically reconciled by the operator. This provides a guarantee that the resource will be recreated if it gets manually deleted. Additionally, it prevents state drifts, as the operator will regularly update the resource according to the CR specification.

    User CR

    By creating this resource, you are declaring an intent to create an user in the referred MariaDB instance, just like a

    # Make executable
    chmod +x install-enterprise-manager.sh
    # Run installer
    ./install-enterprise-manager.sh
    # Extract and load images
    tar -xzvf enterprise-manager.tar.gz
    cd enterprise-manager
    docker image load -i images.tar
    # Start containers
    docker compose up -d
    # Check containers
    cd enterprise-manager
    docker compose ps
    [maxscale]
    # ... other settings ...
    admin_host=0.0.0.0
    admin_oidc_url=https://<Enterprise Manager Host Name>:8090
    admin_oidc_client_id=admin
    admin_oidc_client_secret=mariadb
    admin_oidc_ssl_insecure=true
    .env (example)
    MEMA_TLS_CERTPATH=/certs/my-host.crt
    MEMA_TLS_KEYPATH=/certs/my-host.key
    docker compose up -d
    nano .env
    MEMA_AUDIT_API=false
    docker compose up -d
    MEMA_AUDIT_API=true
    # prometheus.yml
    scrape_configs:
      - job_name: 'mem-federation'
        scrape_interval: 60s
        honor_labels: true
        metrics_path: '/prometheus/federate'
        params:
          'match[]':
            - '{job=~".+"}' # This parameter tells the endpoint to return all series.
        static_configs:
          - targets: ['<Enterprise_Manager_IP>:8090']
        scheme: https
        basic_auth:
          username: admin # default username for Enterprise Manager
          password: mariadb # default password for admin user
        # You may need to add TLS and authentication configurations
        # depending on your network setup and security requirements.
        # tls_config:
        #   insecure_skip_verify: true
    MariaDB Server host
    sudo mema-agent setup --cluster-name=MyCluster \
      --endpoint=https://<external_ip> --otlp-port=<external_port> \
      --mariadb --host-name=<hostname> \
      --mariadb-user=<user> --mariadb-password=<password> \
      --otlp-insecure --otlp-interval=60s
    MaxScale host
    sudo mema-agent setup --cluster-name=MyCluster \
      --endpoint=https://<external_ip> --otlp-port=<external_port> \
      --maxscale --host-name=<hostname> \
      --maxscale-user=admin --maxscale-password=mariadb \
      --otlp-insecure --otlp-interval=60s
    oc get packagemanifests -n openshift-marketplace mariadb-enterprise-operator
    
    NAME                          CATALOG                 AGE
    mariadb-enterprise-operator   Certified Operators     21h
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
      runAsNonRoot: true
      runAsUser: 1000650000
    apiVersion: operators.coreos.com/v1alpha1
    kind: Subscription
    metadata:
      name: mariadb-enterprise-operator
      namespace: openshift-operators
    spec:
      channel: stable
      installPlanApproval: Automatic
      name: mariadb-enterprise-operator
      source: certified-operators
      sourceNamespace: openshift-marketplace
    apiVersion: operators.coreos.com/v1
    kind: OperatorGroup
    metadata:
      name: mariadb-enterprise-operator
      namespace: my-namespace
    spec:
      targetNamespaces:
      - my-namespace
      - my-other-namespace
      - my-other-other-namespace
      upgradeStrategy: Default
    apiVersion: operators.coreos.com/v1alpha1
    kind: Subscription
    metadata:
      name: mariadb-enterprise-operator
      namespace: my-namespace
    spec:
      channel: stable
      installPlanApproval: Automatic
      name: mariadb-enterprise-operator
      source: certified-operators
      sourceNamespace: openshift-marketplace
    apiVersion: operators.coreos.com/v1alpha1
    kind: Subscription
    metadata:
      name: mariadb-enterprise-operator
      namespace: openshift-operators
    spec:
      channel: stable # Change this to the actual channel you want
      installPlanApproval: Automatic
      name: mariadb-enterprise-operator
      source: certified-operators
      sourceNamespace: openshift-marketplace
    oc delete subscription mariadb-enterprise-operator
    oc delete clusterserviceversion mariadb-enterprise-operator.v1.0.0
    # For Red Hat/CentOS/Rocky
    sudo dnf install -y mema-agent
    # For Debian/Ubuntu
    sudo apt install -y mema-agent
    # For Red Hat/CentOS/Rocky
    sudo dnf install -y mema-agent
    # For Debian/Ubuntu
    sudo apt install -y mema-agent
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      tls:
    +   enabled: true
    +   required: false
    +   galeraSSTEnabled: false
    +   galeraServerSSLMode: PROVIDER
    +   galeraClientSSLMode: DISABLED
    kubectl get mxs maxscale-galera -o yaml > maxscale-galera.yaml
    kubectl delete mxs maxscale-galera
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      tls:
    +   required: true
    +   galeraServerSSLMode: SERVER_X509
    curl -sLO https://operator.mariadb.com/scripts/migrate_galera_ssl.sh
    chmod +x migrate_galera_ssl.sh
    ./migrate_galera_ssl.sh <mariadb-name>
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      tls:
    +   galeraSSTEnabled: true
    +   galeraClientSSLMode: VERIFY_IDENTITY
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale-galera
    spec:
    + tls:
    +   enabled: true
    # Direct values in config file
    DB_HOST=localhost
    DB_PASSWORD=your_password
    SECRET_KEY=your_secret_key
    JWT_SECRET_KEY=your_jwt_secret
    GEMINI_API_KEY=your_api_key
    # RAG API
    rag-api.exe --config=config.env.secure.local
    
    # MCP Server
    $env:MCP_CONFIG="config.env.secure.local"
    mcp-server.exe
    # 1Password references
    DB_USER=op://Employee/RAG-Database/username
    DB_PASSWORD=op://Employee/RAG-Database/password
    SECRET_KEY=op://Employee/RAG-Security/secret-key
    JWT_SECRET_KEY=op://Employee/RAG-Security/jwt-secret
    GEMINI_API_KEY=op://Employee/RAG-API-Keys/gemini
    # RAG API
    op run --env-file=config.env.1password.employee -- rag-api.exe
    
    # MCP Server
    op run --env-file=config.env.1password.employee -- mcp-server.exe
    # Vault Configuration
    VAULT_ADDR=http://127.0.0.1:8200
    VAULT_TOKEN=rag-root-token
    VAULT_SKIP_VERIFY=true
    VAULT_SECRET_PATH=rag-in-a-box
    VAULT_MOUNT_POINT=secret
    # Start Vault in dev mode
    vault server -dev -dev-root-token-id="rag-root-token"
    
    # Store secrets
    vault kv put secret/rag-in-a-box/database \
        DB_USER=root \
        DB_PASSWORD=Password123! \
        DB_NAME=kb_chunks
    
    vault kv put secret/rag-in-a-box/security \
        SECRET_KEY=your_secret_key \
        JWT_SECRET_KEY=your_jwt_secret
    
    vault kv put secret/rag-in-a-box/api-keys \
        GEMINI_API_KEY=your_api_key
    # RAG API
    rag-api.exe --config=config.env.vault.local
    
    # MCP Server
    $env:MCP_CONFIG="config.env.vault.local"
    mcp-server.exe
    # HCP Vault Configuration
    VAULT_ADDR=https://your-vault-cluster.hashicorp.cloud:8200
    VAULT_NAMESPACE=admin
    VAULT_SKIP_VERIFY=false
    VAULT_SECRET_PATH=rag-in-a-box
    VAULT_MOUNT_POINT=secret
    
    # AppRole Authentication
    VAULT_ROLE_ID=your-vault-role-id
    VAULT_SECRET_ID=your-vault-secret-id
    # RAG API
    rag-api.exe --config=config.env.hcp.live
    
    # MCP Server
    $env:MCP_CONFIG="config.env.hcp.live"
    mcp-server.exe
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb
    spec:
      updateStrategy:
        type: ReplicasFirstPrimaryLast
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb
    spec:
      ...
    - image: docker.mariadb.com/enterprise-server:10.6.18-14.2
    + image: docker.mariadb.com/enterprise-server:10.6.19-15.1
      resources:
        requests:
          cpu: 200m
          memory: 128Mi
        limits:
    -     memory: 1Gi
    +     memory: 2Gi
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb
    spec:
      ...
      updateStrategy:
        type: RollingUpdate
        rollingUpdate:
          maxUnavailable: 1
    kubectl get mariadbs
    NAME             READY   STATUS           PRIMARY            UPDATES    AGE
    mariadb-galera   True    Pending update   mariadb-galera-0   OnDelete   5m17s
    kubectl get mariadbs
    NAME             READY   STATUS         PRIMARY            UPDATES    AGE
    mariadb-galera   True    Updating       mariadb-galera-0   OnDelete   9m50s
    NAME             READY   STATUS         PRIMARY            UPDATES    AGE
    mariadb-galera   True    Running        mariadb-galera-0   OnDelete   12m
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-repl
    spec:
      updateStrategy:
        autoUpdateDataPlane: true
    {
      "table_name": "customer_feedback",
      "schema_name": "databridge",
      "column_mapping": {
        "content": "feedback_text",
        "metadata": ["customer_id", "product_id", "rating", "date_submitted"],
        "id_column": "feedback_id"
      },
      "filter_condition": "rating >= 3 AND date_submitted > '2025-01-01'",
      "batch_size": 1000,
      "authorized_users": ["user1@example.com", "user2@example.com"]
    }
    {
      "job_id": "db_ingest_xyz123",
      "status": "processing",
      "table_name": "customer_feedback",
      "estimated_rows": 5230,
      "authorized_users": ["user1@example.com", "user2@example.com"]
    }
    curl -X POST "http://localhost:8000/documents/ingest-from-table" \
      -H "Authorization: Bearer YOUR_TOKEN" \
      -H "Content-Type: application/json" \
      -d '{"table_name": "customer_feedback", "schema_name": "databridge", "column_mapping": {"content": "feedback_text", "metadata": ["customer_id", "product_id", "rating", "date_submitted"], "id_column": "feedback_id"}, "authorized_users": ["user1@example.com"]}'
    POST /documents/sql-ingest
    {
      "sql_query": "SELECT id, title, content, author, published_date FROM articles WHERE status = 'published' AND category = 'technical'",
      "role": "ai_nexus",
      "document_name": "published_articles"
    }
    {
      "id": 42,
      "source": "sql://generated/1729425000/published_articles.csv",
      "filename": "published_articles.csv",
      "status": "completed",
      "content": "id,title,content,author,published_date\n1,Article Title,Article content...,John Doe,2025-01-15\n...",
      "error_message": null,
      "created_at": "2025-10-20T12:00:00.123456",
      "updated_at": "2025-10-20T12:00:01.234567"
    }
    curl -X POST "http://localhost:8000/documents/sql-ingest" \
      -H "Authorization: Bearer YOUR_TOKEN" \
      -H "Content-Type: application/json" \
      -d '{
        "sql_query": "SELECT id, title, content, author FROM articles WHERE status = '\''published'\''",
        "role": "ai_nexus",
        "document_name": "published_articles"
      }'
    GET /documents/ingest-status/{job_id}
    {
      "job_id": "db_ingest_xyz123",
      "status": "completed",
      "processed_rows": 5230,
      "created_documents": 5230,
      "failed_rows": 0,
      "completion_time": "2025-08-25T12:34:56.789Z",
      "authorized_users": ["user1@example.com", "user2@example.com"]
    }
    curl "http://localhost:8000/documents/ingest-status/db_ingest_xyz123" \
      -H "Authorization: Bearer YOUR_TOKEN"
    curl -sLO https://operator.mariadb.com/scripts/migrate_enterprise.sh
    chmod +x migrate_enterprise.sh
    RESOURCE="<mariadb-name>" \
    OLD_API_GROUP="k8s.mariadb.com" \
    NEW_API_GROUP="enterprise.mariadb.com" \
    NEW_MARIADB_IMAGE="docker.mariadb.com/enterprise-server:11.4.4-2" \
    NEW_MARIADB_OPERATOR_IMAGE="docker.mariadb.com/mariadb-enterprise-operator:<operator-version>" \
    ./migrate_enterprise.sh
    helm uninstall mariadb-operator
    kubectl delete role <mariadb-name>
    for crd in $(kubectl get crds -o json | jq -r '.items[] | select(.spec.group=="k8s.mariadb.com") | .metadata.name'); do
      kubectl get "$crd" -A -o json | jq -r '.items[] | "\(.metadata.namespace)/\(.metadata.name)"' | while read cr; do
        ns=$(echo "$cr" | cut -d'/' -f1)
        name=$(echo "$cr" | cut -d'/' -f2)
        echo "Removing finalizers from $crd: $name in $ns..."
        kubectl patch "$crd" "$name" -n "$ns" --type merge -p '{"metadata":{"finalizers":[]}}'
      done
    done
    helm uninstall mariadb-operator-crds
    for pod in $(kubectl get pods -l app.kubernetes.io/instance=<mariadb-name> -o jsonpath='{.items[*].metadata.name}'); do
      kubectl exec "$pod" -- sh -c 'mariadb-upgrade -u root -p${MARIADB_ROOT_PASSWORD} -f'
    done
    kubectl rollout restart deployment mariadb-enterprise-operator
    If you select the sql permission, a "Query editor row limit" dropdown will appear. You can adjust this value as needed.

    When creating a role, selecting the edit permission requires you to also select the view permission.

  • Delete: Permanently removes the custom role. A confirmation dialog will appear.

  • Roles that are currently assigned to any user cannot be deleted.

  • Delete: Permanently removes the user from MariaDB Enterprise Manager.

  • You cannot delete the user account that you are currently logged in with. To delete an administrator account, you must first log in with a different administrator account.

    Log in with user who has edit permission.

  • Begin the Add Database process:

    • If this is your first time and no databases are present, you'll be on the "Add Database" screen automatically.

    • If you already have other databases, click the + Add Database button.

  • Ensure the Database without MaxScale option is selected.\

  • Fill in the connection details for your first server using the Enterprise Manager User ('monitor'@'<Enterprise_Manager_IP>').

  • Click the Plus icon (+) to add another server.\
  • Fill in the connection details for the second server in your topology and click Confirm. Repeat for all nodes in your topology.

  • Once all nodes are added, select the Topology Type (e.g., Primary/Replica — default — or Galera Cluster) and click Confirm.\

  • To convert an existing standalone server into a topology of multiple servers: click the three-dot menu (⋮) next to the server, choose Edit, and click the Plus icon (+). Then follow the same steps to add nodes.

  • Enter the credentials for the Local Agent User ('monitor'@'localhost') to generate a setup command.\

  • Copy the command and run it on that server's terminal to link the agent.

  • If this is your first time and no databases are present, you'll be on the "Add Database" screen to begin with.

  • If you already have other databases, click the + Add Database button.

  • Select the Database with MaxScale option.

  • Provide the connection details for your MaxScale instance (IP address, API port 8989, and its admin credentials).

  • Click Add. Enterprise Manager will connect to MaxScale and automatically discover all backend MariaDB servers it manages.

  • Click the three-dot menu (⋮) and select Install Agent.\
  • The UI will generate a unique setup command for that specific server with the username and password you provide. Copy the command.\

  • On that specific server, paste and run the command in the terminal.

  • Repeat this process for every server in the topology. Once all agents are linked, the dashboard will begin showing the health of the entire topology.

    Preserves document structure and metadata

    Manages vector indexes and optimizations

    Supports metadata-based filtering

    Supports streaming output for real-time display

    Provides status monitoring and reporting

    Provides comprehensive error handling and logging

    Retrieved chunks are ranked by relevance

  • Top chunks are used as context for generation

  • LLM generates a response based on the context

  • Text is chunked and embedded

  • Embeddings are stored with source metadata

  • Upon successful connection, the main Query Editor worksheet will appear, ready for you to begin.\

    Query Editor Worksheet

    The Query Editor Workspace is organized around a flexible, multi-tabbed interface designed for parallel work. At the top level, Worksheet tabs represent your connections to different database servers. Within each worksheet, you can open multiple Query Tabs, allowing you to write and execute several independent SQL statements without losing your context.

    SQL Code Management Features

    These features are designed to make writing and managing SQL code efficient and intuitive.

    SQL Editor

    Write, run, and debug SQL statements. The editor supports executing queries in parallel across multiple Query Tabs, allowing you to work on different tasks or connect to different servers simultaneously within isolated sessions.

    SQL Code Completion

    Speed up query authoring and minimize syntax errors with context-sensitive suggestions. As you type, the editor offers relevant SQL keywords, functions, and objects (like tables and columns) from the currently selected database schema.

    SQL Code Formatter

    Improve readability and maintain consistent coding standards by automatically formatting your SQL code. Access this feature via the editor's context menu or command palette (F1).

    SQL Syntax Highlighting

    Enhance code clarity with color syntax highlighting. Different parts of your SQL statements (keywords, strings, comments) are displayed in distinct colors, making queries easier to scan and debug.

    SQL Snippets

    Save frequently used SQL code blocks for quick reuse across sessions. Press CTRL+D (or CMD+D on Mac) to save the current content of the editor as a snippet.

    SQL History

    Keep track of every query executed within the Workspace. The History tab provides a running log, allowing you to quickly find, review, and re-execute previous commands.

    Multiple Connections

    Define and manage connections to various database servers (e.g., development, testing, production). Each connection opens in its own top-level Worksheet tab, within which you can open multiple Query Tabs.

    Open/Edit/Save SQL Files

    Load existing SQL scripts from your local machine into the editor, make changes, and save them back without leaving the workspace.

    Data Management and Analysis Features

    These features help you interact with and understand the results of your queries.

    Export Result Sets

    Easily share or archive query results. You can export data grids directly into common formats like CSV, JSON, or as SQL INSERT statements.

    1

    From results tab, click Export Results

    2

    From Export results window, make the selection.

    Setting
    Description
    3

    Click Import

    Display multiple Result Sets

    When executing a script with multiple SELECT statements, view each result set in its own dedicated grid within the Results panel for easy comparison.

    Vertical Results Mode

    Improve readability for tables with many columns by displaying results in a vertical, record-by-record format.

    Result Set Limits

    Control the number of rows returned by SELECT statements (default: 10,000). This safety feature keeps queries responsive and can be adjusted per role.

    Result Visualizations

    Gain quick insights from your data by visualizing query results directly within the Workspace as simple line, bar, or scatter charts.

    Grid Operations

    Interact directly with the data displayed in the Results grid. Perform actions like searching for specific values, filtering rows, grouping data, and customizing column visibility without writing additional SQL.

    statement would do:

    In the example above, a user named bob identified by the password available in the bob-password Secret will be created in the mariadb instance.

    Refer to the API reference for more detailed information about every field.

    Custom name

    By default, the CR name is used to create the user in the database, but you can specify a different one providing the name field under spec:

    Grant CR

    By creating this resource, you are declaring an intent to grant permissions to a given user in the referred MariaDB instance, just like a statement would do.

    You may provide any set of .

    Refer to the API reference for more detailed information about every field.

    Database CR

    By creating this resource, you are declaring an intent to create a logical database in the referred MariaDB instance, just like a statement would do:

    Refer to the API reference for more detailed information about every field.

    Custom name

    By default, the CR name is used to create the user in the database, but you can specify a different one providing the name field under spec:

    Initial User, Grant and Database

    If you only need one user to interact with a single logical database, you can use of the MariaDB resource to configure it, instead of creating the User, Grant and Database resources separately:

    Behind the scenes, the operator will be creating an User resource with ALL PRIVILEGES in the initial Database.

    Authentication plugins

    This feature requires the skip-strict-password-validation option to be set. See: .

    Passwords can be supplied using the passwordSecretKeyRef field in the User CR. This is a reference to a Secret that contains a password in plain text.

    Alternatively, you can use to avoid passing passwords in plain text and provide the password in a hashed format instead. This doesn't affect the end user experience, as they will still need to provide the password in plain text to authenticate.

    Password hash

    Provide the password hashed using the function:

    The password hash can be obtained by executing SELECT PASSWORD('<password>'); in an existing MariaDB installation.

    Password plugin

    Provide the password hashed using any of the available , for example mysql_native_password:

    The plugin name should be available in a Secret referenced by pluginNameSecretKeyRef and the argument passed to it in pluginArgSecretKeyRef. The argument is the hashed password in most cases, refer to the for further detail.

    Configure reconciliation

    As we previously mentioned, SQL resources are periodically reconciled by the operator into SQL statements. You are able to configure the reconciliation interval using the following fields:

    If the SQL statement executed by the operator is successful, it will schedule the next reconciliation cycle using the requeueInterval. If the statement encounters an error, the operator will use the retryInterval instead.

    Cleanup policy

    Whenever you delete a SQL resource, the operator will also delete the associated resource in the database. This is the default behaviour, that can also be achieved by setting cleanupPolicy=Delete:

    You can opt-out from this cleanup process using cleanupPolicy=Skip. Note that this resources will remain in the database.

    --maxscale-user

    The MaxScale API user for scraping MaxScale metrics.

    --maxscale-password

    The password for the MaxScale user.

    --otlp-insecure

    Disables TLS certificate validation (use for testing or with self-signed certs).

    --otlp-interval

    The interval at which the agent should push metrics (e.g., 60s).

    Standard Database Operations

    create_database

    Creates a new database if it does not already exist.

    Standard Database Operations

    create_vector_store

    Creates a new table optimized as a vector store.

    Vector & AI Functionality

    list_vector_stores

    Lists all tables identified as vector stores.

    Vector & AI Functionality

    delete_vector_store

    Securely removes a vector store table.

    Vector & AI Functionality

    insert_docs_vector_store

    Inserts documents and metadata into a vector store.

    Vector & AI Functionality

    search_vector_store

    Performs a semantic similarity search on a vector store.

    Vector & AI Functionality

    rag_ingestion

    Triggers the full document ingestion pipeline.

    Workflow Orchestration

    rag_generation

    Synthesizes retrieved information with the user's query to generate a final, context-aware response.

    Workflow Orchestration

    MariaDB Server

    This dashboard provides a unified view of a database topology. It combines topology information, system health, replication or cluster metrics, and query performance in one place. Administrators can use it to monitor availability, troubleshoot issues, and optimize performance.

    Topology Overview

    Summarizes the overall topology, showing which servers are active, their versions, and how they are organized.

    • Name — Displays the name of the MariaDB topology currently being monitored.

    • Project — Shows the associated project or environment label.

    • Primary/Replica — A table with:

      • Instance: Server hostname.

      • Type: Instance role.

      • Seconds behind primary: Replication delay value.

    • Topology Info — Count of nodes grouped by type (e.g., server, MaxScale).

    • MariaDB Server Uptime by Instance — Uptime in seconds for each server instance.

    System Metrics

    Monitors server resource usage to detect bottlenecks in CPU, memory, network, and storage.

    Feature
    Description

    Replication / Cluster Metrics

    Provides insight into replication and cluster-related activity, including binary log usage, commit rates, and delay measurements.

    Metric
    Description

    Replication Status Table

    This table provides a consolidated view of the health status of replication across instances.

    Field Name
    Description

    Query Metrics

    Focuses on query execution and workload behavior, highlighting concurrency, throughput, and inefficiencies.

    Metric
    Description

    Connections

    This section provides visibility into how clients connect to the server and whether connection limits or failures are occurring.

    Metric
    Description

    Range Metrics

    Highlights query access patterns where range operations or scans are used.

    Metric
    Description

    InnoDB Metrics

    Shows activity within the InnoDB storage engine.

    Metric
    Description

    Processlist

    Shows information about active sessions and thread states collected from information_schema.processlist.

    • Processlist Count — Table view showing:

      • Instance: Database node.

      • Client: Client host connected.

      • Value: Number of processes/threads from that client.

    High Availability

    This section provides guidance on how to configure high availability in MariaDB and MaxScale instances. If you are looking for an HA setup for the operator, please refer to the Helm documentation.

    Our recommended setup for production is:

    • Use a highly available topology for MariaDB:

      • Asynchronous replication with a primary node and at least 2 replicas.

      • Synchronous multi-master with at least 3 nodes. Always an odd number of nodes, as it is quorum-based.

    • Leverage as database proxy to load balance requests and perform failover/switchover operations. Configure 2 replicas to enable MaxScale upgrades without downtime.

    • Use to avoid noisy neighbours.

    • Define .

    Highly Available Topologies

    • : The primary node allows both reads and writes, while secondary nodes only serve reads. The primary has a binary log and the replicas asynchronously replicate the binary log events.

    • : All nodes support reads and writes, but writes are only sent to one node to avoid contention. The fact that is synchronous and that all nodes are equally configured makes the primary failover/switchover operation seamless and usually instantaneous.

    Kubernetes Services

    In order to address nodes, MariaDB Enterprise Kubernetes Operator provides you with the following Kubernetes Services:

    • <mariadb-name>: This is the default Service, only intended for the .

    • <mariadb-name>-primary: To be used for write requests. It will point to the primary node.

    • <mariadb-name>-secondary: To be used for read requests. It will load balance requests to all nodes except the primary.

    Whenever the primary changes, either by the user or by the operator, both the <mariadb-name>-primary and <mariadb-name>-secondary Services will be automatically updated by the operator to address the right nodes.

    The primary may be manually changed by the user at any point by updating the spec.[replication|galera].primary.podIndex field. Alternatively, automatic primary failover can be enabled by setting spec.[replication|galera].primary.autoFailover, which will make the operator to switch primary whenever the primary Pod goes down.

    MaxScale

    While Kubernetes Services can be used for addressing primary and secondary instances, we recommend utilizing as database proxy for doing so, as it comes with additional advantages:

    • Enhanced failover/switchover operations for both replication and Galera

    • Single entrypoint for both reads and writes

    • Multiple router modules available to define how to route requests

    • Replay pending transaction when primary goes down

    The full lifecyle of the MaxScale proxy is covered by this operator. Please refer to for further detail.

    Pod Anti-Affinity

    Bear in mind that, when enabling this, you need to have at least as many Nodes available as the replicas specified. Otherwise your Pods will be unscheduled and the cluster won't bootstrap.

    To achieve real high availability, we need to run each MariaDB Pod in different Kubernetes Nodes. This practice, known as anti-affinity, helps reducing the blast radius of Nodes being unavailable.

    By default, anti-affinity is disabled, which means that multiple Pods may be scheduled in the same Node, something not desired in HA scenarios.

    You can selectively enable anti-affinity in all the different Pods managed by the MariaDB resource:

    Anti-affinity may also be enabled in the resources that have a reference to MariaDB, resulting in their Pods being scheduled in Nodes where MariaDB is not running. For instance, the Backup and Restore processes can run in different Nodes:

    In the case of MaxScale, the Pods will also be placed in Nodes isolated in terms of compute, ensuring isolation not only among themselves but also from the MariaDB Pods. For example, if you run a MariaDB and MaxScale with 3 replicas each, you will need 6 Nodes in total:

    Default anti-affinity rules generated by the operator might not satisfy your needs, but you can always define your own rules. For example, if you want the MaxScale Pods to be in different Nodes, but you want them to share Nodes with MariaDB:

    Dedicated Nodes

    If you want to avoid noisy neighbours running in the same Kubernetes Nodes as your MariaDB, you may consider using dedicated Nodes. For achieving this, you will need:

    • Taint your Nodes and add the counterpart toleration in your Pods.

    Tainting your Nodes is not covered by this operator, it is something you need to do by yourself beforehand. You may take a look at the to understand how to achieve this.

    • Select the Nodes where Pods will be scheduled in via a nodeSelector.

    Although you can use the default Node labels, you may consider adding more significative labels to your Nodes, as you will have to set to them in your Pod nodeSelector. Refer to the .

    • Add podAntiAffinity to your Pods as described in the section.

    The previous steps can be achieved by setting these fields in the MariaDB resource:

    Pod Disruption Budgets

    Take a look at the if you are unfamiliar to PodDisruptionBudgets

    By defining a PodDisruptionBudget, you are telling Kubernetes how many Pods your database tolerates to be down. This quite important for planned maintenance operations such as Node upgrades.

    MariaDB Enterprise Kubernetes Operator creates a default PodDisruptionBudget if you are running in HA, but you are able to define your own by setting:

    Configuration

    This documentation aims to provide guidance on various configuration aspects shared across many MariaDB Enterprise Kubernetes Operator CRs.

    my.cnf

    An inline can be provisioned in the MariaDB resource via the myCnf field:

    In this field, you may provide any or supported by MariaDB.

    Under the hood, the operator automatically creates a ConfigMap with the contents of the myCnf field, which will be mounted in the MariaDB instance. Alternatively, you can manage your own configuration using a pre-existing ConfigMap by linking it via myCnfConfigMapKeyRef. It is important to note that the key in this ConfigMap i.e. the config file name, must have a .cnf extension in order to be detected by MariaDB:

    To ensure your configuration changes take effect, the operator triggers a MariaDB update whenever the myCnf field or the ConfigMap is updated. For the operator to detect changes in a ConfigMap, it must be labeled with enterprise.mariadb.com/watch. Refer to the section for further detail.

    Compute resources

    CPU and memory resouces can be configured via the resources field in both the MariaDB and MaxScale CRs:

    In the case of MariaDB, it is recommended to set the innodb_buffer_pool_size system variable to a value that is 70-80% of the available memory. This can be done via the :

    Timezones

    By default, MariaDB does not load timezone data on startup for performance reasons and defaults the timezone to SYSTEM, obtaining the timezone information from the environment where it runs. See the for further information.

    You can explicitly configure a timezone in your MariaDB instance by setting the timeZone field:

    This setting is immutable and implies loading the timezone data on startup.

    In regards to Backup and SqlJob resources, which get reconciled into CronJobs, you can also define a timeZone associated with their cron expression:

    If timeZone is not provided, the local timezone will be used, as described in the .

    Passwords

    Some CRs require passwords provided as Secret references to function properly. For instance, the root password for a MariaDB resource:

    By default, fields like rootPasswordSecretKeyRef are optional and defaulted by the operator, resulting in random password generation if not provided:

    You may choose to explicitly provide a Secret reference via rootPasswordSecretKeyRef and opt-out from random password generation by either not providing the generate field or setting it to false:

    This way, we are telling the operator that we are expecting a Secret to be available eventually, enabling the use of GitOps tools to seed the password:

    • : The Secret is reconciled from a SealedSecret, which is decrypted by the sealed-secrets controller.

    • : The Secret is reconciled fom an ExternalSecret, which is read by the external-secrets controller from an external secrets source (Vault, AWS Secrets Manager ...).

    External resources

    Many CRs have a references to external resources (i.e. ConfigMap, Secret) not managed by the operator.

    These external resources should be labeled with enterprise.mariadb.com/watch so the operator can watch them and perform reconciliations based on their changes. For example, see the my.cnf ConfigMap:

    Probes

    Kubernetes probes serve as an inversion of control mechanism, enabling the application to communicate its health status to Kubernetes. This enables Kubernetes to take appropriate actions when the application is unhealthy, such as restarting or stop sending traffic to Pods.

    Make sure you check the if you are unfamiliar with Kubernetes probes.

    Fine tunning of probes for databases running in Kubernetes is critical, you may do so by tweaking the following fields:

    There isn't an universally correct default value for these thresholds, so we recommend determining your own based on factors like the compute resources, network, storage, and other aspects of the environment where your MariaDB and MaxScale instances are running.

    Hashicorp Key Management

    The is used to implement encryption using keys stored in the Hashicorp Vault KMS.

    For more information about configuring the plugin as well as different capabilities, please check the . This guide will cover a minimal example for configuring the plugin with the operator.

    Configuring TDE in MariaDB Using Hashicorp Key Management Plugin

    CREATE USER 'monitor'@'<Enterprise_Manager_IP>' IDENTIFIED BY '<password>';
    GRANT REPLICA MONITOR ON *.* TO 'monitor'@'<Enterprise_Manager_IP>';
    CREATE USER 'monitor'@'localhost' IDENTIFIED BY '<password>';
    GRANT PROCESS, BINLOG MONITOR, REPLICA MONITOR, REPLICATION MASTER ADMIN ON *.* TO 'monitor'@'localhost';
    CREATE USER 'monitor'@'localhost' IDENTIFIED BY '<password>';
    GRANT PROCESS, BINLOG MONITOR, REPLICA MONITOR, REPLICATION MASTER ADMIN ON *.* TO 'monitor'@'localhost';
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: User
    metadata:
      name: bob
    spec:
      mariaDbRef:
        name: mariadb
      passwordSecretKeyRef:
        name: bob-password
        key: password
      maxUserConnections: 20
      host: "%"
      cleanupPolicy: Delete
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: User
    metadata:
      name: user
    spec:
      name: user-custom
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: Grant
    metadata:
      name: grant-bob
    spec:
      mariaDbRef:
        name: mariadb
      privileges:
        - "SELECT"
        - "INSERT"
        - "UPDATE"
      database: "*"
      table: "*"
      username: bob
      grantOption: true
      host: "%"
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: Database
    metadata:
      name: wordpress
    spec:
      mariaDbRef:
        name: mariadb
      characterSet: utf8
      collate: utf8_general_ci
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: Database
    metadata:
      name: database
    spec:
      name: database-custom
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb
    spec:
      username: bob
      passwordSecretKeyRef:
        name: bob-password
        key: password
      database: wordpress
    apiVersion: v1
    kind: Secret
    metadata:
      name: mariadb-auth
    stringData:
      passwordHash: "*57685B4F0FF9D049082E296E2C39354B7A98774E"
    ---
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: User
    metadata:
      name: user-password-hash
    spec:
      mariaDbRef:
        name: mariadb
      passwordHashSecretKeyRef:
        name: mariadb-auth
        key: passwordHash
      host: "%"
    apiVersion: v1
    kind: Secret
    metadata:
      name: mariadb-auth
    stringData:
      passwordHash: "*57685B4F0FF9D049082E296E2C39354B7A98774E"
      nativePasswordPlugin: mysql_native_password
    ---
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: User
    metadata:
      name: user-password-plugin
    spec:
      mariaDbRef:
        name: mariadb
      passwordPlugin:
        pluginNameSecretKeyRef:
            name: mariadb-auth
            key: nativePasswordPlugin
        pluginArgSecretKeyRef:
            name: mariadb-auth
            key: passwordHash
      host: "%"
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: User
    metadata:
      name: user
    spec:
      requeueInterval: 30s
      retryInterval: 5s
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: User
    metadata:
      name: user
    spec:
      cleanupPolicy: Delete
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb
    spec:
      ...
      myCnf: |
        [mariadb]
        bind-address=*
        default_storage_engine=InnoDB
        binlog_format=row
        innodb_autoinc_lock_mode=2
        innodb_buffer_pool_size=1024M
        max_allowed_packet=256M

    NULL replaced by

    How NULL values should be represented (e.g., \N).

    With Headers

    Checkbox to include column names as the first row.

    SQL Options

    Export option

    Choose whether to export Both structure and data, Data only (INSERT statements), or Structure only (CREATE TABLE).

    JSON Options

    None

    File name

    The name for the downloaded export file. A default name with the current date is usually suggested.

    Fields to export

    Allows you to select which columns from the query result set to include in the export.

    File format

    Choose the output format: CSV, SQL, or JSON.

    CSV Options

    Fields terminated by

    The character used to separate values (e.g., , or \t).

    Lines terminated by

    The character indicating the end of a row (e.g., \n).

    Status: Availability of the node.

    Last_SQL_Errno

    Most recent numeric error code reported by the SQL thread.

    Read_Master_Log_Pos

    Current read position in the source’s binary log.

    Relay_Log_Pos

    Last executed position in the local relay log.

    Deadlocks

    Number of detected deadlocks, where transactions block each other and require one to be rolled back.

    CPU Utilisation

    Line graph of CPU usage percentage per instance.

    Memory Usage

    Percentage of used memory per instance (excluding cache/buffers).

    Network Traffic

    Time-series of receive and transmit throughput per instance (bits per second).

    Filesystems Info

    Table with filesystem type, mount point, capacity, and instance.

    Disk Used Space Utilisation

    Graph of percentage disk space used per mount point.

    Disk IOPS

    Reads and writes per second per storage device.

    Binlog Size

    Current binary log size per instance.

    Binlog Throughput

    Bytes written to binary logs per second.

    Binlog Commits

    Rate of commit operations recorded in binary logs.

    Replication Lag

    Replication delay value reported in seconds.

    Slave_connections

    Number of replication I/O connections to the upstream source.

    Retried_transactions

    Total replicated transactions retried due to transient errors.

    Slave_IO_Running

    Status flag indicating if the I/O thread is fetching events.

    Slave_SQL_Running

    Status flag indicating if the SQL thread is applying events.

    Last_Errno

    Most recent numeric error code for replication issues overall.

    Last_IO_Errno

    Most recent numeric error code reported by the I/O thread.

    Current Threads Running

    Number of threads actively executing queries.

    Questions (QPS)

    Queries per second executed on each instance.

    Slow Queries

    Rate of queries exceeding long_query_time.

    Created Tmp Disk Tables

    On-disk temporary tables created per second.

    Number of Connections

    Current number of active client connections (Threads_connected).

    Connection Utilization

    Share of connections in use compared to the configured maximum (Threads_connected / max_connections).

    % of Aborted Connections

    Percentage of connection attempts that failed or were aborted (aborted_connects / connections).

    Select Range Scan

    Number of SELECT operations performing range scans.

    Select Full Range Join

    Number of queries that performed a full range join. Indicates potential suboptimal indexing or join conditions.

    Select Range Check

    Number of SELECT operations requiring range checks.

    InnoDB Read/Writes

    Rate of physical read and write operations by InnoDB per second. Reads are disk fetches, writes are disk flushes.

    InnoDB Buffer Pool Reads

    Logical reads from the buffer pool vs. evicted or read-ahead pages, indicating buffer pool efficiency.

    InnoDB Row Lock

    Number of row lock waits in InnoDB, with high values indicating contention or poor indexing.

    InnoDB Checkpoint Age

    Size of uncheckpointed redo log data in bytes, with large sizes signaling risk of long crash recovery times.

    InnoDB Log Writes

    Number of write operations to the InnoDB redo log per second, reflecting redo logging activity.

    InnoDB History List Length

    Length of the undo log history list, with growth indicating long-running transactions preventing purge.

    Ability to choose whether the old primary rejoins as a replica

  • Connection pooling

  • Galera
    MaxScale
    dedicated nodes
    pod disruption budgets
    Asynchronous replication
    Synchronous multi-master Galera
    standalone topology
    MaxScale
    MaxScale docs
    Kubernetes documentation
    Kubernetes documentation
    Pod Anti-Affinity
    Kubernetes documentation

    Transparent Data Encryption (TDE) can be configured in MariaDB leveraging the Hashicorp Key Management Plugin.

    Requirements

    • Running and accessible Vault KMS setup with a valid SSL certificate.

    • Vault is unsealed and you've logged in to it with vault login $AUTH_TOKEN, where $AUTH_TOKEN is an authentication token given to you by an administrator

    • openssl for generating secrets

    Steps

    1. Creating A New Key-Value Store In Vault. Create a new key-value store and take note of the path. In our example we will use mariadb.

    2. Adding necessary secrets. We will put 2 secrets with ids 1 and 2. 2 will be used for temporary files, while 1 will be used for everything else. It is not neccessary to create 2 of them and in that case, temporary files will use 1.

      Note: Here you should use the path we chose in the previous step.

    3. (Optional) Create An Authentication Token With Policy. This step can be skipped if you want to use your own token. Consult with a Vault administrator regarding this. Policies are Vault's way to restrict access to what you are allowed to do. The following is a policy that should be used by the token following the least permission principle.

      After which, we can create a new token with the given policy.

      You will see output similar to:

      Your new token is: EXAMPLE_TOKEN.

    4. Create A Secret For the vault token. Now that you've either created a new token, or are using an existing one, we need to create a secret with it.

    5. Create a Secret for the Certificate Authority (CA) used to issue the Vault certificate. For further information, consult If you have the certificate locally in a file called ca.crt you can run:

    6. Create A MariaDB Custom Resource. The final step is creating a new MariaDB instance.

      mariadb-vault.yaml

      kubectl apply -f mariadb-vault.yaml

    7. Verify Encryption Works.

      You should see something along the lines of:

      At this point, you can check the encryption status:

      If you create a new database and then table, the above query should return additional information about them. Something like:

      Note: The above query is truncated. In reality, you will see a few more columns.

    Day-2 Operations

    Rotating Secrets

    1. Put A New Secret In Vault. After logging in to vault, you can run again:

      This will start re-encrypting data.

    2. Monitor Re-Encryption.

      If you check the encrpytion status again:

      You should see CURRENT_KEY_VERSION column start getting updated to point to the new key version.

    Rotating Token

    Make sure when rotating the token, to do so in advance of the token expiring.

    1. Acquire a new token and update the secret.

    2. Restart MariaDB Pods. MariaDB will continue using the old token until the Pods are restarted. You can add the following annotation to the Pods in order to trigger an update, see the updates documentation for further detail:

    Known Issues/Limitations

    Vault Not Being Accessible Will Result In MariaDB Not Working

    As MariaDB uses Vault to fetch it's decryption key, in case that Vault becomes unavailable, it will result in MariaDB not being able to fetch the decryption key and hence stop working. While the Hashicorp plugin has a configurable cache, that should be set and will result in MariaDB still working for a few seconds to minutes, depending on configuration, the cache is not reliable as it's ephemeral and short lived.

    Deleting The Decryption Key Will Make Your Data Inaccessible.

    It is recommended to back up the decryption key so accidental deletions will not result in issues.

    Decryption Key Must Be Hexadecimal

    Use the following to generate correct decryption keys.

    Rotating The Decryption Key Before A Previous Re-Encryption Has Finished, Will Result In Data Corruption.

    To check the re-encryption progress, you can run:

    Look for the CURRENT_KEY_VERSION and make sure they are in sync with the latest version you have in Vault.

    Hashicorp Key Management Plugin
    documentation
    external resources
    myCnf field
    Kubernetes docs
    sealed-secrets
    external-secrets
    Kubernetes documentation

    Docker Images

    Certified images

    All the Docker images used by this operator are based on and have been . The advantages of using UBI based images are:

    • Immutability: UBI images are built to be secure and stable, reducing the risk of unintended changes or vulnerabilities due to mutable base layers.

    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      bootstrapFrom:
        restoreJob:
          affinity:
            antiAffinityEnabled: true
      ...
      metrics:
        exporter:
          affinity:
            antiAffinityEnabled: true
      ...
      affinity:
        antiAffinityEnabled: true
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: Backup
    metadata:
      name: backup
    spec:
      mariaDbRef:
        name: mariadb-galera
      ...
      affinity:
        antiAffinityEnabled: true
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: Restore
    metadata:
      name: restore
    spec:
      mariaDbRef:
        name: mariadb-galera
      ...
      affinity:
        antiAffinityEnabled: true
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale-galera
    spec:
      mariaDbRef:
        name: mariadb-galera
      ...
      metrics:
        exporter:
          affinity:
            antiAffinityEnabled: true
      ...
      affinity:
        antiAffinityEnabled: true
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale-galera
    spec:
      mariaDbRef:
        name: mariadb-galera
      ...
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: app.kubernetes.io/instance
                operator: In
                values:
                - maxscale-galera
                # 'mariadb-galera' instance omitted (default anti-affinity rule)
            topologyKey: kubernetes.io/hostname
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      ...
      tolerations:
        - key: "enterprise.mariadb.com/ha"
          operator: "Exists"
          effect: "NoSchedule"
      nodeSelector:
        "enterprise.mariadb.com/node": "ha" 
      affinity:
        antiAffinityEnabled: true
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      ...
        podDisruptionBudget:
          maxUnavailable: 33%
    vault secrets enable -path /mariadb -version=2 kv
    vault kv put /mariadb/1 data="$(openssl rand -hex 32)"
    vault kv put /mariadb/2 data="$(openssl rand -hex 32)"
    kubectl run mariadb-connect --rm -it --image=mariadb:11.4 -- bash -c "mariadb -u root -p'MariaDB11!' --ssl=false -h mariadb"
    SELECT * from information_schema.INNODB_TABLESPACES_ENCRYPTION;
    MariaDB [my_db]> SELECT * from information_schema.INNODB_TABLESPACES_ENCRYPTION;
    +-----------------+-------------------+-----------------+---------------------+----------------+----------------------+
    | NAME            | ENCRYPTION_SCHEME | MIN_KEY_VERSION | CURRENT_KEY_VERSION | CURRENT_KEY_ID | ROTATING_OR_FLUSHING |
    +-----------------+-------------------+-----------------+---------------------+----------------+----------------------+
    | innodb_system   |                 1 |               1 |                   2 |              1 |                    0 |
    | innodb_undo001  |                 1 |               1 |                   2 |              1 |                    0 |
    | innodb_undo002  |                 1 |               1 |                   2 |              1 |                    0 |
    | innodb_undo003  |                 1 |               1 |                   2 |              1 |                    0 |
    | mysql/innodb_ta |                 1 |               1 |                   2 |              1 |                    0 |
    | mysql/innodb_in |                 1 |               1 |                   2 |              1 |                    0 |
    | mysql/gtid_slav |                 1 |               1 |                   2 |              1 |                    0 |
    | mysql/transacti |                 1 |               1 |                   2 |              1 |                    0 |
    | my_db/people    |                 1 |               1 |                   2 |              1 |                    0 |
    +-----------------+-------------------+-----------------+---------------------+----------------+----------------------+
    export TOKEN="EXAMPLE_TOKEN"
    kubeclt create secret generic mariadb-vault-token --from-literal=token="$TOKEN"
    apiVersion: k8s.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb
    spec:
      ...
      podMetadata:
        annotations:
          enterprise.mariadb.com/restarted-at: "2025-09-19T12:54:10Z"
    openssl rand -hex 32
    SELECT * from information_schema.INNODB_TABLESPACES_ENCRYPTION;
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb
    spec:
      ...
      myCnfConfigMapKeyRef:
        name: mariadb
        key: mycnf
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb
    spec:
      ...
      resources:
        requests:
          cpu: 1
          memory: 4Gi
        limits:
          memory: 4Gi
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb
    spec:
      ...
      myCnf: |
        [mariadb]
        innodb_buffer_pool_size=3200M
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      timeZone: "UTC"
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: Backup
    metadata:
      name: backup-scheduled
    spec:
      mariaDbRef:
        name: mariadb
      schedule:
        cron: "*/1 * * * *"
        suspend: false
      timeZone: "UTC"
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      rootPasswordSecretKeyRef:
        name: mariadb
        key: root-password
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      rootPasswordSecretKeyRef:
        name: mariadb
        key: root-password
        generate: true
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      rootPasswordSecretKeyRef:
        name: mariadb
        key: root-password
        generate: false
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb
    spec:
      ...
      myCnfConfigMapKeyRef:
        name: mariadb
        key: mycnf
    apiVersion: v1
    kind: ConfigMap
    metadata:
      name: mariadb
      labels:
        enterprise.mariadb.com/watch: ""
    data:
      mycnf: |
        [mariadb]
        bind-address=*
        default_storage_engine=InnoDB
        binlog_format=row
        innodb_autoinc_lock_mode=2
        innodb_buffer_pool_size=1024M
        max_allowed_packet=256M
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      # Tune your liveness probe accordingly to avoid Pod restarts.
      livenessProbe:
        periodSeconds: 10
        timeoutSeconds: 5
    
      # Tune your readiness probe accordingly to prevent disruptions in network traffic.
      readinessProbe:
        periodSeconds: 10
        timeoutSeconds: 5
    
      # Tune your startup probe accordingly to ensure that the SST completes with a large amount of data.
      # failureThreshold × periodSeconds = 30 × 10 = 300s = 5m until the container gets restarted if unhealthy
      startupProbe:
        failureThreshold: 30
        periodSeconds: 10
        timeoutSeconds: 5
    the docs
    vault kv put /mariadb/1 data="$(openssl rand -hex 32)"
    vault kv put /mariadb/2 data="$(openssl rand -hex 32)"
    cat <<'EOF' | vault policy write -non-interactive mariadb -
    # Allow access to MariaDB secrets
    path "mariadb/*" {
      capabilities = ["create", "read", "update", "delete", "list"]
    }
    
    # Allow reading the mount configuration
    path "sys/mounts/mariadb/tune" {
      capabilities = ["read"]
    }
    EOF
    vault token create -policy mariadb
    Key                  Value
    ---                  -----
    token                EXAMPLE_TOKEN
    token_accessor       utFtmh98YAAJyYdxEVN3SFQA
    token_duration       768h
    token_renewable      true
    token_policies       ["default" "mariadb"]
    identity_policies    []
    policies             ["default" "mariadb"]
    export TOKEN="EXAMPLE_TOKEN"
    kubeclt create secret generic mariadb-vault-token --from-literal=token="$TOKEN"
    kubectl create secret generic vault-tls --from-file=./ca.crt
    ---
    apiVersion: v1
    kind: Secret
    metadata:
      name: mariadb # Used to hold the mariadb and root user passwords
      labels:
        enterprise.mariadb.com/watch: ""
    stringData:
      password: MariaDB11!
      root-password: MariaDB11!
    ---
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb
    spec:
      image: docker.mariadb.com/enterprise-server:11.4.7-4.3
      rootPasswordSecretKeyRef:
        name: mariadb
        key: password
    
      username: mariadb
      passwordSecretKeyRef:
        name: mariadb-password
        key: password
        generate: true
      database: mariadb
    
      port: 3306
    
      storage:
        size: 1Gi
        # storageClassName: csi-hostpath-sc
    
      myCnf: |
        [mariadb]
        bind-address=*
        default_storage_engine=InnoDB
        binlog_format=row
        innodb_autoinc_lock_mode=2
        innodb_buffer_pool_size=800M
        max_allowed_packet=256M
    
        plugin_load_add = hashicorp_key_management
        hashicorp-key-management-vault-url=https://vault-0.vault-internal.default.svc.cluster.local:8200/v1/mariadb
        hashicorp-key-management-caching-enabled=ON
        hashicorp-key-management-vault-ca=/etc/vault/certs/ca.crt
    
        innodb_encrypt_tables = FORCE
        innodb_encrypt_log = ON
        innodb_encrypt_temporary_tables = ON
        encrypt_tmp_disk_tables = ON
        encrypt_tmp_files = ON
        encrypt_binlog = ON
        aria_encrypt_tables = ON
    
        innodb_encryption_threads = 4
        innodb_encryption_rotation_iops = 2000
    
      env:
        - name: VAULT_TOKEN # This is where our token is defined!
          valueFrom:
            secretKeyRef:
              name: mariadb-vault-token
              key: token
    
      resources:
        requests:
          cpu: 100m
          memory: 128Mi
        limits:
          memory: 1Gi
    
      metrics:
        enabled: true
    
      volumes:
        - name: vault-certificates
          secret:
            secretName: vault-tls
            defaultMode: 0600
      volumeMounts:
        - name: vault-certificates
          mountPath: /etc/vault/certs/
    kubectl run mariadb-connect --rm -it --image=mariadb:11.4 -- bash -c "mariadb -u root -p'MariaDB11!' --ssl=false -h mariadb"
    If you don't see a command prompt, try pressing enter.
    Welcome to the MariaDB monitor.  Commands end with ; or \g.
    Your MariaDB connection id is 95
    Server version: 11.4.7-4-MariaDB-enterprise MariaDB Enterprise Server
    
    Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
    
    Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
    
    MariaDB [(none)]>
    SELECT * from information_schema.INNODB_TABLESPACES_ENCRYPTION;
    MariaDB [my_db]> SELECT * from information_schema.INNODB_TABLESPACES_ENCRYPTION;
    +-----------------+-------------------+-----------------+---------------------+----------------+----------------------+
    | NAME            | ENCRYPTION_SCHEME | MIN_KEY_VERSION | CURRENT_KEY_VERSION | CURRENT_KEY_ID | ROTATING_OR_FLUSHING |
    +-----------------+-------------------+-----------------+---------------------+----------------+----------------------+
    | innodb_system   |                 1 |               1 |                   1 |              1 |                    0 |
    | innodb_undo001  |                 1 |               1 |                   1 |              1 |                    0 |
    | innodb_undo002  |                 1 |               1 |                   1 |              1 |                    0 |
    | innodb_undo003  |                 1 |               1 |                   1 |              1 |                    0 |
    | mysql/innodb_ta |                 1 |               1 |                   1 |              1 |                    0 |
    | mysql/innodb_in |                 1 |               1 |                   1 |              1 |                    0 |
    | mysql/gtid_slav |                 1 |               1 |                   1 |              1 |                    0 |
    | mysql/transacti |                 1 |               1 |                   1 |              1 |                    0 |
    | my_db/people    |                 1 |               1 |                   1 |              1 |                    0 |
    +-----------------+-------------------+-----------------+---------------------+----------------+----------------------+
    Small size: The UBI minimal and micro variants used by this operator are designed to be lightweight, containing only the essential packages. This can lead to smaller container image sizes, resulting in faster build times, reduced storage requirements, and quicker image pulls.
  • Security and compliance: Regular CVE scanning and vulnerability patching help maintain compliance with industry standards and security best practices.

  • Enterprise-grade support: UBI images are maintained and supported by Red Hat, ensuring timely security updates and long-term stability.

  • List of compatible images

    MariaDB Enterprise Kubernetes Operator is compatible with the following Docker images:

    Component
    Image
    Supported Tags
    CPU Architecture

    MariaDB Enterprise Kubernetes Operator (ppc64le support)

    docker.mariadb.com/mariadb-enterprise-operator

    25.10.2 25.10.1 25.10.0 25.8.0

    amd64 arm64 ppc64le

    MariaDB Enterprise Kubernetes Operator

    docker.mariadb.com/mariadb-enterprise-operator

    1.0.0

    amd64 arm64

    MariaDB Enterprise Server (ppc64le support)

    docker.mariadb.com/enterprise-server

    11.8.3-1 11.4.8-5 11.4.7-4.3 11.4.7-4.2 11.4.7-4.1 11.4 10.6.23-19 10.6.22-18.1 10.6

    Refer to the registry documentation to access docker.mariadb.com with your customer credentials.

    Working With Air-Gapped Environments

    This section outlines several methods for pulling official MariaDB container images from docker.mariadb.com and making them available in your private container registry. This is often necessary for air-gapped, offline, or secure environments.

    Option 1: Direct Pull, Tag, and Push

    This method is ideal for a "bastion" or "jump" host that has network access to both the public internet (specifically docker.mariadb.com) and your internal private registry.

    1. Log in to both registries. You will need a MariaDB token for the public registry and your credentials for the private one. Refer to the official documentation.

    2. Pull the required image. Pull the official MariaDB Enterprise Kubernetes Operator image from its public registry.

    3. Tag the image for your private registry. Create a new tag for the image that points to your private registry's URL and desired repository path.

    4. Push the re-tagged image. Push the newly tagged image to your private registry.

    Option 2: Using a Proxy or Caching Registry

    Many modern container registries can be configured to function as a pull-through cache or proxy for public registries. When an internal client requests an image, your registry pulls it from the public source, stores a local copy, and then serves it. This automates the process after initial setup.

    You can use Harbor as a pull-through cache (Harbor calls this Replication Rules).

    Option 3: Offline Transfer using docker save and docker push

    This method is designed for fully air-gapped environments where no single machine has simultaneous access to the internet and the private registry.

    On the Internet-Connected Machine

    1. Log in and pull the image.

    2. Save the image to a tar archive. This command packages the image into a single, portable file.

      Use a tool like scp or sftp or a USB drive to copy the generated .tar archives from the internet-connected machine to your isolated systems.

    On the Machine with Private Registry Access

    1. Load the image from the archive.

    2. Log in to your private registry.

    3. Tag the loaded image. The image loaded from the tar file will retain its original tag. You must re-tag it for your private registry.

    4. Push the image to your private registry.

    Option 4: For OpenShift, you can use OpenShift Disconnected Installation Mirroring

    Refer to the official Red Hat documentation

    Option 5: Offline Transfer for containerd Environments

    This method is for air-gapped environments that use containerd as the container runtime (common in Kubernetes) and do not have the Docker daemon. It uses the ctr command-line tool to import, tag, and push images. ⚙️

    1. On the Bastion Host (with Internet)

    First, on a machine with internet access, you'll pull the images and export them to portable archive files.

    1. Pull the Container Image Use the ctr image pull command to download the required image from its public registry.

      Note: If your bastion host uses Docker, you can use docker pull instead as we did in Option 3.

    2. Export the Image to an Archive Next, export the pulled image to a .tar file using ctr image export. The format is ctr image export <output-filename> <image-name>.

      Note: To find the exact image name as containerd sees it, run ctr image ls. The Docker equivalent for this step is docker save <image-name> -o <output-filename>.

    Repeat this process for all the container images you need to transfer.

    2. Transfer the Archives

    Use a tool like scp or sftp or a USB drive to copy the generated .tar archives from the bastion host to your isolated systems.

    3. On the Isolated Host

    Finally, on the isolated system, you will import the archives into containerd. Official Docs

    1. Importing for Kubernetes (Important!) ⚙️ If the images need to be available to Kubernetes, you must import them into the k8s.io namespace by adding the -n=k8s.io flag.

    2. Verify the Image Check that containerd recognizes the newly imported image.

      You can also verify that the Container Runtime Interface (CRI) sees it by running:

    Important Note

    The examples above use the mariadb-enterprise-operator:25.8.0 image. You must repeat the chosen process for all required container images. A complete list is available here

    Additional Resources

    Red Hat UBI
    certified by Red Hat
    # Log in to the official MariaDB registry
    docker login docker.mariadb.com
    
    # Log in to your private registry
    docker login <private-registry-url>
    docker pull docker.mariadb.com/mariadb-enterprise-operator:25.8.0
    docker tag docker.mariadb.com/mariadb-enterprise-operator:25.8.0 <private-registry-url>/mariadb/mariadb-enterprise-operator:25.8.0
    docker login docker.mariadb.com
    docker pull docker.mariadb.com/mariadb-enterprise-operator:25.8.0
    docker save [docker.mariadb.com/mariadb-enterprise-operator:25.8.0 -o mariadb-enterprise-operator_25.8.0.tar
    docker load -i mariadb-enterprise-operator_25.8.0.tar
    docker login <private-registry-url>
    docker tag docker.mariadb.com/mariadb-enterprise-operator:25.8.0 <private-registry-url>/mariadb/mariadb-enterprise-operator:25.8.0
    docker push <private-registry-url>/mariadb/mariadb-enterprise-operator:25.8.0
    ctr image pull docker.mariadb.com/mariadb-enterprise-operator:25.8.0
    ctr -n=k8s.io image import mariadb-enterprise-operator-25.8.0.tar
    ctr image ls
    crictl images

    amd64 arm64 ppc64le

    MariaDB Enterprise Server

    docker.mariadb.com/enterprise-server

    11.4.5-3 11.4.4-2 10.6.21-17 10.6.20-16.1 10.6.19-15.1 10.6.18-14.2 10.6.17-13.2

    amd64 arm64

    MaxScale Enterprise (ppc64le support)

    docker.mariadb.com/maxscale

    25.10.0 25.01.4 25.01.3-1 25.01

    amd64 arm64 ppc64le

    MaxScale Enterprise

    docker.mariadb.com/maxscale-enterprise

    25.01.2 25.01.1

    amd64 arm64

    MaxScale

    mariadb/maxscale

    23.08.9-ubi 23.08-ubi 24.02.5-ubi 24.02-ubi

    amd64 arm64

    MariaDB Prometheus Exporter (ppc64le support)

    mariadb/mariadb-prometheus-exporter-ubi

    1.1.0

    amd64 arm64 ppc64le

    MariaDB Prometheus Exporter

    mariadb/mariadb-prometheus-exporter-ubi

    1.0.0

    amd64 arm64

    MaxScale Prometheus Exporter (ppc64le support)

    mariadb/maxscale-prometheus-exporter-ubi

    1.1.0

    amd64 arm64 ppc64le

    MaxScale Prometheus Exporter

    mariadb/maxscale-prometheus-exporter-ubi

    1.0.0

    amd64 arm64

    MariaDB Enterprise nslcd sidecar

    docker.mariadb.com/nslcd

    0.9.10-13

    amd64 arm64 ppc64le

    PAM

    The MariaDB pam plugin facilitates user authentication by interfacing with the Pluggable Authentication Modules (PAM) framework, enabling diverse and centralized authentication schemes.

    Currently the enterprise operator utilizes this plugin to provide support for:

    • LDAP based authentication

    LDAP

    This guide outlines the process of configuring MariaDB to authenticate users against an LDAP or Active Directory service. The integration is achieved by using MariaDB's Pluggable Authentication Module (PAM) plugin, which delegates authentication requests to the underlying Linux PAM framework.

    How Does It Work?

    To enable LDAP authentication for MariaDB through PAM, several components work in tandem:

    • PAM (Pluggable Authentication Modules): A framework used by Linux and other UNIX-like systems to consolidate authentication tasks. Applications like MariaDB can use PAM to authenticate users without needing to understand the underlying authentication mechanism. Operations such as system login, screen unlocking, and sudo access commonly use PAM.

    • nss-pam-ldapd: This is the software package that provides the necessary bridge between PAM and an LDAP server. It includes the core components required for authentication.

    • pam_ldap.so: A specific PAM module, provided by the nss-pam-ldapd package. This module is the "plug-in" that the PAM framework loads to handle authentication requests destined for an LDAP server.

    The nslcd daemon is ran as a sidecar container and communication happens through the shared unix socket, following container best practices of keeping a single process per container.

    What is needed for LDAP Auth?

    nslcd is configured with 2 files. nslcd.conf which tells the daemon about the LDAP server and nsswitch.conf, determine the sources from which to obtain name-service information.

    nslcd can be configured to run as a specific user based on the uid and gid props specified in the config file, however that user should have sufficient permissions to read/write to /var/run/nslcd, should own both nslcd.conf and nsswitch.conf and they should not be too open (0600).

    Both of these configuration files will be attached later on in the example given.

    nslcd.conf

    The /etc/nslcd.conf is the configuration file for LDAP nameservice daemon.

    In a production environment it is recommended to use LDAPS (LDAP secure), which uses traditional TLS encryption to secure data in transit. To do so, you need to add the following to your nslcd.conf file:

    nsswitch.conf

    The Name Service Switch (NSS) configuration file, located at /etc/nsswitch.conf. It is used by the GNU C Library and certain other applications to determine the sources from which to obtain name-service information in a range of categories, and in what order. Each category of information is identified by a database name.

    Installing The PAM Plugin

    The pam plugin is not enabled by default (even though it is installed). To enable it, you should add the following lines to your MariaDB Custom Resource:

    See below for a complete example.

    Combining It All Together

    Fistly, we need to create our ConfigMaps and Secrets, that will store the nsswitch.conf, nslcd.conf and the mariadb pam module.

    Make sure to adapt the nslcd-conf as per your ldap server configuration.

    mariadb-nss-config.yaml:

    kubectl apply -f mariadb-nss-config.yaml

    Now that our configuration is done, we need to create the MariaDB custom resource along with needed configurations.

    mariadb.yaml:

    kubectl apply -f mariadb.yaml

    And in the end we need to create our user in the database, which must have the same name as a user in ldap server. In the example below that's ldap-user. We also create mariadb-ldap secret, which holds the name of the plugin we are using as well as the module we need to load.

    mariadb-user.yaml:

    kubectl apply -f mariadb-user.yaml

    After a few seconds, the user should have been created by the operator. To verify that all is working as expected, modify the <password> field below and run:

    You should see something along the lines of:

    LDAPS

    If you followed the instructions for setting up a basic MariaDB instance with ldap, you need to fetch the public certificate that your LDAP server is set up with and add it to a called mariadb-ldap-tls.

    If you have the certificate locally in a file called tls.crt you can run:

    Known Issues

    Slow Start On KIND

    This may be a problem with the maximum number of file-handles a process can allocate. Some systems have this value set to really high, which causes an issue. To remedy this, you need to delete your kind cluster and run:

    At this point, the problem should be fixed.

    For more information, check .

    docker push <private-registry-url>/mariadb/mariadb-enterprise-operator:25.8.0
    ctr image export mariadb-enterprise-operator-25.8.0.tar docker.mariadb.com/mariadb-enterprise-operator:25.8.0

    nslcd (Name Service Lookup Daemon): This daemon acts as an intermediary service. The pam_ldap.so module does not communicate directly with the LDAP server. Instead, it forwards authentication requests to the nslcd daemon, which manages the connection and communication with the LDAP directory. This design allows for connection caching and a more robust separation of concerns.

    secret
    this comment

    Deployment Overview

    What You Have

    One Package: ai-nexus.deb

    What's Inside the Package:

    • RAG API application

    • MCP Server application

    • Both applications bundled together

    What You Need to Deploy

    1. The Application Package (ai-nexus.deb)

    This contains your RAG API and MCP Server applications.

    2. A Database (MariaDB)

    The applications need a database to store documents and vector embeddings.

    3. Configuration (Secret Management Mode)

    You need to choose HOW to provide secrets (API keys, passwords) to the applications.


    Two Deployment Options

    Option A: Deploy on Ubuntu (Native) ✅ SIMPLER

    What happens: Install the .deb package directly on Ubuntu

    Steps:

    1. Install MariaDB on Ubuntu

    2. Install ai-nexus.deb on Ubuntu

    3. Configure secrets (choose a mode)

    4. Start services

    Guide: UBUNTU_DEPLOYMENT_GUIDE.md


    Option B: Deploy with Docker (on Windows) 🐳

    What happens: Package everything in Docker containers

    Steps:

    1. Build Docker image (wraps the .deb package)

    2. Start containers with docker-compose

    3. Configure secrets (choose a mode)

    Guide: DOCKER_DEPLOYMENT_GUIDE.md


    Secret Management Modes (Works with BOTH Options)

    After you deploy the application (Ubuntu or Docker), you choose ONE mode:

    Mode 1: Standalone (Simplest) ⭐

    How it works: Secrets stored in a plain text config file

    Config File Location:

    • Ubuntu: /opt/rag-in-a-box/config/config.env.template

    • Docker: config.env.secure.local

    Example:

    How to generate secure keys:

    When to use: Development, testing, single developer


    Mode 2: Local Vault (Production-Like) 🔐

    How it works: Secrets stored in HashiCorp Vault (running locally)

    Architecture:

    Config File Location:

    • Ubuntu: /opt/rag-in-a-box/config/config.env.template

    • Docker: config.env.vault.local

    Example:

    When to use: Team development, production-like testing


    Mode 3: 1Password (Enterprise) 🔑

    How it works: Secrets stored in 1Password vault

    Architecture:

    Config File:

    When to use: Enterprise with 1Password subscription


    Mode 4: HCP Vault (Production Cloud) ☁️

    How it works: Secrets stored in HashiCorp Cloud Platform

    Architecture:

    When to use: Production cloud deployments


    Complete Deployment Flow

    Scenario 1: Ubuntu Native + Standalone Mode


    Scenario 2: Ubuntu Native + Vault Mode


    Scenario 3: Docker + Standalone Mode


    Scenario 4: Docker + Vault Mode


    Key Points to Understand

    1. The Package is the Same

    The ai-nexus.deb package is identical regardless of:

    • Where you deploy it (Ubuntu or Docker)

    • Which secret mode you use (Standalone, Vault, 1Password, HCP)

    2. Deployment Location is Independent of Secret Mode

    You can use ANY secret mode with ANY deployment location:

    • Ubuntu + Standalone ✅

    • Ubuntu + Vault ✅

    • Ubuntu + 1Password ✅

    • Docker + Standalone ✅

    3. The Application Decides at Startup

    When RAG API and MCP Server start, they:

    1. Read the config file

    2. Check which mode is configured

    3. Fetch secrets accordingly:

      • Standalone: Read from config file directly


    Which Guide to Use?

    I want to deploy on Ubuntu (no Docker)

    → Use: UBUNTU_DEPLOYMENT_GUIDE.md

    Then choose secret mode:

    • Standalone: Edit /opt/rag-in-a-box/config/config.env.template with actual secrets

    • Vault: Install Vault, store secrets, configure Vault connection in config

    • 1Password: Install 1Password CLI, configure 1Password references in config


    I want to deploy with Docker (on Windows)

    → Use: DOCKER_DEPLOYMENT_GUIDE.md

    Then choose secret mode:

    • Standalone: Edit config.env.secure.local with actual secrets

    • Vault: Run Vault container, store secrets, use config.env.vault.local

    • 1Password: Install 1Password CLI, use config.env.1password.employee


    Quick Decision Tree


    Example: Complete Ubuntu Deployment (Standalone)


    Example: Complete Ubuntu Deployment (Vault)


    Summary

    One Package (ai-nexus.deb) contains RAG API + MCP Server

    Two Deployment Options:

    1. Ubuntu Native (install .deb directly)

    2. Docker (wrap .deb in container)

    Four Secret Modes (choose one):

    1. Standalone (secrets in config file)

    2. Local Vault (secrets in local Vault)

    3. 1Password (secrets in 1Password)

    4. HCP Vault (secrets in cloud Vault)

    The application is the same - only the deployment location and secret source change.


    Which Documentation to Read?

    Your Situation
    Read This

    Is this clearer now? The key insight is:

    • Same package everywhere

    • Choose where to deploy (Ubuntu or Docker)

    • Choose how to manage secrets (Standalone/Vault/1Password/HCP)

    # /etc/nslcd.conf: Configuration file for nslcd(8)
    # The user/group nslcd will run as. Note that these should not be LDAP users.
    uid mysql # required to be `mysql`
    gid mysql # required to be `mysql`
    
    # The location of the LDAP server.
    uri ldap://openldap-service.default.svc.cluster.local:389
    
    # The search base that will be used for all queries.
    base dc=openldap-service,dc=default,dc=svc,dc=cluster,dc=local
    
    # The distinguished name with which to bind to the directory server for lookups.
    # This is a service account used by the daemon.
    binddn cn=admin,dc=openldap-service,dc=default,dc=svc,dc=cluster,dc=local
    bindpw PASSWORD_REPLACE-ME
    # Change the protocol to `ldaps`
    +uri ldaps://openldap-service.default.svc.cluster.local:636
    -uri ldap://openldap-service.default.svc.cluster.local:389
    
    # ...
    
    +tls_reqcert demand # Look at: https://linux.die.net/man/5/ldap.conf then search for TLS_REQCERT
    +tls_cacertfile /etc/openldap/certs/tls.crt # You will need to mount this certificate (from a secret) later
    passwd:     files ldap
    group:      files ldap
    shadow:     files ldap
      # ....
      myCnf: |
        [mariadb]
        plugin_load_add = auth_pam # Load auth plugin
      # ....
    ---
    apiVersion: v1
    kind: Secret
    type: Opaque
    metadata:
      name: mariadb-nslcd-secret
    stringData:
      nslcd.conf: |
        # /etc/nslcd.conf: Configuration file for nslcd(8)
        # The user/group nslcd will run as. Note that these should not be LDAP users.
        uid mysql # required to be `mysql`
        gid mysql # required to be `mysql`
    
        # The location of the LDAP server.
        uri ldap://openldap-service.default.svc.cluster.local:389
    
        # The search base that will be used for all queries.
        base dc=openldap-service,dc=default,dc=svc,dc=cluster,dc=local
    
        # The distinguished name with which to bind to the directory server for lookups.
        # This is a service account used by the daemon.
        binddn cn=admin,dc=openldap-service,dc=default,dc=svc,dc=cluster,dc=local
        bindpw PASSWORD_REPLACE-ME
    ---
    apiVersion: v1
    kind: ConfigMap
    metadata:
      name: mariadb-nsswitch-configmap
      labels:
        enterprise.mariadb.com/watch: ""
    data:
      nsswitch.conf: |
        passwd:     files ldap
        group:      files ldap
        shadow:     files ldap
    ---
    apiVersion: v1
    kind: ConfigMap
    metadata:
      name: mariadb-pam-configmap
      labels:
        enterprise.mariadb.com/watch: ""
    data:
      mariadb: |
        # This is needed to tell PAM to use pam_ldap.so
        auth required pam_ldap.so
        account required pam_ldap.so
    ---
    apiVersion: v1
    kind: Secret
    metadata:
      name: mariadb # Used to hold the mariadb and root user passwords
      labels:
        enterprise.mariadb.com/watch: ""
    stringData:
      password: MariaDB11!
      root-password: MariaDB11!
    ---
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb
    spec:
      rootPasswordSecretKeyRef:
        name: mariadb
        key: root-password
    
      username: mariadb
      passwordSecretKeyRef:
        name: mariadb
        key: password
        generate: true
      database: mariadb
    
      port: 3306
    
      storage:
        size: 1Gi
    
      service:
        type: LoadBalancer
        metadata:
          annotations:
            metallb.universe.tf/loadBalancerIPs: 172.18.0.20
    
      myCnf: |
        [mariadb]
        bind-address=*
        default_storage_engine=InnoDB
        binlog_format=row
        innodb_autoinc_lock_mode=2
        innodb_buffer_pool_size=800M
        max_allowed_packet=256M
    
        plugin_load_add = auth_pam # Load auth plugin
    
      resources:
        requests:
          cpu: 1
          memory: 128Mi
        limits:
          memory: 1Gi
    
      metrics:
        enabled: true
    
      volumes: # Attach `nslcd.conf`, `nsswitch.conf` and `mariadb` (pam). Also add an emptyDir volume for `nslcd` socket
        - name: nslcd
          secret:
            secretName: mariadb-nslcd-secret
            defaultMode: 0600
        - name: nsswitch
          configMap:
            name: mariadb-nsswitch-configmap
            defaultMode: 0600
        - name: mariadb-pam
          configMap:
            name: mariadb-pam-configmap
            defaultMode: 0600
        - name: nslcd-run
          emptyDir: {}
    
      sidecarContainers:
        # The `nslcd` daemon is ran as a sidecar container
        - name: nslcd
          image: docker.mariadb.com/nslcd:0.9.10-13
          volumeMounts:
            - name: nslcd
              mountPath: /etc/nslcd.conf
              subPath: nslcd.conf
            - name: nsswitch
              mountPath: /etc/nsswitch.conf
              subPath: nsswitch.conf
          # nslcd-run is missing because volumeMounts from main container are shared with sidecar
    
      volumeMounts:
        - name: mariadb-pam
          mountPath: /etc/pam.d/mariadb
          subPath: mariadb
        - name: nslcd-run
          mountPath: /var/run/nslcd
    ---
    apiVersion: v1
    kind: Secret
    metadata:
      name: mariadb-ldap
    stringData:
      plugin: pam # name of the plugin, must be `pam`
      pamModule: mariadb # This is the name of the pam config file placed in `/etc/pam.d/`
    ---
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: User
    metadata:
      name: ldap-user # This user must exist already in your ldap server.
    spec:
      mariaDbRef:
        name: mariadb
      host: "%" # Don't specify the ldap host here. Keep this as is
      passwordPlugin:
        pluginNameSecretKeyRef:
          name: mariadb-ldap
          key: plugin
        pluginArgSecretKeyRef:
          name: mariadb-ldap
          key: pamModule
    
      cleanupPolicy: Delete
      requeueInterval: 10h
      retryInterval: 30s
    kubectl run mariadb-connect --rm -it --image=mariadb:11.4 -- bash -c "mariadb -u ldap-user -p'<secret>' --ssl=false -h mariadb"
    If you don't see a command prompt, try pressing enter.
    Welcome to the MariaDB monitor.  Commands end with ; or \g.
    Your MariaDB connection id is 95
    Server version: 11.4.7-4-MariaDB-enterprise MariaDB Enterprise Server
    
    Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
    
    Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
    
    MariaDB [(none)]>
    kubectl create secret generic mariadb-ldap-tls --from-file=./tls.crt
      volumes: # Attach `nslcd.conf`, `nsswitch.conf` and `mariadb` (pam). Also add an emptyDir volume for `nslcd` socket
        - name: nslcd
          secret:
            secretName: mariadb-nslcd-secret
            defaultMode: 0600
        - name: nsswitch
          configMap:
            name: mariadb-nsswitch-configmap
            defaultMode: 0600
        - name: mariadb-pam
          configMap:
            name: mariadb-pam-configmap
            defaultMode: 0600
        - name: nslcd-run
          emptyDir: {}
    +    - name: ldap-tls
    +      secret:
    +        secretName: mariadb-ldap-tls
    +        defaultMode: 0600
    
      sidecarContainers:
        # The `nslcd` daemon is ran as a sidecar container
        - name: nslcd
          image: docker.mariadb.com/nslcd:0.9.10-13
          volumeMounts:
            - name: nslcd
              mountPath: /etc/nslcd.conf
              subPath: nslcd.conf
            - name: nsswitch
              mountPath: /etc/nsswitch.conf
              subPath: nsswitch.conf
    +        - name: ldap-tls
    +          mountPath: /etc/openldap/certs/
          # nslcd-run is missing because volumeMounts from main container are shared with sidecar
    
      volumeMounts:
        - name: mariadb-pam
          mountPath: /etc/pam.d/mariadb
          subPath: mariadb
        - name: nslcd-run
          mountPath: /var/run/nslcd
    sudo sysctl -w fs.nr_open=1048576
    kind create cluster
    Docker + Vault ✅
  • Docker + 1Password ✅

  • Vault: Connect to Vault and fetch

  • 1Password: Use 1Password CLI to fetch

  • HCP: Connect to HCP Vault and fetch

  • Have Ubuntu, want simplest setup

    Ubuntu Deployment Guide

    Have Ubuntu, want Vault

    Ubuntu Deployment Guide + Vault setup

    Have Windows, want Docker

    Docker Deployment Guide

    Have Windows, want Docker + Vault

    Docker Deployment Guide (Vault section)

    Need to understand architecture

    Technical Architecture

    Need step-by-step checklist

    Deployment Checklist

    Docker Deployment Guide

    📋 Quick Navigation

    • System Overview

    • Prerequisites


    System Overview

    What is MariaDB AI RAG?

    MariaDB AI RAG (RAG-in-a-Box) is a containerized RAG system providing:

    • Document ingestion & processing (PDF, TXT, DOCX, MD, etc.)

    • Vector embeddings using Google Gemini

    • Semantic search & AI-powered queries

    • RESTful RAG API (Port 8000)

    Architecture

    Technology Stack

    • Container: Docker Desktop + Docker Compose

    • OS: Ubuntu 24.04 LTS

    • Database: MariaDB 11 with vector support

    • Embedding: Google Gemini text-embedding-004 (768-dim)


    Prerequisites

    Hardware Requirements

    Component
    Minimum
    Recommended

    Software Requirements

    1. Windows 10/11 Pro/Enterprise (64-bit)

    2. Docker Desktop 4.x+ with WSL 2 backend

    3. PowerShell 5.1+ (built-in)

    API Keys

    1. Google Gemini API Key (Required)

      • Get from: https://makersuite.google.com/app/apikey

      • Free tier available

    Port Requirements

    • 8000 (RAG API)

    • 8002 (MCP Server)

    • 3306 (MariaDB)

    • 8200 (Vault - if using Vault mode)


    Pre-Deployment Checklist

    1. Verify Docker Installation

    2. Check Available Ports

    3. Navigate to Project Directory

    4. Configure API Key


    Deployment - Standalone Mode

    Standalone Mode = Simplest setup with secrets in config file

    Step 1: Build Docker Image

    Time: 2-5 minutes (first time)

    Step 2: Start Services

    Expected Output:

    Step 3: Monitor Startup

    Wait for:

    Press Ctrl+C to exit logs (containers keep running)

    Step 4: Verify Services

    Expected:

    Step 5: Test Accessibility

    ✅ Deployment Complete!

    Access Points:

    • RAG API: http://localhost:8000/docs

    • MCP Server: http://localhost:8002/mcp


    Deployment - Vault Mode

    Vault Mode = Production-like secret management with HashiCorp Vault

    Step 1: Build Docker Image

    Step 2: Run Automated Vault Setup

    Expected:

    Step 3: Update Gemini API Key in Vault

    Step 4: Start MariaDB AI RAG with Vault Config

    Step 5: Monitor & Verify

    ✅ Deployment Complete!

    Vault Management:


    Post-Deployment

    1. Generate Authentication Token

    2. Authorize in Swagger UI

    3. Test Document Ingestion

    4. Test RAG Query


    Usage Guide

    Document Ingestion

    Via Swagger UI

    1. Open http://localhost:8000/docs

    2. Authorize with Bearer token

    3. Use POST /documents/ingest endpoint

    4. Upload file(s)

    Via PowerShell

    RAG Query

    Via Swagger UI

    1. Open http://localhost:8000/docs

    2. Use POST /orchestrate/generation endpoint

    3. Enter your question

    4. Get AI-generated answer

    Via PowerShell

    MCP Server Integration

    For Windsurf/Claude Desktop

    Add to MCP configuration:

    Available MCP Tools

    • Database Tools: execute_sql, list_tables, get_table_schema

    • Vector Tools: create_vector_store, search_vector_store


    Troubleshooting

    Services Won't Start

    Database Connection Errors

    Port Already in Use

    Authentication Fails

    API Key Invalid

    Health Check Timeout


    Management Commands

    View Status

    View Logs

    Stop Services

    Start Services

    Restart Services

    Clean Everything (⚠️ Deletes Data)

    Access Container Shell

    View Resource Usage


    Quick Reference

    Standalone Mode

    Vault Mode

    Switching Modes

    Access Points

    • RAG API: http://localhost:8000/docs

    • MCP Server: http://localhost:8002/mcp

    • Database: localhost:3306


    Support

    Check Logs

    Verify Configuration

    Test Connectivity


    🎉 Deployment Complete! Your MariaDB AI RAG is ready to use.

    Physical backups

    What is a physical backup?

    A physical backup is a snapshot of the entire data directory (/var/lib/mysql), including all data files. This type of backup captures the exact state of the database at a specific point in time, allowing for quick restoration in case of data loss or corruption.

    Physical backups are the recommended method for backing up MariaDB databases, especially in production environments, as they are faster and more efficient than .

    Ubuntu Server
    ├── MariaDB (you install separately)
    ├── RAG API (from .deb package)
    └── MCP Server (from .deb package)
    Windows + Docker Desktop
    ├── Docker Container 1: MariaDB
    └── Docker Container 2: ai-nexus.deb 
    GEMINI_API_KEY=your_actual_gemini_api_key_here
    DB_PASSWORD=your_secure_database_password
    SECRET_KEY=your_generated_secret_key_64_chars_long
    # Generate a secure secret key (Python)
    python3 -c "import secrets; print(secrets.token_urlsafe(64))"
    
    # Or using PowerShell
    [Convert]::ToBase64String((1..64 | ForEach-Object { Get-Random -Maximum 256 }))
    Your Application (RAG API + MCP Server)
        ↓ (fetches secrets at startup)
    HashiCorp Vault (running locally)
        ↓ (stores)
    Secrets (API keys, passwords)
    VAULT_ADDR=http://127.0.0.1:8200
    VAULT_TOKEN=your_vault_token
    VAULT_SECRET_PATH=rag-in-a-box
    # Application fetches secrets from Vault at startup
    Your Application (RAG API + MCP Server)
        ↓ (fetches secrets via 1Password CLI)
    1Password CLI
        ↓ (connects to)
    1Password Cloud
        ↓ (stores)
    Secrets (API keys, passwords)
    GEMINI_API_KEY=op://Employee/RAG-API-Keys/gemini
    DB_PASSWORD=op://Employee/RAG-Database/password
    # op:// references point to 1Password items
    Your Application (RAG API + MCP Server)
        ↓ (fetches secrets at startup)
    HCP Vault (cloud service)
        ↓ (stores)
    Secrets (API keys, passwords)
    Step 1: Install MariaDB on Ubuntu
        ↓
    Step 2: Install ai-nexus.deb on Ubuntu
        ↓
    Step# 3. Edit /opt/rag-in-a-box/config/config.env.template
            Put secrets directly in file (Standalone mode)
            GEMINI_API_KEY=your_actual_api_key
            DB_PASSWORD=your_secure_password
        ↓
    Step 4: Start services in their own terminals by running:
            /opt/rag-in-a-box/bin/rag-api --config /path/to/config.env
            CONFIG_FILE=/path/to/config.env /opt/rag-in-a-box/bin/mcp-server
        ↓
    Step 5: Application reads secrets from config file
        ↓
    ✅ Done! Application running with Standalone mode
    Step 1: Install MariaDB on Ubuntu
        ↓
    Step 2: Install HashiCorp Vault on Ubuntu
        ↓
    Step# 3. Store secrets in Vault
            vault kv put secret/rag-in-a-box \
              GEMINI_API_KEY="your_api_key" \
              DB_PASSWORD="your_password"
        ↓
    Step 4: Install ai-nexus.deb on Ubuntu
        ↓
    Step 5: Edit /opt/rag-in-a-box/config/config.env.template
            Configure Vault connection (NOT the secrets themselves)
            VAULT_ADDR=http://127.0.0.1:8200
            VAULT_TOKEN=your_vault_root_token
        ↓
    Step 6: Start services in their own terminals by running:
            /opt/rag-in-a-box/bin/rag-api --config /path/to/config.env
            CONFIG_FILE=/path/to/config.env /opt/rag-in-a-box/bin/mcp-server
        ↓
    Step 7: Application connects to Vault and fetches secrets
        ↓
    ✅ Done! Application running with Vault mode
    Step 1: Build Docker image (wraps ai-nexus.deb)
            docker build -t ai-nexus-image .
        ↓
    Step# 2. Edit config.env.secure.local
            Put secrets directly in file (Standalone mode)
            GEMINI_API_KEY=your_actual_api_key
            DB_PASSWORD=your_secure_password
        ↓
    Step 3: Start containers
            docker-compose up -d
            (Starts MariaDB container + ai-nexus container)
        ↓
    Step 4: Application reads secrets from config file
        ↓
    ✅ Done! Application running with Standalone mode
    Step 1: Build Docker image (wraps ai-nexus.deb)
            docker build -t ai-nexus-image .
        ↓
    Step 2: Start Vault container
            docker-compose -f Localvault/docker-compose.vault.yml up -d
        ↓
    Step 3. Store secrets in Vault
            docker exec vault vault kv put secret/rag-in-a-box \
              GEMINI_API_KEY="your_api_key" \
              DB_PASSWORD="your_password"
        ↓
    Step 4: Edit config.env.vault.local
            Configure Vault connection
            VAULT_ADDR=http://rag-vault:8200
            VAULT_TOKEN=your_vault_token
        ↓
    Step 5: Start containers with Vault config
            docker-compose --env-file config.env.vault.local up -d
        ↓
    Step 6: Application connects to Vault and fetches secrets
        ↓
    ✅ Done! Application running with Vault mode
    Do you have Ubuntu system?
    ├─ Yes → Deploy natively on Ubuntu
    │         Guide: UBUNTU_DEPLOYMENT_GUIDE.md
    │         
    │         Choose secret mode:
    │         ├─ Simple testing? → Standalone
    │         ├─ Team development? → Local Vault
    │         ├─ Have 1Password? → 1Password
    │         └─ Production cloud? → HCP Vault
    │
    └─ No (Windows/Mac) → Deploy with Docker
              Guide: DOCKER_DEPLOYMENT_GUIDE.md
              
              Choose secret mode:
              ├─ Simple testing? → Standalone
              ├─ Team development? → Local Vault (Docker)
              ├─ Have 1Password? → 1Password
              └─ Production cloud? → HCP Vault
    # 1. Install database
    sudo apt install -y mariadb-server
    sudo mysql_secure_installation
    
    # 2. Create database
    sudo mariadb -u root -p
    CREATE DATABASE kb_chunks;
    EXIT;
    
    # 3. Install application
    sudo apt install -y ./ai-nexus.deb
    
    # 4. Configure (Standalone mode - secrets in file)
    cp /opt/rag-in-a-box/config/config.env.template /path/to/config.env
    nano /path/to/config.env
    
    # Add these lines:
    GEMINI_API_KEY=your_actual_gemini_api_key_here
    DB_PASSWORD=your_secure_database_password
    SECRET_KEY=your_generated_secret_key_must_be_same_for_all_three
    JWT_SECRET_KEY=your_generated_secret_key_must_be_same_for_all_three
    MCP_AUTH_SECRET_KEY=your_generated_secret_key_must_be_same_for_all_three
    
    # 5. Start services in their own terminals:
    /opt/rag-in-a-box/bin/rag-api --config /path/to/config.env
    CONFIG_FILE=/path/to/config.env /opt/rag-in-a-box/bin/mcp-server
    
    # 6. Verify
    curl http://localhost:8000/health
    
    # ✅ Done! Running in Standalone mode
    # 1. Install database
    sudo apt install -y mariadb-server
    sudo mysql_secure_installation
    sudo mariadb -u root -p -e "CREATE DATABASE kb_chunks;"
    
    # 2. Install Vault
    wget https://releases.hashicorp.com/vault/1.15.0/vault_1.15.0_linux_amd64.zip
    unzip vault_1.15.0_linux_amd64.zip
    sudo mv vault /usr/local/bin/
    
    # 3. Start Vault
    vault server -dev &
    export VAULT_ADDR='http://127.0.0.1:8200'
    export VAULT_TOKEN='root'
    
    # 4. Store secrets in Vault
    vault kv put secret/rag-in-a-box \
      GEMINI_API_KEY="your_actual_gemini_api_key" \
      DB_PASSWORD="your_secure_database_password" \
      SECRET_KEY="your_generated_secret_key"
    
    # 5. Install application
    sudo apt install -y ./ai-nexus.deb
    
    # 6. Configure (Vault mode - connection info only)
    cp /opt/rag-in-a-box/config/config.env.template /path/to/config.env
    nano /path/to/config.env
    
    # Add these lines:
    VAULT_ADDR=http://127.0.0.1:8200
    VAULT_TOKEN=your_vault_root_token
    VAULT_SECRET_PATH=rag-in-a-box
    VAULT_MOUNT_POINT=secret
    
    # 7. Start services in their own terminals:
    /opt/rag-in-a-box/bin/rag-api --config /path/to/config.env
    CONFIG_FILE=/path/to/config.env /opt/rag-in-a-box/bin/mcp-server
    
    # 8. Verify
    curl http://localhost:8000/health
    
    # ✅ Done! Running in Vault mode
    # Application fetched secrets from Vault at startup
    MCP Server for AI agents (Port 8002)
  • MariaDB 11 with vector support (Port 3306)

  • LLM: Google Gemini gemini-2.0-flash

  • Framework: FastAPI + Uvicorn

  • Wait for processing

    RAG Tools
    :
    ingest_documents
    ,
    generate_response
  • Health Tools: health_check, get_server_status

  • CPU

    4 cores

    8+ cores

    RAM

    8 GB

    16+ GB

    Storage

    20 GB free

    50+ GB free

    Deployment - Standalone Mode
    Deployment - Vault Mode
    Post-Deployment
    Usage Guide
    Troubleshooting
    Backup strategies

    Multiple strategies are available for performing physical backups, including:

    • mariadb-backup: Taken using the enterprise version of mariadb-backup, specifically MariaDB Enterprise backup, which is available in the MariaDB enterprise images. The operator supports scheduling Jobs to perform backups using this utility.

    • Kubernetes VolumeSnapshot: Leverage Kubernetes VolumeSnapshots to create snapshots of the persistent volumes used by the MariaDB Pods. This method relies on a compatible CSI (Container Storage Interface) driver that supports volume snapshots. See the VolumeSnapshots section for more details.

    In order to use VolumeSnapshots, you will need to provide a VolumeSnapshotClass that is compatible with your storage provider. The operator will use this class to create snapshots of the persistent volumes:

    For the rest of compatible backup storage types, the mariadb-backup CLI will be used to perform the backup. For instance, to use S3 as backup storage:

    Storage types

    Multiple storage types are supported for storing physical backups, including:

    • S3 compatible storage: Store backups in a S3 compatible storage, such as AWS S3 or Minio.

    • Persistent Volume Claims (PVC): Use any of the StorageClasses available in your Kubernetes cluster to create a PersistentVolumeClaim (PVC) for storing backups.

    • Kubernetes Volumes: Store backups in any of the in-tree storage providers supported by Kubernetes out of the box, such as NFS.

    • Kubernetes VolumeSnapshots: Use to create snapshots of the persistent volumes used by the MariaDB Pods. This method relies on a compatible CSI (Container Storage Interface) driver that supports volume snapshots. See the section for more details.

    Scheduling

    Physical backups can be scheduled using the spec.schedule field in the PhysicalBackup resource. The schedule is defined using a Cron format and allows you to specify how often backups should be taken:

    If you want to immediatly trigger a backup after creating the PhysicalBackup resource, you can set the immediate field to true. This will create a backup immediately, regardless of the schedule.

    If you want to suspend the schedule, you can set the suspend field to true. This will prevent any new backups from being created until the PhysicalBackup is resumed.

    Compression

    When using physical backups based on mariadb-backup, you are able to choose the compression algorithm used to compress the backup files. The available options are:

    • bzip2: Good compression ratio, but slower compression/decompression speed compared to gzip.

    • gzip: Good compression/decompression speed, but worse compression ratio compared to bzip2.

    • none: No compression.

    To specify the compression algorithm, you can use the compression field in the PhysicalBackup resource:

    compression is defaulted to none by the operator.

    Retention policy

    You can define a retention policy both for backups based on mariadb-backup and for VolumeSnapshots. The retention policy allows you to specify how long backups should be retained before they are automatically deleted. This can be defined via the maxRetention field in the PhysicalBackup resource:

    When using physical backups based on mariadb-backup, the operator will automatically delete backups files in the specified storage older than the retention period.

    When using VolumeSnapshots, the operator will automatically delete the VolumeSnapshot resources older than the retention period using the Kubernetes API.

    Restoration

    Physical backups can only be restored in brand new MariaDB instances without any existing data. This means that you cannot restore a physical backup into an existing MariaDB instance that already has data.

    To perform a restoration, you can specify a PhysicalBackup as restoration source under the spec.bootstrapFrom field in the MariaDB resource:

    This will take into account the backup strategy and storage type used in the PhysicalBackup, and it will perform the restoration accordingly.

    As an alternative, you can also provide a reference to an S3 bucket that was previously used to store the physical backup files:

    It is important to note that the backupContentType field must be set to Physical when restoring from a physical backup. This ensures that the operator uses the correct restoration method.

    To restore a VolumeSnapshot, you can provide a reference to a specific VolumeSnapshot resource in the spec.bootstrapFrom field:

    Target recovery time

    By default, the operator will match the closest backup available to the current time. You can specify a different target recovery time by using the targetRecoveryTime field in the PhysicalBackup resource. This lets you define the exact point in time you want to restore to:

    Timeout

    By default, both backups based on mariadb-backup and VolumeSnapshots will have a timeout of 1 hour. You can change this timeout by using the timeout field in the PhysicalBackup resource:

    When timed out, the operator will delete the Jobs or VolumeSnapshots resources associated wit the PhysicalBackup resource. The operator will create new Jobs or VolumeSnapshots to retry the backup operation if the PhysicalBackup resource is still scheduled.

    Extra options

    When taking backups based on mariadb-backup, you can specify extra options to be passed to the mariadb-backup command using the args field in the PhysicalBackup resource:

    Refer to the mariadb-backup documentation for a list of available options.

    S3 credentials

    Credentials for accessing an S3 compatible storage can be provided via the s3 key in the storage field of the PhysicalBackup resource. The credentials can be provided as a reference to a Kubernetes Secret:

    Alternatively, if you are running in EKS, you can use dynamic credentials from an EKS Service Account using EKS Pod Identity or IRSA:

    By leaving out the accessKeyIdSecretKeyRef and secretAccessKeySecretKeyRef credentials and pointing to the correct serviceAccountName, the backup Job will use the dynamic credentials from EKS.

    Staging area

    S3 backups based on mariadb-backup are the only scenario that requires a staging area.

    When using S3 storage for backups, a staging area is used for keeping the external backups while they are being processed. By default, this staging area is an emptyDir volume, which means that the backups are temporarily stored in the node's local storage where the PhysicalBackup Job is scheduled. In production environments, large backups may lead to issues if the node doesn't have sufficient space, potentially causing the backup/restore process to fail.

    Additionally, when restoring these backups, the operator will pull the backup files from S3, uncompress them if needded, and restore them to each of the MariaDB Pods in the cluster individually. To save network bandwidth and compute resources, a staging area is used to keep the uncompressed backup files after they have been restored to the first MariaDB Pod. This allows the operator to restore the same backup to the rest of MariaDB Pods seamlessly, without needing to pull and uncompress the backup again.

    To configure the staging area, you can use the stagingStorage field in the PhysicalBackup resource:

    Similarly, you may also use a staging area when bootstrapping from backup, in the MariaDB resource:

    In the examples above, a PVC with the default StorageClass will be provisioned to be used as staging area.

    VolumeSnapshots

    Before using this feature, ensure that you meet the following prerequisites :

    • external-snapshotter and its CRs are installed in the cluster.

    • You have a compatible CSI driver that supports VolumeSnapshots installed in the cluster.

    • You have a VolumeSnapshotClass configured configured for your CSI driver.

    The operator is capable of creating VolumeSnapshot resources of the PVCs used by the MariaDB Pods. This allows you to create point-in-time snapshots of your data in a Kubernetes-native way, leveraging the capabilities of your storage provider.

    Most of the fields described in this documentation apply to VolumeSnapshots, including scheduling, retention policy, and compression. The main difference with the mariadb-backup based backups is that the operator will not create a Job to perform the backup, but instead it will create a VolumeSnapshot resource directly.

    In order to create consistent, point-in-time snapshots of the MariaDB data, the operator will perform the following steps:

    1. Execute a BACKUP STAGE START statement followed by BACKUP STAGE BLOCK_COMMIT in one of the secondary Pods.

    2. Create a VolumeSnapshot resource of the data PVC mounted by the MariaDB secondary Pod.

    3. Wait until the VolumeSnapshot resource becomes ready. When timing out, the operator will delete the VolumeSnapshot resource and retry the operation.

    4. Issue a BACKUP STAGE END statement.

    This backup process is described in the MariaDB documentation and is designed to be non-blocking.

    Non-blocking physical backups

    Both for mariadb-backup and VolumeSnapshot backup strategies, the enterprise operator performs non-blocking physical backups by leveraging the BACKUP STAGE feature.. This implies that the backups are taken without long read locks, enabling consistent, production-grade backups with minimal impact on running workloads, ideal for high-availability and performance-sensitive environments.

    Important considerations and limitations

    Root credentials

    When restoring a backup, the root credentials specified through the spec.rootPasswordSecretKeyRef field in the MariaDB resource must match the ones in the backup. These credentials are utilized by the liveness and readiness probes, and if they are invalid, the probes will fail, causing your MariaDB Pods to restart after the backup restoration.

    Restore Job

    When using backups based on mariadb-backup, restoring and uncompressing large backups can consume significant compute resources and may cause restoration Jobs to become stuck due to insufficient resources. To prevent this, you can define the compute resources allocated to the Job:

    ReadWriteOncePod access mode partially supported

    When using backups based on mariadb-backup, the data PVC used by the MariaDB Pod cannot use the ReadWriteOncePod access mode, as it needs to be mounted at the same time by both the MariaDB Pod and the PhysicalBackup Job. In this case, please use either the ReadWriteOnce or ReadWriteMany access modes instead.

    Alternatively, if you want to keep using the ReadWriteOncePod access mode, you must use backups based on VolumeSnapshots, which do not require creating a Job to perform the backup and therefore avoid the volume sharing limitation.

    PhysicalBackup Jobs scheduling

    PhysicalBackup Jobs must mount the data PVC used by one of the secondary MariaDB Pods. To avoid scheduling issues caused by the commonly used ReadWriteOnce access mode, the operator schedules backup Jobs on the same node as MariaDB by default.

    If you prefer to disable this behavior and allow Jobs to run on any node, you can set podAffinity=false:

    This configuration may be suitable when using the ReadWriteMany access mode, which allows multiple Pods across different nodes to mount the volume simultaneously.

    Troubleshooting

    Custom columns are used to display the status of the PhysicalBackup resource:

    To get a higher level of detail, you can also check the status field directly:

    You may also check the related events for the PhysicalBackup resource to see if there are any issues:

    Common errors

    mariadb-backup log copy incomplete: consider increasing innodb_log_file_size

    In some situations, when using the mariadb-backup strategy, you may encounter the following error in the backup Job logs:

    This can be addressed by increasing the innodb_log_file_size in the MariaDB configuration. You can do this by adding the following to your MariaDB resource:

    Refer to MDEV-36159 for further details on this issue.

    logical backups

    API Reference

    MariaDB AI RAG exposes a comprehensive RESTful API for programmatic interaction with the system. All API endpoints require authentication except for the login endpoint.

    Authentication Endpoints

    Login

    Purpose: Authenticates a user and provides a JWT token for subsequent API calls.

    Request body:

    Response:

    Usage Example: Authentication should be performed before any other API calls. The returned JWT token must be included in the Authorization header of subsequent requests:

    Document Management Endpoints

    Upload Documents

    Purpose: Uploads and processes one or more documents for ingestion into the system. Documents are processed asynchronously in the background.

    Request: multipart/form-data with one or more file attachments

    Request Parameters:

    • files: One or more files to upload (required)

    Response:

    Status Values:

    • pending: Document is queued for processing

    • completed: Document has been successfully processed

    • failed: Document processing failed (check error_message)

    Usage Example: Upload one or more documents for ingestion.

    Note: The endpoint accepts both single and multiple files. Documents are processed asynchronously, so the initial status will be pending. Use the document ID to check processing status later.

    List Documents

    Purpose: Retrieves a paginated list of all documents uploaded by the authenticated user.

    Parameters:

    • skip (optional): Number of records to skip for pagination (default: 0)

    • limit (optional): Maximum number of records to return (default: 100)

    Response:

    Usage Example: Use this endpoint to monitor all documents in the system, check their processing status, or select documents for further operations.

    Retrieve Document

    Purpose: Retrieves detailed information about a specific document.

    Response:

    Usage Example: Use this endpoint to check the status of a specific document or retrieve its metadata.

    Delete Documents

    Purpose: Deletes multiple documents and their associated chunks and vector embeddings.

    Request body:

    Response:

    Usage Example: Use this endpoint to remove documents that are no longer needed, freeing up storage space and improving search performance.

    Chunking Endpoints

    Chunk Documents (Batch)

    Purpose: Processes multiple documents into chunks and creates vector embeddings for semantic search. Documents are processed asynchronously in the background.

    Request body:

    Chunking Methods:

    • recursive: Recursive text splitting (default)

    • sentence: Sentence-based chunking

    • token: Token-based chunking

    Response:

    Usage Example: Use this endpoint after document ingestion to prepare documents for semantic search. The chunking process divides documents into semantically meaningful segments and creates vector embeddings.

    Note: For semantic chunking, the threshold parameter controls how similar adjacent chunks should be before they are merged.

    Chunk All Documents

    Purpose: Processes all documents in the system into chunks. Useful for batch processing or reprocessing all documents with new chunking parameters.

    Request body:

    Response:

    Usage Example: Use this endpoint to reprocess all documents with new chunking settings.

    Filter/Retrieve Chunks

    Purpose: Retrieves chunks for specific documents. Use this to check if chunking has completed or to retrieve chunk data.

    Request body:

    Response: Array of chunk objects

    Usage Example: Check if documents have been chunked and retrieve their chunks.

    Retrieval and Search Endpoints

    Semantic Retrieval

    Purpose: Performs semantic search to retrieve relevant document chunks based on a query using vector similarity.

    Request body:

    Request Parameters:

    • query (required): The search query

    • top_k (optional): Number of results to return (default: 20)

    • document_ids (optional): Filter results to specific document IDs (default: all documents)

    Response: Array of retrieval results

    Response Fields:

    • id: Unique chunk identifier

    • document_id: ID of the source document

    • content: The chunk text content

    Usage Example: Use this endpoint to find semantically relevant information. The system converts your query into a vector embedding and finds the most similar chunks.

    Full-Text Search

    Purpose: Performs full-text search using MariaDB's FULLTEXT index to find relevant document chunks.

    Request body:

    Request Parameters:

    • query (required): The search query

    • top_k (optional): Number of results to return (default: 10)

    • document_ids (optional): Filter results to specific document IDs

    Response: Array of search results

    Response Fields:

    • id: Unique chunk identifier

    • document_id: ID of the source document

    • source: File path of the source document

    Usage Example: Use this endpoint for keyword-based search when you need exact term matching.

    Hybrid Search

    Purpose: Combines semantic search (vector similarity) and full-text search using Reciprocal Rank Fusion (RRF) for optimal results.

    Request body:

    Request Parameters:

    • query (required): The search query

    • top_k (optional): Number of results to return (default: 20)

    • k (optional): RRF parameter for rank fusion (default: 60)

    Response: Array of hybrid search results

    Response Fields:

    • id: Unique chunk identifier

    • document_id: ID of the source document

    • source: File path of the source document

    Usage Example: Use this endpoint for the best of both worlds - combining semantic understanding with keyword matching.

    Generate Text

    Purpose: Generates a response to a query using a language model and the provided context chunks.

    Request body:

    Request Parameters:

    • query (required): The user's question or prompt

    • chunks (required): Array of context chunks to use for generation

    • llm_provider (optional): LLM provider - openai, anthropic, gemini

    Response:

    Usage Example: Use this endpoint after retrieving relevant chunks to generate a coherent response based on the information in those chunks.

    Asynchronous Generation

    Purpose: Generates a response asynchronously, useful for long-running generation tasks.

    Request body: Same as /generate

    Response: Same as /generate

    Usage Example: Use this endpoint for generation tasks that may take longer to complete.

    Streaming Generation

    Purpose: Generates a response with streaming output (Server-Sent Events), allowing for real-time display of results as tokens are generated.

    Request body: Same as /generate

    Response: Server-Sent Events (SSE) stream with the following event types:

    Usage Example: Use this endpoint for a better user experience when generating longer responses, as it allows displaying partial results as they become available.

    MariaDB Galera Cluster
    High Availability documentation
    primary switchover
    MariaDB Services
    Windows Host
      └─ Docker Desktop
          ├─ ai-nexus Container (Ubuntu 24.04)
          │   ├─ RAG API (Port 8000) - FastAPI
          │   └─ MCP Server (Port 8002) - FastAPI
          └─ mysql-db Container (MariaDB 11)
              └─ Vector Database (Port 3306)
    docker --version
    docker-compose --version
    
    # Test Docker
    docker run hello-world
    # Verify ports are free
    netstat -ano | findstr :8000
    netstat -ano | findstr :8002
    netstat -ano | findstr :3306
    
    # No output = ports are free ✓
    # Navigate to your MariaDB AI RAG deployment directory
    cd "<path-to-your-mariadb-ai-rag-directory>"
    
    # Verify required files exist
    Get-ChildItem | Select-Object Name
    
    # Required files:
    # ✓ ai-nexus.deb
    # ✓ Dockerfile
    # ✓ docker-compose.yml
    # ✓ start-services.sh
    # ✓ config.env.secure.local
    # Edit configuration file
    notepad config.env.secure.local
    
    # Update this line with your actual API key:
    # GEMINI_API_KEY=YOUR_ACTUAL_API_KEY_HERE
    
    # Save and close
    # Ensure you're in the MariaDB AI RAG directory
    docker build -t ai-nexus-image .
    docker-compose up -d
    [+] Running 3/3
     ✔ Network ai-nexus-network    Created
     ✔ Container mysql-db          Started
     ✔ Container ai-nexus          Started
    docker logs ai-nexus -f
    ✓ RAG API is ready! (took ~30 seconds)
    Starting MCP server...
    Adaptive MCP Server ready on 0.0.0.0:8002
    docker-compose ps
    NAME       STATUS                    PORTS
    ai-nexus   Up X minutes              0.0.0.0:8000->8000/tcp, 0.0.0.0:8002->8002/tcp
    mysql-db   Up X minutes (healthy)    0.0.0.0:3306->3306/tcp
    # Test RAG API
    Invoke-RestMethod -Uri "http://localhost:8000/health"
    
    # Open Swagger UI
    Start-Process "http://localhost:8000/docs"
    # Ensure you're in the MariaDB AI RAG directory
    docker build -t ai-nexus-image .
    .\Localvault\setup_vault_local.ps1
    [SUCCESS] Vault Setup Complete!
    
    Vault Details:
      URL:    http://127.0.0.1:8200
      Token:  rag-root-token
      Path:   secret/rag-in-a-box
    docker exec -e VAULT_TOKEN=rag-root-token rag-vault vault kv patch secret/rag-in-a-box GEMINI_API_KEY="YOUR_ACTUAL_API_KEY"
    docker-compose --env-file config.env.vault.local up -d
    # Watch logs
    docker logs ai-nexus -f
    
    # Check status
    docker-compose ps
    # View secrets
    docker exec -e VAULT_TOKEN=rag-root-token rag-vault vault kv get secret/rag-in-a-box
    
    # Update secret
    docker exec -e VAULT_TOKEN=rag-root-token rag-vault vault kv patch secret/rag-in-a-box KEY="value"
    
    # Restart to apply changes
    docker restart ai-nexus
    # Open Swagger UI
    Start-Process "http://localhost:8000/docs"
    
    # In browser:
    # 1. Navigate to POST /token endpoint
    # 2. Click "Try it out"
    # 3. Enter credentials:
    #    {
    #      "username": "admin",
    #      "password": "your_password"
    #    }
    # 4. Click "Execute"
    # 5. Copy the "access_token" from response
    1. Click "Authorize" button (🔒 icon)
    2. Enter: Bearer YOUR_TOKEN_HERE
    3. Click "Authorize"
    1. Navigate to POST /ingest endpoint
    2. Click "Try it out"
    3. Upload a test document (PDF/TXT)
    4. Click "Execute"
    5. Verify: Response shows document processed
    1. Navigate to POST /generate endpoint
    2. Enter a question about your document
    3. Click "Execute"
    4. Verify: AI-generated response with sources
    $token = "YOUR_TOKEN_HERE"
    $headers = @{
        "Authorization" = "Bearer $token"
    }
    
    $file = "C:\path\to\document.pdf"
    $form = @{
        file = Get-Item -Path $file
    }
    
    Invoke-RestMethod -Uri "http://localhost:8000/documents/ingest" `
        -Method POST `
        -Headers $headers `
        -Form $form
    $token = "YOUR_TOKEN_HERE"
    $headers = @{
        "Authorization" = "Bearer $token"
        "Content-Type" = "application/json"
    }
    
    $body = @{
        query = "What is the main topic of the document?"
    } | ConvertTo-Json
    
    Invoke-RestMethod -Uri "http://localhost:8000/orchestrate/generation" `
        -Method POST `
        -Headers $headers `
        -Body $body
    {
      "mcpServers": {
        "ai-nexus": {
          "url": "http://localhost:8002/mcp",
          "headers": {
            "Authorization": "Bearer YOUR_TOKEN_HERE"
          }
        }
      }
    }
    # Check logs
    docker logs ai-nexus --tail 100
    docker logs mysql-db --tail 50
    
    # Rebuild and restart
    docker build -t ai-nexus-image .
    docker-compose down
    docker-compose up -d
    # Check MariaDB status
    docker logs mysql-db --tail 20
    
    # Wait for healthy status
    docker-compose ps
    # Look for "(healthy)" next to mysql-db
    
    # Verify DB_HOST in config
    # Should be: DB_HOST=mysql-db
    # Find process using port
    netstat -ano | findstr :8000
    
    # Stop process (replace <PID>)
    Stop-Process -Id <PID> -Force
    
    # Or change port in docker-compose.yml
    # Verify secret keys are identical
    docker exec ai-nexus env | Select-String "SECRET"
    
    # All three must match:
    # SECRET_KEY
    # JWT_SECRET_KEY
    # MCP_AUTH_SECRET_KEY
    
    # If different, edit config and restart
    docker-compose down
    docker-compose up -d
    # Test Gemini API key
    $apiKey = "YOUR_API_KEY"
    $uri = "https://generativelanguage.googleapis.com/v1beta/models?key=$apiKey"
    Invoke-RestMethod -Uri $uri
    
    # If error: Get new key from https://makersuite.google.com/app/apikey
    # Update in config.env.secure.local or Vault
    # Restart: docker restart ai-nexus
    # Increase timeout in start-services.sh
    # Edit: MAX_WAIT=300  # 5 minutes
    
    # Rebuild
    docker build -t ai-nexus-image .
    docker-compose down
    docker-compose up -d
    docker-compose ps
    # All services
    docker-compose logs -f
    
    # Specific service
    docker logs ai-nexus -f
    docker logs mysql-db -f
    
    # Last N lines
    docker logs ai-nexus --tail 100
    # Stop MariaDB AI RAG
    docker-compose down
    
    # Stop Vault (if using Vault mode)
    docker-compose -f "Localvault/docker-compose.vault.yml" down
    # Standalone mode
    docker-compose up -d
    
    # Vault mode
    docker-compose --env-file config.env.vault.local up -d
    # Restart all
    docker-compose restart
    
    # Restart specific service
    docker restart ai-nexus
    docker-compose down -v
    docker exec -it ai-nexus /bin/bash
    docker stats ai-nexus mysql-db
    # Build
    docker build -t ai-nexus-image .
    
    # Start
    docker-compose up -d
    
    # Stop
    docker-compose down
    # Setup Vault (one-time)
    .\Localvault\setup_vault_local.ps1
    
    # Start
    docker-compose --env-file config.env.vault.local up -d
    
    # Stop
    docker-compose down
    docker-compose -f "Localvault/docker-compose.vault.yml" down
    # Stop current mode
    docker-compose down
    
    # Start different mode
    docker-compose up -d  # Standalone
    docker-compose --env-file config.env.vault.local up -d  # Vault
    docker logs ai-nexus --tail 100
    docker exec ai-nexus env | Select-String "GEMINI"
    docker exec ai-nexus env | Select-String "DB_"
    # RAG API
    Invoke-RestMethod -Uri "http://localhost:8000/health"
    
    # MCP Server
    Invoke-RestMethod -Uri "http://localhost:8002/health"
    
    # Database (from container)
    docker exec ai-nexus curl -s http://mysql-db:3306
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: PhysicalBackup
    metadata:
      name: physicalbackup
    spec:
      mariaDbRef:
        name: mariadb
      storage:
        volumeSnapshot:
          volumeSnapshotClassName: csi-hostpath-snapclass
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: PhysicalBackup
    metadata:
      name: physicalbackup
    spec:
      mariaDbRef:
        name: mariadb
      storage:
        s3:
          bucket: physicalbackups
          endpoint: minio.minio.svc.cluster.local:9000
          accessKeyIdSecretKeyRef:
            name: minio
            key: access-key-id
          secretAccessKeySecretKeyRef:
            name: minio
            key: secret-access-key
          tls:
            enabled: true
            caSecretKeyRef:
              name: minio-ca
              key: ca.crt
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: PhysicalBackup
    metadata:
      name: physicalbackup
    spec:
      mariaDbRef:
        name: mariadb
      schedule:
        cron: "*/1 * * * *"
        suspend: false
        immediate: true
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: PhysicalBackup
    metadata:
      name: physicalbackup
    spec:
      mariaDbRef:
        name: mariadb
      compression: bzip2
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: PhysicalBackup
    metadata:
      name: physicalbackup
    spec:
      mariaDbRef:
        name: mariadb
      maxRetention: 720h # 30 days
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      bootstrapFrom:
        backupRef:
          name: physicalbackup
          kind: PhysicalBackup
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      bootstrapFrom:
        s3:
          bucket: physicalbackups
          prefix: mariadb
          endpoint: minio.minio.svc.cluster.local:9000
          accessKeyIdSecretKeyRef:
            name: minio
            key: access-key-id
          secretAccessKeySecretKeyRef:
            name: minio
            key: secret-access-key
          tls:
            enabled: true
            caSecretKeyRef:
              name: minio-ca
              key: ca.crt
        backupContentType: Physical
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      bootstrapFrom:
        volumeSnapshotRef:
          name: physicalbackup-20250611163352
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      bootstrapFrom:
        targetRecoveryTime: 2025-06-17T08:07:00Z
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: PhysicalBackup
    metadata:
      name: physicalbackup
    spec:
      mariaDbRef:
        name: mariadb
      timeout: 2h
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: PhysicalBackup
    metadata:
      name: physicalbackup
    spec:
      mariaDbRef:
        name: mariadb
      args:
        - "--verbose"
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: PhysicalBackup
    metadata:
      name: physicalbackup
    spec:
      mariaDbRef:
        name: mariadb
      storage:
        s3:
          bucket: physicalbackups
          endpoint: minio.minio.svc.cluster.local:9000
          accessKeyIdSecretKeyRef:
            name: minio
            key: access-key-id
          secretAccessKeySecretKeyRef:
            name: minio
            key: secret-access-key
          tls:
            enabled: true
            caSecretKeyRef:
              name: minio-ca
              key: ca.crt
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: mariadb-backup
      annotations:
        eks.amazonaws.com/role-arn: arn:aws:iam::<<account_id>>:role/my-role-irsa
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: PhysicalBackup
    metadata:
      name: physicalbackup
    spec:
      mariaDbRef:
        name: mariadb
      serviceAccountName: mariadb-backup
      storage:
        s3:
          bucket: physicalbackups
          prefix: mariadb
          endpoint: s3.us-east-1.amazonaws.com
          region:  us-east-1
          tls:
            enabled: true
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: PhysicalBackup
    metadata:
      name: physicalbackup
    spec:
      mariaDbRef:
        name: mariadb
      storage:
        s3:
          bucket: physicalbackups
          prefix: mariadb
          endpoint: minio.minio.svc.cluster.local:9000
          region:  us-east-1
          accessKeyIdSecretKeyRef:
            name: minio
            key: access-key-id
          secretAccessKeySecretKeyRef:
            name: minio
            key: secret-access-key
          tls:
            enabled: true
            caSecretKeyRef:
              name: minio-ca
              key: ca.crt
      stagingStorage:
        persistentVolumeClaim:
          resources:
            requests:
              storage: 1Gi
          accessModes:
            - ReadWriteOnce
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      mariaDbRef:
        name: mariadb
      bootstrapFrom:
        s3:
          bucket: physicalbackups
          prefix: mariadb
          endpoint: minio.minio.svc.cluster.local:9000
          accessKeyIdSecretKeyRef:
            name: minio
            key: access-key-id
          secretAccessKeySecretKeyRef:
            name: minio
            key: secret-access-key
          tls:
            enabled: true
            caSecretKeyRef:
              name: minio-ca
              key: ca.crt
        backupContentType: Physical
        stagingStorage:
          persistentVolumeClaim:
            resources:
              requests:
                storage: 1Gi
            accessModes:
              - ReadWriteOnce
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb
    spec:
      bootstrapFrom:
        restoreJob:
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              memory: 1Gi
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: PhysicalBackup
    metadata:
      name: physicalbackup
    spec:
      mariaDbRef:
        name: mariadb
      podAffinity: false
    kubectl get physicalbackups
    
    NAME             COMPLETE   STATUS    MARIADB   LAST SCHEDULED   AGE
    physicalbackup   True       Success   mariadb   17s              17s
    kubectl get physicalbackups physicalbackup -o json | jq -r '.status'
    
    {
      "conditions": [
        {
          "lastTransitionTime": "2025-07-14T07:01:14Z",
          "message": "Success",
          "reason": "JobComplete",
          "status": "True",
          "type": "Complete"
        }
      ],
      "lastScheduleCheckTime": "2025-07-14T07:00:00Z",
      "lastScheduleTime": "2025-07-14T07:00:00Z",
      "nextScheduleTime": "2025-07-15T07:00:00Z"
    }
    kubectl get events --field-selector involvedObject.name=physicalbackup
    
    LAST SEEN   TYPE     REASON                  OBJECT                                 MESSAGE
    116s        Normal   WaitForFirstConsumer    persistentvolumeclaim/physicalbackup   waiting for first consumer to be created before binding
    116s        Normal   JobScheduled            physicalbackup/physicalbackup          Job physicalbackup-20250714140837 scheduled
    116s        Normal   ExternalProvisioning    persistentvolumeclaim/physicalbackup   Waiting for a volume to be created either by the external provisioner 'rancher.io/local-path' or manually by the system administrator. If volume creation is delayed, please verify that the provisioner is running and correctly registered.
    116s        Normal   Provisioning            persistentvolumeclaim/physicalbackup   External provisioner is provisioning volume for claim "default/physicalbackup"
    113s        Normal   ProvisioningSucceeded   persistentvolumeclaim/physicalbackup   Successfully provisioned volume pvc-7b7c71f9-ea7e-4950-b612-2d41d7ab35b7
    mariadb [00] 2025-08-04 09:15:57 Was only able to copy log from 58087 to 59916, not 68968; try increasing
    innodb_log_file_size
    mariadb mariabackup: Stopping log copying thread.[00] 2025-08-04 09:15:57 Retrying read of log at LSN=59916
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb
    spec:
    ...
      myCnf: |
        [mariadb]
        innodb_log_file_size=200M
    POST /token
    semantic: Semantic similarity-based chunking (requires threshold)
    metadata: Additional metadata about the chunk
  • distance: Vector distance (lower = more similar)

  • content: The chunk text content
  • score: Relevance score (higher = more relevant)

  • provider (optional): Embedding provider for semantic search
  • model (optional): Embedding model for semantic search

  • document_ids (optional): Filter results to specific document IDs

  • content: The chunk text content
  • metadata: Additional metadata about the chunk

  • distance: Vector distance from semantic search (lower = more similar)

  • score: Full-text relevance score (higher = more relevant)

  • ,
    cohere
    ,
    ollama
    ,
    azure
    ,
    bedrock
  • llm_model (optional): Specific model to use (e.g., gpt-4, claude-3-opus)

  • temperature (optional): Controls randomness (0.0-2.0, default: 0.7)

  • top_p (optional): Nucleus sampling parameter (0.0-1.0, default: 0.9)

  • max_tokens (optional): Maximum tokens to generate (1-8192, default: 1000)

  • Kubernetes VolumeSnapshots
    VolumeSnapshots

    Ubuntu Deployment Guide

    MariaDB AI RAG - Ubuntu Native Deployment Guide

    Deploy MariaDB AI RAG .deb package directly on Ubuntu (without Docker)


    Quick Start


    Prerequisites

    System Requirements

    • OS: Ubuntu 22.04 LTS or 24.04 LTS (x86_64)

    • CPU: 4+ cores (8+ recommended)

    • RAM: 8+ GB (16+ recommended)

    • Storage: 20+ GB free

    Required

    • Google Gemini API Key: Get from https://makersuite.google.com/app/apikey

    Verify System


    Step 1: Install MariaDB


    Step 2: Secure MariaDB

    Follow prompts:

    • Enter current password for root: [Press Enter]

    • Switch to unix_socket authentication? n

    • Change the root password? Y

      • New password: [Choose a secure password]


    Step 3: Create Database

    In MariaDB shell:


    Step 4: Configure MariaDB

    Add under [mysqld] section:

    Save and restart:


    Step 5: Install MariaDB AI RAG Package

    Verify installation:


    Step 6: Configure MariaDB AI RAG

    Update these essential settings:

    Save: Ctrl+X, Y, Enter


    Step 7: Start Services in their own terminals

    Step 8: Verify Deployment

    Check listening ports:

    Should show LISTEN on both ports

    Test Health Endpoints

    View Logs

    Expected log messages:


    Step 9: Test Functionality

    Generate Authentication Token

    Test Document Upload

    Test RAG Query

    Verify Database

    In MariaDB:


    Access Points

    After successful deployment:

    • RAG API Swagger UI: http://<server-ip>:8000/docs

    • RAG API Health: http://<server-ip>:8000/health

    • MCP Server: http://<server-ip>:8002/mcp

    • MCP Health: http://<server-ip>:8002/health

    Get server IP:


    Troubleshooting

    Services Won't Start

    Check logs in the terminal windows

    Common causes:

    1. MariaDB not running

    1. Configuration errors

    1. Port already in use

    1. Permission issues

    Database Connection Fails

    Authentication Fails

    API Key Invalid

    Port Already in Use

    Out of Memory


    Maintenance

    Daily Operations

    Backup Database

    Update Configuration

    Update MariaDB AI RAG

    Optimize Database


    Uninstall


    Security Best Practices

    Change Default Passwords

    Update config:

    Generate New Secret Keys

    Configure Firewall

    Restrict Database Access

    Update config:


    Quick Reference

    Essential Commands

    File Locations

    Service Dependencies

    Start order: MariaDB → RAG API → MCP Server Stop order: MCP Server → RAG API → MariaDB


    Architecture Overview


    Performance Tuning

    MariaDB Optimization

    System Resources


    Deployment Complete! 🎉

    Your MariaDB AI RAG is now running natively on Ubuntu.

    Next Steps:

    1. Access Swagger UI: http://<server-ip>:8000/docs

    2. Generate authentication token

    3. Upload test documents

    4. Start querying with RAG

    For support:

    • Check logs

    • Verify config: nano /path/to/config.env

    • Test health: curl http://localhost:8000/health

    Logical backups

    What is a logical backup?

    A logical backup is a backup that contains the logical structure of the database, such as tables, indexes, and data, rather than the physical storage format. It is created using , which generates SQL statements that can be used to recreate the database schema and populate it with data.

    Logical backups serve not just as a source of restoration, but also enable data mobility between MariaDB instances. These backups are called "logical" because they are independent from the MariaDB topology, as they only contain DDLs and INSERT statements to populate data.

    {
      "username": "user@example.com",
      "password": "secure_password"
    }
    {
      "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
      "token_type": "bearer"
    }
    Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
    POST /documents/ingest
    {
      "message": "2 documents have been queued for ingestion.",
      "documents": [
        {
          "id": 42,
          "source": "/uploaded_files/example1.pdf",
          "filename": "example1.pdf",
          "status": "pending",
          "content": null,
          "error_message": null,
          "created_at": "2025-10-20T12:00:00.123456",
          "updated_at": null
        },
        {
          "id": 43,
          "source": "/uploaded_files/example2.docx",
          "filename": "example2.docx",
          "status": "pending",
          "content": null,
          "error_message": null,
          "created_at": "2025-10-20T12:00:00.234567",
          "updated_at": null
        }
      ]
    }
    # Upload single document
    curl -X POST "http://localhost:8000/documents/ingest" \
      -H "Authorization: Bearer YOUR_TOKEN" \
      -F "files=@/path/to/document.pdf"
    
    # Upload multiple documents
    curl -X POST "http://localhost:8000/documents/ingest" \
      -H "Authorization: Bearer YOUR_TOKEN" \
      -F "files=@/path/to/document1.pdf" \
      -F "files=@/path/to/document2.docx"
    GET /documents
    {
      "documents": [
        {
          "id": 42,
          "filename": "example.pdf",
          "content_type": "application/pdf",
          "size": 1048576,
          "status": "completed",
          "created_at": "2025-08-25T11:42:00.123456",
          "updated_at": "2025-08-25T11:43:30.123456",
          "chunk_count": 15
        },
        {...}
      ],
      "total_count": 42,
      "page": 1,
      "pages": 5
    }
    curl "http://localhost:8000/documents?skip=0&limit=10" \
      -H "Authorization: Bearer YOUR_TOKEN"
    GET /documents/{document_id}
    {
      "id": 42,
      "filename": "example.pdf",
      "content_type": "application/pdf",
      "size": 1048576,
      "status": "completed",
      "created_at": "2025-08-25T11:42:00.123456",
      "updated_at": "2025-08-25T11:43:30.123456",
      "chunk_count": 15,
      "metadata": {
        "page_count": 10,
        "author": "John Doe",
        "creation_date": "2025-08-20"
      }
    }
    curl "http://localhost:8000/documents/42" \
      -H "Authorization: Bearer YOUR_TOKEN"
    DELETE /documents
    {
      "document_ids": [42, 43, 44]
    }
    {
      "deleted_count": 3,
      "status": "success"
    }
    curl -X DELETE "http://localhost:8000/documents" \
      -H "Authorization: Bearer YOUR_TOKEN" \
      -H "Content-Type: application/json" \
      -d '{"document_ids": [42, 43, 44]}'
    POST /chunk
    {
      "document_ids": [42, 43, 44],
      "chunking_method": "recursive",
      "chunk_size": 512,
      "chunk_overlap": 128,
      "threshold": 0.8
    }
    {
      "message": "Chunking task scheduled for 3 documents",
      "queued_documents": [42, 43, 44],
      "status": "success"
    }
    curl -X POST "http://localhost:8000/chunk" \
      -H "Authorization: Bearer YOUR_TOKEN" \
      -H "Content-Type: application/json" \
      -d '{
        "document_ids": [42, 43],
        "chunking_method": "semantic",
        "chunk_size": 512,
        "chunk_overlap": 128,
        "threshold": 0.8
      }'
    POST /chunk/all
    {
      "chunking_method": "recursive",
      "chunk_size": 512,
      "chunk_overlap": 128,
      "threshold": 0.8
    }
    {
      "message": "Chunking task scheduled for all documents",
      "queued_documents": [42, 43, 44, 45, 46],
      "status": "success"
    }
    curl -X POST "http://localhost:8000/chunk/all" \
      -H "Authorization: Bearer YOUR_TOKEN" \
      -H "Content-Type: application/json" \
      -d '{
        "chunking_method": "recursive",
        "chunk_size": 512,
        "chunk_overlap": 128
      }'
    POST /chunks/filter
    {
      "document_ids": [42, 43]
    }
    [
      {
        "id": "uuid-string",
        "document_id": 42,
        "chunk_text": "This is the content of the first chunk...",
        "chunk_index": 0,
        "embedding": [0.123, 0.456, ...],
        "metadata": {}
      },
      {
        "id": "uuid-string-2",
        "document_id": 42,
        "chunk_text": "This is the content of the second chunk...",
        "chunk_index": 1,
        "embedding": [0.789, 0.012, ...],
        "metadata": {}
      }
    ]
    curl -X POST "http://localhost:8000/chunks/filter" \
      -H "Authorization: Bearer YOUR_TOKEN" \
      -H "Content-Type: application/json" \
      -d '{"document_ids": [42, 43]}'
    POST /retrieve
    {
      "query": "What is MariaDB AI RAG?",
      "top_k": 20,
      "document_ids": [42, 43]
    }
    [
      {
        "id": "uuid-chunk-id",
        "document_id": 42,
        "content": "MariaDB AI RAG is an enterprise-grade RAG solution...",
        "metadata": {},
        "distance": 0.15
      },
      {
        "id": "uuid-chunk-id-2",
        "document_id": 43,
        "content": "Key features include document processing and semantic search...",
        "metadata": {},
        "distance": 0.23
      }
    ]
    curl -X POST "http://localhost:8000/retrieve" \
      -H "Authorization: Bearer YOUR_TOKEN" \
      -H "Content-Type: application/json" \
      -d '{
        "query": "What is MariaDB AI RAG?",
        "top_k": 5,
        "document_ids": [42, 43]
      }'
    POST /search
    {
      "query": "MariaDB features",
      "top_k": 10,
      "document_ids": [42, 43]
    }
    [
      {
        "id": "uuid-chunk-id",
        "document_id": 42,
        "source": "/uploaded_files/product_overview.pdf",
        "content": "MariaDB features include vector search, full-text indexing...",
        "score": 15.5
      },
      {
        "id": "uuid-chunk-id-2",
        "document_id": 43,
        "source": "/uploaded_files/technical_docs.pdf",
        "content": "Additional MariaDB capabilities for enterprise applications...",
        "score": 12.3
      }
    ]
    curl -X POST "http://localhost:8000/search" \
      -H "Authorization: Bearer YOUR_TOKEN" \
      -H "Content-Type: application/json" \
      -d '{
        "query": "MariaDB features",
        "top_k": 10
      }'
    POST /hybrid_search
    {
      "query": "MariaDB vector capabilities",
      "top_k": 20,
      "k": 60,
      "provider": "openai",
      "model": "text-embedding-3-small",
      "document_ids": [42, 43]
    }
    [
      {
        "id": "uuid-chunk-id",
        "document_id": 42,
        "source": "/uploaded_files/product_overview.pdf",
        "content": "MariaDB vector capabilities enable semantic search...",
        "metadata": {},
        "distance": 0.18,
        "score": 14.2
      },
      {
        "id": "uuid-chunk-id-2",
        "document_id": 43,
        "source": "/uploaded_files/technical_docs.pdf",
        "content": "Vector indexing in MariaDB provides fast similarity search...",
        "metadata": {},
        "distance": 0.25,
        "score": 11.8
      }
    ]
    curl -X POST "http://localhost:8000/hybrid_search" \
      -H "Authorization: Bearer YOUR_TOKEN" \
      -H "Content-Type: application/json" \
      -d '{
        "query": "MariaDB vector capabilities",
        "top_k": 10,
        "k": 60
      }'
    POST /generate
    {
      "query": "Explain MariaDB AI RAG features",
      "chunks": [
        "MariaDB AI RAG is an enterprise-grade RAG solution that integrates with MariaDB...",
        "Key features include document processing, semantic search, and AI-powered responses..."
      ],
      "llm_provider": "openai",
      "llm_model": "gpt-4",
      "temperature": 0.7,
      "top_p": 0.9,
      "max_tokens": 1000
    }
    {
      "response": "MariaDB AI RAG is an enterprise-grade Retrieval-Augmented Generation (RAG) solution that seamlessly integrates with MariaDB. Its key features include..."
    }
    curl -X POST "http://localhost:8000/generate" \
      -H "Authorization: Bearer YOUR_TOKEN" \
      -H "Content-Type: application/json" \
      -d '{
        "query": "Explain MariaDB AI RAG features",
        "chunks": ["chunk1", "chunk2"],
        "llm_provider": "openai",
        "llm_model": "gpt-4",
        "temperature": 0.7
      }'
    POST /generate-async
    curl -X POST "http://localhost:8000/generate-async" \
      -H "Authorization: Bearer YOUR_TOKEN" \
      -H "Content-Type: application/json" \
      -d '{
        "query": "Provide a detailed analysis",
        "chunks": ["chunk1", "chunk2"],
        "llm_provider": "openai",
        "llm_model": "gpt-4"
      }'
    POST /generate-stream
    // Start event
    {"type": "start", "provider": "openai", "model": "gpt-4"}
    
    // Token events (streamed as generated)
    {"type": "token", "content": "MariaDB", "chunk_index": 1}
    {"type": "token", "content": " Data", "chunk_index": 2}
    {"type": "token", "content": " Bridge", "chunk_index": 3}
    
    // Completion event
    {"type": "complete", "duration": 2.5, "chunks_streamed": 150}
    
    // Error event (if error occurs)
    {"type": "error", "message": "Error description"}
    curl -X POST "http://localhost:8000/generate-stream" \
      -H "Authorization: Bearer YOUR_TOKEN" \
      -H "Content-Type: application/json" \
      -d '{
        "query": "Explain MariaDB AI RAG features",
        "chunks": ["chunk1", "chunk2"],
        "llm_provider": "openai",
        "llm_model": "gpt-4"
      }'

    Access: Root/sudo privileges

    Re-enter: [Same password]

  • Remove anonymous users? Y

  • Disallow root login remotely? Y

  • Remove test database? Y

  • Reload privilege tables? Y

  • Although logical backups are a great fit for data mobility and migrations, they are not as efficient as physical backups for large databases. For this reason, physical backups are the recommended method for backing up MariaDB databases, especially in production environments.

    Storage types

    Currently, the following storage types are supported:

    • S3 compatible storage: Store backups in a S3 compatible storage, such as AWS S3 or Minio.

    • PVCs: Use the available StorageClasses in your Kubernetes cluster to provision a PVC dedicated to store the backup files.

    • Kubernetes volumes: Use any of the volume types supported natively by Kubernetes.

    Our recommendation is to store the backups externally in a S3 compatible storage.

    Backup CR

    You can take a one-time backup of your MariaDB instance by declaring the following resource:

    This will use the default StorageClass to provision a PVC that would hold the backup files, but ideally you should use a S3 compatible storage:

    By providing the authentication details and the TLS configuration via references to Secret keys, this example will store the backups in a local Minio instance.

    Alternatively you can use dynamic credentials from an EKS Service Account using EKS Pod Identity or IRSA:

    By leaving out the accessKeyIdSecretKeyRef and secretAccessKeySecretKeyRef credentials and pointing to the correct serviceAccountName, the backup Job will use the dynamic credentials from EKS.

    Scheduling

    To minimize the Recovery Point Objective (RPO) and mitigate the risk of data loss, it is recommended to perform backups regularly. You can do so by providing a spec.schedule in your Backup resource:

    This resource gets reconciled into a CronJob that periodically takes the backups.

    It is important to note that regularly scheduled Backups complement very well the target recovery time feature detailed below.

    Retention policy

    Given that the backups can consume a substantial amount of storage, it is crucial to define your retention policy by providing the spec.maxRetention field in your Backup resource:

    Compression

    You are able to compress backups by providing the compression algorithm you want to use in the spec.compression field:

    Currently the following compression algorithms are supported:

    • bzip2: Good compression ratio, but slower compression/decompression speed compared to gzip.

    • gzip: Good compression/decompression speed, but worse compression ratio compared to bzip2.

    • none: No compression.

    compression is defaulted to none by the operator.

    Restore CR

    You can easily restore a Backup in your MariaDB instance by creating the following resource:

    This will trigger a Job that will mount the same storage as the Backup and apply the dump to your MariaDB database.

    Nevertheless, the Restore resource doesn't necessarily need to specify a spec.backupRef, you can point to other storage source that contains backup files, for example a S3 bucket:

    Target recovery time

    If you have multiple backups available, specially after configuring a scheduled Backup, the operator is able to infer which backup to restore based on the spec.targetRecoveryTime field.

    The operator will look for the closest backup available and utilize it to restore your MariaDB instance.

    By default, spec.targetRecoveryTime will be set to the current time, which means that the latest available backup will be used.

    Bootstrap new MariaDB instances

    To minimize your Recovery Time Objective (RTO) and to switfly spin up new clusters from existing Backups, you can provide a Restore source directly in the MariaDB object via the spec.bootstrapFrom field:

    As in the Restore resource, you don't strictly need to specify a reference to a Backup, you can provide other storage types that contain backup files:

    Under the hood, the operator creates a Restore object just after the MariaDB resource becomes ready. The advantage of using spec.bootstrapFrom over a standalone Restore is that the MariaDB is bootstrap-aware and this will allow the operator to hold primary switchover/failover operations until the restoration is finished.

    Backup and restore specific databases

    By default, all the logical databases are backed up when a Backup is created, but you may also select specific databases by providing the databases field:

    When it comes to restore, all the databases available in the backup will be restored, but you may also choose a single database to be restored via the database field available in the Restore resource:

    There are a couple of points to consider here:

    • The referred database (db1 in the example) must previously exist for the Restore to succeed.

    • The mariadb CLI invoked by the operator under the hood only supports selecting a single database to restore via the --one-database option, restoration of multiple specific databases is not supported.

    Extra options

    Not all the flags supported by mariadb-dump and mariadb have their counterpart field in the Backup and Restore CRs respectively, but you may pass extra options by using the args field. For example, setting the --verbose flag can be helpful to track the progress of backup and restore operations:

    Refer to the mariadb-dump and mariadb CLI options in the reference section.

    Staging area

    S3 is the only storage type that supports a staging area.

    When using S3 storage for backups, a staging area is used for keeping the external backups while they are being processed. By default, this staging area is an emptyDir volume, which means that the backups are temporarily stored in the node's local storage where the Backup/Restore Job is scheduled. In production environments, large backups may lead to issues if the node doesn't have sufficient space, potentially causing the backup/restore process to fail.

    To overcome this limitation, you are able to define your own staging area by setting the stagingStorage field to both the Backup and Restore CRs:

    In the examples above, a PVC with the default StorageClass will be used as staging area. Refer to the API reference for more configuration options.

    Similarly, you may also use a custom staging area when bootstrapping from backup:

    Important considerations and limitations

    Root credentials

    When restoring a backup, the root credentials specified through the spec.rootPasswordSecretKeyRef field in the MariaDB resource must match the ones in the backup. These credentials are utilized by the liveness and readiness probes, and if they are invalid, the probes will fail, causing your MariaDB Pods to restart after the backup restoration.

    Restore job

    Restoring large backups can consume significant compute resources and may cause Restore Jobs to become stuck due to insufficient resources. To prevent this, you can define the compute resources allocated to the Job:

    Galera backup limitations

    mysql.global_priv

    Galera only replicates the tables with InnoDB engine, see the Galera docs.

    Something that does not include mysql.global_priv, the table used to store users and grants, which uses the MyISAM engine. This basically means that a Galera instance with mysql.global_priv populated will not replicate this data to an empty Galera instance. However, DDL statements (CREATE USER, ALTER USER ...) will be replicated.

    Taking this into account, if we think now about a restore scenario where:

    • The backup file includes a DROP TABLE statement for the mysql.global_priv table.

    • The backup has some INSERT statements for the mysql.global_priv table.

    • The Galera cluster has 3 nodes: galera-0, galera-1 and galera-2.

    • The backup is restored in galera-0.

    This is what will happen under the scenes while restoring the backup:

    • The DROP TABLE statement is a DDL so it will be executed in galera-0, galera-1 and galera-2.

    • The INSERT statements are not DDLs, so they will only be applied to galera-0.

    • This results in the galera-1 and galera-2 not having the mysql.global_priv table.

    After the backup is fully restored, the liveness and readiness probes will kick in, they will succeed in galera-0, but they will fail in galera-1 and galera-2, as they rely in the root credentials available in mysql.global_priv, resulting in the galera-1 and galera-2 getting restarted.

    To address this issue, when backing up MariaDB instances with Galera enabled, the mysql.global_priv table will be excluded from backups by using the --ignore-table option with mariadb-dump. This prevents the replication of the DROP TABLE statement for the mysql.global_priv table. You can opt-out from this feature by setting spec.ignoreGlobalPriv=false in the Backup resource.

    Also, to avoid situations where mysql.global_priv is unreplicated, all the entries in that table must be managed via DDLs. This is the recommended approach suggested in the Galera docs. There are a couple of ways that we can guarantee this:

    • Use the rootPasswordSecretKeyRef, username and passwordSecretKeyRef fields of the MariaDB CR to create the root and initial user respectively. This fields will be translated into DDLs by the image entrypoint.

    • Rely on the User and Grant CRs to create additional users and grants. Refer to the SQL resource documentation for further detail.

    LOCK TABLES

    Galera is not compatible with the LOCK TABLES statement:

    • LOCK TABLES Limitations

    For this reason, the operator automatically adds the --skip-add-locks option to the Backup to overcome this limitation.

    Migrations using logical backups

    Migrating an external MariaDB to a MariaDB running in Kubernetes

    You can leverage logical backups to bring your external MariaDB data into a new MariaDB instance running in Kubernetes. Follow this runbook for doing so:

    1. Take a logical backup of your external MariaDB using one of the commands below:

    If you are using Galera or planning to migrate to a Galera instance, make sure you understand the Galera backup limitations and use the following command instead:

    1. Ensure that your backup file is named in the following format: backup.2024-08-26T12:24:34Z.sql. If the file name does not follow this format, it will be ignored by the operator.

    2. Upload the backup file to one of the supported storage types. We recommend using S3.

    3. Create your MariaDB resource declaring that you want to bootstrap from the previous backup and providing a root password Secret that matches the backup:

    1. If you are using Galera in your new instance, migrate your previous users and grants to use the User and Grant CRs. Refer to the SQL resource documentation for further detail.

    Migrating to a MariaDB with different topology

    Database mobility between MariaDB instances with different topologies is possible with logical backups. However, there are a couple of technical details that you need to be aware of in the following scenarios:

    Migrating between standalone and replicated MariaDBs

    This should be fully compatible, no issues have been detected.

    Migrating from standalone/replicated to Galera MariaDBs

    There are a couple of limitations regarding the backups in Galera, please make sure you read the Galera backup limitations section before proceeding.

    To overcome this limitations, the Backup in the standalone/replicated instance needs to be taken with spec.ignoreGlobalPriv=true. In the following example, we are backing up a standalone MariaDB (single instance):

    Once the previous Backup is completed, we will be able bootstrap a new Galera instance from it:

    Reference

    • API reference

    • mariadb-dump options

    • mariadb options

    Troubleshooting

    Galera Pods restarting after bootstrapping from a backup

    Please make sure you understand the Galera backup limitations.

    After doing so, ensure that your backup does not contain a DROP TABLE mysql.global_priv; statement, as it will make your liveness and readiness probes to fail after the backup restoration.

    mariadb-dump

    Synchronous Multi-Master With Galera

    MariaDB Enterprise Kubernetes Operator provides cloud native support for provisioning and operating multi-master MariaDB clusters using Galera. This setup enables the ability to perform writes on a single node and reads in all nodes, enhancing availability and allowing scalability across multiple nodes.

    In certain circumstances, it could be the case that all the nodes of your cluster go down at the same time, something that Galera is not able to recover by itself, and it requires manual action to bring the cluster up again, as documented in the Galera documentation. The MariaDB Enterprise Kubernetes Operator encapsulates this operational expertise in the MariaDB CR. You just need to declaratively specify spec.galera, as explained in more detail later in this guide.

    To accomplish this, after the MariaDB cluster has been provisioned, the operator will regularly monitor the cluster's status to make sure it is healthy. If any issues are detected, the operator will initiate the recovery process to restore the cluster to a healthy state. During this process, the operator will set status conditions in the MariaDB and emit Events so you have a better understanding of the recovery progress and the underlying activities being performed. For example, you may want to know which Pods were out of sync to further investigate infrastructure-related issues (i.e. networking, storage...) on the nodes where these Pods were scheduled.

    MariaDB configuration

    The easiest way to get a MariaDB Galera cluster up and running is setting spec.galera.enabled = true:

    This relies on sensible defaults set by the operator, which may not be suitable for your Kubernetes cluster. This can be solved by overriding the defaults, so you have fine-grained control over the Galera configuration.

    Refer to the to better understand the purpose of each field.

    Storage

    By default, the operator provisions two PVCs for running Galera:

    • Storage PVC: Used to back the MariaDB data directory, mounted at /var/lib/mysql.

    • Config PVC: Where the Galera config files are located, mounted at /etc/mysql/conf.d.

    However, you are also able to use just one PVC for keeping both the data and the config files:

    Wsrep provider

    You are able to pass extra options to the Galera wsrep provider by using the galera.providerOptions field:

    It is important to note that, the ist.recv_addr cannot be set by the user, as it is automatically configured to the Pod IP by the operator, something that an user won't be able to know beforehand.

    A list of the available options can be found in the .

    IPv6 support

    If you have a Kubernetes cluster running with IPv6, the operator will automatically detect the IPv6 addresses of your Pods and it will configure several options to ensure that the Galera protocol runs smoothly with IPv6.

    Galera cluster recovery

    MariaDB Enterprise Kubernetes Operator monitors the Galera cluster and acts accordinly to recover it if needed. This feature is enabled by default, but you may tune it as you need:

    The minClusterSize field indicates the minimum cluster size (either absolut number of replicas or percentage) for the operator to consider the cluster healthy. If the cluster is unhealthy for more than the period defined in clusterHealthyTimeout (30s by default), a cluster recovery process is initiated by the operator. The process is explained in the and consists of the following steps:

    • Recover the sequence number from the grastate.dat on each node.

    • Trigger a to obtain the sequence numbers in case that the previous step didn't manage to.

    • Mark the node with highest sequence (bootstrap node) as safe to bootstrap.

    • Bootstrap a new cluster in the bootstrap node.

    The operator monitors the Galera cluster health periodically and performs the cluster recovery described above if needed. You are able to tune the monitoring interval via the clusterMonitorInterval field.

    Refer to the to better understand the purpose of each field.

    Galera recovery Job

    During the recovery process, a Job is triggered for each MariaDB Pod to obtain the sequence numbers. It's crucial for this Job to succeed; otherwise, the recovery process will fail. As a user, you are responsible for adjusting this Job to allocate sufficient resources and provide the necessary metadata to ensure its successful completion.

    For example, if you're using a service mesh like Istio, it's important to add the sidecar.istio.io/inject=false label. Without this label, the Job will not complete, which would prevent the recovery process from finishing successfully.

    Force cluster bootstrap

    Use this option only in exceptional circumstances. Not selecting the Pod with the highest sequence number may result in data loss.

    Ensure you unset forceClusterBootstrapInPod after completing the bootstrap to allow the operator to choose the appropriate Pod to bootstrap from in an event of cluster recovery.

    You have the ability to manually select which Pod is used to bootstrap a new cluster during the recovery process by setting forceClusterBootstrapInPod:

    This should only be used in exceptional circumstances:

    • You are absolutely certain that the chosen Pod has the highest sequence number.

    • The operator has not yet selected a Pod to bootstrap from.

    You can verify this with the following command:

    In this case, assuming that mariadb-galera-2 sequence is lower than 350454, it should be safe to bootstrap from mariadb-galera-0.

    Finally, after your cluster has been bootstrapped, remember to unset forceClusterBootstrapInPod to allow the operator to select the appropriate node for bootstrapping in the event of a cluster recovery.

    Bootstrap Galera cluster from existing PVCs

    MariaDB Enterprise Kubernetes Operator will never delete your MariaDB PVCs. Whenever you delete a MariaDB resource, the PVCs will remain intact so you could reuse them to re-provision a new cluster.

    That said, Galera is unable to form a cluster from pre-existing state, it requires a process to identify which Pod has the highest sequence number to bootstrap a new cluster. That's exactly what the operator does: whenever a new MariaDB Galera cluster is created and previously created PVCs exist, a cluster recovery process is automatically triggered.

    Quickstart

    Apply the following manifests to get started with Galera in Kubernetes:

    Next, check the MariaDB status and the resources created by the operator:

    Let's now proceed with simulating a Galera cluster failure by deleting all the Pods at the same time:

    After some time, we will see the MariaDB entering a non Ready state:

    Eventually, the operator will kick in and recover the Galera cluster:

    Finally, the MariaDB resource will become Ready and your Galera cluster will be operational again:

    Troubleshooting

    The aim of this section is showing you how to diagnose your Galera cluster when something goes wrong. In this situations, observability is a key factor to understand the problem, so we recommend following these steps before jumping into debugging the problem.

    • Inspect MariaDB status conditions.

    • Make sure network connectivity is fine by checking that you have an Endpoint per Pod in your Galera cluster.

    • Check the events associated with the MariaDB object, as they provide significant insights for diagnosis, particularly within the context of cluster recovery.

    • Enable debug logs in mariadb-enterprise-operator.

    • Get the logs of all the MariaDB Pod containers, not only of the main mariadb container but also the agent and init ones.

    Once you are done with these steps, you will have the context required to jump ahead to the section to see if any of them matches your case.

    Common errors

    Galera cluster recovery not progressing

    If your MariaDB Galera cluster has been in GaleraNotReady state for a long time, the recovery process might not be progressing. You can diagnose this by checking:

    • Operator logs.

    • Galera recovery status:

    • MariaDB events:

    • If you have Pods named <mariadb-name>-<ordinal>-recovery-<suffix> running for a long time, check its logs to understand if something is wrong.

    One of the reasons could be misconfigured Galera recovery Jobs, please make sure you read . If after checking all the points above, there are still no clear symptoms of what could be wrong, continue reading.

    First af all, you could attempt to forcefully bootstrap a new cluster as it is described in . Please, refrain from doing so if the conditions described in the docs are not met.

    Alternatively, if you can afford some downtime and your PVCs are in healthy state, you may follow this procedure:

    • Delete your existing MariaDB, this will leave your PVCs intact.

    • Create your MariaDB again, this will trigger a Galera recovery process as described in .

    As a last resource, you can always delete the PVCs and bootstrap a new MariaDB from a backup as documented .

    Permission denied writing Galera configuration

    This error occurs when the user that runs the container does not have enough privileges to write in /etc/mysql/mariadb.conf.d:

    To mitigate this, by default, the operator sets the following securityContext in the MariaDB's StatefulSet :

    This enables the CSIDriver and the kubelet to recursively set the ownership ofr the /etc/mysql/mariadb.conf.d folder to the group 999, which is the one expected by MariaDB. It is important to note that not all the CSIDrivers implementations support this feature, see the for further information.

    Unauthorized error disabling bootstrap

    This situation occurs when the mariadb-enterprise-operator credentials passed to the agent as authentication are either invalid or the agent is unable to verify them. To confirm this, ensure that both the mariadb-enterprise-operator and the MariaDB ServiceAccounts are able to create TokenReview objects:

    If that's not the case, check that the following ClusterRole and ClusterRoleBindings are available in your cluster:

    mariadb-enterprise-operator:auth-delegator is the ClusterRoleBinding bound to the mariadb-enterprise-operator ServiceAccount which is created by the helm chart, so you can re-install the helm release in order to recreate it:

    mariadb-galera:auth-delegator is the ClusterRoleBinding bound to the mariadb-galera ServiceAccount which is created on the flight by the operator as part of the reconciliation logic. You may check the mariadb-enterprise-operator logs to see if there are any issues reconciling it.

    Bear in mind that ClusterRoleBindings are cluster-wide resources that are not garbage collected when the MariaDB owner object is deleted, which means that creating and deleting MariaDBs could leave leftovers in your cluster. These leftovers can lead to RBAC misconfigurations, as the ClusterRoleBinding might not be pointing to the right ServiceAccount. To overcome this, you can override the ClusterRoleBinding name setting the spec.galera.agent.kubernetesAuth.authDelegatorRoleName field.

    Timeout waiting for Pod to be Synced

    This error appears in the mariadb-enterprise-operator logs when a Pod is in non synced state for a duration exceeding the spec.galera.recovery.podRecoveryTimeout. Just after, the operator will restart the Pod.

    Increase this timeout if you consider that your Pod may take longer to recover.

    Galera cluster bootstrap timed out

    This is error is returned by the mariadb-enterprise-operator after exceeding the spec.galera.recovery.clusterBootstrapTimeout when recovering the cluster. At this point, the operator will reset the recovered sequence numbers and start again from a clean state.

    Increase this timeout if you consider that your Galera cluster may take longer to recover.

    Deployment Checklist

    Pre-Deployment Checklist

    System Requirements Verification

    Hardware

    Software

    Verification Commands

    Linux:

    Windows (PowerShell):


    Port Availability Check

    Verification Commands

    Linux:

    Windows (PowerShell):


    API Keys Obtained

    Get API Key

    1. Visit: https://makersuite.google.com/app/apikey

    2. Sign in with Google account

    3. Click "Create API Key"

    4. Copy and save the key

    Test API Key

    Linux:

    Windows (PowerShell):


    Project Files Verification

    Required Files for Ubuntu Docker Deployment

    Verification Commands

    Linux:

    Windows (PowerShell):


    Configuration File Setup

    Critical Settings to Verify


    Deployment Checklist - Standalone Mode

    Step 1: Build Docker Image

    Commands

    Verification


    Step 2: Start Services

    Commands

    Expected Output


    Step 3: Monitor Startup

    Commands

    Expected Log Messages


    Step 4: Verify Container Status

    Commands

    Expected Output


    Step 5: Test API Accessibility

    Commands

    Linux:

    Windows (PowerShell):


    Deployment Checklist - Vault Mode

    Step 1: Build Docker Image

    Commands


    Step 2: Run Vault Setup Script

    Commands

    Expected Output


    Step 3: Verify Vault Status

    Commands


    Step 4: Update Gemini API Key in Vault

    Commands


    Step 5: Start MariaDB AI RAG with Vault Config

    Step 5: Start AI Nexus with Vault Config

    Step 5: Start MariaDB AI RAG with Vault Config

    Commands


    Step 6: Verify Deployment

    Commands

    Linux:

    Windows (PowerShell):


    Post-Deployment Checklist

    Authentication Setup

    Steps

    1. Open: http://localhost:8000/docs

    2. Click on POST /token

    3. Click "Try it out"

    4. Enter credentials:


    Authorize in Swagger UI


    Test Document Ingestion

    Test Files

    Use files from test_documents/ directory or upload your own:

    • PDF files

    • TXT files

    • DOCX files

    • MD files


    Test RAG Query

    Example Query


    Test MCP Server (Optional)

    MCP Configuration


    Verification Checklist

    System Health Checks

    Commands

    Linux:

    Windows (PowerShell):


    Functional Tests


    Performance Checks

    Commands


    Troubleshooting Checklist

    If Services Won't Start


    If Database Connection Fails

    Commands


    If Authentication Fails

    Commands


    If API Key Invalid

    Test API Key


    If Ports Already in Use

    Commands


    Maintenance Checklist

    Daily Operations


    Weekly Operations


    Stopping Services


    Starting Services


    Quick Reference Commands

    Essential Commands


    Deployment Sign-Off

    Final Verification

    Deployment Details

    Deployment Date: _______________

    Deployment Mode:

    Deployed By: _______________

    Access URLs:

    • RAG API: http://localhost:8000/docs

    • MCP Server: http://localhost:8002/mcp

    Notes:





    ✅ Deployment Complete!

    MaxScale Database Proxy

    MaxScale is a sophisticated database proxy, router, and load balancer designed specifically for and by MariaDB. It provides a range of features that ensure optimal high availability:

    • Query-based routing: Transparently route write queries to the primary nodes and read queries to the replica nodes.

    • Connection-based routing: Load balance connections between multiple servers.

    • Automatic primary failover based on MariaDB internals.

    # 1. Install MariaDB
    sudo apt update && sudo apt install -y mariadb-server mariadb-client
    sudo systemctl start mariadb && sudo systemctl enable mariadb
    
    # 2. Secure MariaDB (set root password during setup)
    sudo mysql_secure_installation
    
    # 3. Create database
    sudo mariadb -u root -p <<EOF
    CREATE DATABASE kb_chunks CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
    EXIT;
    EOF
    
    # 4. Install MariaDB AI RAG
    sudo apt install -y ./ai-nexus.deb
    
    # 5. Configure (update GEMINI_API_KEY)
    cp /opt/rag-in-a-box/config/config.env.template /path/to/config.env
    nano /path/to/config.env
    
    # 6. Start services in their own terminals
    /opt/rag-in-a-box/bin/rag-api --config /path/to/config.env
    CONFIG_FILE=/path/to/config.env /opt/rag-in-a-box/bin/mcp-server
    
    # 7. Verify
    curl http://localhost:8000/health
    # Check Ubuntu version
    lsb_release -a
    
    # Check disk space
    df -h /
    
    # Check ports are free
    sudo netstat -tuln | grep -E ':(8000|8002|3306)'
    # No output = ports available
    # Update package lists
    sudo apt update
    
    # Install MariaDB
    sudo apt install -y mariadb-server mariadb-client
    
    # Start and enable MariaDB
    sudo systemctl start mariadb
    sudo systemctl enable mariadb
    
    # Verify running
    sudo systemctl status mariadb
    sudo mysql_secure_installation
    # Login to MariaDB
    sudo mariadb -u root -p
    # Enter password: [your_password]
    -- Create database
    CREATE DATABASE kb_chunks CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
    
    -- Verify
    SHOW DATABASES;
    
    -- Exit
    EXIT;
    # Edit configuration
    sudo nano /etc/mysql/mariadb.conf.d/50-server.cnf
    character-set-server = utf8mb4
    collation-server = utf8mb4_unicode_ci
    innodb_page_size = 16k
    innodb_default_row_format = dynamic
    max_connections = 100
    innodb_buffer_pool_size = 2G
    # Save: Ctrl+X, Y, Enter
    sudo systemctl restart mariadb
    # Navigate to directory with .deb file
    cd ~/
    
    # Install package
    sudo apt install -y ./ai-nexus.deb
    
    # If dependency issues:
    sudo dpkg -i ai-nexus.deb
    sudo apt-get install -f
    # Check installed files
    dpkg -L ai-nexus | head -20
    
    # Expected locations:
    # /opt/rag-in-a-box/bin/rag-api
    # /opt/rag-in-a-box/bin/mcp-server
    # /opt/rag-in-a-box/config/config.env.template
    
    # Check binaries exist
    ls -lh /opt/rag-in-a-box/bin/
    # Edit configuration file
    cp /opt/rag-in-a-box/config/config.env.template /path/to/config.env
    nano /path/to/config.env
    # ===== DATABASE CONFIGURATION =====
    DB_HOST=localhost
    DB_PORT=3306
    DB_USER=root
    DB_PASSWORD=your_secure_database_password
    DB_NAME=kb_chunks
    
    # ===== API KEYS (REQUIRED - UPDATE THIS!) =====
    GEMINI_API_KEY=your_actual_gemini_api_key_here
    
    # ===== SECURITY KEYS (MUST BE IDENTICAL) =====
    SECRET_KEY=your_generated_secret_key_must_be_same_for_all_three
    JWT_SECRET_KEY=your_generated_secret_key_must_be_same_for_all_three
    MCP_AUTH_SECRET_KEY=your_generated_secret_key_must_be_same_for_all_three
    
    # ===== SERVER CONFIGURATION =====
    APP_HOST=0.0.0.0
    APP_PORT=8000
    MCP_HOST=0.0.0.0
    MCP_PORT=8002
    
    # ===== EMBEDDING & LLM =====
    EMBEDDING_PROVIDER=gemini
    embedding_model=text-embedding-004
    LLM_PROVIDER=gemini
    LLM_MODEL=gemini-2.0-flash
    
    # ===== TABLE NAMES =====
    DOCUMENTS_TABLE=documents_DEMO_gemini
    VDB_TABLE=vdb_tbl_DEMO_gemini
    
    # ===== MCP CONFIGURATION =====
    MCP_ENABLE_AUTH=true
    MCP_ENABLE_VECTOR_TOOLS=true
    MCP_ENABLE_DATABASE_TOOLS=true
    MCP_ENABLE_RAG_TOOLS=true
    MCP_READ_ONLY=false
    MCP_LOG_LEVEL=INFO
    
    # ===== PROCESSING =====
    CHUNK_SIZE=512
    CHUNK_OVERLAP=128
    DOCUMENT_PROCESSING_BATCH_SIZE=5
    EMBEDDING_BATCH_SIZE=32
    # Start RAG API
    /opt/rag-in-a-box/bin/rag-api --config /path/to/config.env
    
    # Start MCP Server
    CONFIG_FILE=/path/to/config.env /opt/rag-in-a-box/bin/mcp-server
    sudo netstat -tuln | grep -E ':(8000|8002)'
    # Test RAG API
    curl http://localhost:8000/health
    # Expected: {"status":"healthy","database":"connected"}
    
    # Test MCP Server
    curl http://localhost:8002/health
    # Expected: {"status":"healthy"}
    
    # Test API info
    curl http://localhost:8000/
    INFO:     Started server process
    INFO:     Waiting for application startup.
    INFO:     Application startup complete.
    INFO:     Uvicorn running on http://0.0.0.0:8000
    # Generate token
    curl -X POST "http://localhost:8000/token" \
      -H "Content-Type: application/json" \
      -d '{"username":"admin","password":"your_password"}'
    
    # Save token for next commands
    export TOKEN="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
    # Create test document
    echo "This is a test document for MariaDB AI RAG RAG system. It contains sample text for testing." > test_document.txt
    
    # Upload document
    curl -X POST "http://localhost:8000/documents/ingest" \
      -H "Authorization: Bearer $TOKEN" \
      -F "file=@test_document.txt"
    
    # Expected output:
    # {"document_id":1,"filename":"test_document.txt","chunks_created":1,"status":"success"}
    # Query the document
    curl -X POST "http://localhost:8000/orchestrate/generation" \
      -H "Authorization: Bearer $TOKEN" \
      -H "Content-Type: application/json" \
      -d '{"query":"What is this document about?"}'
    
    # Expected: AI-generated response with sources
    # Login to MariaDB
    mariadb -u root -p kb_chunks
    # Enter password: [your_password]
    -- Show tables
    SHOW TABLES;
    
    -- Check documents
    SELECT id, filename, created_at FROM documents_DEMO_gemini;
    
    -- Check embeddings
    SELECT COUNT(*) FROM vdb_tbl_DEMO_gemini;
    
    -- Exit
    EXIT;
    hostname -I
    sudo systemctl status mariadb
    sudo systemctl start mariadb
    nano /path/to/config.env
    # Check for typos, missing values
    sudo lsof -i :8000
    sudo lsof -i :8002
    # Stop conflicting service or kill process
    sudo chmod +x /opt/rag-in-a-box/bin/rag-api
    sudo chmod +x /opt/rag-in-a-box/bin/mcp-server
    sudo chmod 640 /opt/rag-in-a-box/config/config.env.template
    # Test MariaDB connection
    mariadb -u root -p -e "SELECT 1;"
    
    # Check MariaDB status
    sudo systemctl status mariadb
    
    # Restart MariaDB
    sudo systemctl restart mariadb
    
    # Check credentials in config
    sudo grep DB_ /path/to/config.env
    
    # View MariaDB logs
    sudo tail -f /var/log/mysql/error.log
    # Verify all three secret keys are identical
    sudo grep SECRET_KEY /path/to/config.env
    
    # Should show same value for:
    # SECRET_KEY=...
    # JWT_SECRET_KEY=...
    # MCP_AUTH_SECRET_KEY=...
    
    # If different, fix and restart
    nano /path/to/config.env
    # Test Gemini API key
    API_KEY="YOUR_KEY"
    curl -s "https://generativelanguage.googleapis.com/v1beta/models?key=$API_KEY"
    
    # If invalid, update config
    nano /path/to/config.env
    # Update: GEMINI_API_KEY=...
    
    # Restart services
    /opt/rag-in-a-box/bin/rag-api --config /path/to/config.env
    CONFIG_FILE=/path/to/config.env /opt/rag-in-a-box/bin/mcp-server
    # Find process using port
    sudo lsof -i :8000
    sudo lsof -i :8002
    
    # Kill process (if safe)
    sudo kill <PID>
    # Check memory
    free -h
    top
    
    # Add swap if needed (4GB example)
    sudo fallocate -l 4G /swapfile
    sudo chmod 600 /swapfile
    sudo mkswap /swapfile
    sudo swapon /swapfile
    
    # Make permanent
    echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab
    # Check service status
    sudo systemctl status mariadb
    
    # Test RAG API
    curl http://localhost:8000/health
    # Expected: {"status":"healthy","database":"connected"}
    
    # Test MCP Server
    curl http://localhost:8002/health
    # Expected: {"status":"healthy"}
    
    # Test API info
    curl http://localhost:8000/
    
    # Monitor disk space
    df -h
    # Backup
    sudo mysqldump -u root -p kb_chunks > kb_chunks_backup_$(date +%Y%m%d).sql
    
    # Compress backup
    gzip kb_chunks_backup_$(date +%Y%m%d).sql
    
    # Restore (if needed)
    mariadb -u root -p kb_chunks < kb_chunks_backup_20241013.sql
    # Edit config
    nano /path/to/config.env
    
    # Restart services to apply changes
    /opt/rag-in-a-box/bin/rag-api --config /path/to/config.env
    CONFIG_FILE=/path/to/config.env /opt/rag-in-a-box/bin/mcp-server
    # Install new version
    sudo apt install -y ./ai-nexus-new-version.deb
    
    # Start services in their own terminals
    /opt/rag-in-a-box/bin/rag-api --config /path/to/config.env
    CONFIG_FILE=/path/to/config.env /opt/rag-in-a-box/bin/mcp-server
    
    # Verify
    curl http://localhost:8000/health
    mariadb -u root -p <<EOF
    USE kb_chunks;
    OPTIMIZE TABLE documents_DEMO_gemini;
    OPTIMIZE TABLE vdb_tbl_DEMO_gemini;
    EXIT;
    EOF
    # Remove package
    sudo apt remove --purge rag-in-a-box
    
    # Remove configuration (optional)
    sudo rm -rf /opt/rag-in-a-box/
    
    # Remove database (optional - ⚠️ deletes all data)
    mariadb -u root -p -e "DROP DATABASE kb_chunks;"
    # Change MariaDB root password
    sudo mariadb -u root -p
    ALTER USER 'root'@'localhost' IDENTIFIED BY 'your_new_secure_password';
    FLUSH PRIVILEGES;
    EXIT;
    nano /path/to/config.env
    # DB_PASSWORD=your_new_secure_password
    /opt/rag-in-a-box/bin/rag-api --config /path/to/config.env
    CONFIG_FILE=/path/to/config.env /opt/rag-in-a-box/bin/mcp-server
    # Generate secure key
    python3 -c "import secrets; print(secrets.token_urlsafe(64))"
    
    # Use same value for all three keys in config
    nano /path/to/config.env
    # Install UFW
    sudo apt install -y ufw
    
    # Allow SSH (IMPORTANT!)
    sudo ufw allow 22/tcp
    
    # Allow RAG API
    sudo ufw allow 8000/tcp
    
    # Allow MCP Server
    sudo ufw allow 8002/tcp
    
    # Enable firewall
    sudo ufw enable
    
    # Check status
    sudo ufw status
    # Create dedicated database user
    sudo mariadb -u root -p
    CREATE USER 'rag_user'@'localhost' IDENTIFIED BY 'your_secure_password';
    GRANT ALL PRIVILEGES ON kb_chunks.* TO 'rag_user'@'localhost';
    FLUSH PRIVILEGES;
    EXIT;
    nano /path/to/config.env
    # DB_USER=rag_user
    # DB_PASSWORD=your_secure_password
    # Start services
    /opt/rag-in-a-box/bin/rag-api --config /path/to/config.env
    CONFIG_FILE=/path/to/config.env /opt/rag-in-a-box/bin/mcp-server
    
    # Test health
    curl http://localhost:8000/health
    
    # Edit config
    nano /path/to/config.env
    
    # Database access
    mariadb -u root -p kb_chunks
    /opt/rag-in-a-box/bin/rag-api                   # RAG API binary
    /opt/rag-in-a-box/bin/mcp-server                # MCP Server binary
    /opt/rag-in-a-box/config/config.env.template    # Configuration file
    /var/log/mysql/error.log                        # MariaDB logs
    MariaDB (Port 3306)
        ↓
    RAG API (Port 8000)
        ↓
    MCP Server (Port 8002)
    Ubuntu System (Native)
    ├── MariaDB Service (systemd)
    │   └── Database: kb_chunks (Port 3306)
    ├── RAG API Service (systemd)
    │   └── FastAPI Server (Port 8000)
    └── MCP Server Service (systemd)
        └── FastAPI Server (Port 8002)
    sudo nano /etc/mysql/mariadb.conf.d/50-server.cnf
    [mysqld]
    # Adjust based on available RAM
    innodb_buffer_pool_size = 4G  # 50-70% of RAM
    max_connections = 200
    innodb_log_file_size = 512M
    query_cache_size = 0
    query_cache_type = 0
    # Monitor resources
    htop
    # Or
    top
    
    # Check disk I/O
    iostat -x 1
    
    # Check network
    iftop
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: Backup
    metadata:
      name: backup
    spec:
      mariaDbRef:
        name: mariadb
      storage:
        persistentVolumeClaim:
          resources:
            requests:
              storage: 100Mi
          accessModes:
            - ReadWriteOnce
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: Backup
    metadata:
      name: backup
    spec:
      mariaDbRef:
        name: mariadb
      storage:
        s3:
          bucket: backups
          prefix: mariadb
          endpoint: minio.minio.svc.cluster.local:9000
          region:  us-east-1
          accessKeyIdSecretKeyRef:
            name: minio
            key: access-key-id
          secretAccessKeySecretKeyRef:
            name: minio
            key: secret-access-key
          tls:
            enabled: true
            caSecretKeyRef:
              name: minio-ca
              key: tls.crt
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: mariadb-backup
      annotations:
        eks.amazonaws.com/role-arn: arn:aws:iam::<<account_id>>:role/my-role-irsa
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: Backup
    metadata:
      name: backup
    spec:
      mariaDbRef:
        name: mariadb
      serviceAccountName: mariadb-backup
      storage:
        s3:
          bucket: backups
          prefix: mariadb
          endpoint: s3.us-east-1.amazonaws.com
          region:  us-east-1
          tls:
            enabled: true
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: Backup
    metadata:
      name: backup
    spec:
      mariaDbRef:
        name: mariadb
      schedule:
        cron: "*/1 * * * *"
        suspend: false
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: Backup
    metadata:
      name: backup
    spec:
      mariaDbRef:
        name: mariadb
      maxRetention: 720h # 30 days
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: Backup
    metadata:
      name: backup
    spec:
      mariaDbRef:
        name: mariadb
      compression: gzip
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: Restore
    metadata:
      name: restore
    spec:
      mariaDbRef:
        name: mariadb
      backupRef:
        name: backup
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: Restore
    metadata:
      name: restore
    spec:
      mariaDbRef:
        name: mariadb
      s3:
        bucket: backups
        prefix: mariadb
        endpoint: minio.minio.svc.cluster.local:9000
        region:  us-east-1
        accessKeyIdSecretKeyRef:
          name: minio
          key: access-key-id
        secretAccessKeySecretKeyRef:
          name: minio
          key: secret-access-key
        tls:
          enabled: true
          caSecretKeyRef:
            name: minio-ca
            key: tls.crt
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: Restore
    metadata:
      name: restore
    spec:
      mariaDbRef:
        name: mariadb
      backupRef:
        name: backup
      targetRecoveryTime: 2023-12-19T09:00:00Z
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-from-backup
    spec:
      storage:
        size: 1Gi
      bootstrapFrom:
        backupRef:
          name: backup
        targetRecoveryTime: 2023-12-19T09:00:00Z
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-from-backup
    spec:
      storage:
        size: 1Gi
      bootstrapFrom:
        s3:
          bucket: backups
          prefix: mariadb
          endpoint: minio.minio.svc.cluster.local:9000
          accessKeyIdSecretKeyRef:
            name: minio
            key: access-key-id
          secretAccessKeySecretKeyRef:
            name: minio
            key: secret-access-key
          tls:
            enabled: true
            caSecretKeyRef:
              name: minio-ca
              key: tls.crt
        targetRecoveryTime: 2023-12-19T09:00:00Z
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: Backup
    metadata:
      name: backup
    spec:
      mariaDbRef:
        name: mariadb
      databases:
        - db1
        - db2
        - db3
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: Restore
    metadata:
      name: restore
    spec:
      mariaDbRef:
        name: mariadb
      backupRef:
        name: backup
      database: db1
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: Backup
    metadata:
      name: backup
    spec:
      mariaDbRef:
        name: mariadb
      args:
        - --verbose
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: Restore
    metadata:
      name: restore
    spec:
      mariaDbRef:
        name: mariadb
      backupRef:
        name: backup
      args:
        - --verbose
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: Backup
    metadata:
      name: backup
    spec:
      storage:
        s3:
          ...
      stagingStorage:
        persistentVolumeClaim:
          resources:
            requests:
              storage: 10Gi
          accessModes:
            - ReadWriteOnce
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: Restore
    metadata:
      name: restore
    spec:
      s3:
        ...
      stagingStorage:
        persistentVolumeClaim:
          resources:
            requests:
              storage: 10Gi
          accessModes:
            - ReadWriteOnce
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb
    spec:
      bootstrapFrom:
        s3:
          ...
        stagingStorage:
          persistentVolumeClaim:
            resources:
              requests:
                storage: 10Gi
            accessModes:
              - ReadWriteOnce
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb
    spec:
      storage:
        size: 1Gi
      bootstrapFrom:
        restoreJob:
          args:
            - --verbose
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              memory: 1Gi
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: Backup
    metadata:
      name: backup
    spec:
      mariaDbRef:
        name: mariadb
      ignoreGlobalPriv: false
    mariadb-dump --user=${MARIADB_USER} --password=${MARIADB_PASSWORD} --host=${MARIADB_HOST} --single-transaction --events --routines --all-databases > backup.2024-08-26T12:24:34Z.sql
    mariadb-dump --user=${MARIADB_USER} --password=${MARIADB_PASSWORD} --host=${MARIADB_HOST} --single-transaction --events --routines --all-databases --skip-add-locks --ignore-table=mysql.global_priv > backup.2024-08-26T12:24:34Z.sql
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      rootPasswordSecretKeyRef:
        name: mariadb
        key: root-password
      replicas: 3
      galera:
        enabled: true
      storage:
        size: 1Gi
      bootstrapFrom:
        s3:
          bucket: backups
          prefix: mariadb
          endpoint: minio.minio.svc.cluster.local:9000
          accessKeyIdSecretKeyRef:
            name: minio
            key: access-key-id
          secretAccessKeySecretKeyRef:
            name: minio
            key: secret-access-key
          tls:
            enabled: true
            caSecretKeyRef:
              name: minio-ca
              key: tls.crt
        targetRecoveryTime: 2024-08-26T12:24:34Z
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: Backup
    metadata:
      name: backup-standalone
    spec:
      mariaDbRef:
        name: mariadb-standalone
      ignoreGlobalPriv: true
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      replicas: 3
      galera:
        enabled: true
      storage:
        size: 1Gi
      bootstrapFrom:
        backupRef:
          name: backup-standalone

    Restart and wait until the bootstrap node becomes ready.

  • Restart the rest of the nodes one by one so they can join the new cluster.

  • API reference
    MariaDB documentation
    wsrep provider
    Galera documentation
    recovery Job
    API reference
    cluster recovery
    Common errors
    this section
    this section
    this section
    here
    CSIDriver documentation

    Click "Execute"

  • Copy access_token from response

  • Disk space sufficient
  • Restart containers if keys changed
  • Replay pending transactions when a server goes down.

  • Support for Galera and Replication.

  • To better understand what MaxScale is capable of you may check the product page and the documentation.

    MaxScale resources

    Prior to configuring MaxScale within Kubernetes, it's essential to have a basic understanding of the resources managed through its API.

    Servers

    A server defines the backend database servers that MaxScale forwards traffic to. For more detailed information, please consult the server reference.

    Monitors

    A monitor is an agent that queries the state of the servers and makes it available to the services in order to route traffic based on it. For more detailed information, please consult the monitor reference.

    Depending on which highly available configuration your servers have, you will need to choose betweeen the following modules:

    • Galera Monitor: Detects whether servers are part of the cluster, ensuring synchronization among them, and assigning primary and replica roles as needed.

    • MariaDB Monitor: Probes the state of the cluster, assigns roles to the servers, and executes failover, switchover, and rejoin operations as necessary.

    Services

    A service defines how the traffic is routed to the servers based on a routing algorithm that takes into account the state of the servers and its role. For more detailed information, please consult the service reference.

    Depending on your requirements to route traffic, you may choose between the following routers:

    • Readwritesplit: Route write queries to the primary server and read queries to the replica servers.

    • Readconnroute: Load balance connections between multiple servers.

    Listeners

    A listener specifies a port where MaxScale listens for incoming connections. It is associated with a service that handles the requests received on that port. For more detailed information, please consult the listener reference.

    MaxScale CR

    The minimal spec you need to provision a MaxScale instance is just a reference to a MariaDB resource:

    This will provision a new StatefulSet for running MaxScale and configure the servers specified by the MariaDB resource. Refer to the Server configuration section if you want to manually configure the MariaDB servers.

    The rest of the configuration uses reasonable defaults set automatically by the operator. If you need a more fine grained configuration, you can provide this values yourself:

    As you can see, the MaxScale resources we previously mentioned have a counterpart resource in the MaxScale CR.

    The previous example configured a MaxScale for a Galera cluster, but you may also configure MaxScale with a MariaDB that uses replication. It is important to note that the monitor module is automatically inferred by the operator based on the MariaDB reference you provided, however, its parameters are specific to each monitor module:

    You also need to set a reference in the MariaDB resource to make it MaxScale-aware. This is explained in the MariaDB CR section.

    Refer to the API reference for further detail.

    MariaDB CR

    You can set a spec.maxScaleRef in your MariaDB resource to make it MaxScale-aware. By doing so, the primary server reported by MaxScale will be used in MariaDB and the high availability tasks such the primary failover will be delegated to MaxScale:

    Refer to the API reference for further detail.

    MaxScale embedded in MariaDB

    To streamline the setup outlined in the MaxScale CR and MariaDB CR sections, you can provision a MaxScale to be used with MariaDB in just one resource:

    This will automatically set the references between MariaDB and MaxScale and default the rest of the fields.

    It is important to note that, this is intended for simple use cases that only require a single replica and where no further modifications are done on the spec.maxscale field. If you need a more fine grained configuration and perform further updates to the MaxScale resource, please use a dedicated MaxScale as described in the MaxScale CR section.

    Refer to the API reference for further detail.

    Defaults

    MariaDB Enterprise Kubernetes Operator aims to provide highly configurable CRs, but at the same time maximize its usability by providing reasonable defaults. In the case of MaxScale, the following defaulting logic is applied:

    • spec.servers are inferred from spec.mariaDbRef.

    • spec.monitor.module is inferred from the spec.mariaDbRef.

    • spec.monitor.cooperativeMonitoring is set if high availability is enabled.

    • If spec.services is not provided, a readwritesplit service is configured on port 3306 by default.

    Server configuration

    As an alternative to provide a reference to a MariaDB via spec.mariaDbRef, you can also specify the servers manually:

    As you could see, you can refer to in-cluser MariaDB servers by providing the DNS names of the MariaDB Pods as server addresses. In addition, you can also refer to external MariaDB instances running outside of the Kubernetes cluster where the operator was deployed:

    Pointing to external MariaDBs has some limitations: Since the operator doesn't have a reference to a MariaDB resource (spec.mariaDbRef), it will be unable to perform the following actions:

    • Infer the monitor module (spec.monitor.module), so it will need to be provided by the user.

    • Autogenerate authentication credentials (spec.auth), so they will need to be provided by the user. See Authentication section.

    Primary server switchover

    Only the MariaDB Monitor, to be used with MariaDB replication, supports the primary switchover operation.

    You can declaratively select the primary server by setting spec.primaryServer=<server>:

    This will trigger a switchover operation and MaxScale will promote the specified server to be the new primary server.

    Server maintenance

    You can put servers in maintenance mode by setting the server field maintenance=true:

    Configuration

    Similar to MariaDB, MaxScale allows you to provide global configuration parameters in a maxscale.conf file. You don't need to provide this config file directly, but instead you can use the spec.config.params to instruct the operator to create the maxscale.conf:

    Both this global configuration and the resources created by the operator using the MaxScale API are stored under a volume provisioned by the spec.config.volumeClaimTemplate. Refer to the troubleshooting if you are getting errors writing on this volume.

    Refer to the MaxScale reference for more details about the supported parameters.

    Authentication

    MaxScale requires authentication with differents levels of permissions for the following components/actors:

    • MaxScale API consumed by MariaDB Enterprise Kubernetes Operator.

    • Clients connecting to MaxScale.

    • MaxScale connecting to MariaDB servers.

    • MaxScale monitor connecting to MariaDB servers.

    • MaxScale configuration syncer to connect to MariaDB servers. See section.

    By default, the operator generates this credentials when spec.mariaDbRef is set and spec.auth.generate = true, but you are still able to provide your own:

    As you could see, you are also able to limit the number of connections for each component/actor. Bear in mind that, when running in high availability, you may need to increase this number, as more MaxScale instances implies more connections.

    Kubernetes Services

    To enable your applications to communicate with MaxScale, a Kubernetes Service is provisioned with all the ports specified in the MaxScale listeners. You have the flexibility to provide a template to customize this Service:

    This results in the reconciliation of the following Service:

    There is also another Kubernetes Service to access the GUI, please refer to the MaxScale GUI section for further detail.

    Connection

    You can leverage the Connection resource to automatically configure connection strings as Secret resources that your applications can mount:

    Alternatively, you can also provide a connection template to your MaxScale resource:

    Note that, the Connection uses the Service described in the Kubernetes Service section and you are able to specify which MaxScale service to connect to by providing the port (spec.port) of the corresponding MaxScale listener.

    High availability

    To synchronize the configuration state across multiple replicas, MaxScale stores the configuration externally in a MariaDB table and conducts periodic polling across all replicas. By default, the table mysql.maxscale_config is used, but this can be configured by the user as well as the synchronization interval.

    Another crucial aspect to consider regarding HA is that only one monitor can be running at any given time to avoid conflicts. This can be achieved via cooperative locking, which can be configured by the user. Refer to for more information.

    Multiple MaxScale replicas can be specified by providing the spec.replicas field. Note that, MaxScale exposes the scale subresource, so you can scale/downscale it by running the following command:

    Suspend resources

    In order to enable this feature, you must set the --feature-maxscale-suspend feature flag:

    Then you will be able to suspend any MaxScale resources, for instance, you can suspend a monitor:

    MaxScale GUI

    MaxScale offers a great user interface that provides very useful information about the MaxScale resources. You can enable it by providing the following configuration:

    The GUI is exposed via a dedicated Kubernetes Service in the same port as the MaxScale API. Once you access, you will need to enter the MaxScale API credentials configured by the operator in a Secret. See the Authentication section for more details.

    MaxScale API

    MariaDB Enterprise Kubernetes Operator interacts with the to reconcile the specification provided by the user, considering both the MaxScale status retrieved from the API and the provided spec.

    Troubleshooting

    The operator tracks both the MaxScale status in regards to Kubernetes resources as well as the status of the MaxScale API resources. This information is available on the status field of the MaxScale resource, it may be very useful for debugging purposes:

    Kubernetes events emitted by mariadb-enterprise-operator may also be very relevant for debugging. For instance, an event is emitted whenever the primary server changes:

    The operator logs can also be a good source of information for troubleshooting. You can increase its verbosity and enable MaxScale API request logs by running:

    Common errors

    Permission denied writing /var/lib/maxscale

    This error occurs when the user that runs the container does not have enough privileges to write in /var/lib/maxscale:

    To mitigate this, by default, the operator sets the following securityContext in the MaxScale's StatefulSet:

    This enables the CSIDriver and the kubelet to recursively set the ownership ofr the /var/lib/maxscale folder to the group 999, which is the one expected by MaxScale. It is important to note that not all the CSIDrivers implementations support this feature, see the CSIDriver documentation for further information.

    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
    ...
      replicas: 3
    
      galera:
        enabled: true
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      ...
      galera:
        enabled: true
        config:
          reuseStorageVolume: true
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      ...
      galera:
        providerOptions:
          gcs.fc_limit: '64'
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      ...
      galera:
        enabled: true
        recovery:
          enabled: true
          minClusterSize: 1
          clusterMonitorInterval: 10s
          clusterHealthyTimeout: 30s
          clusterBootstrapTimeout: 10m
          podRecoveryTimeout: 5m
          podSyncTimeout: 5m
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      ...
      galera:
        enabled: true
        recovery:
          job:
            metadata:
              labels:
                sidecar.istio.io/inject: "false"
            resources:
              requests:
                cpu: 100m
                memory: 128Mi
              limits:
                memory: 256Mi
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      ...
      galera:
        enabled: true
        recovery:
          enabled: true
          forceClusterBootstrapInPod: "mariadb-galera-0"
    kubectl get mariadb mariadb-galera -o jsonpath="{.status.galeraRecovery}" | jq
    {
      "recovered": {
        "mariadb-galera-0": {
          "seqno": 350454,
          "uuid": "67a44ea9-63a8-11ef-98a2-2b0c0aa0a627"
        },
        "mariadb-galera-1": {
          "seqno": 350450,
          "uuid": "67a44ea9-63a8-11ef-98a2-2b0c0aa0a627"
        }
      },
      "state": {
        "mariadb-galera-0": {
          "safeToBootstrap": false,
          "seqno": -1,
          "uuid": "67a44ea9-63a8-11ef-98a2-2b0c0aa0a627",
          "version": "2.1"
        },
        "mariadb-galera-1": {
          "safeToBootstrap": false,
          "seqno": -1,
          "uuid": "67a44ea9-63a8-11ef-98a2-2b0c0aa0a627",
          "version": "2.1"
        },
        "mariadb-galera-2": {
          "safeToBootstrap": false,
          "seqno": -1,
          "uuid": "67a44ea9-63a8-11ef-98a2-2b0c0aa0a627",
          "version": "2.1"
        }
      }
    }
    apiVersion: v1
    kind: Secret
    metadata:
      name: mariadb
    stringData:
      root-password: MariaDB11!
    ---
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      rootPasswordSecretKeyRef:
        name: mariadb
        key: root-password
      storage:
        size: 1Gi
      replicas: 3
      galera:
        enabled: true
    kubectl get mariadbs
    NAME             READY   STATUS    PRIMARY POD          AGE
    mariadb-galera   True    Running   mariadb-galera-0     48m
    
    kubectl get events --field-selector involvedObject.name=mariadb-galera --sort-by='.lastTimestamp'
    LAST SEEN   TYPE     REASON                 OBJECT                               MESSAGE
    ...
    45m         Normal   GaleraClusterHealthy   mariadb/mariadb-galera               Galera cluster is healthy
    
    kubectl get mariadb mariadb-galera -o jsonpath="{.status.conditions[?(@.type=='GaleraReady')]}" | jq
    {
      "lastTransitionTime": "2023-07-13T18:22:31Z",
      "message": "Galera ready",
      "reason": "GaleraReady",
      "status": "True",
      "type": "GaleraReady"
    }
    
    kubectl get mariadb mariadb-galera -o jsonpath="{.status.conditions[?(@.type=='GaleraConfigured')]}" | jq
    {
      "lastTransitionTime": "2023-07-13T18:22:31Z",
      "message": "Galera configured",
      "reason": "GaleraConfigured",
      "status": "True",
      "type": "GaleraConfigured"
    }
    
    kubectl get statefulsets
    NAME             READY   AGE
    mariadb-galera   3/3     58m
    
    kubectl get pods -o wide
    NAME                                        READY   STATUS    RESTARTS   AGE   IP           NODE          NOMINATED NODE   READINESS GATES
    mariadb-galera-0                            2/2     Running   0          58m   10.244.2.4   mdb-worker3   <none>           <none>
    mariadb-galera-1                            2/2     Running   0          58m   10.244.1.9   mdb-worker2   <none>           <none>
    mariadb-galera-2                            2/2     Running   0          58m   10.244.5.4   mdb-worker4   <none>           <none>
    kubectl delete pods -l app.kubernetes.io/instance=mariadb-galera
    pod "mariadb-galera-0" deleted
    pod "mariadb-galera-1" deleted
    pod "mariadb-galera-2" deleted
    kubectl get mariadb mariadb-galera
    NAME             READY   STATUS             PRIMARY POD             AGE
    mariadb-galera   False   Galera not ready   mariadb-galera-0        67m
    
    kubectl get events --field-selector involvedObject.name=mariadb-galera --sort-by='.lastTimestamp'
    LAST SEEN   TYPE      REASON                    OBJECT                       MESSAGE
    ...
    48s         Warning   GaleraClusterNotHealthy   mariadb/mariadb-galera       Galera cluster is not healthy
    
    kubectl get mariadb mariadb-galera -o jsonpath="{.status.conditions[?(@.type=='GaleraReady')]}" | jq
    {
      "lastTransitionTime": "2023-07-13T19:25:17Z",
      "message": "Galera not ready",
      "reason": "GaleraNotReady",
      "status": "False",
      "type": "GaleraReady"
    }
    kubectl get events --field-selector involvedObject.name=mariadb-galera --sort-by='.lastTimestamp'
    LAST SEEN   TYPE      REASON                    OBJECT                       MESSAGE
    ...
    16m         Warning   GaleraClusterNotHealthy   mariadb/mariadb-galera       Galera cluster is not healthy
    16m         Normal    GaleraPodStateFetched     mariadb/mariadb-galera       Galera state fetched in Pod 'mariadb-galera-2'
    16m         Normal    GaleraPodStateFetched     mariadb/mariadb-galera       Galera state fetched in Pod 'mariadb-galera-1'
    16m         Normal    GaleraPodStateFetched     mariadb/mariadb-galera       Galera state fetched in Pod 'mariadb-galera-0'
    16m         Normal    GaleraPodRecovered        mariadb/mariadb-galera       Recovered Galera sequence in Pod 'mariadb-galera-1'
    16m         Normal    GaleraPodRecovered        mariadb/mariadb-galera       Recovered Galera sequence in Pod 'mariadb-galera-2'
    17m         Normal    GaleraPodRecovered        mariadb/mariadb-galera       Recovered Galera sequence in Pod 'mariadb-galera-0'
    17m         Normal    GaleraClusterBootstrap    mariadb/mariadb-galera       Bootstrapping Galera cluster in Pod 'mariadb-galera-2'
    20m         Normal    GaleraClusterHealthy      mariadb/mariadb-galera       Galera cluster is healthy
    
    kubectl get mariadb mariadb-galera -o jsonpath="{.status.galeraRecovery}" | jq
    {
      "bootstrap": {
        "pod": "mariadb-galera-2",
        "time": "2023-07-13T19:25:28Z"
      },
      "recovered": {
        "mariadb-galera-0": {
          "seqno": 3,
          "uuid": "bf00b9c3-21a9-11ee-984f-9ba9ff0e9285"
        },
        "mariadb-galera-1": {
          "seqno": 3,
          "uuid": "bf00b9c3-21a9-11ee-984f-9ba9ff0e9285"
        },
        "mariadb-galera-2": {
          "seqno": 3,
          "uuid": "bf00b9c3-21a9-11ee-984f-9ba9ff0e9285"
        }
      },
      "state": {
        "mariadb-galera-0": {
          "safeToBootstrap": false,
          "seqno": -1,
          "uuid": "bf00b9c3-21a9-11ee-984f-9ba9ff0e9285",
          "version": "2.1"
        },
        "mariadb-galera-1": {
          "safeToBootstrap": false,
          "seqno": -1,
          "uuid": "bf00b9c3-21a9-11ee-984f-9ba9ff0e9285",
          "version": "2.1"
        },
        "mariadb-galera-2": {
          "safeToBootstrap": false,
          "seqno": -1,
          "uuid": "bf00b9c3-21a9-11ee-984f-9ba9ff0e9285",
          "version": "2.1"
        }
      }
    }
    kubectl get mariadb mariadb-galera -o jsonpath="{.status.conditions[?(@.type=='GaleraReady')]}" | jq
    {
      "lastTransitionTime": "2023-07-13T19:27:51Z",
      "message": "Galera ready",
      "reason": "GaleraReady",
      "status": "True",
      "type": "GaleraReady"
    }
    
    kubectl get mariadb mariadb-galera
    NAME             READY   STATUS    PRIMARY POD          AGE
    mariadb-galera   True    Running   mariadb-galera-0     82m
    kubectl get mariadb mariadb-galera -o jsonpath="{.status.conditions}" | jq
    [
      {
        "lastTransitionTime": "2023-08-05T14:58:57Z",
        "message": "Galera not ready",
        "reason": "GaleraNotReady",
        "status": "False",
        "type": "Ready"
      },
      {
        "lastTransitionTime": "2023-08-05T14:58:57Z",
        "message": "Galera not ready",
        "reason": "GaleraNotReady",
        "status": "False",
        "type": "GaleraReady"
      },
      {
        "lastTransitionTime": "2023-08-03T19:21:16Z",
        "message": "Galera configured",
        "reason": "GaleraConfigured",
        "status": "True",
        "type": "GaleraConfigured"
      }
    ]
    kubectl get endpoints mariadb-galera-internal -o yaml
    apiVersion: v1
    kind: Endpoints
    metadata:
      name: mariadb-internal
    subsets:
    - addresses:
      - hostname: mariadb-1
        ip: 10.255.140.181
        nodeName: k8s-worker-1
        targetRef:
          kind: Pod
          name: mariadb-1
          namespace: mariadb
      - hostname: mariadb-2
        ip: 10.255.20.156
        nodeName: k8s-worker-2
        targetRef:
          kind: Pod
          name: mariadb-2
          namespace: mariadb
      - hostname: mariadb-0
        ip: 10.255.214.164
        nodeName: k8s-worker-0
        targetRef:
          kind: Pod
          name: mariadb-0
          namespace: mariadb
      ports:
      - name: sst
        port: 4568
        protocol: TCP
      - name: ist
        port: 4567
        protocol: TCP
      - name: mariadb
        port: 3306
        protocol: TCP
      - name: agent
        port: 5555
        protocol: TCP
      - name: cluster
        port: 4444
        protocol: TCP
    kubectl get events --field-selector involvedObject.name=mariadb-galera --sort-by='.lastTimestamp'
    LAST SEEN   TYPE      REASON                    OBJECT                       MESSAGE
    ...
    16m         Warning   GaleraClusterNotHealthy   mariadb/mariadb-galera       Galera cluster is not healthy
    16m         Normal    GaleraPodStateFetched     mariadb/mariadb-galera       Galera state fetched in Pod 'mariadb-galera-2'
    16m         Normal    GaleraPodStateFetched     mariadb/mariadb-galera       Galera state fetched in Pod 'mariadb-galera-1'
    16m         Normal    GaleraPodStateFetched     mariadb/mariadb-galera       Galera state fetched in Pod 'mariadb-galera-0'
    16m         Normal    GaleraPodRecovered        mariadb/mariadb-galera       Recovered Galera sequence in Pod 'mariadb-galera-1'
    16m         Normal    GaleraPodRecovered        mariadb/mariadb-galera       Recovered Galera sequence in Pod 'mariadb-galera-2'
    17m         Normal    GaleraPodRecovered        mariadb/mariadb-galera       Recovered Galera sequence in Pod 'mariadb-galera-0'
    17m         Normal    GaleraClusterBootstrap    mariadb/mariadb-galera       Bootstrapping Galera cluster in Pod 'mariadb-galera-2'
    20m         Normal    GaleraClusterHealthy      mariadb/mariadb-galera       Galera cluster is healthy
    helm upgrade --install mariadb-enterprise-operator mariadb-enterprise-operator/mariadb-enterprise-operator --set logLevel=debug
    kubectl logs mariadb-enterprise-operator-546c78f4f5-gq44k
    {"level":"info","ts":1691090524.4911606,"logger":"galera.health","msg":"Checking Galera cluster health","controller":"statefulset","controllerGroup":"apps","controllerKind":"StatefulSet","statefulSet":{"name":"mariadb-galera","namespace":"default"},"namespace":"default","name":"mariadb-galera","reconcileID":"098620db-4486-45cc-966a-9f3fec0d165e"}
    {"level":"debug","ts":1691090524.4911761,"logger":"galera.health","msg":"StatefulSet ready replicas","controller":"statefulset","controllerGroup":"apps","controllerKind":"StatefulSet","statefulSet":{"name":"mariadb-galera","namespace":"default"},"namespace":"default","name":"mariadb-galera","reconcileID":"098620db-4486-45cc-966a-9f3fec0d165e","replicas":1}
    kubectl logs mariadb-galera-0 -c init
    {"level":"info","ts":1691090778.5239124,"msg":"Starting init"}
    {"level":"info","ts":1691090778.5305626,"msg":"Configuring Galera"}
    {"level":"info","ts":1691090778.5307593,"msg":"Already initialized. Init done"}
    
    kubectl logs mariadb-galera-0 -c agent
    {"level":"info","ts":1691090779.3193653,"logger":"server","msg":"server listening","addr":":5555"}
    2023/08/03 19:26:28 "POST http://mariadb-galera-0.mariadb-galera-internal.default.svc.cluster.local:5555/api/recovery HTTP/1.1" from 10.244.4.2:39162 - 200 58B in 4.112086ms
    2023/08/03 19:26:28 "DELETE http://mariadb-galera-0.mariadb-galera-internal.default.svc.cluster.local:5555/api/recovery HTTP/1.1" from 10.244.4.2:39162 - 200 0B in 883.544µs
    
    kubectl logs mariadb-galera-0 -c mariadb
    2023-08-03 19:27:10 0 [Note] WSREP: Member 2.0 (mariadb-galera-0) synced with group.
    2023-08-03 19:27:10 0 [Note] WSREP: Processing event queue:...100.0% (1/1 events) complete.
    2023-08-03 19:27:10 0 [Note] WSREP: Shifting JOINED -> SYNCED (TO: 6)
    2023-08-03 19:27:10 2 [Note] WSREP: Server mariadb-galera-0 synced with group
    2023-08-03 19:27:10 2 [Note] WSREP: Server status change joined -> synced
    2023-08-03 19:27:10 2 [Note] WSREP: Synchronized with group, ready for connections
    kubectl get mariadb mariadb-galera -o jsonpath="{.status.galeraRecovery}" | jq
    kubectl get events --field-selector involvedObject.name=mariadb-galera
    Error writing Galera config: open /etc/mysql/mariadb.conf.d/0-galera.cnf: permission denied
    apiVersion: apps/v1
    kind: StatefulSet
    metadata:
      name: mariadb-galera
    spec:
      securityContext:
        fsGroup: 999
        runAsGroup: 999
        runAsNonRoot: true
        runAsUser: 999
    Error reconciling Galera: error disabling bootstrap in Pod 0: unauthorized
    kubectl auth can-i --list --as=system:serviceaccount:default:mariadb-enterprise-operator | grep tokenreview
    tokenreviews.authentication.k8s.io              []                                    []               [create]
    
    kubectl auth can-i --list --as=system:serviceaccount:default:mariadb-galera | grep tokenreview
    tokenreviews.authentication.k8s.io              []                                    []               [create]
    kubectl get clusterrole system:auth-delegator
    NAME                    CREATED AT
    system:auth-delegator   2023-08-03T19:12:37Z
    
    kubectl get clusterrolebinding | grep mariadb | grep auth-delegator
    mariadb-galera:auth-delegator                     ClusterRole/system:auth-delegator                                                  108m
    mariadb-enterprise-operator:auth-delegator                        ClusterRole/system:auth-delegator                                                  112m
    helm upgrade --install mariadb-enterprise-operator mariadb-enterprise-operator/mariadb-enterprise-operator
    Timeout waiting for Pod 'mariadb-galera-2' to be Synced
    Galera cluster bootstrap timed out. Resetting recovery status
    # Check Docker
    docker --version
    
    # Check disk space
    df -h /
    
    # Check shell
    echo $SHELL
    # Check Docker
    docker --version
    
    # Check disk space
    Get-PSDrive C | Select-Object Used,Free
    # Check if ports are in use
    sudo lsof -i :8000
    sudo lsof -i :8002
    sudo lsof -i :3306
    sudo lsof -i :8200
    
    # No output = ports are free ✓
    # Alternative using netstat:
    netstat -an | grep :8000
    # Check if ports are in use
    netstat -ano | findstr :8000
    netstat -ano | findstr :8002
    netstat -ano | findstr :3306
    netstat -ano | findstr :8200
    
    # No output = ports are free ✓
    # Test API key
    API_KEY="YOUR_API_KEY_HERE"
    curl "https://generativelanguage.googleapis.com/v1beta/models?key=$API_KEY"
    # Should return list of models
    $apiKey = "YOUR_API_KEY_HERE"
    $uri = "https://generativelanguage.googleapis.com/v1beta/models?key=$apiKey"
    Invoke-RestMethod -Uri $uri
    # Should return list of models
    ├── rag-in-a-box_1.0_amd64.deb
    ├── Dockerfile
    ├── docker-compose.yml
    ├── start-services.sh
    ├── config.env.secure.local
    ├── config.env.vault.local
    ├── config.env.template
    └── Localvault/
        ├── docker-compose.vault.yml
        └── setup_vault_local.ps1
    # Navigate to download location
    cd /path/to/download/location
    
    # List files
    ls -lh
    # Navigate to download location
    cd "C:\path\to\download\location"
    
    # List files
    Get-ChildItem | Select-Object Name, Length
    # API Key (MUST UPDATE)
    GEMINI_API_KEY=YOUR_ACTUAL_API_KEY_HERE
    
    # Database (default values OK)
    DB_HOST=mysql-db
    DB_PORT=3306
    DB_USER=root
    DB_PASSWORD=your_secure_database_password
    DB_NAME=kb_chunks
    
    # Security Keys (MUST BE IDENTICAL)
    SECRET_KEY=your_generated_secret_key_must_be_same_for_all_three
    JWT_SECRET_KEY=your_generated_secret_key_must_be_same_for_all_three
    MCP_AUTH_SECRET_KEY=your_generated_secret_key_must_be_same_for_all_three
    
    # Server Configuration (default values OK)
    APP_HOST=0.0.0.0
    APP_PORT=8000
    MCP_HOST=0.0.0.0
    MCP_PORT=8002
    cd "c:\Users\YourUsername\OneDrive\WIP\MariaDB AI RAG Binaries\Ubuntu"
    cd "c:\Users\YourUsername\OneDrive\WIP\AI Nexus Binaries\Ubuntu"
    cd "c:\DOWNLOAD-LOCATION"
    docker build -t ai-nexus-image .
    docker images | Select-String "ai-nexus-image"
    # Should show: ai-nexus-image    latest    <image-id>    <time>    ~1.2GB
    docker compose up -d
    [+] Running 3/3
     ✔ Network ai-nexus-network    Created
     ✔ Container mysql-db          Started
     ✔ Container ai-nexus          Started
    docker logs ai-nexus -f
    # Press Ctrl+C to exit (containers keep running)
    Starting RAG server...
    RAG server started with PID: 15
    Waiting for RAG API to be ready...
    ✓ RAG API is ready! (took ~30 seconds)
    Starting MCP server...
    Adaptive MCP Server ready on 0.0.0.0:8002
    INFO:     Uvicorn running on http://0.0.0.0:8000
    docker-compose ps
    NAME       STATUS                    PORTS
    ai-nexus   Up X minutes              0.0.0.0:8000->8000/tcp, 0.0.0.0:8002->8002/tcp
    mysql-db   Up X minutes (healthy)    0.0.0.0:3306->3306/tcp
    # Test RAG API
    curl http://localhost:8000/health
    
    # Open Swagger UI in browser
    
    xdg-open http://localhost:8000/docs  # Linux
    
    # Test MCP Server
    curl http://localhost:8002/health
    # Test RAG API
    Invoke-RestMethod -Uri "http://localhost:8000/health"
    
    # Open Swagger UI
    Start-Process "http://localhost:8000/docs"
    
    # Test MCP Server
    Invoke-RestMethod -Uri "http://localhost:8002/health"
    cd "c:\Users\YourUsername\OneDrive\WIP\MariaDB AI RAG Binaries\Ubuntu"
    cd "c:\Users\YourUsername\OneDrive\WIP\AI Nexus Binaries\Ubuntu"
    cd "c:\DOWNLOAD-LOCATION"
    docker build -t ai-nexus-image .
    .\Localvault\setup_vault_local.ps1
    [SUCCESS] Vault Setup Complete!
    
    Vault Details:
      URL:    http://127.0.0.1:8200
      Token:  rag-root-token
      Path:   secret/rag-in-a-box
    # Check Vault container
    docker ps --filter "name=rag-vault"
    
    # View secrets
    docker exec -e VAULT_TOKEN=rag-root-token rag-vault vault kv get secret/rag-in-a-box
    docker exec -e VAULT_TOKEN=rag-root-token rag-vault vault kv patch secret/rag-in-a-box GEMINI_API_KEY="YOUR_ACTUAL_API_KEY"
    docker-compose --env-file config.env.vault.local up -d
    docker compose ps
    docker logs ai-nexus -f
    curl http://localhost:8000/health
    docker compose ps
    docker logs ai-nexus -f
    Invoke-RestMethod -Uri "http://localhost:8000/health"
    {
      "username": "admin",
      "password": "your_password"
    }
    {
      "query": "What is the main topic of the document?"
    }
    {
      "mcpServers": {
        "ai-nexus": {
          "url": "http://localhost:8002/mcp",
          "headers": {
            "Authorization": "Bearer YOUR_TOKEN_HERE"
          }
        }
      }
    }
    # Check all services
    docker compose ps
    
    # Check RAG API health
    curl http://localhost:8000/health
    
    # Check MCP Server health
    curl http://localhost:8002/health
    
    # Check logs
    docker logs ai-nexus --tail 50
    docker logs mysql-db --tail 50
    # Check all services
    docker compose ps
    
    # Check RAG API health
    Invoke-RestMethod -Uri "http://localhost:8000/health"
    
    # Check MCP Server health
    Invoke-RestMethod -Uri "http://localhost:8002/health"
    
    # Check logs
    docker logs ai-nexus --tail 50
    docker logs mysql-db --tail 50
    # Monitor resource usage
    docker stats ai-nexus mysql-db
    
    # Check disk space
    docker system df
    docker logs mysql-db --tail 20
    docker-compose ps
    docker exec ai-nexus ping mysql-db
    # Check secret keys
    docker exec ai-nexus env | Select-String "SECRET"
    
    # Restart if needed
    docker-compose restart
    $apiKey = "YOUR_API_KEY"
    $uri = "https://generativelanguage.googleapis.com/v1beta/models?key=$apiKey"
    Invoke-RestMethod -Uri $uri
    # Find process on port 8000
    netstat -ano | findstr :8000
    
    # Stop process (replace <PID>)
    Stop-Process -Id <PID> -Force
    # Navigate to project
    cd "c:\Users\YourUsername\OneDrive\WIP\MariaDB AI RAG Binaries\Ubuntu"
    cd "c:\Users\YourUsername\OneDrive\WIP\AI Nexus Binaries\Ubuntu"
    cd "c:\DOWNLOAD-LOCATION"
    
    # Build image
    docker build -t ai-nexus-image .
    
    # Start (Standalone)
    docker-compose up -d
    
    # Start (Vault)
    docker-compose --env-file config.env.vault.local up -d
    
    # Stop
    docker-compose down
    
    # View logs
    docker logs ai-nexus -f
    
    # Check status
    docker-compose ps
    
    # Restart
    docker-compose restart
    
    # Clean restart
    docker-compose down -v && docker-compose up -d
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale-galera
    spec:
      mariaDbRef:
        name: mariadb-galera
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale-galera
    spec:
    ...
      mariaDbRef:
        name: mariadb-galera
    
      services:
        - name: rw-router
          router: readwritesplit
          listener:
            port: 3306
    
      monitor:
        interval: 2s
        cooperativeMonitoring: majority_of_all
        params:
          disable_master_failback: "false"
          available_when_donor: "false"
          disable_master_role_setting: "false"
    
      kubernetesService:
        type: LoadBalancer
        metadata:
          annotations:
            metallb.universe.tf/loadBalancerIPs: 172.18.0.224
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale-repl
    spec:
    ...
      mariaDbRef:
        name: mariadb-repl
    
      services:
        - name: rw-router
          router: readwritesplit
          params:
            transaction_replay: "true"
            transaction_replay_attempts: "10"
            transaction_replay_timeout: "5s"
            max_slave_connections: "255"
            max_replication_lag: "3s"
            master_accept_reads: "true"
          listener:
            port: 3306
            protocol: MariaDBProtocol
            params:
              connection_metadata: "tx_isolation=auto"
        - name: rconn-master-router
          router: readconnroute
          params:
            router_options: "master"
            max_replication_lag: "3s"
            master_accept_reads: "true"
          listener:
            port: 3307
        - name: rconn-slave-router
          router: readconnroute
          params:
            router_options: "slave"
            max_replication_lag: "3s"
          listener:
            port: 3308
    
      monitor:
        interval: 2s
        cooperativeMonitoring: majority_of_all
        params:
          auto_failover: "true"
          auto_rejoin: "true"
          switchover_on_low_disk_space: "true"
    
      kubernetesService:
        type: LoadBalancer
        metadata:
          annotations:
            metallb.universe.tf/loadBalancerIPs: 172.18.0.214
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
    ...
      maxScaleRef:
        name: maxscale-galera
    
      galera:
        enabled: true
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
    ...
      maxScale:
        enabled: true
    
        kubernetesService:
          type: LoadBalancer
          metadata:
            annotations:
              metallb.universe.tf/loadBalancerIPs: 172.18.0.229
    
      galera:
        enabled: true
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale-galera
    spec:
    ...
      servers:
        - name: mariadb-0
          address: mariadb-galera-0.mariadb-galera-internal.default.svc.cluster.local
        - name: mariadb-1
          address: mariadb-galera-1.mariadb-galera-internal.default.svc.cluster.local
        - name: mariadb-2
          address: mariadb-galera-2.mariadb-galera-internal.default.svc.cluster.local
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale-galera
    spec:
    ...
      servers:
        - name: mariadb-0
          address: 172.18.0.140
          port: 3306
        - name: mariadb-1
          address: 172.18.0.141
        - name: mariadb-2
          address: 172.18.0.142
    
      monitor:
        name: mariadb-monitor
        module: galeramon
        interval: 2s
        cooperativeMonitoring: majority_of_all
        params:
          disable_master_failback: "false"
          available_when_donor: "false"
          disable_master_role_setting: "false"
    
      auth:
        adminUsername: mariadb-enterprise-operator
        adminPasswordSecretKeyRef:
          name: maxscale
          key: password
        clientUsername: maxscale-client
        clientPasswordSecretKeyRef:
          name: maxscale
          key: password
        serverUsername: maxscale-server
        serverPasswordSecretKeyRef:
          name: maxscale
          key: password
        monitorUsername: maxscale-monitor
        monitorPasswordSecretKeyRef:
          name: maxscale
          key: password
        syncUsername: maxscale-sync
        syncPasswordSecretKeyRef:
          name: maxscale
          key: password
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale-repl
    spec:
      primaryServer: mariadb-repl-1
    kubectl patch maxscale maxscale-repl \
      --type='merge' \
      -p '{"spec":{"primaryServer":"mariadb-repl-1"}}'
      
    kubectl get maxscale
    NAME            READY   STATUS                                  PRIMARY          AGE
    maxscale-repl   False   Switching primary to 'mariadb-repl-1'   mariadb-repl-0   2m15s
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale-galera
    spec:
      servers:
        - name: mariadb-0
          address: mariadb-galera-0.mariadb-galera-internal.default.svc.cluster.local
          port: 3306
          protocol: MariaDBBackend
          maintenance: true
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale-galera
    spec:
    ...
      config:
        params:
          log_info: "true"
        volumeClaimTemplate:
          resources:
            requests:
              storage: 100Mi
          accessModes:
            - ReadWriteOnce
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale-galera
    spec:
    ...
      auth:
        generate: false
        adminUsername: mariadb-enterprise-operator
        adminPasswordSecretKeyRef:
          name: maxscale
          key: password
        deleteDefaultAdmin: true
        clientUsername: maxscale-client
        clientPasswordSecretKeyRef:
          name: maxscale
          key: password
        clientMaxConnections: 90
        serverUsername: maxscale-server
        serverPasswordSecretKeyRef:
          name: maxscale
          key: password
        serverMaxConnections: 90 
        monitorUsername: maxscale-monitor
        monitorPasswordSecretKeyRef:
          name: maxscale
          key: password
        monitorMaxConnections: 90 
        syncUsername: maxscale-sync
        syncPasswordSecretKeyRef:
          name: maxscale
          key: password
        syncMaxConnections: 90
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale-galera
    spec:
    ...
      kubernetesService:
        type: LoadBalancer
        metadata:
          annotations:
            metallb.universe.tf/loadBalancerIPs: 172.18.0.224
    apiVersion: v1
    kind: Service
    metadata:
      annotations:
        metallb.universe.tf/loadBalancerIPs: 172.18.0.229
      name: maxscale-galera
    spec:
    ...
      ports:
      - name: admin
        port: 8989
        targetPort: 8989
      - name: rw-router-listener
        port: 3306
        targetPort: 3306
      selector:
        app.kubernetes.io/instance: maxscale-galera
        app.kubernetes.io/name: maxscale
      type: LoadBalancer
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: Connection
    metadata:
      name: connection-maxscale
    spec:
      maxScaleRef:
        name: maxscale-galera
      username: maxscale-galera-client
      passwordSecretKeyRef:
        name: maxscale-galera-client
        key: password
      secretName: conn-mxs
      port: 3306
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale-galera
    spec:
    ...  
      connection:
        secretName: mxs-galera-conn
        port: 3306
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale-galera
    spec:
    ...
      replicas: 2
    
      monitor:
        name: mariadb-monitor
        module: galeramon
        interval: 2s
        cooperativeMonitoring: majority_of_all
        params:
          disable_master_failback: "false"
          available_when_donor: "false"
          disable_master_role_setting: "false"   
    
      config:
        sync:
          database: mysql
          interval: 5s
          timeout: 10s
    kubectl scale maxscale maxscale-galera --replicas 3
    helm upgrade --install mariadb-enterprise-operator mariadb-enterprise-operator/mariadb-enterprise-operator --set extraArgs={--feature-maxscale-suspend}
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale-galera
    spec:
    ...
      monitor:
        name: mariadb-monitor
        module: galeramon
        interval: 2s
        cooperativeMonitoring: majority_of_all
        params:
          disable_master_failback: "false"
          available_when_donor: "false"
          disable_master_role_setting: "false"   
        suspend: true
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale-galera
    spec:
    ...
      admin:
        port: 8989
        guiEnabled: true
      guiKubernetesService:
        type: LoadBalancer
        metadata:
          metadata:
            annotations:
              metallb.universe.tf/loadBalancerIPs: 172.18.0.231
    status:
      conditions:
      - lastTransitionTime: "2024-02-08T17:29:01Z"
        message: Running
        reason: MaxScaleReady
        status: "True"
        type: Ready
      configSync:
        databaseVersion: 20
        maxScaleVersion: 20
      listeners:
      - name: rw-router-listener
        state: Running
      monitor:
        name: galeramon-monitor
        state: Running
      primaryServer: mariadb-galera-1
      replicas: 1
      servers:
      - name: mariadb-galera-0
        state: Slave, Synced, Running
      - name: mariadb-galera-1
        state: Master, Synced, Running
      - name: mariadb-galera-2
        state: Slave, Synced, Running
      services:
      - name: rw-router
        state: Started
    kubectl get events --field-selector involvedObject.name=mariadb-repl-maxscale --sort-by='.lastTimestamp'
    
    LAST SEEN   TYPE      REASON                         OBJECT                           MESSAGE
    24s         Normal    MaxScalePrimaryServerChanged   maxscale/mariadb-repl-maxscale   MaxScale primary server changed from 'mariadb-repl-0' to 'mariadb-repl-1'
    helm upgrade --install mariadb-enterprise-operator mariadb-enterprise-operator/mariadb-enterprise-operator --set logLevel=debug --set extraArgs={--log-maxscale}
    Failed to create directory '/var/lib/maxscale/maxscale.cnf.d': 13, Permission denied
    apiVersion: apps/v1
    kind: StatefulSet
    metadata:
      name: maxscale-galera
    spec:
      securityContext:
        fsGroup: 999
        runAsGroup: 999
        runAsNonRoot: true
        runAsUser: 999

    WHITE PAPER

    The Ultimate Guide to High Availability with MariaDB

    Download Now

    Cover
    high availability
    Cover

    Developing Applications with MariaDB & Containers via Docker

    Asynchronous Replication

    The operator supports provisioning and operating MariaDB clusters with replication as a highly availability topology. In the following sections we will be covering how to manage the full lifecycle of a replication cluster.

    In a replication setup, one primary server handles all write operations while one or more replica servers replicate data from the primary, being able to handle read operations. More precisely, the primary has a binary log and the replicas asynchronously replicate the binary log events over the network.

    Please refer to the MariaDB documentation for more details about replication.

    Provisioning

    In order to provision a replication cluster, you need to configure a number of replicas greater than 1 and set the replication.enabled=true in the MariaDB CR:

    After applying the previous CR, the operator will provision a replication cluster with one primary and two replicas. The operator will take care of setting up replication, configuring the replication user and monitoring the replication status:

    As you can see, the primary can be identified in the PRIMARY column of the kubectl get mariadb output. You may also inspect the current replication status by checking the MariaDB CR status:

    The operator continiously monitors the replication status via , taking it into account for internal operations and updating the CR status accordingly.

    Asynchronous vs semi-syncrhonous replication

    By default, is configured, which requires an acknowledgement from at least one replica before committing the transaction back to the client. This trades off performance for better consistency and facilitates and operations.

    If you are aiming for better performance, you can disable semi-synchronous replication, and go fully asynchronous, please refer to section for doing so.

    Configuration

    The replication settings can be customized under the replication section of the MariaDB CR. The following options are available:

    • gtidStrictMode: Enables GTID strict mode. It is recommended and enabled by default. See .

    • semiSyncEnabled: Determines whether semi-synchronous replication should be enabled. It is enabled by default. See .

    • semiSyncAckTimeout: ACK timeout for the replicas to acknowledge transactions to the primary. It requires semi-synchronous replication. See .

    These options are used by the operator to create a replication configuration file that is applied to all nodes in the cluster. When updating any of these options, an will be triggered in order to apply the new configuration.

    For replica-specific configuration options, please refer to the section. Additional system variables may be configured via the myCnf configuration field. Refer to the for more details.

    Replica configuration

    The following options are replica-specific and can be configured under the replication.replica section of the MariaDB CR:

    • replPasswordSecretKeyRef: Reference to the Secret key containing the password for the replication user, used by the replicas to connect to the primary. By default, a Secret with a random password will be created.

    • gtid: GTID position mode to be used (CurrentPos and SlavePos allowed). It defaults to CurrentPos. See .

    Probes

    Kubernetes probes are resolved by the agent (see documentation) in the replication topology, taking into account both the MariaDB and replication status. Additionally, as described in the , probe thresholds may be tuned accordingly for a better reliability based on your environment.

    In the following sub-sections we will be covering specifics about the replication topology.

    Liveness probe

    As part of the liveness probe, the agent checks that the MariaDB server is running and that the replication threads (Slave_IO_Running and Slave_SQL_Running) are both running on replicas. If any of these checks fail, the liveness probe will fail.

    If such a behaviour is undesirable, it is possible to opt in for regular standalone startup/liveness probes (default SELECT 1 query). See standaloneProbes in the section.

    Readiness probe

    The readiness probe checks that the MariaDB server is running and that the Seconds_Behind_Master value is within the acceptable lag range defined by the spec.replication.replica.maxLagSeconds configuration option. If the lag exceeds this value, the readiness probe will fail and the replica will be marked as not ready.

    Lagged replicas

    A replica is considered to be lagging behind the primary when the Seconds_Behind_Master value reported by SHOW SLAVE STATUS exceeds the spec.replication.replica.maxLagSeconds configuration option. This results in the failing for that replica, and it has the following implications:

    • When using , queries will not be forwarded to lagged replicas. This doesn't affect MaxScale routing.

    • When taking a , lagged replicas will not be considered as a target for taking the backup.

    • During a managed by the operator, lagged replicas will block switchover operations, as all the replicas must be in sync before promoting the new primary. This doesn't affect MaxScale switchover operation.

    • During a managed by the operator, lagged replicas will not be considered as candidates to be promoted as the new primary. MaxScale failover will not consider lagged replicas either.

    Backing up and restoring

    In order to back up and restore a replication cluster, all the concepts and procedures described in the documentation apply.

    Additionally, for the replication topology, the operator tracks the GTID position at the time of taking the backup, and sets this position in the gtid_slave_pos system variable when restoring the backup, as described in the .

    Depending on the PhysicalBackup strategy used, the operator will track the GTID position accordingly:

    mariadb-backup

    When using PhysicalBackup with the mariadb-backup strategy, the GTID will be restored to a mariadb-enterprise-operator.info file in the data directory, which the agent will expose to the operator via HTTP.

    VolumeSnapshot

    When using PhysicalBackup with the VolumeSnapshot strategy, the GTID position will be kept in a enterprise.mariadb.com/gtid annotation in the VolumeSnapshot object, which later on the operator will read when restoring the backup.

    Refrain from removing the enterprise.mariadb.com/gtid annotation in the VolumeSnapshot object, as it is required for configuring the replica when restoring the backup.

    Primary switchover

    Our recommendation for production environments is to rely on for the , as it provides .

    You can declaratively trigger a primary switchover by updating the spec.replication.primary.podIndex field in the MariaDB CR to the index of the replica you want to promote as the new primary. For example, to promote the replica at index 1:

    You can also do this imperatively using kubectl:

    This will result in the MariaDB object reporting the following status:

    The steps involved in the switchover operation are:

    1. Lock the current primary using FLUSH TABLES WITH READ LOCK to ensure no new transactions are being processed.

    2. Set the read_only system variable on the current primary to prevent any write operations.

    3. Wait until all the replicas are in sync with the current primary. The timeout for this step can be configured via the spec.replication.replica.syncTimeout option. If the timeout is reached, the switchover operation will be retried from the beginning.

    If the switchover operation is stuck waiting for replicas to be in sync, you can check the MariaDB status to identify which replicas are causing the issue. Furthermore, if still in this step, you can cancel the switchover operation by setting back the spec.replication.primary.podIndex field back to the previous primary index.

    Primary failover

    Our recommendation for production environments is to rely on for the failover process, as it provides .

    You can configure the operator to automatically perform a primary failover whenever the current primary becomes unavailable:

    Optionally, you may also specify a autoFailoverDelay, which will add a delay before triggering the failover operation. By default, the failover is immediate, but introducing a delay may be useful to avoid failovers due to transient issues. But note that the delay should be lower than the readiness probe failure threshold (e.g. 20 seconds delay when readiness threshold is 30 seconds), otherwise all the replicas will be marked as not ready and the automatic failover will not be able to proceed.

    Whenever the primary becomes unavailable, the following status will be reported in the MariaDB CR:

    The criteria for choosing a new primary is:

    • The Pod should be in Ready state, therefore not considering unavailable or lagged replicas (see and sections).

    • Both the IO(Slave_IO_Running) and the SQL(Slave_SQL_Running) threads should be running.

    • The replica should not have relay log events.

    Once the new primary is selected, the failover process will be performed, consisting of the following steps:

    1. Wait for the new primary to apply all relay log events.

    2. Promote the selected replica to be the new primary.

    3. Connect replicas to the new primary.

    Updates

    When updating a replication cluster, all the considerations and procedures described in the documentation apply.

    Furthermore, for the replication topology, the operator will trigger an additional once all the replicas have been updated, just before updating the primary. This ensures that the primary is always updated last, minimizing the impact on write operations.

    The steps involved in updating a replication cluster are:

    1. Update each replica one by one, waiting for each replica to be ready before proceeding to the next one (see section).

    2. Once all replicas are up to date and synced, perform a to promote one of the replicas as the new primary. If MariaDB CR has a MaxScale configured using the spec.maxScaleRef field, the operator will trigger the instead.

    3. Update the previous primary, now running as a replica.

    Scaling out

    Scaling out a replication cluster implies adding new replicas to the cluster i.e scaling horizontally. The process involves taking a physical backup from a ready replica to setup the new replica PVC, and upscaling the replication cluster afterwards.

    The first step is to define the to be used for taking the backup. For doing so, we will be defining a PhysicalBackup CR, that will be used by the operator as template for creating the actual PhysicalBackup object during scaling out events. For instance, to use the mariadb-backup strategy, we can define the following PhysicalBackup:

    It is important to note that, we set the spec.schedule.suspend=true to prevent scheduling this backup, as it will be only be used as a template.

    Alternatively, you may also use a VolumeSnapshot strategy for taking the backup:

    Once the PhysicalBackup template is created, you neeed to set a reference to it in the spec.replication.replica.bootstrapFrom, indicating that this will be the source for creating new replicas:

    At this point, you can proceed to scale out the cluster by increasing the spec.replicas field in the MariaDB CR. For example, to scale out from 3 to 4 replicas:

    You can also do this imperatively using kubectl:

    This will trigger an scaling out operation, resulting in:

    • A PhysicalBackup based on the template being created.

    • Creating a new PVC for the new replica based on the PhysicalBackup.

    • Upscaling the StatefulSet, adding a Pod that mounts the newly created PVC.

    It is important to note that, if there are no ready replicas available at the time of the scaling out operation, the PhysicalBackup will not become ready, and the scaling out operation will be stuck until a replica becomes ready. You have the ability to cancel the scaling out operation by setting back the spec.replicas field to the previous value.

    Replica recovery

    The operator has the ability to automatically recover replicas that become unavailable and report a specific error code in the replication status. For doing so, the operator continiously monitors the replication status of each replica, and whenever a replica reports an error code listed in the table below, the operator will trigger an automated recovery process for that replica:

    Error Code
    Thread
    Description
    Documentation

    To perform the recovery, the operator will take a physical backup from a ready replica, restore it to the failed replica PVC, and reconfigure the replica to connect to the primary from the GTID position stored in the backup.

    Similarly to the operation, you need to define a PhysicalBackup template and set a reference to it in the spec.replication.replica.bootstrapFrom field of the MariaDB CR. Additionally, you need to explicitly enable the replica recovery, as it is disabled by default:

    The errorDurationThreshold option defines the duration after which, a replica reporting an unknown error code will be considered for recovery. This is useful to avoid recovering replicas due to transient issues. It defaults to 5m.

    We will be simulating a 1236 error in a replica to demostrate how the recovery process works:

    Do not perform the following steps in a production environment.

    • Purge the binary logs in the primary:

    • Delete the PVC and restart one of the replicas:

    This will trigger a replica recovery operation, resulting in:

    • A PhysicalBackup based on the template being created.

    • Restoring the backup to the failed replica PVC.

    • Reconfigure the replica to connect to the primary from the GTID position stored in the backup.

    It is important to note that, if there are no ready replicas available at the time of the recovery operation, the PhysicalBackup will not become ready, and the recovery operation will be stuck until a replica becomes ready. You have the ability to cancel the recovery operation by setting spec.replication.replica.recovery.enabled=false.

    Troubleshooting

    The operator tracks the current replication status under the MariaDB status subresource. This status is updated every time the operator reconciles the MariaDB resource, and it is the first place to look for when troubleshooting replication issues:

    Additionally, also under the status subresource, the operator sets status conditions whenever a specific state of the MariaDB lifecycle is reached:

    The operator also emits Kubernetes events during failover/switchover operations. You may check them to see how these operations progress:

    Common errors

    Primary has purged binary logs, unable to configure replica

    The primary may purge binary log events at some point, after then, if a replica requests events before that point, it will fail with the following error:

    This is a something the operator is able to recover from, please refer to the .

    Scaling out/recovery operation stucked

    These operations rely on a PhysicalBackup for setting up the new replicas. If this PhysicalBackup does not become ready, the operation will not progress. In order to debug this please refer to the .

    One of the reasons could be that there are not replicas in ready state at the time of creating the PhysicalBackup, for instance, all the replicas are lagging behind the primary. Please verify that this is the case by checking the status of your MariaDB resource and your Pods.

    MaxScale switchover stucked during update

    When using MaxScale, after having updated all the replica Pods, it could happen that MaxScale refuses to perform the switchover, as it considers the Pod chosen by the operator to be unsafe:

    For this case, you can manually update the primaryServer field in the MaxScale resource to a safe Pod, and restart the operator. If the new primary server is the right Pod, MaxScale will start the switchover and the update will continue after it completes.

    Technical Architecture

    Table of Contents

    1. System Architecture

    2. Component Details


    System Architecture

    High-Level Architecture

    Container Dependency Graph


    Component Details

    1. RAG API Component

    Binary Location: /opt/rag-in-a-box/bin/rag-api

    Responsibilities:

    • Document ingestion and processing

    • Text chunking and embedding generation

    • Vector storage and retrieval

    • Semantic search

    Technology Stack:

    • Framework: FastAPI (Python)

    • ASGI Server: Uvicorn

    • Database Driver: PyMySQL / aiomysql

    • Embedding Client: Google Generative AI SDK

    Endpoints:

    Configuration Variables:

    2. MCP Server Component

    Binary Location: /opt/rag-in-a-box/bin/mcp-server

    Responsibilities:

    • Model Context Protocol implementation

    • Database tool exposure

    • Vector store tool exposure

    • RAG tool exposure

    Technology Stack:

    • Framework: FastAPI (Python)

    • ASGI Server: Uvicorn

    • Protocol: MCP (Model Context Protocol)

    • Database Client: PyMySQL

    Available Tools:

    Core Tools:

    • health_check - Server health verification

    • get_server_status - Detailed server status

    Database Tools:

    • list_databases - List all databases

    • list_tables - List tables in database

    • get_table_schema - Get table structure

    Vector Store Tools:

    • create_vector_store - Create vector store

    • delete_vector_store - Delete vector store

    • list_vector_stores - List all vector stores

    RAG Tools:

    • ingest_documents - Ingest documents via RAG API

    • generate_response - Generate RAG responses

    Configuration Variables:

    3. MariaDB Component

    Image: mariadb:11

    Configuration:

    Database Schema:


    Data Flow

    Document Ingestion Flow

    RAG Query Flow


    Security Architecture

    Authentication Flow

    Security Keys

    Critical Requirement: All three keys must be identical for unified authentication:

    Key Generation (for production):

    Security Features

    1. JWT Authentication

      • Algorithm: HS256

      • Expiration: 30 minutes (configurable)

      • Unified token for RAG API and MCP Server


    Configuration Management

    Configuration Modes

    1. Standalone Mode

    File: config.env.secure.local Usage: Direct environment variables Security: Secrets stored in file Best for: Development, single developer

    2. Vault Mode

    File: config.env.vault.local Usage: HashiCorp Vault integration Security: Secrets stored in Vault Best for: Team development, production-like

    Vault Configuration:

    3. 1Password Mode

    File: config.env.1password.employee Usage: 1Password CLI references Security: Secrets in 1Password vault Best for: Enterprise with 1Password

    1Password References:

    4. HCP Vault Mode

    File: config.env.hcp.live Usage: HashiCorp Cloud Platform Security: Cloud-managed secrets Best for: Production cloud deployments


    API Specifications

    RAG API Endpoints

    POST /token

    Description: Generate JWT authentication token

    Request:

    Response:

    POST /ingest

    Description: Upload and process documents

    Headers:

    Request:

    Response:

    POST /generate

    Description: Generate RAG response

    Headers:

    Request:

    Response:


    Database Schema

    Tables

    documents_DEMO_gemini

    vdb_tbl_DEMO_gemini

    Vector Storage Format

    Embedding Dimensions: 768 (float32) Storage Size: 768 × 4 bytes = 3,072 bytes per vector Format: Binary BLOB Encoding: IEEE 754 single-precision floating-point


    Performance Characteristics

    Resource Requirements

    Per Container:

    Performance Metrics

    Document Ingestion:

    • Processing speed: ~5 documents/batch

    • Chunking: ~100 chunks/second

    • Embedding generation: ~32 chunks/batch

    • Total time: ~30-60 seconds per document (depends on size)

    Query Performance:

    • Embedding generation: ~100-200ms

    • Similarity search: ~50-100ms (depends on dataset size)

    • LLM generation: ~1-3 seconds

    • Total response time: ~2-4 seconds

    Scalability

    Current Limits:

    • Max file size: 200MB

    • Max concurrent requests: 100/minute

    • Database connections: 10 (pool size)

    Scaling Options:

    • Horizontal: Deploy multiple ai-nexus containers

    • Vertical: Increase container resources

    • Database: Use read replicas for queries


    End of Technical Architecture Document

    semiSyncWaitPoint: Determines whether the transaction should wait for an ACK after having synced the binlog (AfterSync) or after having committed to the storage engine (AfterCommit, the default). It requires semi-synchronous replication. See MariaDB documentation.

  • syncBinlog: Number of events after which the binary log is synchronized to disk. See MariaDB documentation.

  • standaloneProbes: Determines whether to use regular non-HA startup and liveness probes. It is disabled by default.

  • connectionRetrySeconds: Number of seconds that the replica will wait between connection retries. See MariaDB documentation.

  • maxLagSeconds: Maximum acceptable lag in seconds between the replica and the primary. If the lag exceeds this value, the readiness probe will fail and the replica will be marked as not ready. It defaults to 0, meaning that no lag is allowed. See lagged replicas section for more details.

  • syncTimeout: Timeout for the replicas to be synced during switchover and failover operations. It defaults to 10s. See the primary switchover and primary failover sections for more details.

  • During updates, lagged replicas will block the update operation, as each of the replicas must pass the readiness probe before proceeding to the update of the next one.

  • Promote the selected replica to be the new primary.

  • Connect replicas to the new primary.

  • Change the current primary to be a replica of the new primary.

  • Among the candidates, the one with the highest gtid_current_pos will be selected.

    The Pod is configured as a replica, connected to the primary by starting the replication in the GTID position stored in the backup.

    1236

    IO

    Error 1236: Got fatal error from master when reading data from binary log.

    MariaDB docs

    SHOW SLAVE STATUS
    semi-synchronous replication
    failover
    switchover
    configuration
    MariaDB documentation
    MariaDB documentation
    MariaDB documentation
    update of the cluster
    replica configuration
    configuration documentation
    MariaDB documentation
    data-plane
    configuration documentation
    configuration
    readiness probe
    Kubernetes Services for high availability
    physical backup
    primary switchover
    primary failover
    physical backup
    MariaDB documentation
    MaxScale
    switchover operation
    several advantages
    MaxScale
    several advantages
    readiness probe
    lagged replicas
    updates
    switchover operation
    readiness probe
    primary switchover
    primary switchover in MaxScale
    PhysicalBackup strategy
    scaling out
    replica recovery section
    PhysicalBackup troubleshooting section
    RAG query processing
  • Authentication and authorization

  • Document Processing: LangChain / Custom parsers

    Authentication and rate limiting
    execute_sql - Execute SQL queries
  • create_database - Create new database

  • drop_database - Delete database

  • insert_docs_vector_store - Add documents
  • search_vector_store - Semantic search

  • Rate Limiting

    • 100 requests per minute (default)

    • Configurable per endpoint

  • CORS Configuration

    • Allowed origins: Configurable

    • Credentials: Supported

    • Methods: GET, POST, PUT, DELETE, OPTIONS

  • File Upload Security

    • Max file size: 200MB

    • Allowed extensions: .pdf, .txt, .docx, .md, .html, .csv, .json, .xml

    • Malware scanning: Optional

    • Quarantine: Enabled for suspicious files

  • Database Security

    • Parameterized queries (SQL injection prevention)

    • Connection pooling

    • Encrypted connections (optional)

  • Data Flow
    Security Architecture
    Configuration Management
    API Specifications
    Database Schema
    Performance Characteristics
    Watch the Webinar
    Run In Postman
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-repl
    spec:
      replicas: 3
      replication:
        enabled: true
    kubectl get pods
    NAME                                    READY   STATUS    RESTARTS   AGE
    mariadb-repl-0                          2/2     Running   0          2d19h
    mariadb-repl-1                          2/2     Running   0          2d19h
    mariadb-repl-2                          2/2     Running   0          2d19h
    mariadb-repl-metrics-56865fff65-t72kc   1/1     Running   0          2d20h
    
    kubectl get mariadb
    NAME           READY   STATUS    PRIMARY          UPDATES                    AGE
    mariadb-repl   True    Running   mariadb-repl-0   ReplicasFirstPrimaryLast   2d20h
    kubectl get mariadb mariadb-repl -o jsonpath="{.status.replication}" | jq
    {
      "replicas": {
        "mariadb-repl-1": {
          "gtidCurrentPos": "0-10-155",
          "gtidIOPos": "0-10-155",
          "lastErrorTransitionTime": "2025-10-22T10:51:10Z",
          "lastIOErrno": 0,
          "lastIOError": "",
          "lastSQLErrno": 0,
          "lastSQLError": "",
          "secondsBehindMaster": 0,
          "slaveIORunning": true,
          "slaveSQLRunning": true
        },
        "mariadb-repl-2": {
          "gtidCurrentPos": "0-10-155",
          "gtidIOPos": "0-10-155",
          "lastErrorTransitionTime": "2025-10-22T10:47:29Z",
          "lastIOErrno": 0,
          "lastIOError": "",
          "lastSQLErrno": 0,
          "lastSQLError": "",
          "secondsBehindMaster": 0,
          "slaveIORunning": true,
          "slaveSQLRunning": true
        }
      },
      "roles": {
        "mariadb-repl-0": "Primary",
        "mariadb-repl-1": "Replica",
        "mariadb-repl-2": "Replica"
      }
    }
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-repl
    spec:
      replicas: 3
      replication:
        enabled: true
        gtidStrictMode: true
        semiSyncEnabled: true
        semiSyncAckTimeout: 10s
        semiSyncWaitPoint: AfterCommit
        syncBinlog: 1
        standaloneProbes: false
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-repl
    spec:
      replicas: 3
      replication:
        enabled: true
        replica:
          replPasswordSecretKeyRef:
            name: mariadb
            key: password
          gtid: CurrentPos
          connectionRetrySeconds: 10
          maxLagSeconds: 0
          syncTimeout: 10s
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-repl
    spec:
      replicas: 3
      replication:
        enabled: true
        primary:
          podIndex: 1
    kubectl patch mariadb mariadb-repl \
      --type='merge' \
      -p '{"spec":{"replication":{"primary":{"podIndex":1}}}}'
    kubectl get mariadb
    NAME           READY   STATUS                                  PRIMARY          UPDATES                    AGE
    mariadb-repl   False   Switching primary to 'mariadb-repl-1'   mariadb-repl-0   ReplicasFirstPrimaryLast   3d2h
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-repl
    spec:
      replicas: 3
      replication:
        enabled: true
        primary:
          autoFailover: true
          autoFailoverDelay: 0s
    kubectl get mariadb
    NAME           READY   STATUS    PRIMARY          UPDATES                    AGE
    mariadb-repl   True    Running   mariadb-repl-0   ReplicasFirstPrimaryLast   3d2h
    
    kubectl delete pod mariadb-repl-0
    pod "mariadb-repl-0" deleted
    
    kubectl get mariadb
    NAME           READY   STATUS                                  PRIMARY          UPDATES                    AGE
    mariadb-repl   False   Switching primary to 'mariadb-repl-1'   mariadb-repl-0   ReplicasFirstPrimaryLast   3d2h 
    
    kubectl get mariadb
    NAME           READY   STATUS    PRIMARY          UPDATES                    AGE
    mariadb-repl   True    Running   mariadb-repl-1   ReplicasFirstPrimaryLast   3d2h
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: PhysicalBackup
    metadata:
      name: physicalbackup-tpl
    spec:
      mariaDbRef:
        name: mariadb-repl
      schedule:
        suspend: true
      storage:
        s3:
          bucket: scaleout
          prefix: mariadb
          endpoint: minio.minio.svc.cluster.local:9000
          region:  us-east-1
          accessKeyIdSecretKeyRef:
            name: minio
            key: access-key-id
          secretAccessKeySecretKeyRef:
            name: minio
            key: secret-access-key
          tls:
            enabled: true
            caSecretKeyRef:
              name: minio-ca
              key: ca.crt
      timeout: 1h
      podAffinity: true
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: PhysicalBackup
    metadata:
      name: physicalbackup-tpl
    spec:
      mariaDbRef:
        name: mariadb-repl
      schedule:
        suspend: true
      storage:
        volumeSnapshot:
          volumeSnapshotClassName: csi-hostpath-snapclass
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-repl
    spec:
      replication:
        enabled: true
        replica:
          bootstrapFrom:
            physicalBackupTemplateRef:
              name: physicalbackup-tpl
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-repl
    spec:
      replicas: 4
      replication:
        enabled: true
        replica:
          bootstrapFrom:
            physicalBackupTemplateRef:
              name: physicalbackup-tpl
    kubectl scale mariadb mariadb-repl --replicas=4
    kubectl scale mariadb mariadb-repl --replicas=4
    mariadb.enterprise.mariadb.com/mariadb-repl scaled
    
    kubectl get mariadb
    NAME           READY   STATUS        PRIMARY          UPDATES                    AGE
    mariadb-repl   False   Scaling out   mariadb-repl-1   ReplicasFirstPrimaryLast   3d5h
    
    kubectl get physicalbackups
    NAME                                    COMPLETE   STATUS      MARIADB        LAST SCHEDULED   AGE
    mariadb-repl-physicalbackup-scale-out   True       Success     mariadb-repl   14s              14s
    physicalbackup-tpl                      False      Suspended   mariadb-repl                    3d8h
    
    kubectl get pods
    NAME                                    READY   STATUS    RESTARTS   AGE
    mariadb-repl-0                          2/2     Running   0          137m
    mariadb-repl-1                          2/2     Running   0          3d5h
    mariadb-repl-2                          2/2     Running   0          3d5h
    mariadb-repl-3                          2/2     Running   0          40s
    mariadb-repl-metrics-56865fff65-t72kc   1/1     Running   0          3d5h
    
    kubectl get mariadb
    NAME           READY   STATUS    PRIMARY          UPDATES                    AGE
    mariadb-repl   True    Running   mariadb-repl-1   ReplicasFirstPrimaryLast   3d5h
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-repl
    spec:
      replication:
        enabled: true
        replica:
          bootstrapFrom:
            physicalBackupTemplateRef:
              name: physicalbackup-tpl
          recovery:
            enabled: true
            errorDurationThreshold: 5m
    PRIMARY=$(kubectl get mariadb mariadb-repl -o jsonpath="{.status.currentPrimary}")
    echo "Purging binary logs in primary $PRIMARY"
    kubectl exec -it $PRIMARY -c mariadb -- mariadb -u root -p'MariaDB11!' --ssl=false -e "FLUSH LOGS;"
    kubectl exec -it $PRIMARY -c mariadb -- mariadb -u root -p'MariaDB11!' --ssl=false -e "PURGE BINARY LOGS BEFORE NOW();"
    kubectl exec -it $PRIMARY -c mariadb -- mariadb -u root -p'MariaDB11!' --ssl=false -e "SHOW BINARY LOGS;"
    REPLICA=$(kubectl get mariadb mariadb-repl -o jsonpath='{.status.replication.replicas}' | jq -r 'keys[]' | head -n1)
    echo "Deleting PVC and restarting replica $REPLICA"
    kubectl delete pvc storage-$REPLICA --wait=false 
    kubectl delete pod $REPLICA --wait=false 
    kubectl get mariadb
    NAME           READY   STATUS                PRIMARY          UPDATES                    AGE
    mariadb-repl   False   Recovering replicas   mariadb-repl-1   ReplicasFirstPrimaryLast   3d6h
    
    kubectl get physicalbackups
    NAME                                           COMPLETE   STATUS      MARIADB        LAST SCHEDULED   AGE
    mariadb-repl-physicalbackup-replica-recovery   True       Success     mariadb-repl   31s              31s
    physicalbackup-tpl                             False      Suspended   mariadb-repl                    3d9h
    
    kubectl get pods
    NAME                                                              READY   STATUS            RESTARTS       AGE
    mariadb-repl-0                                                    0/2     PodInitializing   0              22s
    mariadb-repl-0-physicalbackup-init-qn79f                          0/1     Completed         0              8s
    mariadb-repl-1                                                    2/2     Running           0              3d6h
    mariadb-repl-2                                                    2/2     Running           0              3d6h
    mariadb-repl-metrics-56865fff65-t72kc                             1/1     Running           0              3d6h
    mariadb-repl-physicalbackup-replica-recovery-2025102020270r98zr   0/1     Completed         0              31s
    
    kubectl get mariadb
    NAME           READY   STATUS    PRIMARY          UPDATES                    AGE
    mariadb-repl   True    Running   mariadb-repl-1   ReplicasFirstPrimaryLast   3d6h
    kubectl get mariadb mariadb-repl -o jsonpath="{.status.replication}" | jq
    {
      "replicas": {
        "mariadb-repl-1": {
          "gtidCurrentPos": "0-10-155",
          "gtidIOPos": "0-10-155",
          "lastErrorTransitionTime": "2025-10-22T10:51:10Z",
          "lastIOErrno": 0,
          "lastIOError": "",
          "lastSQLErrno": 0,
          "lastSQLError": "",
          "secondsBehindMaster": 0,
          "slaveIORunning": true,
          "slaveSQLRunning": true
        },
        "mariadb-repl-2": {
          "gtidCurrentPos": "0-10-155",
          "gtidIOPos": "0-10-155",
          "lastErrorTransitionTime": "2025-10-22T10:47:29Z",
          "lastIOErrno": 0,
          "lastIOError": "",
          "lastSQLErrno": 0,
          "lastSQLError": "",
          "secondsBehindMaster": 0,
          "slaveIORunning": true,
          "slaveSQLRunning": true
        }
      },
      "roles": {
        "mariadb-repl-0": "Primary",
        "mariadb-repl-1": "Replica",
        "mariadb-repl-2": "Replica"
      }
    }
    kubectl get mariadb mariadb-repl -o jsonpath="{.status.conditions}" | jq
    [
      {
        "lastTransitionTime": "2025-10-20T20:28:09Z",
        "message": "Running",
        "reason": "StatefulSetReady",
        "status": "True",
        "type": "Ready"
      },
      {
        "lastTransitionTime": "2025-10-17T14:17:43Z",
        "message": "Updated",
        "reason": "Updated",
        "status": "True",
        "type": "Updated"
      },
      {
        "lastTransitionTime": "2025-10-17T14:17:58Z",
        "message": "Replication configured",
        "reason": "ReplicationConfigured",
        "status": "True",
        "type": "ReplicationConfigured"
      },
      {
        "lastTransitionTime": "2025-10-20T17:14:38Z",
        "message": "Switchover complete",
        "reason": "SwitchPrimary",
        "status": "True",
        "type": "PrimarySwitched"
      },
      {
        "lastTransitionTime": "2025-10-20T19:31:29Z",
        "message": "Scaled out",
        "reason": "ScaledOut",
        "status": "True",
        "type": "ScaledOut"
      },
      {
        "lastTransitionTime": "2025-10-20T20:27:41Z",
        "message": "Replica recovered",
        "reason": "ReplicaRecovered",
        "status": "True",
        "type": "ReplicaRecovered"
      }
    ]
    kubectl get events --field-selector involvedObject.name=mariadb-repl --sort-by='.lastTimestamp'
    
    LAST SEEN   TYPE     REASON             OBJECT                 MESSAGE
    17s         Normal   PrimaryLock        mariadb/mariadb-repl   Locking primary with read lock
    17s         Normal   PrimaryReadonly    mariadb/mariadb-repl   Enabling readonly mode in primary
    17s         Normal   ReplicaSync        mariadb/mariadb-repl   Waiting for replicas to be synced with primary
    17s         Normal   PrimaryNew         mariadb/mariadb-repl   Configuring new primary at index '0'
    7s          Normal   ReplicaConn        mariadb/mariadb-repl   Connecting replicas to new primary at '0'
    7s          Normal   PrimaryToReplica   mariadb/mariadb-repl   Unlocking primary '1' and configuring it to be a replica. New primary at '0'
    7s          Normal   PrimaryLock        mariadb/mariadb-repl   Unlocking primary
    7s          Normal   PrimarySwitched    mariadb/mariadb-repl   Primary switched from index '1' to index '0'
    Error 1236: Got fatal error from master when reading data from binary log.
    2025-10-27 15:17:11   error  : [mariadbmon] 'mariadb-repl-1' is not a valid demotion target for switchover: it does not have a 'gtid_binlog_pos'.
    ┌─────────────────────────────────────────────────────────────────────┐
    │                         Windows Host System                         │
    │                                                                     │
    │  ┌─────────────────────────────────────────────────────────────┐    │
    │  │              Docker Desktop (WSL 2 Backend)                 │    │
    │  │                                                             │    │
    │  │  ┌────────────────────────────────────────────────────────┐ │    │
    │  │  │              Docker Network: ai-nexus-network          │ │    │
    │  │  │                  (Bridge Driver)                       │ │    │
    │  │  │                                                        │ │    │
    │  │  │  ┌──────────────────────────────────────────────────┐  │ │    │
    │  │  │  │      ai-nexus Container (Ubuntu 24.04)           │  │ │    │
    │  │  │  │                                                  │  │ │    │
    │  │  │  │  ┌────────────────────────────────────────────┐  │  │ │    │
    │  │  │  │  │  Process 1: RAG API (PID: dynamic)         │  │  │ │    │
    │  │  │  │  │  - Framework: FastAPI                      │  │  │ │    │
    │  │  │  │  │  - Server: Uvicorn (ASGI)                  │  │  │ │    │
    │  │  │  │  │  - Bind: 0.0.0.0:8000                      │  │  │ │    │
    │  │  │  │  │  - Workers: 1                              │  │  │ │    │
    │  │  │  │  │  - Binary: /opt/rag-in-a-box/bin/rag-api   │  │  │ │    │
    │  │  │  │  └────────────────────────────────────────────┘  │  │ │    │
    │  │  │  │                                                  │  │ │    │
    │  │  │  │  ┌────────────────────────────────────────────┐  │  │ │    │
    │  │  │  │  │  Process 2: MCP Server (PID: dynamic)      │  │  │ │    │
    │  │  │  │  │  - Framework: FastAPI                      │  │  │ │    │
    │  │  │  │  │  - Server: Uvicorn (ASGI)                  │  │  │ │    │
    │  │  │  │  │  - Bind: 0.0.0.0:8002                      │  │  │ │    │
    │  │  │  │  │  - Workers: 1                              │  │  │ │    │
    │  │  │  │  │  - Binary: /opt/rag-in-a-box/bin/mcp-server│  │  │ │    │
    │  │  │  │  └────────────────────────────────────────────┘  │  │ │    │
    │  │  │  │                                                  │  │ │    │
    │  │  │  │  Startup: start-services.sh                      │  │ │    │
    │  │  │  │  Health Check: 180s timeout, 10s interval        │  │ │    │
    │  │  │  └──────────────────┬────────────────────────────┘     │ │    │
    │  │  │                     │                                  │ │    │
    │  │  │                     │ MySQL Protocol (Port 3306)       │ │    │
    │  │  │                     │                                  │ │    │
    │  │  │  ┌──────────────────▼────────────────────────────┐     │ │    │
    │  │  │  │      mysql-db Container (MariaDB 11)          │     │ │    │
    │  │  │  │                                               │     │ │    │
    │  │  │  │  ┌──────────────────────────────────────────┐ │     │ │    │
    │  │  │  │  │  MariaDB Server                          │ │     │ │    │
    │  │  │  │  │  - Version: 11.x                         │ │     │ │    │
    │  │  │  │  │  - Storage Engine: InnoDB                │ │     │ │    │
    │  │  │  │  │  - Character Set: utf8mb4                │ │     │ │    │
    │  │  │  │  │  - Collation: utf8mb4_unicode_ci         │ │     │ │    │
    │  │  │  │  │  - Page Size: 16KB                       │ │     │ │    │
    │  │  │  │  │  - Row Format: Dynamic                   │ │     │ │    │
    │  │  │  │  └──────────────────────────────────────────┘ │     │ │    │
    │  │  │  │                                               │     │ │    │
    │  │  │  │  ┌──────────────────────────────────────────┐ │     │ │    │
    │  │  │  │  │  Persistent Volume: mysql_data           │ │     │ │    │
    │  │  │  │  │  - Database: kb_chunks                   │ │     │ │    │
    │  │  │  │  │  - Tables: documents_*, vdb_tbl_*        │ │     │ │    │
    │  │  │  │  │  - Indexes: Vector indexes               │ │     │ │    │
    │  │  │  │  └──────────────────────────────────────────┘ │     │ │    │
    │  │  │  └────────────────────────────────────────────┘ │ │           │
    │  │  └─────────────────────────────────────────────────┘ │           │
    │  └───────────────────────────────────────────────────────┘          │
    │                                                                     │
    │  Port Mappings (Host → Container):                                  │
    │  - 8000:8000  (RAG API)                                             │
    │  - 8002:8002  (MCP Server)                                          │
    │  - 3306:3306  (MariaDB)                                             │
    └─────────────────────────────────────────────────────────────────────┘
    
    External Services (Internet):
    ┌─────────────────────────────────────────────────┐
    │  Google Generative AI API                       │
    │  - Endpoint: generativelanguage.googleapis.com  │
    │  - Embedding: text-embedding-004                │
    │  - LLM: gemini-2.0-flash                        │
    └─────────────────────────────────────────────────┘
    Start Order:
    1. mysql-db (MariaDB)
       ├─ Health Check: 30s start period, 10s interval
       └─ Condition: service_healthy
    
    2. ai-nexus (Application)
       ├─ Depends on: mysql-db (healthy)
       ├─ Startup Script: start-services.sh
       │   ├─ Start RAG API (background)
       │   ├─ Wait for RAG API health (max 180s)
       │   └─ Start MCP Server (foreground)
       └─ Restart Policy: unless-stopped
    Authentication:
    POST   /token                 - Generate JWT token
    
    Document Management:
    POST   /documents/ingest      - Upload and process documents
    GET    /documents             - List all documents
    GET    /documents/{id}        - Get document details
    DELETE /documents/{id}        - Delete document
    
    RAG Operations:
    POST   /generate              - Generate RAG response
    POST   /search                - Semantic search
    GET    /embeddings/{doc_id}   - Get document embeddings
    
    Health & Status:
    GET    /health                - Health check
    GET    /                      - API info
    GET    /docs                  - Swagger UI
    GET    /openapi.json          - OpenAPI spec
    APP_HOST=0.0.0.0
    APP_PORT=8000
    DB_HOST=mysql-db
    DB_PORT=3306
    DB_USER=root
    DB_PASSWORD=your_secure_database_password
    DB_NAME=kb_chunks
    GEMINI_API_KEY=your_gemini_api_key
    SECRET_KEY=your_generated_secret_key
    JWT_SECRET_KEY=<secret>
    EMBEDDING_PROVIDER=gemini
    embedding_model=text-embedding-004
    LLM_PROVIDER=gemini
    LLM_MODEL=gemini-2.0-flash
    DOCUMENTS_TABLE=documents_DEMO_gemini
    VDB_TABLE=vdb_tbl_DEMO_gemini
    CHUNK_SIZE=512
    CHUNK_OVERLAP=128
    MCP_HOST=0.0.0.0
    MCP_PORT=8002
    MCP_MARIADB_HOST=mysql-db
    MCP_MARIADB_PORT=3306
    MCP_AUTH_SECRET_KEY=<secret>
    MCP_ENABLE_AUTH=true
    MCP_ENABLE_VECTOR_TOOLS=true
    MCP_ENABLE_DATABASE_TOOLS=true
    MCP_ENABLE_RAG_TOOLS=true
    MCP_READ_ONLY=false
    MCP_STANDALONE_MODE=false
    MCP_RAG_HEALTHCHECK_ENABLED=true
    MCP_LOG_LEVEL=INFO
    Environment:
      MYSQL_ROOT_PASSWORD: your_secure_database_password
      MYSQL_DATABASE: kb_chunks
    
    Command:
      --character-set-server=utf8mb4
      --collation-server=utf8mb4_unicode_ci
      --innodb-page-size=16k
      --innodb-default-row-format=dynamic
    
    Health Check:
      Test: healthcheck.sh --connect --innodb_initialized
      Interval: 10s
      Timeout: 5s
      Retries: 10
      Start Period: 30s
    
    Volume:
      mysql_data:/var/lib/mysql (persistent)
    -- Documents Table
    CREATE TABLE documents_DEMO_gemini (
        id INT AUTO_INCREMENT PRIMARY KEY,
        filename VARCHAR(255) NOT NULL,
        content LONGTEXT,
        metadata JSON,
        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
        updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
        INDEX idx_filename (filename),
        INDEX idx_created_at (created_at)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
    
    -- Vector Database Table
    CREATE TABLE vdb_tbl_DEMO_gemini (
        id INT AUTO_INCREMENT PRIMARY KEY,
        document_id INT NOT NULL,
        chunk_index INT NOT NULL,
        chunk_text LONGTEXT NOT NULL,
        embedding BLOB,  -- 768-dimensional vector (3072 bytes)
        metadata JSON,
        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
        FOREIGN KEY (document_id) REFERENCES documents_DEMO_gemini(id) ON DELETE CASCADE,
        INDEX idx_document_id (document_id),
        INDEX idx_chunk_index (chunk_index)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
    User Upload
        │
        ▼
    ┌───────────────────────────────────────┐
    │  1. RAG API - File Reception          │
    │  - Validate file type                 │
    │  - Check file size (max 200MB)        │
    │  - Generate unique ID                 │
    └───────────────┬───────────────────────┘
                    │
                    ▼
    ┌───────────────────────────────────────┐
    │  2. Document Processing               │
    │  - Extract text from file             │
    │  - Clean and normalize text           │
    │  - Store in documents table           │
    └───────────────┬───────────────────────┘
                    │
                    ▼
    ┌───────────────────────────────────────┐
    │  3. Text Chunking                     │
    │  - Method: Recursive character split  │
    │  - Chunk size: 512 tokens             │
    │  - Overlap: 128 tokens                │
    │  - Generate chunk metadata            │
    └───────────────┬───────────────────────┘
                    │
                    ▼
    ┌───────────────────────────────────────┐
    │  4. Embedding Generation              │
    │  - Batch size: 32 chunks              │
    │  - Call Gemini API                    │
    │  - Model: text-embedding-004          │
    │  - Dimensions: 768                    │
    └───────────────┬───────────────────────┘
                    │
                    ▼
    ┌───────────────────────────────────────┐
    │  5. Vector Storage                    │
    │  - Store in vdb_tbl_DEMO_gemini       │
    │  - Link to document_id                │
    │  - Store chunk text + embedding       │
    │  - Create indexes                     │
    └───────────────┬───────────────────────┘
                    │
                    ▼
    ┌───────────────────────────────────────┐
    │  6. Response to User                  │
    │  - Document ID                        │
    │  - Number of chunks                   │
    │  - Processing status                  │
    └───────────────────────────────────────┘
    User Query
        │
        ▼
    ┌───────────────────────────────────────┐
    │  1. Query Reception                   │
    │  - Validate JWT token                 │
    │  - Parse query text                   │
    └───────────────┬───────────────────────┘
                    │
                    ▼
    ┌───────────────────────────────────────┐
    │  2. Query Embedding                   │
    │  - Call Gemini API                    │
    │  - Generate 768-dim vector            │
    └───────────────┬───────────────────────┘
                    │
                    ▼
    ┌───────────────────────────────────────┐
    │  3. Similarity Search                 │
    │  - Calculate cosine similarity        │
    │  - Filter by threshold (0.8)          │
    │  - Retrieve top-k chunks (default: 5) │
    │  - Order by similarity score          │
    └───────────────┬───────────────────────┘
                    │
                    ▼
    ┌───────────────────────────────────────┐
    │  4. Context Preparation               │
    │  - Combine retrieved chunks           │
    │  - Add source metadata                │
    │  - Format for LLM prompt              │
    └───────────────┬───────────────────────┘
                    │
                    ▼
    ┌───────────────────────────────────────┐
    │  5. LLM Generation                    │
    │  - Construct prompt:                  │
    │    "Context: {chunks}"                │
    │    "Question: {query}"                │
    │  - Call Gemini LLM                    │
    │  - Model: gemini-2.0-flash            │
    └───────────────┬───────────────────────┘
                    │
                    ▼
    ┌───────────────────────────────────────┐
    │  6. Response Formatting               │
    │  - AI-generated answer                │
    │  - Source documents                   │
    │  - Confidence scores                  │
    │  - Metadata                           │
    └───────────────┬───────────────────────┘
                    │
                    ▼
        Return to User
    ┌─────────────────────────────────────────────────────────────┐
    │  1. Token Generation                                        │
    │                                                             │
    │  POST /token                                                │
    │  Body: {"username": "admin", "password": "password"}        │
    │                                                             │
    │  ┌────────────────────────────────────────────────────────┐ │
    │  │  Server validates credentials                          │ │
    │  │  Generates JWT with:                                   │ │
    │  │  - Header: {"alg": "HS256", "typ": "JWT"}              │ │
    │  │  - Payload: {"sub": "admin", "exp": <timestamp>}       │ │
    │  │  - Signature: HMAC-SHA256(header.payload, SECRET_KEY)  │ │
    │  └────────────────────────────────────────────────────────┘ │
    │                                                             │
    │  Response: {"access_token": "eyJ...", "token_type": "bearer"}│
    └─────────────────────────────────────────────────────────────┘
                                │
                                ▼
    ┌─────────────────────────────────────────────────────────────┐
    │  2. Authenticated Request                                   │
    │                                                             │
    │  GET /documents                                             │
    │  Headers: {"Authorization": "Bearer eyJ..."}                │
    │                                                             │
    │  ┌────────────────────────────────────────────────────────┐ │
    │  │  Server extracts token                                 │ │
    │  │  Verifies signature with SECRET_KEY                    │ │
    │  │  Checks expiration (30 minutes)                        │ │
    │  │  Validates claims                                      │ │
    │  └────────────────────────────────────────────────────────┘ │
    │                                                             │
    │  If valid: Process request                                  │
    │  If invalid: Return 401 Unauthorized                        │
    └─────────────────────────────────────────────────────────────┘
    SECRET_KEY=<same-value>
    JWT_SECRET_KEY=<same-value>
    MCP_AUTH_SECRET_KEY=<same-value>
    import secrets
    key = secrets.token_urlsafe(64)
    # Use this key for all three variables
    VAULT_ADDR=http://rag-vault:8200
    VAULT_TOKEN=rag-root-token
    VAULT_SECRET_PATH=rag-in-a-box
    VAULT_MOUNT_POINT=secret
    GEMINI_API_KEY=op://Employee/RAG-API-Keys/gemini
    DB_PASSWORD=op://Employee/RAG-Database/password
    {
      "username": "admin",
      "password": "your_password"
    }
    {
      "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
      "token_type": "bearer"
    }
    Authorization: Bearer <token>
    Content-Type: multipart/form-data
    file: <binary-file-data>
    {
      "document_id": 123,
      "filename": "document.pdf",
      "chunks_created": 45,
      "status": "success"
    }
    Authorization: Bearer <token>
    Content-Type: application/json
    {
      "query": "What is the main topic?",
      "top_k": 5,
      "threshold": 0.8
    }
    {
      "answer": "The main topic is...",
      "sources": [
        {
          "document_id": 123,
          "chunk_index": 5,
          "similarity": 0.92,
          "text": "..."
        }
      ],
      "metadata": {
        "processing_time": 1.23,
        "model": "gemini-2.0-flash"
      }
    }
    CREATE TABLE documents_DEMO_gemini (
        id INT AUTO_INCREMENT PRIMARY KEY,
        filename VARCHAR(255) NOT NULL,
        content LONGTEXT,
        metadata JSON,
        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
        updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
        INDEX idx_filename (filename),
        INDEX idx_created_at (created_at)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
    CREATE TABLE vdb_tbl_DEMO_gemini (
        id INT AUTO_INCREMENT PRIMARY KEY,
        document_id INT NOT NULL,
        chunk_index INT NOT NULL,
        chunk_text LONGTEXT NOT NULL,
        embedding BLOB,
        metadata JSON,
        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
        FOREIGN KEY (document_id) REFERENCES documents_DEMO_gemini(id) ON DELETE CASCADE,
        INDEX idx_document_id (document_id),
        INDEX idx_chunk_index (chunk_index)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
    ai-nexus:
      CPU: 1-2 cores
      RAM: 2-4 GB
      Disk: 1 GB (application)
    
    mysql-db:
      CPU: 1-2 cores
      RAM: 2-4 GB
      Disk: Variable (depends on data)

    Helm

    Helm is the preferred way to install MariaDB Enterprise Kubernetes Operator in Kubernetes clusters. This documentation aims to provide guidance on how to manage the installation and upgrades of both the CRDs and the operator via Helm charts.

    Prerequisites

    Configure your customer credentials as described in the documentation to be able to pull images.

    Charts

    MariaDB Enterprise Kubernetes Operator is splitted into two different helm charts for better convenience:

    • mariadb-enterprise-operator-crds: Bundles the required by the operator.

    • mariadb-enterprise-operator: Contains all the template manifests required to install the operator. Refer to the section for detailed information about the supported values.

    Control-plane

    The operator extends the Kubernetes control plane and consists of the following components deployed via Helm:

    • operator: The mariadb-enterprise-operator itself that performs the CRD reconciliation.

    • webhook: The Kubernetes control-plane delegates CRD validations to this HTTP server. Kubernetes requires TLS to communicate with the webhook server.

    • cert-controller: Provisions TLS certificates for the webhook. You can see it as a minimal that is intended to work only with the webhook. It is optional and can be replaced by cert-manager.

    Installing CRDs

    Helm has certain . To address this, we are providing the CRDs in a separate chart, . This allows us to manage the installation and updates of the CRDs independently from the operator. For example, you can uninstall the operator without impacting your existing MariaDB CRDs.

    CRDs can be installed in your cluster by running the following commands

    Installing the operator

    The first step is to prepare a values.yaml file to specify your previously configured :

    Then, you can proceed to install the operator:

    If you have the and already installed in your cluster, it is recommended to leverage them to scrape the operator metrics and provision the webhook certificate respectively:

    Refer to the section for detailed information about the supported values.

    Long-Term Support Versions

    MariaDB Enterprise Kubernetes Operator provides stable Long-Term Support (LTS) versions.

    Version
    Supported Kubernetes Versions
    Description

    If you instead wish to install a specific LTS release, you can do:

    Where: --version "25.10.*" installs the most recent available release within the 25.10 series.

    Deployment modes

    The following deployment modes are supported:

    Cluster-wide

    The operator watches CRDs in all namespaces and requires cluster-wide RBAC permissions to operate. This is the default deployment mode, enabled through the default configuration values:

    Single namespace

    By setting currentNamespaceOnly=true, the operator will only watch CRDs within the namespace it is deployed in, and the RBAC permissions will be restricted to that namespace as well:

    Updates

    Make sure you read and understand the before proceeding to update the operator.

    To install a version instead, replace <new-version> with your desired LTS release. For example: --version "25.10.*" will automatically install the latest available patch within that LTS series.

    The first step is upgrading the CRDs that the operator depends on:

    Once updated, you may proceed to upgrade the operator:

    Whenever a new version of the operator is released, an upgrade guide is linked in the if additional upgrade steps are required. Be sure to review the and follow the version-specific upgrade guides accordingly.

    Operator high availability

    The operator can run in high availability mode to prevent downtime during updates and ensure continuous reconciliation of your CRs, even if the node where the operator runs goes down. To achieve this, you need:

    • Multiple replicas

    • Configure Pod anti-affinity

    • Configure PodDisruptionBudgets

    You can achieve this by providing the following values to the helm chart:

    You may similarly configure the webhook and cert-controller components to run in high availability mode by providing the same values to their respective sections. Refer to the for detailed information.

    Uninstalling

    Uninstalling the mariadb-enterprise-operator-crds Helm chart will remove the CRDs and their associated resources, resulting in downtime.

    First, uninstall the mariadb-enterprise-operator Helm chart. This action will not delete your CRDs, so your operands (i.e. MariaDB and MaxScale) will continue to run without the operator's reconciliation.

    At this point, if you also want to delete CRDs and the operands running in your cluster, you may proceed to uninstall the mariadb-enterprise-operator-crds Helm chart:

    Operator helm values

    Key
    Type
    Default
    Description

    TLS

    MariaDB Enterprise Kubernetes Operator supports issuing, configuring and rotating TLS certificates for both your MariaDB and MaxScale resources. It aims to be secure by default; for this reason, TLS certificates are issued and configured by the operator as a default behaviour.

    MariaDB configuration

    This section covers TLS configuration in new instances. If you are looking to migrate an existing instance to use TLS, please refer to instead.

    TLS can be configured in MariaDB resources by setting tls.enabled=true:

    As a result, the operator will generate a Certificate Authority (CA) and use it to issue the leaf certificates mounted by the instance. It is important to note that the TLS connections are not enforced in this case i.e. both TLS and non-TLS connections will be accepted. This is the default behaviour when no tls field is specified.

    If you want to enforce TLS connections, you can set tls.required=true:

    This approach ensures that any unencrypted connection will fail, effectively enforcing security best practices.

    If you want to fully opt-out from TLS, you can set tls.enabled=false:

    This will disable certificate issuance, resulting in all connections being unencrypted.

    Refer to further sections for a more advanced TLS configuration.

    MaxScale configuration

    This section covers TLS configuration in new instances. If you are looking to migrate an existing instance to use TLS, please refer to instead.

    TLS will be automatically enabled in MaxScale when the referred MariaDB (via mariaDbRef) has TLS enabled and enforced. Alternatively, you can explicitly enable TLS by setting tls.enabled=true:

    As a result, the operator will generate a Certificate Authority (CA) and use it to issue the leaf certificates mounted by the instance. It is important to note that, unlike MariaDB, MaxScale does not support TLS and non-TLS connections simultaneously (see ). Therefore, TLS connections will be enforced in this case i.e. unencrypted connections will fail, ensuring security best practises.

    If you want to fully opt-out from TLS, you can set tls.enabled=false. This should only be done when MariaDB TLS is not enforced or disabled:

    This will disable certificate issuance, resulting in all connections being unencrypted.

    Refer to further sections for a more advanced TLS configuration.

    MariaDB certificate specification

    The MariaDB TLS setup consists of the following certificates:

    • Certificate Authority (CA) keypair to issue the server certificate.

    • Server leaf certificate used to encrypt server connections.

    • Certificate Authority (CA) keypair to issue the client certificate.

    • Client leaf certificate used to encrypt and authenticate client connections.

    As a default behaviour, the operator generates a single CA to be used for issuing both the server and client certificates, but the user can decide to use dedicated CAs for each case. Root CAs, and in some cases, are supported, see for further detail.

    The server certificate contains the following Subject Alternative Names (SANs):

    • <mariadb-name>.<namespace>.svc.<cluster-name>

    • <mariadb-name>.<namespace>.svc

    • <mariadb-name>.<namespace>

    Whereas the client certificate is only valid for the <mariadb-name>-client SAN.

    MaxScale certificate specification

    The MaxScale TLS setup consists of the following certificates:

    • Certificate Authority (CA) keypair to issue the admin certificate.

    • Admin leaf certificate used to encrypt the administrative REST API and GUI.

    • Certificate Authority (CA) keypair to issue the listener certificate.

    • Listener leaf certificate used to encrypt database connections to the listener.

    As a default behaviour, the operator generates a single CA to be used for issuing both the admin and the listener certificates, but the user can decide to use dedicated CAs for each case. Client certificate and CA bundle configured in the referred MariaDB are used as server certificates by default, but the user is able to provide its own certificates. Root CAs, and in some cases, are supported, see for further detail.

    Both the admin and listener certificates contain the following Subject Alternative Names (SANs):

    • <maxscale-name>.<namespace>.svc.<clusername>

    • <maxscale-name>.<namespace>.svc

    • <maxscale-name>.<namespace>

    For details about the server certificate, see .

    CA bundle

    As you could appreciate in and , the TLS setup involves multiple CAs. In order to establish trust in a more convenient way, the operator groups the CAs together in a CA bundle that will need to be specified when . Every MariaDB and MaxScale resources have a dedicated bundle of its own available in a Secret named <instance-name>-ca-bundle.

    These trust bundles contain non expired CAs needed to connect to the instances. New CAs are automatically added to the bundle after , whilst old CAs are removed after they expire. It is important to note that both the new and old CAs remain in the bundle for a while to ensure a smooth update when the new certificates are issued by the new CA.

    Issue certificates with the operator

    By setting tls.enabled=true, the operator will generate a root CA for each instance, which will be used to issue the certificates described in the and sections:

    To establish trust with the instances, the CA's public key will be added to the . If you need a different trust chain, please refer to the section.

    The advantage of this approach is that the operator fully manages the Secrets that contain the certificates without depending on any third party dependency. Also, since the operator fully controls the renewal process, it is able to pause a leaf certificate renewal if the CA is being updated at that moment, as described in the section.

    Issue certificates with cert-manager

    must be previously installed in the cluster in order to use this feature.

    cert-manager is the de-facto standard for managing certificates in Kubernetes. It is a Kubernetes native certificate management controller that allows you to automatically provision, manage and renew certificates. It supports multiple (in-cluster, Hashicorp Vault...) which are configured as Issuer or ClusterIssuer resources.

    As an example, we are going to setup an in-cluster root CA ClusterIssuer:

    Then, you can reference the ClusterIssuer in the MariaDB and MaxScale resources:

    The operator will create cert-manager's for each certificate, and will mount the resulting in the instances. These Secrets containing the certificates will be managed by cert-manager as well as its renewal process.

    To establish trust with the instances, the in the Secret will be added to the . If you need a different trust chain, please refer to the section.

    The advantage of this approach is that you can use any of the , such as the in-cluster CA or HashiCorp Vault, and potentially reuse the same Issuer/ClusterIssuer with multiple instances.

    Provide your own certificates

    Providing your own certificates is as simple as creating the Secrets with the appropriate structure and referencing them in the MariaDB and MaxScale resources. The certificates must be compliant with the and .

    The CA certificate must be provided as a Secret with the following structure:

    The ca.key field is only required if you want to the operator to automatically re-issue certificates with this CA, see for further detail. In other words, if only ca.crt is provided, the operator will trust this CA by adding it to the , but no certificates will be issued with it, the user will responsible for upating the certificate Secret manually with renewed certificates.

    The enterprise.mariadb.com/watch label is required only if you want the operator to automatically trigger an update when the CA is renewed, see for more detail.

    The leaf certificate must match the previous CA's public key, and it should provided as a with the following structure:

    The enterprise.mariadb.com/watch label is required only if you want the operator to automatically trigger an update when the certificate is renewed, see for more detail.

    Once the certificate Secrets are available in the cluster, you can create the MariaDB and MaxScale resources referencing them:

    Bring your own CA

    If you already have a CA setup outside of Kubernetes, you can use it with the operator by providing the CA certificate as a Secret with the following structure:

    Just by providing a reference to this Secret, the operator will use it to issue leaf certificates instead of generating a new CA:

    Intermediate CAs

    Intermediate CAs are supported by the operator with . Leaf certificates issued by the intermediate CAs are slightly different, and include the intermediate CA public key as part of the certificate, in the following order: Leaf certificate -> Intermediate CA. This is a common practise to easily establish trust in complex PKI setups, where multiple CA are involved.

    Many applications support this Leaf certificate -> Intermediate CA structure as a valid leaf certificate, and are able to establish trust with the intermediate CA. Normally, the intermediate CA will not be directly trusted, but used as a path to the root CA, which should be trusted by the application. If not trusted already, you can add the root CA to the by using a .

    Custom trust

    You are able to provide a set of CA public keys to be added to the by creating a Secret with the following structure:

    And referencing it in the MariaDB and MaxScale resources, for instance:

    This is specially useful when issuing certificates with an intermediate CA, see section for further detail.

    Distributing trust

    Distributing the to your application namespace is out of the scope of this operator, the bundles will remain in the same namespace as the MariaDB and MaxScale instances.

    If your application is in a different namespace, you can copy the CA bundle to the application namespace. Projects like can help you to automate this process and continously reconcile bundle changes.

    TLS version configuration

    You may configure the supported TLS versions in MariaDB by setting:

    If not specified, the MariaDB's default TLS versions will be used. See .

    Regarding MaxScale, you can also configure the supported TLS versions, both for the Admin REST API and MariaDB servers:

    If not specified, the MaxScale's default TLS versions will be used. See MaxScale docs:

    Certificate lifetime configuration

    By default, CA certificates are valid for 3 years, while leaf certificates have a validity of 3 months. This lifetime can be customized in both MariaDB and MaxScale resources through the certificate configuration fields. For example:

    When issuing certificates with cert-manager, you can specify the certificate configuration field alongside the issuer reference:

    Private key configuration

    By default, private keys are generated with the ECDSA algorithm and a size of 256. You can customize the private key configuration in both MariaDB and MaxScale resources through the certificate configuration fields. For example:

    When issuing certificates with cert-manager, you can specify the private key configuration field alongside the issuer reference:

    The following set of algorithms and sizes are supported:

    Algorithm
    Key Sizes

    CA renewal

    Depending on the setup, CAs can be managed and renewed by either MariaDB Enterprise Kubernetes Operator or cert-manager.

    When managed by the operator, CAs have a lifetime of 3 years by default, and are marked for renewal after 66% of its lifetime has passed i.e. ~2 years. After being renewed, the operator will trigger an update of the instances to include the new CA in the bundle.

    When managed by cert-manager, the renewal process is fully controlled by cert-manager, but the operator will also update the CA bundle after the CA is renewed.

    You may choose any of the available to control the instance update process.

    Certificate renewal

    Depending on the setup, certificates can be managed and renewed by the operator or cert-manager. In either case, certificates have a lifetime of 90 days by default, and marked for renewal after 66% of its lifetime has passed i.e. ~60 days.

    When the , the operator is able to pause a leaf certificate renewal if the CA is being updated at that same moment. This approach ensures a smooth update by avoiding the simultaneous rollout of the new CA and its associated certificates. Rolling them out together could be problematic, as all Pods need to trust the new CA before its issued certificates can be utilized.

    When the , the renewal process is fully managed by cert-manager, and the operator will not interfere with it. The operator will only update the instances whenever the CA or the certificates get renewed.

    You may choose any of the available to control the instance update process.

    Certificate status

    To have a high level picture of the certificates status, you can check the status.tls field of the MariaDB and MaxScale resources:

    TLS requirements for Users

    You are able to declaratively manage access to your MariaDB instances by creating . In particular, when TLS is enabled, you can provide additional requirements for the user when connecting over TLS.

    For instance, if you want to require a valid x509 certificate for the user to be able o connect:

    In order to restrict which subject the user certificate should have and/or require a particular issuer, you may set:

    When any of these TLS requirements are not met, the user will not be able to connect to the instance.

    See and the for further detail.

    Galera Enterprise SSL modes

    MariaDB Enterprise Cluster (Galera) supports multiple SSL modes to secure the communication between the nodes. For configuring the SSL enforcement level on the server i.e. WSREP, you can set:

    The following values are supported: SERVER_X509, SERVER and PROVIDER. Refer to the for further detail about these modes.

    You may also configure the SSL enforcement level used during Snapshot State Transfers(SST) by setting:

    The following values are supported: VERIFY_IDENTITY, VERIFY, REQUIRED and DISABLED. Refer to the for further detail about these modes.

    If you are willing to increase the enforcement level in an existing instance, make sure you follow the migration guide provided in the section.

    Secure application connections with TLS

    In this guide, we will configure TLS for an application running in the app namespace to connect with MariaDB and MaxScale instances deployed in the default namespace. We assume that the following resources are already present in the default namespace with TLS enabled:

    The first step is to create a User resource and grant the necessary permissions:

    The app user will be able to connect to the MariaDB instance from the app namespace by providing a certificate with subject mariadb-galera-client and issued by the mariadb-galera-ca CA.

    With the permissions in place, the next step is to prepare the certificates required for the application to connect:

    • CA Bundle: The trust bundle for MariaDB and MaxScale is available as a Secret named <instance-name>-ca-bundle in the default namespace. For more details, refer to the sections on and .

    • Client Certificate: MariaDB provides a default client certificate stored in a Secret named <mariadb-name>-client-cert

    In this example, we assume that the following Secrets are available in the app namespace:

    • mariadb-bundle: CA bundle for the MariaDB and MaxScale instances.

    • mariadb-galera-client-cert: Client certificate required to connect to the MariaDB instance.

    With these Secrets in place, we can proceed to define our application:

    The application will connect to the MariaDB instance using the app user, and will execute a simple query to check the connection status. The --ssl-ca, --ssl-cert, --ssl-key and --ssl-verify-server-cert flags are used to provide the CA bundle, client certificate and key, and to verify the server certificate respectively.

    If the connection is successful, the output should be:

    You can also point the application to the MaxScale instance by updating the host to maxscale-galera.default.svc.cluster.local:

    If successful, the expected output is:

    Test TLS certificates with Connections

    In order to validate your TLS setup, and to ensure that you TLS certificates are correctly issued and configured, you can use the Connection resource to test the connection to both your MariaDB and MaxScale instances:

    If successful, the Connection resource will be in a Ready state, which means that your TLS setup is correctly configured:

    This could be specially useful when and issuing certificates for your applications.

    Limitations

    Galera and intermediate CAs

    Leaf certificates issued by are not supported by Galera, see . This implies that a root CA must be used to issue the MariaDB certificates.

    This doesn't affect MaxScale, as it is able to establish trust with intermediate CAs, and therefore you can still issue your application facing certificates (MaxScale listeners) with an intermediate CA, giving you more flexibility in your PKI setup.

    MaxScale

    • Unlike MariaDB, TLS and non-TLS connections on the same port are not supported simultaneously.

    • TLS encryption must be enabled for listeners when they are created. For servers, the TLS can be enabled after creation but it cannot be disabled or altered.

    Refer to the for further details.

    certController.certLifetime

    string

    "2160h"

    Certificate lifetime.

    certController.enabled

    bool

    true

    Specifies whether the cert-controller should be created.

    certController.extrArgs

    list

    []

    Extra arguments to be passed to the cert-controller entrypoint

    certController.extraVolumeMounts

    list

    []

    Extra volumes to mount to cert-controller container

    certController.extraVolumes

    list

    []

    Extra volumes to pass to cert-controller Pod

    certController.ha.enabled

    bool

    false

    Enable high availability

    certController.ha.replicas

    int

    3

    Number of replicas

    certController.image.pullPolicy

    string

    "IfNotPresent"

    certController.image.repository

    string

    "docker.mariadb.com/mariadb-enterprise-operator"

    certController.image.tag

    string

    ""

    Image tag to use. By default the chart appVersion is used

    certController.imagePullSecrets

    list

    []

    certController.nodeSelector

    object

    {}

    Node selectors to add to cert-controller container

    certController.pdb.enabled

    bool

    false

    Enable PodDisruptionBudget for the cert-controller.

    certController.pdb.maxUnavailable

    int

    1

    Maximum number of unavailable Pods. You may also give a percentage, like 50%

    certController.podAnnotations

    object

    {}

    Annotations to add to cert-controller Pod

    certController.podSecurityContext

    object

    {}

    Security context to add to cert-controller Pod

    certController.priorityClassName

    string

    ""

    priorityClassName to add to cert-controller container

    certController.privateKeyAlgorithm

    string

    "ECDSA"

    Private key algorithm to be used for the CA and leaf certificate private keys. One of: ECDSA or RSA.

    certController.privateKeySize

    int

    256

    Private key size to be used for the CA and leaf certificate private keys. Supported values: ECDSA(256, 384, 521), RSA(2048, 3072, 4096)

    certController.renewBeforePercentage

    int

    33

    How long before the certificate expiration should the renewal process be triggered. For example, if a certificate is valid for 60 minutes, and renewBeforePercentage=25, cert-controller will begin to attempt to renew the certificate 45 minutes after it was issued (i.e. when there are 15 minutes (25%) remaining until the certificate is no longer valid).

    certController.requeueDuration

    string

    "5m"

    Requeue duration to ensure that certificate gets renewed.

    certController.resources

    object

    {}

    Resources to add to cert-controller container

    certController.securityContext

    object

    {}

    Security context to add to cert-controller Pod

    certController.serviceAccount.annotations

    object

    {}

    Annotations to add to the service account

    certController.serviceAccount.automount

    bool

    true

    Automounts the service account token in all containers of the Pod

    certController.serviceAccount.enabled

    bool

    true

    Specifies whether a service account should be created

    certController.serviceAccount.extraLabels

    object

    {}

    Extra Labels to add to the service account

    certController.serviceAccount.name

    string

    ""

    The name of the service account to use. If not set and enabled is true, a name is generated using the fullname template

    certController.serviceMonitor.additionalLabels

    object

    {}

    Labels to be added to the cert-controller ServiceMonitor

    certController.serviceMonitor.enabled

    bool

    true

    Enable cert-controller ServiceMonitor. Metrics must be enabled

    certController.serviceMonitor.interval

    string

    "30s"

    Interval to scrape metrics

    certController.serviceMonitor.metricRelabelings

    list

    []

    certController.serviceMonitor.relabelings

    list

    []

    certController.serviceMonitor.scrapeTimeout

    string

    "25s"

    Timeout if metrics can't be retrieved in given time interval

    certController.tolerations

    list

    []

    Tolerations to add to cert-controller container

    certController.topologySpreadConstraints

    list

    []

    topologySpreadConstraints to add to cert-controller container

    clusterName

    string

    "cluster.local"

    Cluster DNS name

    config.exporterImage

    string

    "mariadb/mariadb-prometheus-exporter-ubi:1.1.0"

    Default MariaDB exporter image

    config.exporterMaxscaleImage

    string

    "mariadb/maxscale-prometheus-exporter-ubi:1.1.0"

    Default MaxScale exporter image

    config.galeraLibPath

    string

    "/usr/lib64/galera/libgalera_enterprise_smm.so"

    Galera Enterprise library path to be used with Galera

    config.mariadbDefaultVersion

    string

    "11.8"

    Default MariaDB Enterprise version to be used when unable to infer it via image tag

    config.mariadbImage

    string

    "docker.mariadb.com/enterprise-server:11.8.3-1"

    Default MariaDB Enterprise image

    config.mariadbImageName

    string

    "docker.mariadb.com/enterprise-server"

    Default MariaDB Enterprise image name

    config.maxscaleImage

    string

    "docker.mariadb.com/maxscale:25.10.0"

    Default MaxScale Enterprise image

    crds

    object

    {"enabled":false}

    CRDs

    crds.enabled

    bool

    false

    Whether the helm chart should create and update the CRDs. It is false by default, which implies that the CRDs must be managed independently with the mariadb-enterprise-operator-crds helm chart. WARNING This should only be set to true during the initial deployment. If this chart manages the CRDs and is later uninstalled, all MariaDB instances will be DELETED.

    currentNamespaceOnly

    bool

    false

    Whether the operator should watch CRDs only in its own namespace or not.

    extrArgs

    list

    []

    Extra arguments to be passed to the controller entrypoint

    extraEnv

    list

    []

    Extra environment variables to be passed to the controller

    extraEnvFrom

    list

    []

    Extra environment variables from preexiting ConfigMap / Secret objects used by the controller using envFrom

    extraVolumeMounts

    list

    []

    Extra volumes to mount to the container.

    extraVolumes

    list

    []

    Extra volumes to pass to pod.

    fullnameOverride

    string

    ""

    ha.enabled

    bool

    false

    Enable high availability of the controller. If you enable it we recommend to set affinity and pdb

    ha.replicas

    int

    3

    Number of replicas

    image.pullPolicy

    string

    "IfNotPresent"

    image.repository

    string

    "docker.mariadb.com/mariadb-enterprise-operator"

    image.tag

    string

    ""

    Image tag to use. By default the chart appVersion is used

    imagePullSecrets

    list

    []

    logLevel

    string

    "INFO"

    Controller log level

    metrics.enabled

    bool

    false

    Enable operator internal metrics. Prometheus must be installed in the cluster

    metrics.serviceMonitor.additionalLabels

    object

    {}

    Labels to be added to the controller ServiceMonitor

    metrics.serviceMonitor.enabled

    bool

    true

    Enable controller ServiceMonitor

    metrics.serviceMonitor.interval

    string

    "30s"

    Interval to scrape metrics

    metrics.serviceMonitor.metricRelabelings

    list

    []

    metrics.serviceMonitor.relabelings

    list

    []

    metrics.serviceMonitor.scrapeTimeout

    string

    "25s"

    Timeout if metrics can't be retrieved in given time interval

    nameOverride

    string

    ""

    nodeSelector

    object

    {}

    Node selectors to add to controller Pod

    pdb.enabled

    bool

    false

    Enable PodDisruptionBudget for the controller.

    pdb.maxUnavailable

    int

    1

    Maximum number of unavailable Pods. You may also give a percentage, like 50%

    podAnnotations

    object

    {}

    Annotations to add to controller Pod

    podSecurityContext

    object

    {}

    Security context to add to controller Pod

    pprof.enabled

    bool

    false

    Enable the pprof HTTP server.

    pprof.port

    int

    6060

    The port where the pprof HTTP server listens.

    priorityClassName

    string

    ""

    priorityClassName to add to controller Pod

    rbac.aggregation.enabled

    bool

    true

    Specifies whether the cluster roles aggrate to view and edit predefinied roles

    rbac.enabled

    bool

    true

    Specifies whether RBAC resources should be created

    resources

    object

    {}

    Resources to add to controller container

    securityContext

    object

    {}

    Security context to add to controller container

    serviceAccount.annotations

    object

    {}

    Annotations to add to the service account

    serviceAccount.automount

    bool

    true

    Automounts the service account token in all containers of the Pod

    serviceAccount.enabled

    bool

    true

    Specifies whether a service account should be created

    serviceAccount.extraLabels

    object

    {}

    Extra Labels to add to the service account

    serviceAccount.name

    string

    ""

    The name of the service account to use. If not set and enabled is true, a name is generated using the fullname template

    tolerations

    list

    []

    Tolerations to add to controller Pod

    topologySpreadConstraints

    list

    []

    topologySpreadConstraints to add to controller Pod

    webhook.affinity

    object

    {}

    Affinity to add to webhook Pod

    webhook.annotations

    object

    {}

    Annotations for webhook configurations.

    webhook.cert.ca.key

    string

    ""

    File under 'ca.path' that contains the full CA trust chain.

    webhook.cert.ca.path

    string

    ""

    Path that contains the full CA trust chain.

    webhook.cert.certManager.duration

    string

    ""

    Duration to be used in the Certificate resource,

    webhook.cert.certManager.enabled

    bool

    false

    Whether to use cert-manager to issue and rotate the certificate. If set to false, mariadb-enterprise-operator's cert-controller will be used instead.

    webhook.cert.certManager.issuerRef

    object

    {}

    Issuer reference to be used in the Certificate resource. If not provided, a self-signed issuer will be used.

    webhook.cert.certManager.privateKeyAlgorithm

    string

    "ECDSA"

    Private key algorithm to be used for the CA and leaf certificate private keys. One of: ECDSA or RSA.

    webhook.cert.certManager.privateKeySize

    int

    256

    Private key size to be used for the CA and leaf certificate private keys. Supported values: ECDSA(256, 384, 521), RSA(2048, 3072, 4096)

    webhook.cert.certManager.renewBefore

    string

    ""

    Renew before duration to be used in the Certificate resource.

    webhook.cert.certManager.revisionHistoryLimit

    int

    3

    The maximum number of CertificateRequest revisions that are maintained in the Certificate’s history.

    webhook.cert.path

    string

    "/tmp/k8s-webhook-server/serving-certs"

    Path where the certificate will be mounted. 'tls.crt' and 'tls.key' certificates files should be under this path.

    webhook.cert.secretAnnotations

    object

    {}

    Annotatioms to be added to webhook TLS secret.

    webhook.cert.secretLabels

    object

    {}

    Labels to be added to webhook TLS secret.

    webhook.enabled

    bool

    true

    Specifies whether the webhook should be created.

    webhook.extrArgs

    list

    []

    Extra arguments to be passed to the webhook entrypoint

    webhook.extraVolumeMounts

    list

    []

    Extra volumes to mount to webhook container

    webhook.extraVolumes

    list

    []

    Extra volumes to pass to webhook Pod

    webhook.ha.enabled

    bool

    false

    Enable high availability

    webhook.ha.replicas

    int

    3

    Number of replicas

    webhook.hostNetwork

    bool

    false

    Expose the webhook server in the host network

    webhook.image.pullPolicy

    string

    "IfNotPresent"

    webhook.image.repository

    string

    "docker.mariadb.com/mariadb-enterprise-operator"

    webhook.image.tag

    string

    ""

    Image tag to use. By default the chart appVersion is used

    webhook.imagePullSecrets

    list

    []

    webhook.nodeSelector

    object

    {}

    Node selectors to add to webhook Pod

    webhook.pdb.enabled

    bool

    false

    Enable PodDisruptionBudget for the webhook.

    webhook.pdb.maxUnavailable

    int

    1

    Maximum number of unavailable Pods. You may also give a percentage, like 50%

    webhook.podAnnotations

    object

    {}

    Annotations to add to webhook Pod

    webhook.podSecurityContext

    object

    {}

    Security context to add to webhook Pod

    webhook.port

    int

    9443

    Port to be used by the webhook server

    webhook.priorityClassName

    string

    ""

    priorityClassName to add to webhook Pod

    webhook.resources

    object

    {}

    Resources to add to webhook container

    webhook.securityContext

    object

    {}

    Security context to add to webhook container

    webhook.serviceAccount.annotations

    object

    {}

    Annotations to add to the service account

    webhook.serviceAccount.automount

    bool

    true

    Automounts the service account token in all containers of the Pod

    webhook.serviceAccount.enabled

    bool

    true

    Specifies whether a service account should be created

    webhook.serviceAccount.extraLabels

    object

    {}

    Extra Labels to add to the service account

    webhook.serviceAccount.name

    string

    ""

    The name of the service account to use. If not set and enabled is true, a name is generated using the fullname template

    webhook.serviceMonitor.additionalLabels

    object

    {}

    Labels to be added to the webhook ServiceMonitor

    webhook.serviceMonitor.enabled

    bool

    true

    Enable webhook ServiceMonitor. Metrics must be enabled

    webhook.serviceMonitor.interval

    string

    "30s"

    Interval to scrape metrics

    webhook.serviceMonitor.metricRelabelings

    list

    []

    webhook.serviceMonitor.relabelings

    list

    []

    webhook.serviceMonitor.scrapeTimeout

    string

    "25s"

    Timeout if metrics can't be retrieved in given time interval

    webhook.tolerations

    list

    []

    Tolerations to add to webhook Pod

    webhook.topologySpreadConstraints

    list

    []

    topologySpreadConstraints to add to webhook Pod

    25.10

    >=1.32.0-0 <= 1.34.0-0

    LTS 25.10. It was tested to work up to kubernetes v1.34.

    affinity

    object

    {}

    Affinity to add to controller Pod

    certController.affinity

    object

    {}

    Affinity to add to cert-controller container

    certController.caLifetime

    string

    "26280h"

    CustomResourceDefinitions
    operator helm values
    cert-manager
    limitations when it comes to manage CRDs
    as recommended by the official Helm documentation
    customer credentials
    prometheus operator
    cert-manager
    operator helm values
    updates documentation
    Long-Term Support (LTS)
    release notes
    release notes
    operator helm values

    CA certificate lifetime. It must be greater than certLifetime.

    <mariadb-name>
  • *.<mariadb-name>-internal.<namespace>.svc.<cluster-name>

  • *.<mariadb-name>-internal.<namespace>.svc

  • *.<mariadb-name>-internal.<namespace>

  • *.<mariadb-name>-internal

  • <mariadb-name>-primary.<namespace>.svc.<cluster-name>

  • <mariadb-name>-primary.<namespace>.svc

  • <mariadb-name>-primary.<namespace>

  • <mariadb-name>-primary

  • <mariadb-name>-secondary.<namespace>.svc.<cluster-name>

  • <mariadb-name>-secondary.<namespace>.svc

  • <mariadb-name>-secondary.<namespace>

  • <mariadb-name>-secondary

  • localhost

  • Server CA bundle used to establish trust with the MariaDB server.

  • Server leaf certificate used to connect to the MariaDB server.

  • <maxscale-name>
  • <maxscale-name>-gui.<namespace>.svc.<clusername>

  • <maxscale-name>-gui.<namespace>.svc

  • <maxscale-name>-gui.<namespace>

  • <maxscale-name>-gui

  • *.<maxscale-name>-internal.<namespace>.svc.<clusername>

  • *.<maxscale-name>-internal.<namespace>.svc

  • *.<maxscale-name>-internal.<namespace>

  • *.<maxscale-name>-internal

  • in the
    default
    namespace. You can either use this
    Secret
    or generate a new one with the subject
    mariadb-galera-client
    , issued by the
    mariadb-galera-ca
    CA. While issuing client certificates for applications falls outside the scope of this operator, you can
    .

    RSA

    2048, 3072, 4096

    ECDSA

    256, 384, 521

    Enabling TLS in existing instances
    Enabling TLS in existing instances
    limitations
    intermedicate CAs
    limitations
    intermedicate CAs
    limitations
    MariaDB certificate specification
    MariaDB certificate specification
    MaxScale certificate specification
    securely connecting from your applications
    renewal
    MariaDB cert spec
    MaxScale cert spec
    CA bundle
    custom trust
    cert renewal
    cert-manager
    certificate backends
    Certificate resources
    TLS Secrets
    ca.crt field provided by cert-managed
    CA bundle
    custom trust
    cert-manager's certificate backends
    MariaDB cert spec
    MaxScale cert spec
    bring your own CA
    CA bundle
    CA renewal
    TLS Secret
    cert renewal
    some limitations
    CA bundle
    custom trust
    CA bundle
    intermediate CAs
    CA bundle
    trust-manager
    Admin TLS version
    Server TLS version
    update strategies
    certificates are issued by the operator
    certificates are issued by cert-manager
    update strategies
    User SQL resources
    API reference
    MariaDB Enterprise Cluster documentation
    MariaDB Enterprise Cluster documentation
    Enabling TLS in existing instances
    CA bundle
    distributing trust
    providing your own certificates
    intermediate CAs
    MDEV-35812
    MaxScale documentation
    test them using Connection resources
    helm repo add mariadb-enterprise-operator https://operator.mariadb.com
    helm install mariadb-enterprise-operator-crds mariadb-enterprise-operator/mariadb-enterprise-operator-crds
    imagePullSecrets:
      - name: mariadb-enterprise
    
    webhook:
      imagePullSecrets:
          - name: mariadb-enterprise
    
    certController:
      imagePullSecrets:
        - name: mariadb-enterprise
    helm repo add mariadb-enterprise-operator https://operator.mariadb.com
    helm install mariadb-enterprise-operator mariadb-enterprise-operator/mariadb-enterprise-operator \
      -f values.yaml
    helm repo add mariadb-enterprise-operator https://operator.mariadb.com
    helm install mariadb-enterprise-operator mariadb-enterprise-operator/mariadb-enterprise-operator \
      -f values.yaml \
      --set metrics.enabled=true --set webhook.cert.certManager.enabled=true
    helm install --version "25.10.*" mariadb-enterprise-operator-crds mariadb-enterprise-operator/mariadb-enterprise-operator-crds
    helm install mariadb-enterprise-operator mariadb-enterprise-operator/mariadb-enterprise-operator \
      -f values.yaml \
      --version "25.10.*"
    helm repo add mariadb-enterprise-operator https://operator.mariadb.com
    helm install mariadb-enterprise-operator mariadb-enterprise-operator/mariadb-enterprise-operator
    helm repo add mariadb-enterprise-operator https://operator.mariadb.com
    helm install mariadb-enterprise-operator \
      -n databases --create-namespace \
      -f values.yaml \
      --set currentNamespaceOnly=true \
      mariadb-enterprise-operator/mariadb-enterprise-operator
    helm repo update mariadb-enterprise-operator
    helm upgrade --install mariadb-enterprise-operator-crds \
      --version <new-version> \
      mariadb-enterprise-operator/mariadb-enterprise-operator-crds
    helm repo update mariadb-enterprise-operator
    helm upgrade --install mariadb-enterprise-operator \
      --version <new-version> \
      mariadb-enterprise-operator/mariadb-enterprise-operator
    ha:
      enabled: true
      replicas: 3
    
    affinity:
      podAntiAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
        - labelSelector:
            matchExpressions:
            - key: app.kubernetes.io/name
              operator: In
              values:
              - mariadb-enterprise-operator
            - key: app.kubernetes.io/instance
              operator: In
              values:
              - mariadb-enterprise-operator
          topologyKey: kubernetes.io/hostname
    
    pdb:
      enabled: true
      maxUnavailable: 1
    helm uninstall mariadb-enterprise-operator
    helm uninstall mariadb-enterprise-operator-crds
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      ...
      tls:
        enabled: true
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      ...
      tls:
        enabled: true
        required: true
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      ...
      tls:
        enabled: false
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale-galera
    spec:
      ...
      mariaDbRef:
        name: mariadb-galera
      tls:
        enabled: true
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale-galera
    spec:
      ...
      mariaDbRef:
        name: mariadb-galera
      tls:
        enabled: false
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb
    spec:
      ...
      tls:
        enabled: true
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale
    spec:
      ...
      tls:
        enabled: true
    apiVersion: cert-manager.io/v1
    kind: ClusterIssuer
    metadata:
      name: selfsigned
    spec:
      selfSigned: {}
    ---
    apiVersion: cert-manager.io/v1
    kind: Certificate
    metadata:
      name: root-ca
      namespace: default
    spec:
      duration: 52596h # 6 years
      commonName: root-ca
      usages:
      - digital signature
      - key encipherment
      - cert sign
      issuerRef:
        name: selfsigned
        kind: ClusterIssuer
      isCA: true
      privateKey:
        encoding: PKCS1
        algorithm: ECDSA
        size: 256
      secretTemplate:
        labels:
          enterprise.mariadb.com/watch: ""
      secretName: root-ca
      revisionHistoryLimit: 10
    ---
    apiVersion: cert-manager.io/v1
    kind: ClusterIssuer
    metadata:
      name: root-ca
    spec:
      ca:
        secretName: root-ca
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      ...
      tls:
        enabled: true
        serverCertIssuerRef:
          name: root-ca
          kind: ClusterIssuer
        clientCertIssuerRef:
          name: root-ca
          kind: ClusterIssuer
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale-galera
    spec:
      ...
      tls:
        enabled: true
        adminCertIssuerRef:
          name: root-ca
          kind: ClusterIssuer
        listenerCertIssuerRef:
          name: root-ca
          kind: ClusterIssuer
    apiVersion: v1
    kind: Secret
    type: Opaque
    metadata:
      name: mariadb-galera-server-ca
      labels:
        enterprise.mariadb.com/watch: ""
    data:
      ca.crt:
      -----BEGIN CERTIFICATE-----
      <public-key>
      -----END CERTIFICATE-----
      ca.key:
      -----BEGIN EC PRIVATE KEY-----
      <private-key>
      -----END EC PRIVATE KEY-----
    apiVersion: v1
    kind: Secret
    type: kubernetes.io/tls  
    metadata:
      name: mariadb-galera-server-tls 
      labels:
        enterprise.mariadb.com/watch: ""
    data:
      tls.crt:
      -----BEGIN CERTIFICATE-----
      <public-key>
      -----END CERTIFICATE-----
      tls.key:
      -----BEGIN EC PRIVATE KEY-----
      <private-key>
      -----END EC PRIVATE KEY-----
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      ...
      tls:
        enabled: true
        serverCASecretRef:
          name: mariadb-server-ca
        serverCertSecretRef:
          name: mariadb-galera-server-tls
        clientCASecretRef:
          name: mariadb-client-ca
        clientCertSecretRef:
          name: mariadb-galera-client-tls
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale-galera
    spec:
      ...
      tls:
        enabled: true
        adminCASecretRef:
          name: maxscale-admin-ca
        adminCertSecretRef:
          name: maxscale-galera-admin-tls
        listenerCASecretRef:
          name: maxscale-listener-ca
        listenerCertSecretRef:
          name: maxscale-galera-listener-tls
        serverCASecretRef:
          name: mariadb-galera-ca-bundle
        serverCertSecretRef:
          name: mariadb-galera-client-tls
    apiVersion: v1
    kind: Secret
    type: Opaque
    metadata:
      name: mariadb-ca
      labels:
        enterprise.mariadb.com/watch: ""
    data:
      ca.crt:
      -----BEGIN CERTIFICATE-----
      <public-key>
      -----END CERTIFICATE-----
      ca.key:
      -----BEGIN EC PRIVATE KEY-----
      <private-key>
      -----END EC PRIVATE KEY-----
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      ...
      tls:
        enabled: true
        serverCASecretRef:
          name: mariadb-server-ca
        clientCASecretRef:
          name: mariadb-client-ca
    apiVersion: v1
    kind: Secret
    type: Opaque
    metadata:
      name: custom-trust
      labels:
        enterprise.mariadb.com/watch: ""
    data:
      ca.crt:
      -----BEGIN CERTIFICATE-----
      <my-org-root-ca>
      -----END CERTIFICATE-----
      -----BEGIN CERTIFICATE-----
      <root-ca>
      -----END CERTIFICATE-----
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale-galera
    spec:
      ...
      tls:
        enabled: true
        adminCASecretRef:
          name: custom-trust
        adminCertIssuerRef:
          name: my-org-intermediate-ca
          kind: ClusterIssuer
        listenerCASecretRef:
          name: custom-trust
        listenerCertIssuerRef:
          name: intermediate-ca
          kind: ClusterIssuer
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      tls:
        versions:
          - TLSv1.3
          - TLSv1.2
          - TLSv1.1
          - TLSv1.0
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale-galera
    spec:
      ...
      tls:
        adminVersions:
          - TLSv13
          - TLSv12
          - TLSv11
          - TLSv10
        serverVersions:
          - TLSv13
          - TLSv12
          - TLSv11
          - TLSv10
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      tls:
        enabled: true
        required: true
        serverCertConfig:
          caLifetime: 8766h # 1 year
          certLifetime: 720h # 1 month
        clientCertConfig:
          caLifetime: 8766h # 1 year
          certLifetime: 720h # 1 month
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale-galera
    spec:
      tls:
        enabled: true
        adminCertConfig:
          caLifetime: 8766h # 1 year
          certLifetime: 1h # 1 month
        listenerCertConfig:
          caLifetime: 8766h # 1 year
          certLifetime: 720h # 1 month
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      tls:
        enabled: true
        required: true
        serverCertIssuerRef:
          name: root-ca
          kind: ClusterIssuer
        serverCertConfig:
          caLifetime: 8766h # 1 year
          certLifetime: 720h # 1 month
        clientCertIssuerRef:
          name: root-ca
          kind: ClusterIssuer
        clientCertConfig:
          caLifetime: 8766h # 1 year
          certLifetime: 720h # 1 month
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale-galera
    spec:
      tls:
        enabled: true
        adminCertIssuerRef:
          name: root-ca
          kind: ClusterIssuer
        adminCertConfig:
          caLifetime: 8766h # 1 year
          certLifetime: 1h # 1 month
        listenerCertIssuerRef:
          name: root-ca
          kind: ClusterIssuer
        listenerCertConfig:
          caLifetime: 8766h # 1 year
          certLifetime: 720h # 1 month
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      tls:
        enabled: true
        required: true
        serverCertConfig:
          privateKeyAlgorithm: RSA
          privateKeySize: 2048
        clientCertConfig:
          privateKeyAlgorithm: RSA
          privateKeySize: 2048
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale-galera
    spec:
      tls:
        enabled: true
        adminCertConfig:
          privateKeyAlgorithm: RSA
          privateKeySize: 2048
        listenerCertConfig:
          privateKeyAlgorithm: RSA
          privateKeySize: 2048
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      tls:
        enabled: true
        required: true
        serverCertIssuerRef:
          name: root-ca
          kind: ClusterIssuer
        serverCertConfig:
          privateKeyAlgorithm: ECDSA
          privateKeySize: 256
        clientCertIssuerRef:
          name: root-ca
          kind: ClusterIssuer
        clientCertConfig:
          privateKeyAlgorithm: ECDSA
          privateKeySize: 256
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale-galera
    spec:
      tls:
        enabled: true
        adminCertIssuerRef:
          name: root-ca
          kind: ClusterIssuer
        adminCertConfig:
          privateKeyAlgorithm: ECDSA
          privateKeySize: 256
        listenerCertIssuerRef:
          name: root-ca
          kind: ClusterIssuer
        listenerCertConfig:
          privateKeyAlgorithm: ECDSA
          privateKeySize: 256
    kubectl get mariadb mariadb-galera -o jsonpath="{.status.tls}" | jq
    {
      "caBundle": [
        {
          "issuer": "CN=mariadb-galera-ca",
          "notAfter": "2028-01-20T14:26:50Z",
          "notBefore": "2025-01-20T13:26:50Z",
          "subject": "CN=mariadb-galera-ca"
        }
      ],
      "clientCert": {
        "issuer": "CN=mariadb-galera-ca",
        "notAfter": "2025-04-20T14:26:50Z",
        "notBefore": "2025-01-20T13:26:50Z",
        "subject": "CN=mariadb-galera-client"
      },
      "serverCert": {
        "issuer": "CN=mariadb-galera-ca",
        "notAfter": "2025-04-20T14:26:50Z",
        "notBefore": "2025-01-20T13:26:50Z",
        "subject": "CN=mariadb-galera.default.svc.cluster.local"
      }
    }
    kubectl get maxscale maxscale-galera -o jsonpath="{.status.tls}" | jq
    {
      "adminCert": {
        "issuer": "CN=maxscale-galera-ca",
        "notAfter": "2025-04-20T14:33:09Z",
        "notBefore": "2025-01-20T13:33:09Z",
        "subject": "CN=maxscale-galera.default.svc.cluster.local"
      },
      "caBundle": [
        {
          "issuer": "CN=maxscale-galera-ca",
          "notAfter": "2028-01-20T14:33:09Z",
          "notBefore": "2025-01-20T13:33:09Z",
          "subject": "CN=maxscale-galera-ca"
        },
        {
          "issuer": "CN=mariadb-galera-ca",
          "notAfter": "2028-01-20T14:28:46Z",
          "notBefore": "2025-01-20T13:28:46Z",
          "subject": "CN=mariadb-galera-ca"
        }
      ],
      "listenerCert": {
        "issuer": "CN=maxscale-galera-ca",
        "notAfter": "2025-04-20T14:33:09Z",
        "notBefore": "2025-01-20T13:33:09Z",
        "subject": "CN=maxscale-galera.default.svc.cluster.local"
      },
      "serverCert": {
        "issuer": "CN=mariadb-galera-ca",
        "notAfter": "2025-04-20T14:28:46Z",
        "notBefore": "2025-01-20T13:28:46Z",
        "subject": "CN=mariadb-galera-client"
      }
    }
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: User
    metadata:
      name: user
    spec:
      ...
      require:
        x509: true
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: User
    metadata:
      name: user
    spec:
      ...
      require:
        issuer: "/CN=mariadb-galera-ca"
        subject: "/CN=mariadb-galera-client"
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      tls:
        enabled: true
        galeraServerSSLMode: SERVER_X509
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      tls:
        enabled: true
        galeraSSTEnabled: true
        galeraClientSSLMode: VERIFY_IDENTITY
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb-galera
    spec:
      rootPasswordSecretKeyRef:
        name: mariadb
        key: root-password
      storage:
        size: 1Gi
      replicas: 3
      galera:
        enabled: true
      tls:
        enabled: true
        required: true
    ---
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale-galera
    spec:
      replicas: 2
      mariaDbRef:
        name: mariadb-galera
      tls:
        enabled: true
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: User
    metadata:
      name: app
      namespace: app
    spec:
      mariaDbRef:
        name: mariadb-galera
        namespace: default
      require:
        issuer: "/CN=mariadb-galera-ca"
        subject: "/CN=mariadb-galera-client"
      host: "%"
    ---
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: Grant
    metadata:
      name: grant-app
      namespace: app
    spec:
      mariaDbRef:
        name: mariadb-galera
        namespace: default
      privileges:
        - "ALL PRIVILEGES"
      database: "*"
      table: "*"
      username: app
      host: "%"
    apiVersion: batch/v1
    kind: CronJob
    metadata:
      name: mariadb-client
      namespace: app
    spec:
      schedule: "*/1 * * * *"
      jobTemplate:
        spec:
          template:
            spec:
              containers:
              - name: mariadb-client
                image: mariadb:11.4.4
                command:
                  - bash
                args:
                  - -c
                  - >
                    mariadb -u app -h mariadb-galera-primary.default.svc.cluster.local
                    --ssl-ca=/etc/pki/ca.crt --ssl-cert=/etc/pki/tls.crt
                    --ssl-key=/etc/pki/tls.key --ssl-verify-server-cert
                    -e "SELECT 'MariaDB connection successful!' AS Status;" -t
                volumeMounts:
                - name: pki
                  mountPath: /etc/pki
                  readOnly: true
              volumes:
              - name: pki
                projected:
                  sources:
                  - secret:
                      name: mariadb-bundle
                      items:
                      - key: ca.crt
                        path: ca.crt
                  - secret:
                      name: mariadb-galera-client-cert
                      items:
                      - key: tls.crt
                        path: tls.crt
                      - key: tls.key
                        path: tls.key
              restartPolicy: Never
    +---------------------------------+
    | Status                          |
    +---------------------------------+
    | MariaDB connection successful!  |
    +---------------------------------+
    apiVersion: batch/v1
    kind: CronJob
    metadata:
      name: maxscale-client
      namespace: app
    spec:
      schedule: "*/1 * * * *"
      jobTemplate:
        spec:
          template:
            spec:
              containers:
              - name: maxscale-client
                image: mariadb:11.4.4
                command:
                  - bash
                args:
                  - -c
                  - >
                    mariadb -u app -h maxscale-galera.default.svc.cluster.local
                    --ssl-ca=/etc/pki/ca.crt --ssl-cert=/etc/pki/tls.crt
                    --ssl-key=/etc/pki/tls.key --ssl-verify-server-cert
                    -e "SELECT 'MaxScale connection successful!' AS Status;" -t
                volumeMounts:
                - name: pki
                  mountPath: /etc/pki
                  readOnly: true
              volumes:
              - name: pki
                projected:
                  sources:
                  - secret:
                      name: mariadb-bundle
                      items:
                      - key: ca.crt
                        path: ca.crt
                  - secret:
                      name: mariadb-galera-client-cert
                      items:
                      - key: tls.crt
                        path: tls.crt
                      - key: tls.key
                        path: tls.key
              restartPolicy: Never
    +---------------------------------+
    | Status                          |
    +---------------------------------+
    | MaxScale connection successful! |
    +---------------------------------+
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: Connection
    metadata:
      name: connection
    spec:
      mariaDbRef:
        name: mariadb-galera
      username: mariadb
      passwordSecretKeyRef:
        name: mariadb
        key: password
      tlsClientCertSecretRef:
        name: mariadb-galera-client-cert
      database: mariadb
      healthCheck:
        interval: 30s
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: Connection
    metadata:
      name: connection-maxscale
    spec:
      maxScaleRef:
        name: maxscale-galera
      username: mariadb
      passwordSecretKeyRef:
        name: mariadb
        key: password
      tlsClientCertSecretRef:
        name: mariadb-galera-client-cert
      database: mariadb
      healthCheck:
        interval: 30s
    kubectl get connections
    NAME                         READY   STATUS    SECRET                AGE
    connection                   True    Healthy   connection            2m8s
    connection-maxscale          True    Healthy   connection-maxscale   97s
    Cover

    WEBINAR

    New innovations in MaxScale 25.01 and Enterprise Platform

    Watch Now
    MaxScale UI
    MaxScale docs
    MaxScale REST API

    Metrics

    MariaDB Enterprise Kubernetes Operator is able to configure Prometheus operator resources to scrape metrics from MariaDB and MaxScale instances. These metrics can be used later on to build Grafana dashboards or trigger Alertmanager alerts.

    Operator metrics

    In order to expose the operator internal metrics, you can install the operator Helm chart passing the metrics.enabled = true value. Refer to the Helm documentation for further detail.

    Exporters

    The operator configures exporters to query MariaDB and MaxScale, exposing metrics in Prometheus format through an HTTP endpoint.

    It is important to note that these exporters run as standalone Deployments rather than as sidecars for each data-plane replica. Since they can communicate with all replicas of MariaDB and MaxScale, there is no need to run a separate exporter for each replica.

    As a result, the lifecycle of MariaDB and MaxScale remains independent from the exporters, allowing for upgrades without impacting the availability of either component.

    ServiceMonitor

    Once the exporter Deployment is ready, the operator creates a object that will be eventually reconciled by the , resulting in the Prometheus instance being configured to scrape the exporter endpoint.

    As you scale MariaDB and MaxScale by adjusting the number of replicas, the operator will reconcile the ServiceMonitor to dynamically add or remove targets corresponding to the updated instances.

    Configuration

    The easiest way to setup metrics in your MariaDB and MaxScale instances is just by setting spec.metrics.enabled = true:

    The rest of the fields are defaulted by the operator. If you need a more fine grained configuration, refer to the and the following examples:

    Grafana dashboards

    The following community dashboards available on are compatible with the , and therefore they can be used to monitor MariaDB instances:

    MariaDB metrics

    The following metrics are available for MariaDB instances:

    Metric Name
    Description
    Type

    MaxScale metrics

    The following metrics are available for MaxScale instances:

    Metric Name
    Description
    Type

    mysql_galera_evs_repl_latency_max_seconds

    PXC/Galera group communication latency. Max value.

    GAUGE

    mysql_galera_evs_repl_latency_min_seconds

    PXC/Galera group communication latency. Min value.

    GAUGE

    mysql_galera_evs_repl_latency_sample_size

    PXC/Galera group communication latency. Sample Size.

    GAUGE

    mysql_galera_evs_repl_latency_stdev

    PXC/Galera group communication latency. Standard Deviation.

    GAUGE

    mysql_galera_gcache_size_bytes

    PXC/Galera gcache size.

    GAUGE

    mysql_galera_status_info

    PXC/Galera status information.

    GAUGE

    mysql_galera_variables_info

    PXC/Galera variables information.

    GAUGE

    mysql_global_status_aborted_clients

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_aborted_connects

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_aborted_connects_preauth

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_access_denied_errors

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_acl_column_grants

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_acl_database_grants

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_acl_function_grants

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_acl_package_body_grants

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_acl_package_spec_grants

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_acl_procedure_grants

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_acl_proxy_users

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_acl_role_grants

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_acl_roles

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_acl_table_grants

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_acl_users

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_aria_pagecache_blocks_not_flushed

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_aria_pagecache_blocks_unused

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_aria_pagecache_blocks_used

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_aria_pagecache_read_requests

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_aria_pagecache_reads

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_aria_pagecache_write_requests

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_aria_pagecache_writes

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_aria_transaction_log_syncs

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_binlog_bytes_written

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_binlog_cache_disk_use

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_binlog_cache_use

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_binlog_commits

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_binlog_disk_use

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_binlog_group_commit_trigger_count

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_binlog_group_commit_trigger_lock_wait

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_binlog_group_commit_trigger_timeout

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_binlog_group_commits

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_binlog_gtid_index_hit

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_binlog_gtid_index_miss

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_binlog_snapshot_position

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_binlog_stmt_cache_disk_use

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_binlog_stmt_cache_use

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_buffer_pool_dirty_pages

    Innodb buffer pool dirty pages.

    GAUGE

    mysql_global_status_buffer_pool_page_changes_total

    Innodb buffer pool page state changes.

    COUNTER

    mysql_global_status_buffer_pool_pages

    Innodb buffer pool pages by state.

    GAUGE

    mysql_global_status_busy_time

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_bytes_received

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_bytes_sent

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_column_compressions

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_column_decompressions

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_commands_total

    Total number of executed MySQL commands.

    COUNTER

    mysql_global_status_compression

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_connection_errors_total

    Total number of MySQL connection errors.

    COUNTER

    mysql_global_status_connections

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_cpu_time

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_created_tmp_disk_tables

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_created_tmp_files

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_created_tmp_tables

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_delayed_errors

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_delayed_insert_threads

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_delayed_writes

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_delete_scan

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_empty_queries

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_executed_events

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_executed_triggers

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_feature_application_time_periods

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_feature_check_constraint

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_feature_custom_aggregate_functions

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_feature_delay_key_write

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_feature_dynamic_columns

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_feature_fulltext

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_feature_gis

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_feature_insert_returning

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_feature_into_outfile

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_feature_into_variable

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_feature_invisible_columns

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_feature_json

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_feature_locale

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_feature_subquery

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_feature_system_versioning

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_feature_timezone

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_feature_trigger

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_feature_window_functions

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_feature_xml

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_handlers_total

    Total number of executed MySQL handlers.

    COUNTER

    mysql_global_status_innodb_adaptive_hash_hash_searches

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_adaptive_hash_non_hash_searches

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_available_undo_logs

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_background_log_sync

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_buffer_pool_bytes_data

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_buffer_pool_bytes_dirty

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_buffer_pool_load_incomplete

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_buffer_pool_read_ahead

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_buffer_pool_read_ahead_evicted

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_buffer_pool_read_ahead_rnd

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_buffer_pool_read_requests

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_buffer_pool_reads

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_buffer_pool_wait_free

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_buffer_pool_write_requests

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_bulk_operations

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_checkpoint_age

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_checkpoint_max_age

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_data_fsyncs

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_data_pending_fsyncs

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_data_pending_reads

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_data_pending_writes

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_data_read

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_data_reads

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_data_writes

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_data_written

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_dblwr_pages_written

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_dblwr_writes

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_deadlocks

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_encryption_n_merge_blocks_decrypted

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_encryption_n_merge_blocks_encrypted

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_encryption_n_rowlog_blocks_decrypted

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_encryption_n_rowlog_blocks_encrypted

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_encryption_n_temp_blocks_decrypted

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_encryption_n_temp_blocks_encrypted

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_encryption_num_key_requests

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_encryption_rotation_estimated_iops

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_encryption_rotation_pages_flushed

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_encryption_rotation_pages_modified

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_encryption_rotation_pages_read_from_cache

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_encryption_rotation_pages_read_from_disk

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_have_bzip2

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_have_lz4

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_have_lzma

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_have_lzo

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_have_punch_hole

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_have_snappy

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_history_list_length

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_instant_alter_column

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_log_waits

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_log_write_requests

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_log_writes

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_lsn_current

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_lsn_flushed

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_lsn_last_checkpoint

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_master_thread_active_loops

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_master_thread_idle_loops

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_max_trx_id

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_mem_adaptive_hash

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_mem_dictionary

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_num_open_files

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_num_page_compressed_trim_op

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_num_pages_decrypted

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_num_pages_encrypted

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_num_pages_page_compressed

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_num_pages_page_compression_error

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_num_pages_page_decompressed

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_onlineddl_pct_progress

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_onlineddl_rowlog_pct_used

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_onlineddl_rowlog_rows

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_os_log_written

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_page_compression_saved

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_page_size

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_pages_created

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_pages_read

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_pages_written

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_row_lock_current_waits

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_row_lock_time

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_row_lock_time_avg

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_row_lock_time_max

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_row_lock_waits

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_truncated_status_writes

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_innodb_undo_truncations

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_key_blocks_not_flushed

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_key_blocks_unused

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_key_blocks_used

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_key_blocks_warm

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_key_read_requests

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_key_reads

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_key_write_requests

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_key_writes

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_last_query_cost

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_master_gtid_wait_count

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_master_gtid_wait_time

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_master_gtid_wait_timeouts

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_max_statement_time_exceeded

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_max_tmp_space_used

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_max_used_connections

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_max_used_connections_time

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_memory_used

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_memory_used_initial

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_not_flushed_delayed_rows

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_open_files

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_open_streams

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_open_table_definitions

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_open_tables

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_opened_files

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_opened_plugin_libraries

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_opened_table_definitions

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_opened_tables

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_opened_views

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_optimizer_join_prefixes_check_calls

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_performance_schema_lost_total

    Total number of MySQL instrumentations that could not be loaded or created due to memory constraints.

    COUNTER

    mysql_global_status_prepared_stmt_count

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_qcache_free_blocks

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_qcache_free_memory

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_qcache_hits

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_qcache_inserts

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_qcache_lowmem_prunes

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_qcache_not_cached

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_qcache_queries_in_cache

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_qcache_total_blocks

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_queries

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_questions

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_resultset_metadata_skipped

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_rows_read

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_rows_sent

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_rows_tmp_read

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_rpl_semi_sync_master_clients

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_rpl_semi_sync_master_get_ack

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_rpl_semi_sync_master_net_avg_wait_time

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_rpl_semi_sync_master_net_wait_time

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_rpl_semi_sync_master_net_waits

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_rpl_semi_sync_master_no_times

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_rpl_semi_sync_master_no_tx

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_rpl_semi_sync_master_request_ack

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_rpl_semi_sync_master_status

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_rpl_semi_sync_master_timefunc_failures

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_rpl_semi_sync_master_tx_avg_wait_time

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_rpl_semi_sync_master_tx_wait_time

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_rpl_semi_sync_master_tx_waits

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_rpl_semi_sync_master_wait_pos_backtraverse

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_rpl_semi_sync_master_wait_sessions

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_rpl_semi_sync_master_yes_tx

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_rpl_semi_sync_slave_send_ack

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_rpl_semi_sync_slave_status

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_rpl_transactions_multi_engine

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_select_full_join

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_select_full_range_join

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_select_range

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_select_range_check

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_select_scan

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_server_audit_active

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_server_audit_writes_failed

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_slave_connections

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_slave_heartbeat_period

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_slave_open_temp_tables

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_slave_received_heartbeats

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_slave_retried_transactions

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_slave_running

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_slave_skipped_errors

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_slaves_connected

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_slaves_running

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_slow_launch_threads

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_slow_queries

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_sort_merge_passes

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_sort_priority_queue_sorts

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_sort_range

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_sort_rows

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_sort_scan

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_ssl_accept_renegotiates

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_ssl_accepts

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_ssl_callback_cache_hits

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_ssl_client_connects

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_ssl_connect_renegotiates

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_ssl_ctx_verify_depth

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_ssl_ctx_verify_mode

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_ssl_default_timeout

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_ssl_finished_accepts

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_ssl_finished_connects

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_ssl_session_cache_hits

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_ssl_session_cache_misses

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_ssl_session_cache_overflows

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_ssl_session_cache_size

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_ssl_session_cache_timeouts

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_ssl_sessions_reused

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_ssl_used_session_cache_entries

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_ssl_verify_depth

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_ssl_verify_mode

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_subquery_cache_hit

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_subquery_cache_miss

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_syncs

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_table_locks_immediate

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_table_locks_waited

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_table_open_cache_active_instances

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_table_open_cache_hits

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_table_open_cache_misses

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_table_open_cache_overflows

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_tc_log_max_pages_used

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_tc_log_page_size

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_tc_log_page_waits

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_threadpool_idle_threads

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_threadpool_threads

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_threads_cached

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_threads_connected

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_threads_created

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_threads_running

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_tmp_space_used

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_transactions_gtid_foreign_engine

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_transactions_multi_engine

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_update_scan

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_uptime

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_uptime_since_flush_status

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_applier_thread_count

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_apply_oooe

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_apply_oool

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_apply_waits

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_apply_window

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_causal_reads

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_cert_deps_distance

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_cert_index_size

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_cert_interval

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_cluster_conf_id

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_cluster_size

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_cluster_status

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_cluster_weight

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_commit_oooe

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_commit_oool

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_commit_window

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_connected

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_desync_count

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_flow_control_paused

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_flow_control_paused_ns

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_flow_control_recv

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_flow_control_sent

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_gmcast_segment

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_last_committed

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_local_bf_aborts

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_local_cached_downto

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_local_cert_failures

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_local_commits

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_local_index

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_local_recv_queue

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_local_recv_queue_avg

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_local_recv_queue_max

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_local_recv_queue_min

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_local_replays

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_local_send_queue

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_local_send_queue_avg

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_local_send_queue_max

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_local_send_queue_min

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_local_state

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_open_connections

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_open_transactions

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_protocol_version

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_ready

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_received

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_received_bytes

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_repl_data_bytes

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_repl_keys

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_repl_keys_bytes

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_repl_other_bytes

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_replicated

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_replicated_bytes

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_rollbacker_thread_count

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_status_wsrep_thread_count

    Generic metric from SHOW GLOBAL STATUS.

    UNTYPED

    mysql_global_variables_allow_suspicious_udfs

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_analyze_sample_percentage

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_aria_block_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_aria_checkpoint_interval

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_aria_checkpoint_log_activity

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_aria_encrypt_tables

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_aria_force_start_after_recovery_failures

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_aria_group_commit_interval

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_aria_log_file_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_aria_max_sort_file_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_aria_page_checksum

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_aria_pagecache_age_threshold

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_aria_pagecache_buffer_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_aria_pagecache_division_limit

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_aria_pagecache_file_hash_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_aria_repair_threads

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_aria_sort_buffer_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_aria_used_for_temp_tables

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_auto_increment_increment

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_auto_increment_offset

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_autocommit

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_automatic_sp_privileges

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_back_log

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_big_tables

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_binlog_alter_two_phase

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_binlog_annotate_row_events

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_binlog_cache_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_binlog_commit_wait_count

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_binlog_commit_wait_usec

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_binlog_direct_non_transactional_updates

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_binlog_expire_logs_seconds

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_binlog_file_cache_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_binlog_gtid_index

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_binlog_gtid_index_page_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_binlog_gtid_index_span_min

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_binlog_legacy_event_pos

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_binlog_optimize_thread_scheduling

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_binlog_row_event_max_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_binlog_space_limit

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_binlog_stmt_cache_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_bulk_insert_buffer_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_check_constraint_checks

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_column_compression_threshold

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_column_compression_zlib_level

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_column_compression_zlib_wrap

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_connect_timeout

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_core_file

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_deadlock_search_depth_long

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_deadlock_search_depth_short

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_deadlock_timeout_long

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_deadlock_timeout_short

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_default_password_lifetime

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_default_week_format

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_delay_key_write

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_delayed_insert_limit

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_delayed_insert_timeout

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_delayed_queue_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_disconnect_on_expired_password

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_div_precision_increment

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_encrypt_binlog

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_encrypt_tmp_disk_tables

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_encrypt_tmp_files

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_eq_range_index_dive_limit

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_event_scheduler

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_expensive_subquery_limit

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_expire_logs_days

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_explicit_defaults_for_timestamp

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_extra_max_connections

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_extra_port

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_flush

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_flush_time

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_foreign_key_checks

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_ft_max_word_len

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_ft_min_word_len

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_ft_query_expansion_limit

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_general_log

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_group_concat_max_len

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_gtid_cleanup_batch_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_gtid_domain_id

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_gtid_ignore_duplicates

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_gtid_strict_mode

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_have_compress

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_have_crypt

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_have_dynamic_loading

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_have_geometry

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_have_openssl

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_have_profiling

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_have_query_cache

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_have_rtree_keys

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_have_ssl

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_have_symlink

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_histogram_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_host_cache_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_idle_readonly_transaction_timeout

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_idle_transaction_timeout

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_idle_write_transaction_timeout

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_ignore_builtin_innodb

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_in_predicate_conversion_threshold

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_adaptive_flushing

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_adaptive_flushing_lwm

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_adaptive_hash_index

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_adaptive_hash_index_parts

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_alter_copy_bulk

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_autoextend_increment

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_autoinc_lock_mode

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_buf_dump_status_frequency

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_buffer_pool_chunk_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_buffer_pool_dump_at_shutdown

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_buffer_pool_dump_now

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_buffer_pool_dump_pct

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_buffer_pool_load_abort

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_buffer_pool_load_at_startup

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_buffer_pool_load_now

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_buffer_pool_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_cmp_per_index_enabled

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_compression_default

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_compression_failure_threshold_pct

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_compression_level

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_compression_pad_pct_max

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_data_file_buffering

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_data_file_write_through

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_deadlock_detect

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_default_encryption_key_id

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_disable_sort_file_cache

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_doublewrite

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_encrypt_log

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_encrypt_tables

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_encrypt_temporary_tables

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_encryption_rotate_key_age

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_encryption_rotation_iops

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_encryption_threads

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_fast_shutdown

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_fatal_semaphore_wait_threshold

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_file_per_table

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_fill_factor

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_flush_log_at_timeout

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_flush_log_at_trx_commit

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_flush_neighbors

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_flush_sync

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_flushing_avg_loops

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_force_primary_key

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_force_recovery

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_ft_cache_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_ft_enable_diag_print

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_ft_enable_stopword

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_ft_max_token_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_ft_min_token_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_ft_num_word_optimize

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_ft_result_cache_limit

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_ft_sort_pll_degree

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_ft_total_cache_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_immediate_scrub_data_uncompressed

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_io_capacity

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_io_capacity_max

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_lock_wait_timeout

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_log_buffer_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_log_file_buffering

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_log_file_mmap

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_log_file_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_log_file_write_through

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_log_spin_wait_delay

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_log_write_ahead_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_lru_flush_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_lru_scan_depth

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_max_dirty_pages_pct

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_max_dirty_pages_pct_lwm

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_max_purge_lag

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_max_purge_lag_delay

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_max_purge_lag_wait

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_max_undo_log_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_old_blocks_pct

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_old_blocks_time

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_online_alter_log_max_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_open_files

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_optimize_fulltext_only

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_page_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_prefix_index_cluster_optimization

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_print_all_deadlocks

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_purge_batch_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_purge_rseg_truncate_frequency

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_purge_threads

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_random_read_ahead

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_read_ahead_threshold

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_read_io_threads

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_read_only

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_read_only_compressed

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_rollback_on_timeout

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_snapshot_isolation

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_sort_buffer_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_spin_wait_delay

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_stats_auto_recalc

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_stats_include_delete_marked

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_stats_modified_counter

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_stats_on_metadata

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_stats_persistent

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_stats_persistent_sample_pages

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_stats_traditional

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_stats_transient_sample_pages

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_status_output

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_status_output_locks

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_strict_mode

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_sync_spin_loops

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_table_locks

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_truncate_temporary_tablespace_now

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_undo_log_truncate

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_undo_tablespaces

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_use_atomic_writes

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_use_native_aio

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_innodb_write_io_threads

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_interactive_timeout

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_join_buffer_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_join_buffer_space_limit

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_join_cache_level

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_keep_files_on_create

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_key_buffer_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_key_cache_age_threshold

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_key_cache_block_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_key_cache_division_limit

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_key_cache_file_hash_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_key_cache_segments

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_large_files_support

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_large_page_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_large_pages

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_local_infile

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_lock_wait_timeout

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_locked_in_memory

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_log_bin

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_log_bin_compress

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_log_bin_compress_min_len

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_log_bin_trust_function_creators

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_log_queries_not_using_indexes

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_log_slave_updates

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_log_slow_admin_statements

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_log_slow_max_warnings

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_log_slow_min_examined_row_limit

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_log_slow_query

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_log_slow_query_time

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_log_slow_rate_limit

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_log_slow_slave_statements

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_log_tc_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_log_warnings

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_long_query_time

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_low_priority_updates

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_lower_case_file_system

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_lower_case_table_names

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_master_verify_checksum

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_max_allowed_packet

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_max_binlog_cache_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_max_binlog_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_max_binlog_stmt_cache_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_max_binlog_total_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_max_connect_errors

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_max_connections

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_max_delayed_threads

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_max_digest_length

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_max_error_count

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_max_heap_table_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_max_insert_delayed_threads

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_max_join_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_max_length_for_sort_data

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_max_password_errors

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_max_prepared_stmt_count

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_max_recursive_iterations

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_max_relay_log_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_max_rowid_filter_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_max_seeks_for_key

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_max_session_mem_used

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_max_sort_length

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_max_sp_recursion_depth

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_max_statement_time

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_max_tmp_session_space_usage

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_max_tmp_total_space_usage

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_max_user_connections

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_max_write_lock_count

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_metadata_locks_cache_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_metadata_locks_hash_instances

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_min_examined_row_limit

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_mrr_buffer_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_myisam_block_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_myisam_data_pointer_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_myisam_max_sort_file_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_myisam_mmap_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_myisam_repair_threads

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_myisam_sort_buffer_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_myisam_use_mmap

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_mysql56_temporal_format

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_net_buffer_length

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_net_read_timeout

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_net_retry_count

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_net_write_timeout

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_old

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_old_passwords

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_open_files_limit

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_optimizer_adjust_secondary_key_costs

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_optimizer_disk_read_cost

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_optimizer_disk_read_ratio

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_optimizer_extra_pruning_depth

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_optimizer_index_block_copy_cost

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_optimizer_join_limit_pref_ratio

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_optimizer_key_compare_cost

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_optimizer_key_copy_cost

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_optimizer_key_lookup_cost

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_optimizer_key_next_find_cost

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_optimizer_max_sel_arg_weight

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_optimizer_max_sel_args

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_optimizer_prune_level

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_optimizer_row_copy_cost

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_optimizer_row_lookup_cost

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_optimizer_row_next_find_cost

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_optimizer_rowid_compare_cost

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_optimizer_rowid_copy_cost

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_optimizer_scan_setup_cost

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_optimizer_search_depth

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_optimizer_selectivity_sampling_limit

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_optimizer_trace_max_mem_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_optimizer_use_condition_selectivity

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_optimizer_where_cost

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_accounts_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_digests_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_events_stages_history_long_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_events_stages_history_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_events_statements_history_long_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_events_statements_history_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_events_transactions_history_long_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_events_transactions_history_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_events_waits_history_long_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_events_waits_history_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_hosts_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_max_cond_classes

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_max_cond_instances

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_max_digest_length

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_max_file_classes

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_max_file_handles

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_max_file_instances

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_max_index_stat

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_max_memory_classes

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_max_metadata_locks

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_max_mutex_classes

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_max_mutex_instances

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_max_prepared_statements_instances

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_max_program_instances

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_max_rwlock_classes

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_max_rwlock_instances

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_max_socket_classes

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_max_socket_instances

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_max_sql_text_length

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_max_stage_classes

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_max_statement_classes

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_max_statement_stack

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_max_table_handles

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_max_table_instances

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_max_table_lock_stat

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_max_thread_classes

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_max_thread_instances

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_session_connect_attrs_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_setup_actors_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_setup_objects_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_performance_schema_users_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_port

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_preload_buffer_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_profiling

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_profiling_history_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_progress_report_time

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_protocol_version

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_query_alloc_block_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_query_cache_limit

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_query_cache_min_res_unit

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_query_cache_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_query_cache_strip_comments

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_query_cache_type

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_query_cache_wlock_invalidate

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_query_prealloc_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_range_alloc_block_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_read_binlog_speed_limit

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_read_buffer_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_read_only

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_read_rnd_buffer_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_relay_log_purge

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_relay_log_recovery

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_relay_log_space_limit

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_replicate_annotate_row_events

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_report_port

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_require_secure_transport

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_rowid_merge_buff_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_rpl_semi_sync_master_enabled

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_rpl_semi_sync_master_timeout

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_rpl_semi_sync_master_trace_level

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_rpl_semi_sync_master_wait_no_slave

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_rpl_semi_sync_slave_delay_master

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_rpl_semi_sync_slave_enabled

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_rpl_semi_sync_slave_kill_conn_timeout

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_rpl_semi_sync_slave_trace_level

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_secure_auth

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_secure_timestamp

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_server_audit_file_rotate_now

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_server_audit_file_rotate_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_server_audit_file_rotations

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_server_audit_load_on_error

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_server_audit_logging

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_server_audit_mode

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_server_audit_query_log_limit

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_server_audit_reload_filters

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_server_id

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_session_track_schema

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_session_track_state_change

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_session_track_transaction_info

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_shutdown_wait_for_slaves

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_simple_password_check_digits

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_simple_password_check_letters_same_case

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_simple_password_check_minimal_length

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_simple_password_check_other_characters

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_skip_external_locking

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_skip_grant_tables

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_skip_name_resolve

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_skip_networking

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_skip_show_database

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_slave_compressed_protocol

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_slave_connections_needed_for_purge

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_slave_domain_parallel_threads

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_slave_max_allowed_packet

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_slave_max_statement_time

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_slave_net_timeout

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_slave_parallel_max_queued

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_slave_parallel_threads

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_slave_parallel_workers

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_slave_run_triggers_for_rbr

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_slave_skip_errors

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_slave_sql_verify_checksum

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_slave_transaction_retries

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_slave_transaction_retry_interval

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_slow_launch_time

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_slow_query_log

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_sort_buffer_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_sql_auto_is_null

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_sql_big_selects

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_sql_buffer_result

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_sql_if_exists

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_sql_log_bin

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_sql_log_off

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_sql_notes

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_sql_quote_show_create

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_sql_safe_updates

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_sql_select_limit

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_sql_slave_skip_counter

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_sql_warnings

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_standard_compliant_cte

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_stored_program_cache

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_strict_password_validation

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_sync_binlog

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_sync_frm

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_sync_master_info

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_sync_relay_log

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_sync_relay_log_info

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_system_versioning_insert_history

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_table_definition_cache

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_table_open_cache

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_table_open_cache_instances

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_tcp_keepalive_interval

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_tcp_keepalive_probes

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_tcp_keepalive_time

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_tcp_nodelay

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_thread_cache_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_thread_pool_dedicated_listener

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_thread_pool_exact_stats

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_thread_pool_idle_timeout

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_thread_pool_max_threads

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_thread_pool_oversubscribe

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_thread_pool_prio_kickup_timer

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_thread_pool_reshuffle_group_period

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_thread_pool_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_thread_pool_stall_limit

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_thread_stack

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_tmp_disk_table_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_tmp_memory_table_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_tmp_table_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_transaction_alloc_block_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_transaction_prealloc_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_transaction_read_only

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_tx_read_only

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_unique_checks

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_updatable_views_with_limit

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_userstat

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wait_timeout

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_auto_increment_control

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_black_box_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_certificate_expiration_hours_warning

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_certify_nonpk

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_convert_lock_to_trx

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_desync

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_dirty_reads

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_drupal_282555_workaround

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_gtid_domain_id

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_gtid_mode

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_ignore_apply_errors

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_load_data_splitting

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_log_conflicts

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_max_ws_rows

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_max_ws_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_mysql_replication_bundle

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_on

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_base_port

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_cert_log_conflicts

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_cert_optimistic_pa

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_debug

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_evs_auto_evict

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_evs_causal_keepalive_period

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_evs_delay_margin

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_evs_delayed_keep_period

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_evs_inactive_check_period

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_evs_inactive_timeout

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_evs_info_log_mask

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_evs_install_timeout

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_evs_join_retrans_period

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_evs_keepalive_period

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_evs_max_install_timeouts

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_evs_send_window

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_evs_stats_report_period

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_evs_suspect_timeout

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_evs_use_aggregate

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_evs_user_send_window

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_evs_version

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_evs_view_forget_timeout

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_gcache_keep_pages_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_gcache_keep_plaintext_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_gcache_mem_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_gcache_page_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_gcache_recover

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_gcache_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_gcs_fc_debug

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_gcs_fc_factor

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_gcs_fc_limit

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_gcs_fc_master_slave

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_gcs_fc_single_primary

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_gcs_max_packet_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_gcs_max_throttle

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_gcs_recv_q_hard_limit

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_gcs_recv_q_soft_limit

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_gcs_sync_donor

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_gcs_vote_policy

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_gmcast_mcast_ttl

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_gmcast_peer_timeout

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_gmcast_segment

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_gmcast_time_wait

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_gmcast_version

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_pc_announce_timeout

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_pc_bootstrap

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_pc_checksum

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_pc_ignore_quorum

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_pc_ignore_sb

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_pc_linger

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_pc_npvo

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_pc_recovery

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_pc_version

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_pc_wait_prim

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_pc_wait_prim_timeout

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_pc_weight

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_protonet_version

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_repl_causal_read_timeout

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_repl_commit_order

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_repl_max_ws_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_repl_proto_max

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_socket_checksum

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_socket_dynamic

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_socket_ssl

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_socket_ssl_cipher

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_socket_ssl_compression

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_provider_socket_ssl_reload

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_recover

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_restart_slave

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_retry_autocommit

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_slave_fk_checks

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_slave_threads

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_slave_uk_checks

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_sst_donor_rejects_queries

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_sync_wait

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_global_variables_wsrep_trx_fragment_size

    Generic gauge metric from SHOW GLOBAL VARIABLES.

    GAUGE

    mysql_info_schema_innodb_cmp_compress_ops_ok_total

    Number of times a B-tree page of the size PAGE_SIZE has been successfully compressed.

    COUNTER

    mysql_info_schema_innodb_cmp_compress_ops_total

    Number of times a B-tree page of the size PAGE_SIZE has been compressed.

    COUNTER

    mysql_info_schema_innodb_cmp_compress_time_seconds_total

    Total time in seconds spent in attempts to compress B-tree pages.

    COUNTER

    mysql_info_schema_innodb_cmp_uncompress_ops_total

    Number of times a B-tree page of the size PAGE_SIZE has been uncompressed.

    COUNTER

    mysql_info_schema_innodb_cmp_uncompress_time_seconds_total

    Total time in seconds spent in uncompressing B-tree pages.

    COUNTER

    mysql_info_schema_innodb_cmpmem_pages_free_total

    Number of blocks of the size PAGE_SIZE that are currently available for allocation.

    COUNTER

    mysql_info_schema_innodb_cmpmem_pages_used_total

    Number of blocks of the size PAGE_SIZE that are currently in use.

    COUNTER

    mysql_info_schema_innodb_cmpmem_relocation_ops_total

    Number of times a block of the size PAGE_SIZE has been relocated.

    COUNTER

    mysql_info_schema_innodb_cmpmem_relocation_time_seconds_total

    Total time in seconds spent in relocating blocks.

    COUNTER

    mysql_transaction_isolation

    MySQL transaction isolation.

    GAUGE

    mysql_up

    Whether the MySQL server is up.

    GAUGE

    mysql_version_info

    MySQL version and distribution.

    GAUGE

    maxscale_logging_level

    The current logging levels active.

    GAUGE

    maxscale_logging_maxlog

    Whether maxlog is active.

    GAUGE

    maxscale_logging_syslog

    Whether syslog is active.

    GAUGE

    maxscale_logging_throttling_count

    The number of logging throttling.

    GAUGE

    maxscale_logging_throttling_suppress_milliseconds

    The value of throttling suppress_ms.

    GAUGE

    maxscale_logging_throttling_suppress_window_milliseconds

    The value of throttling window_ms.

    GAUGE

    maxscale_modules

    Maxscale modules currently enabled.

    GAUGE

    maxscale_monitor

    Maxscale Monitor.

    GAUGE

    maxscale_server_active_operations

    The number of active operations.

    GAUGE

    maxscale_server_adaptive_avg_select_time

    The adaptive average select time. This is always zero.

    GAUGE

    maxscale_server_connection_pool_empty

    The current connection pool empty

    GAUGE

    maxscale_server_connections

    The current number of connections to the server.

    GAUGE

    maxscale_server_max_connections

    The max number of connections.

    GAUGE

    maxscale_server_max_pool_size

    The current max pool size,

    GAUGE

    maxscale_server_persistent_connections

    The number of persistent connections to the server.

    GAUGE

    maxscale_server_reused_connections

    The number of Re-used Connections by the server.

    GAUGE

    maxscale_server_routed_packets

    The number of routed packets to the server,

    GAUGE

    maxscale_server_state

    The current state of the server.

    GAUGE

    maxscale_server_total_connections

    The total number of connections to the server.

    COUNTER

    maxscale_service_active_connections

    The total number of active operations to the service.

    GAUGE

    maxscale_service_connections

    The current number of connections to the server.

    GAUGE

    maxscale_service_state

    The current state of each service.

    GAUGE

    maxscale_service_statistics_connections

    The total number of connections to the service.

    GAUGE

    maxscale_service_statistics_failed_auths

    The total number of failed authentications to the service.

    COUNTER

    maxscale_service_statistics_max_connections

    The max number of connections to the service.

    GAUGE

    maxscale_service_statistics_routed_packets

    The total number of routed packets to the service.

    GAUGE

    maxscale_service_statistics_total_connections

    The total number of connections to the service.

    COUNTER

    maxscale_service_total_connections

    The total number of connections to the server.

    COUNTER

    maxscale_threads_accepts

    The number of accept events.

    COUNTER

    maxscale_threads_blocking_polls

    The number of non-blocking poll cycles that will be done before a blocking poll takes place.

    GAUGE

    maxscale_threads_count

    The number of threads

    GAUGE

    maxscale_threads_current_descriptors

    The current number of descriptors handled by each thread.

    GAUGE

    maxscale_threads_errors

    The number of error events.

    COUNTER

    maxscale_threads_event_queue_length

    The amount of I/O events returned by one call to epoll_wait().

    GAUGE

    maxscale_threads_hangups

    The number of hangup events.

    COUNTER

    maxscale_threads_load_last_hour

    The load during the last 60m.

    GAUGE

    maxscale_threads_load_last_minute

    The load during the last 60s.

    GAUGE

    maxscale_threads_load_last_second

    The load during the last second.

    GAUGE

    maxscale_threads_max_event_queue_length

    The maximum amount of I/O events returned by one call to epoll_wait().

    GAUGE

    maxscale_threads_max_exec_time

    The maximum time it took to process an I/O event.

    GAUGE

    maxscale_threads_max_queue_time

    The maximum time it took before an I/O event became ready for processing (ms).

    GAUGE

    maxscale_threads_reads

    The number of read events.

    COUNTER

    maxscale_threads_stack_size

    The stack size of each worker.

    GAUGE

    maxscale_threads_total_descriptors

    The total number of descriptors handled by each thread since MaxScale startup.

    GAUGE

    maxscale_threads_writes

    The number of write events.

    COUNTER

    maxscale_up

    Whether the Maxscale server is up.

    GAUGE

    maxscale_uptime_seconds

    Maxscale uptime in seconds

    GAUGE

    maxscale_version

    Maxscale Version

    GAUGE

    Metric Name

    Description

    Type

    mysql_exporter_collector_duration_seconds

    Collector time duration.

    GAUGE

    mysql_exporter_collector_success

    mysqld_exporter: Whether a collector succeeded.

    GAUGE

    mysql_galera_evs_repl_latency_avg_seconds

    PXC/Galera group communication latency. Avg value.

    GAUGE

    maxscale_exporter_collector_duration_seconds

    Collector time duration.

    GAUGE

    maxscale_exporter_last_scrape_error

    Whether the last scrape of metrics from MariaDB resulted in an error (1 for error, 0 for success).

    GAUGE

    maxscale_exporter_scrapes_total

    Total number of times MariaDB was scraped for metrics.

    COUNTER

    maxscale_logging_high_precision

    Whether high precision logging is active.

    GAUGE

    ServiceMonitor
    Prometheus operator
    API reference
    grafana.com
    MariaDB metrics
    MySQL Overview
    MySQL Exporter Quickstart and Dashboard
    MySQL Replication
    Galera/MariaDB - Overview
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb
    spec:
    ...
      metrics:
        enabled: true
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale
    spec:
    ...
      metrics:
        enabled: true
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MariaDB
    metadata:
      name: mariadb
    spec:
    ...
      metrics:
        enabled: true
        exporter:
          image: mariadb/mariadb-prometheus-exporter-ubi:v0.0.2
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 300m
              memory: 512Mi
          port: 9104
        serviceMonitor:
          prometheusRelease: kube-prometheus-stack
          jobLabel: mariadb-monitoring
          interval: 10s
          scrapeTimeout: 10s
        username: monitoring
        passwordSecretKeyRef:
          name: mariadb
          key: password
    apiVersion: enterprise.mariadb.com/v1alpha1
    kind: MaxScale
    metadata:
      name: maxscale
    spec:
    ...
      auth:
        metricsUsername: metrics
        metricsPasswordSecretKeyRef:
          key: password
          name: maxscale-galera-metrics
      metrics:
        enabled: true
        exporter:
          image: mariadb/maxscale-prometheus-exporter-ubi:v0.0.2
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 300m
              memory: 512Mi
          port: 9105
        serviceMonitor:
          prometheusRelease: kube-prometheus-stack
          jobLabel: mariadb-monitoring
          interval: 10s
          scrapeTimeout: 10s

    API Reference

    • enterprise.mariadb.com/v1alpha1

    enterprise.mariadb.com/v1alpha1

    Package v1alpha1 contains API Schema definitions for the v1alpha1 API group

    Resource Types

    Affinity

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#affinity-v1-core.

    Appears in:

    Field
    Description
    Default
    Validation

    AffinityConfig

    AffinityConfig defines policies to schedule Pods in Nodes.

    Appears in:

    Field
    Description
    Default
    Validation

    Agent

    Agent is a sidecar agent that co-operates with mariadb-enterprise-operator.

    Appears in:

    Field
    Description
    Default
    Validation

    Backup

    Backup is the Schema for the backups API. It is used to define backup jobs and its storage.

    Field
    Description
    Default
    Validation

    BackupContentType

    Underlying type: string

    BackupContentType defines the backup content type.

    Appears in:

    Field
    Description

    BackupSpec

    BackupSpec defines the desired state of Backup

    Appears in:

    Field
    Description
    Default
    Validation

    BackupStagingStorage

    BackupStagingStorage defines the temporary storage used to keep external backups (i.e. S3) while they are being processed.

    Appears in:

    Field
    Description
    Default
    Validation

    BackupStorage

    BackupStorage defines the final storage for backups.

    Appears in:

    Field
    Description
    Default
    Validation

    BasicAuth

    BasicAuth refers to the basic authentication mechanism utilized for establishing a connection from the operator to the agent.

    Appears in:

    Field
    Description
    Default
    Validation

    BootstrapFrom

    BootstrapFrom defines a source to bootstrap MariaDB from.

    Appears in:

    Field
    Description
    Default
    Validation

    CSIVolumeSource

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#csivolumesource-v1-core.

    Appears in:

    Field
    Description
    Default
    Validation

    CleanupPolicy

    Underlying type: string

    CleanupPolicy defines the behavior for cleaning up a resource.

    Appears in:

    Field
    Description

    CompressAlgorithm

    Underlying type: string

    CompressAlgorithm defines the compression algorithm for a Backup resource.

    Appears in:

    Field
    Description

    ConfigMapKeySelector

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#configmapkeyselector-v1-core.

    Appears in:

    Field
    Description
    Default
    Validation

    ConfigMapVolumeSource

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#configmapvolumesource-v1-core.

    Appears in:

    Field
    Description
    Default
    Validation

    Connection

    Connection is the Schema for the connections API. It is used to configure connection strings for the applications connecting to MariaDB.

    Field
    Description
    Default
    Validation

    ConnectionSpec

    ConnectionSpec defines the desired state of Connection

    Appears in:

    Field
    Description
    Default
    Validation

    ConnectionTemplate

    ConnectionTemplate defines a template to customize Connection objects.

    Appears in:

    Field
    Description
    Default
    Validation

    Container

    Container object definition.

    Appears in:

    Field
    Description
    Default
    Validation

    ContainerTemplate

    ContainerTemplate defines a template to configure Container objects.

    Appears in:

    Field
    Description
    Default
    Validation

    CooperativeMonitoring

    Underlying type: string

    CooperativeMonitoring enables coordination between multiple MaxScale instances running monitors. See: https://mariadb.com/docs/server/architecture/components/maxscale/monitors/mariadbmon/use-cooperative-locking-ha-maxscale-mariadb-monitor/

    Appears in:

    Field
    Description

    CronJobTemplate

    CronJobTemplate defines parameters for configuring CronJob objects.

    Appears in:

    Field
    Description
    Default
    Validation

    Database

    Database is the Schema for the databases API. It is used to define a logical database as if you were running a 'CREATE DATABASE' statement.

    Field
    Description
    Default
    Validation

    DatabaseSpec

    DatabaseSpec defines the desired state of Database

    Appears in:

    Field
    Description
    Default
    Validation

    EmptyDirVolumeSource

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#emptydirvolumesource-v1-core.

    Appears in:

    Field
    Description
    Default
    Validation

    EnvFromSource

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#envfromsource-v1-core.

    Appears in:

    Field
    Description
    Default
    Validation

    EnvVar

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#envvarsource-v1-core.

    Appears in:

    Field
    Description
    Default
    Validation

    EnvVarSource

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#envvarsource-v1-core.

    Appears in:

    Field
    Description
    Default
    Validation

    ExecAction

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#execaction-v1-core.

    Appears in:

    Field
    Description
    Default
    Validation

    Exporter

    Exporter defines a metrics exporter container.

    Appears in:

    Field
    Description
    Default
    Validation

    ExternalMariaDB

    ExternalMariaDB is the Schema for the external MariaDBs API. It is used to define external MariaDB server.

    Field
    Description
    Default
    Validation

    ExternalMariaDBSpec

    ExternalMariaDBSpec defines the desired state of an External MariaDB

    Appears in:

    Field
    Description
    Default
    Validation

    Galera

    Galera allows you to enable multi-master HA via Galera in your MariaDB cluster.

    Appears in:

    Field
    Description
    Default
    Validation

    GaleraConfig

    GaleraConfig defines storage options for the Galera configuration files.

    Appears in:

    Field
    Description
    Default
    Validation

    GaleraInitJob

    GaleraInitJob defines a Job used to be used to initialize the Galera cluster.

    Appears in:

    Field
    Description
    Default
    Validation

    GaleraRecovery

    GaleraRecovery is the recovery process performed by the operator whenever the Galera cluster is not healthy. More info: https://galeracluster.com/library/documentation/crash-recovery.html.

    Appears in:

    Field
    Description
    Default
    Validation

    GaleraRecoveryJob

    GaleraRecoveryJob defines a Job used to be used to recover the Galera cluster.

    Appears in:

    Field
    Description
    Default
    Validation

    GaleraSpec

    GaleraSpec is the Galera desired state specification.

    Appears in:

    Field
    Description
    Default
    Validation

    GeneratedSecretKeyRef

    GeneratedSecretKeyRef defines a reference to a Secret that can be automatically generated by mariadb-enterprise-operator if needed.

    Appears in:

    Field
    Description
    Default
    Validation

    Grant

    Grant is the Schema for the grants API. It is used to define grants as if you were running a 'GRANT' statement.

    Field
    Description
    Default
    Validation

    GrantSpec

    GrantSpec defines the desired state of Grant

    Appears in:

    Field
    Description
    Default
    Validation

    Gtid

    Underlying type: string

    Gtid indicates which Global Transaction ID (GTID) position mode should be used when connecting a replica to the master. See: https://mariadb.com/kb/en/gtid/#using-current_pos-vs-slave_pos.

    Appears in:

    Field
    Description

    HTTPGetAction

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#httpgetaction-v1-core.

    Appears in:

    Field
    Description
    Default
    Validation

    HealthCheck

    HealthCheck defines intervals for performing health checks.

    Appears in:

    Field
    Description
    Default
    Validation

    HostPathVolumeSource

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#hostpathvolumesource-v1-core

    Appears in:

    Field
    Description
    Default
    Validation

    InitContainer

    InitContainer is an init container that runs in the MariaDB Pod and co-operates with mariadb-enterprise-operator.

    Appears in:

    Field
    Description
    Default
    Validation

    Job

    Job defines a Job used to be used with MariaDB.

    Appears in:

    Field
    Description
    Default
    Validation

    JobContainerTemplate

    JobContainerTemplate defines a template to configure Container objects that run in a Job.

    Appears in:

    Field
    Description
    Default
    Validation

    JobPodTemplate

    JobPodTemplate defines a template to configure Container objects that run in a Job.

    Appears in:

    Field
    Description
    Default
    Validation

    KubernetesAuth

    KubernetesAuth refers to the Kubernetes authentication mechanism utilized for establishing a connection from the operator to the agent. The agent validates the legitimacy of the service account token provided as an Authorization header by creating a TokenReview resource.

    Appears in:

    Field
    Description
    Default
    Validation

    LabelSelector

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#labelselector-v1-meta

    Appears in:

    Field
    Description
    Default
    Validation

    LabelSelectorRequirement

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#labelselectorrequirement-v1-meta

    Appears in:

    Field
    Description
    Default
    Validation

    LocalObjectReference

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#localobjectreference-v1-core.

    Appears in:

    Field
    Description
    Default
    Validation

    MariaDB

    MariaDB is the Schema for the mariadbs API. It is used to define MariaDB clusters.

    Field
    Description
    Default
    Validation

    MariaDBMaxScaleSpec

    MariaDBMaxScaleSpec defines a reduced version of MaxScale to be used with the current MariaDB.

    Appears in:

    Field
    Description
    Default
    Validation

    MariaDBRef

    MariaDBRef is a reference to a MariaDB object.

    Appears in:

    Field
    Description
    Default
    Validation

    MariaDBSpec

    MariaDBSpec defines the desired state of MariaDB

    Appears in:

    Field
    Description
    Default
    Validation

    MariadbMetrics

    MariadbMetrics defines the metrics for a MariaDB.

    Appears in:

    Field
    Description
    Default
    Validation

    MaxScale

    MaxScale is the Schema for the maxscales API. It is used to define MaxScale clusters.

    Field
    Description
    Default
    Validation

    MaxScaleAdmin

    MaxScaleAdmin configures the admin REST API and GUI.

    Appears in:

    Field
    Description
    Default
    Validation

    MaxScaleAuth

    MaxScaleAuth defines the credentials required for MaxScale to connect to MariaDB.

    Appears in:

    Field
    Description
    Default
    Validation

    MaxScaleConfig

    MaxScaleConfig defines the MaxScale configuration.

    Appears in:

    Field
    Description
    Default
    Validation

    MaxScaleConfigSync

    MaxScaleConfigSync defines how the config changes are replicated across replicas.

    Appears in:

    Field
    Description
    Default
    Validation

    MaxScaleListener

    MaxScaleListener defines how the MaxScale server will listen for connections.

    Appears in:

    Field
    Description
    Default
    Validation

    MaxScaleMetrics

    MaxScaleMetrics defines the metrics for a Maxscale.

    Appears in:

    Field
    Description
    Default
    Validation

    MaxScaleMonitor

    MaxScaleMonitor monitors MariaDB server instances

    Appears in:

    Field
    Description
    Default
    Validation

    MaxScalePodTemplate

    MaxScalePodTemplate defines a template for MaxScale Pods.

    Appears in:

    Field
    Description
    Default
    Validation

    MaxScaleServer

    MaxScaleServer defines a MariaDB server to forward traffic to.

    Appears in:

    Field
    Description
    Default
    Validation

    MaxScaleService

    Services define how the traffic is forwarded to the MariaDB servers.

    Appears in:

    Field
    Description
    Default
    Validation

    MaxScaleSpec

    MaxScaleSpec defines the desired state of MaxScale.

    Appears in:

    Field
    Description
    Default
    Validation

    MaxScaleTLS

    TLS defines the PKI to be used with MaxScale.

    Appears in:

    Field
    Description
    Default
    Validation

    Metadata

    Metadata defines the metadata to added to resources.

    Appears in:

    Field
    Description
    Default
    Validation

    MonitorModule

    Underlying type: string

    MonitorModule defines the type of monitor module

    Appears in:

    Field
    Description

    NFSVolumeSource

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#nfsvolumesource-v1-core.

    Appears in:

    Field
    Description
    Default
    Validation

    NodeAffinity

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#nodeaffinity-v1-core

    Appears in:

    Field
    Description
    Default
    Validation

    NodeSelector

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#nodeselector-v1-core

    Appears in:

    Field
    Description
    Default
    Validation

    NodeSelectorRequirement

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#nodeselectorrequirement-v1-core

    Appears in:

    Field
    Description
    Default
    Validation

    NodeSelectorTerm

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#nodeselectorterm-v1-core

    Appears in:

    Field
    Description
    Default
    Validation

    ObjectFieldSelector

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#objectfieldselector-v1-core.

    Appears in:

    Field
    Description
    Default
    Validation

    ObjectReference

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#objectreference-v1-core.

    Appears in:

    Field
    Description
    Default
    Validation

    PasswordPlugin

    PasswordPlugin defines the password plugin and its arguments.

    Appears in:

    Field
    Description
    Default
    Validation

    PersistentVolumeClaimSpec

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#persistentvolumeclaimspec-v1-core.

    Appears in:

    Field
    Description
    Default
    Validation

    PersistentVolumeClaimVolumeSource

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#persistentvolumeclaimvolumesource-v1-core.

    Appears in:

    Field
    Description
    Default
    Validation

    PhysicalBackup

    PhysicalBackup is the Schema for the physicalbackups API. It is used to define physical backup jobs and its storage.

    Field
    Description
    Default
    Validation

    PhysicalBackupPodTemplate

    PhysicalBackupPodTemplate defines a template to configure Container objects that run in a PhysicalBackup.

    Appears in:

    Field
    Description
    Default
    Validation

    PhysicalBackupSchedule

    PhysicalBackupSchedule defines when the PhysicalBackup will be taken.

    Appears in:

    Field
    Description
    Default
    Validation

    PhysicalBackupSpec

    PhysicalBackupSpec defines the desired state of PhysicalBackup.

    Appears in:

    Field
    Description
    Default
    Validation

    PhysicalBackupStorage

    PhysicalBackupStorage defines the storage for physical backups.

    Appears in:

    Field
    Description
    Default
    Validation

    PhysicalBackupVolumeSnapshot

    PhysicalBackupVolumeSnapshot defines parameters for the VolumeSnapshots used as physical backups.

    Appears in:

    Field
    Description
    Default
    Validation

    PodAffinityTerm

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#podaffinityterm-v1-core.

    Appears in:

    Field
    Description
    Default
    Validation

    PodAntiAffinity

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#podantiaffinity-v1-core.

    Appears in:

    Field
    Description
    Default
    Validation

    PodDisruptionBudget

    PodDisruptionBudget is the Pod availability bundget for a MariaDB

    Appears in:

    Field
    Description
    Default
    Validation

    PodSecurityContext

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#podsecuritycontext-v1-core

    Appears in:

    Field
    Description
    Default
    Validation

    PodTemplate

    PodTemplate defines a template to configure Container objects.

    Appears in:

    Field
    Description
    Default
    Validation

    PreferredSchedulingTerm

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#preferredschedulingterm-v1-core

    Appears in:

    Field
    Description
    Default
    Validation

    PrimaryGalera

    PrimaryGalera is the Galera configuration for the primary node.

    Appears in:

    Field
    Description
    Default
    Validation

    PrimaryReplication

    PrimaryReplication is the replication configuration and operation parameters for the primary.

    Appears in:

    Field
    Description
    Default
    Validation

    Probe

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#probe-v1-core.

    Appears in:

    Field
    Description
    Default
    Validation

    ProbeHandler

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#probe-v1-core.

    Appears in:

    Field
    Description
    Default
    Validation

    ReplicaBootstrapFrom

    ReplicaBootstrapFrom defines the sources for bootstrapping new relicas.

    Appears in:

    Field
    Description
    Default
    Validation

    ReplicaRecovery

    ReplicaRecovery defines how the replicas should be recovered after they enter an error state.

    Appears in:

    Field
    Description
    Default
    Validation

    ReplicaReplication

    ReplicaReplication is the replication configuration and operation parameters for the replicas.

    Appears in:

    Field
    Description
    Default
    Validation

    Replication

    Replication defines replication configuration for a MariaDB cluster.

    Appears in:

    Field
    Description
    Default
    Validation

    ReplicationSpec

    ReplicationSpec is the replication desired state.

    Appears in:

    Field
    Description
    Default
    Validation

    ResourceRequirements

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#resourcerequirements-v1-core.

    Appears in:

    Restore

    Restore is the Schema for the restores API. It is used to define restore jobs and its restoration source.

    Field
    Description
    Default
    Validation

    RestoreSource

    RestoreSource defines a source for restoring a logical backup.

    Appears in:

    Field
    Description
    Default
    Validation

    RestoreSpec

    RestoreSpec defines the desired state of restore

    Appears in:

    Field
    Description
    Default
    Validation

    S3

    Appears in:

    Field
    Description
    Default
    Validation

    SQLTemplate

    SQLTemplate defines a template to customize SQL objects.

    Appears in:

    Field
    Description
    Default
    Validation

    SST

    Underlying type: string

    SST is the Snapshot State Transfer used when new Pods join the cluster. More info: https://galeracluster.com/library/documentation/sst.html.

    Appears in:

    Field
    Description

    Schedule

    Schedule contains parameters to define a schedule

    Appears in:

    Field
    Description
    Default
    Validation

    SecretKeySelector

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#secretkeyselector-v1-core.

    Appears in:

    Field
    Description
    Default
    Validation

    SecretTemplate

    SecretTemplate defines a template to customize Secret objects.

    Appears in:

    Field
    Description
    Default
    Validation

    SecretVolumeSource

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#secretvolumesource-v1-core.

    Appears in:

    Field
    Description
    Default
    Validation

    SecurityContext

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#securitycontext-v1-core.

    Appears in:

    Field
    Description
    Default
    Validation

    ServiceMonitor

    ServiceMonitor defines a prometheus ServiceMonitor object.

    Appears in:

    Field
    Description
    Default
    Validation

    ServicePort

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#serviceport-v1-core

    Appears in:

    Field
    Description
    Default
    Validation

    ServiceRouter

    Underlying type: string

    ServiceRouter defines the type of service router.

    Appears in:

    Field
    Description

    ServiceTemplate

    ServiceTemplate defines a template to customize Service objects.

    Appears in:

    Field
    Description
    Default
    Validation

    SqlJob

    SqlJob is the Schema for the sqljobs API. It is used to run sql scripts as jobs.

    Field
    Description
    Default
    Validation

    SqlJobSpec

    SqlJobSpec defines the desired state of SqlJob

    Appears in:

    Field
    Description
    Default
    Validation

    Storage

    Storage defines the storage options to be used for provisioning the PVCs mounted by MariaDB.

    Appears in:

    Field
    Description
    Default
    Validation

    StorageVolumeSource

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#volume-v1-core.

    Appears in:

    Field
    Description
    Default
    Validation

    SuspendTemplate

    SuspendTemplate indicates whether the current resource should be suspended or not.

    Appears in:

    Field
    Description
    Default
    Validation

    TCPSocketAction

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#tcpsocketaction-v1-core.

    Appears in:

    Field
    Description
    Default
    Validation

    TLS

    TLS defines the PKI to be used with MariaDB.

    Appears in:

    Field
    Description
    Default
    Validation

    TLSConfig

    TLSConfig defines parameters to configure a certificate.

    Appears in:

    Field
    Description
    Default
    Validation

    TLSRequirements

    TLSRequirements specifies TLS requirements for the user to connect. See: https://mariadb.com/kb/en/securing-connections-for-client-and-server/#requiring-tls.

    Appears in:

    Field
    Description
    Default
    Validation

    TLSS3

    Appears in:

    Field
    Description
    Default
    Validation

    TopologySpreadConstraint

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#topologyspreadconstraint-v1-core.

    Appears in:

    Field
    Description
    Default
    Validation

    TypedLocalObjectReference

    TypedLocalObjectReference is a reference to a specific object type.

    Appears in:

    Field
    Description
    Default
    Validation

    UpdateStrategy

    UpdateStrategy defines how a MariaDB resource is updated.

    Appears in:

    Field
    Description
    Default
    Validation

    UpdateType

    Underlying type: string

    UpdateType defines the type of update for a MariaDB resource.

    Appears in:

    Field
    Description

    User

    User is the Schema for the users API. It is used to define grants as if you were running a 'CREATE USER' statement.

    Field
    Description
    Default
    Validation

    UserSpec

    UserSpec defines the desired state of User

    Appears in:

    Field
    Description
    Default
    Validation

    Volume

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#volume-v1-core.

    Appears in:

    Field
    Description
    Default
    Validation

    VolumeClaimTemplate

    VolumeClaimTemplate defines a template to customize PVC objects.

    Appears in:

    Field
    Description
    Default
    Validation

    VolumeMount

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#volumemount-v1-core.

    Appears in:

    Field
    Description
    Default
    Validation

    VolumeSource

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#volume-v1-core.

    Appears in:

    Field
    Description
    Default
    Validation

    WaitPoint

    Underlying type: string

    WaitPoint defines whether the transaction should wait for ACK before committing to the storage engine. More info: https://mariadb.com/kb/en/semisynchronous-replication/#rpl_semi_sync_master_wait_point.

    Appears in:

    Field
    Description

    WeightedPodAffinityTerm

    Refer to the Kubernetes docs: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#weightedpodaffinityterm-v1-core.

    Appears in:

    Field
    Description
    Default
    Validation
    Grant
  • MariaDB

  • MaxScale

  • PhysicalBackup

  • Restore

  • SqlJob

  • User

  • MariaDBSpec
  • MaxScalePodTemplate

  • MaxScaleSpec

  • PodTemplate

  • RestoreSpec

  • SqlJobSpec

  • envFrom array

    EnvFrom represents the references (via ConfigMap and Secrets) to environment variables to be injected in the container.

    volumeMounts array

    VolumeMounts to be used in the Container.

    livenessProbe

    LivenessProbe to be used in the Container.

    readinessProbe

    ReadinessProbe to be used in the Container.

    startupProbe

    StartupProbe to be used in the Container.

    resources

    Resources describes the compute resource requirements.

    securityContext

    SecurityContext holds security configuration that will be applied to a container.

    image string

    Image name to be used by the MariaDB instances. The supported format is <image>:<tag>.

    imagePullPolicy

    ImagePullPolicy is the image pull policy. One of Always, Never or IfNotPresent. If not defined, it defaults to IfNotPresent.

    Enum: [Always Never IfNotPresent]

    port integer

    Port where the agent will be listening for API connections.

    probePort integer

    Port where the agent will be listening for probe connections.

    kubernetesAuth

    KubernetesAuth to be used by the agent container

    basicAuth

    BasicAuth to be used by the agent container

    gracefulShutdownTimeout

    GracefulShutdownTimeout is the time we give to the agent container in order to gracefully terminate in-flight requests.

    spec

    podMetadata

    PodMetadata defines extra metadata for the Pod.

    imagePullSecrets array

    ImagePullSecrets is the list of pull Secrets to be used to pull the image.

    podSecurityContext

    SecurityContext holds pod-level security attributes and common container settings.

    serviceAccountName string

    ServiceAccountName is the name of the ServiceAccount to be used by the Pods.

    affinity

    Affinity to be used in the Pod.

    nodeSelector object (keys:string, values:string)

    NodeSelector to be used in the Pod.

    tolerations array

    Tolerations to be used in the Pod.

    priorityClassName string

    PriorityClassName to be used in the Pod.

    successfulJobsHistoryLimit integer

    SuccessfulJobsHistoryLimit defines the maximum number of successful Jobs to be displayed.

    Minimum: 0

    failedJobsHistoryLimit integer

    FailedJobsHistoryLimit defines the maximum number of failed Jobs to be displayed.

    Minimum: 0

    timeZone string

    TimeZone defines the timezone associated with the cron expression.

    mariaDbRef

    MariaDBRef is a reference to a MariaDB object.

    Required: {}

    compression

    Compression algorithm to be used in the Backup.

    Enum: [none bzip2 gzip]

    stagingStorage

    StagingStorage defines the temporary storage used to keep external backups (i.e. S3) while they are being processed. It defaults to an emptyDir volume, meaning that the backups will be temporarily stored in the node where the Backup Job is scheduled. The staging area gets cleaned up after each backup is completed, consider this for sizing it appropriately.

    storage

    Storage defines the final storage for backups.

    Required: {}

    schedule

    Schedule defines when the Backup will be taken.

    maxRetention

    MaxRetention defines the retention policy for backups. Old backups will be cleaned up by the Backup Job. It defaults to 30 days.

    databases string array

    Databases defines the logical databases to be backed up. If not provided, all databases are backed up.

    ignoreGlobalPriv boolean

    IgnoreGlobalPriv indicates to ignore the mysql.global_priv in backups. If not provided, it will default to true when the referred MariaDB instance has Galera enabled and otherwise to false.

    logLevel string

    LogLevel to be used n the Backup Job. It defaults to 'info'.

    info

    backoffLimit integer

    BackoffLimit defines the maximum number of attempts to successfully take a Backup.

    restartPolicy

    RestartPolicy to be added to the Backup Pod.

    OnFailure

    Enum: [Always OnFailure Never]

    inheritMetadata

    InheritMetadata defines the metadata to be inherited by children resources.

    RestoreSpec

    s3

    S3 defines the configuration to restore backups from a S3 compatible storage. This field takes precedence over the Volume source.

    volume

    Volume is a Kubernetes Volume object that contains a backup.

    targetRecoveryTime

    TargetRecoveryTime is a RFC3339 (1970-01-01T00:00:00Z) date and time that defines the point in time recovery objective. It is used to determine the closest restoration source in time.

    stagingStorage

    StagingStorage defines the temporary storage used to keep external backups (i.e. S3) while they are being processed. It defaults to an emptyDir volume, meaning that the backups will be temporarily stored in the node where the Job is scheduled.

    restoreJob

    RestoreJob defines additional properties for the Job used to perform the restoration.

    volumeAttributes object (keys:string, values:string)

    nodePublishSecretRef

    spec

    params object (keys:string, values:string)

    Params to be used in the Connection.

    serviceName string

    ServiceName to be used in the Connection.

    port integer

    Port to connect to. If not provided, it defaults to the MariaDB port or to the first MaxScale listener.

    mariaDbRef

    MariaDBRef is a reference to the MariaDB to connect to. Either MariaDBRef or MaxScaleRef must be provided.

    maxScaleRef

    MaxScaleRef is a reference to the MaxScale to connect to. Either MariaDBRef or MaxScaleRef must be provided.

    username string

    Username to use for configuring the Connection.

    Required: {}

    passwordSecretKeyRef

    PasswordSecretKeyRef is a reference to the password to use for configuring the Connection. Either passwordSecretKeyRef or tlsClientCertSecretRef must be provided as client credentials. If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the password.

    tlsClientCertSecretRef

    TLSClientCertSecretRef is a reference to a Kubernetes TLS Secret used as authentication when checking the connection health. Either passwordSecretKeyRef or tlsClientCertSecretRef must be provided as client credentials. If not provided, the client certificate provided by the referred MariaDB is used if TLS is enabled. If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the client certificate.

    host string

    Host to connect to. If not provided, it defaults to the MariaDB host or to the MaxScale host.

    database string

    Database to use when configuring the Connection.

    MaxScaleSpec

    params object (keys:string, values:string)

    Params to be used in the Connection.

    serviceName string

    ServiceName to be used in the Connection.

    port integer

    Port to connect to. If not provided, it defaults to the MariaDB port or to the first MaxScale listener.

    command string array

    Command to be used in the Container.

    args string array

    Args to be used in the Container.

    env array

    Env represents the environment variables to be injected in a container.

    volumeMounts array

    VolumeMounts to be used in the Container.

    resources

    Resources describes the compute resource requirements.

    envFrom array

    EnvFrom represents the references (via ConfigMap and Secrets) to environment variables to be injected in the container.

    volumeMounts array

    VolumeMounts to be used in the Container.

    livenessProbe

    LivenessProbe to be used in the Container.

    readinessProbe

    ReadinessProbe to be used in the Container.

    startupProbe

    StartupProbe to be used in the Container.

    resources

    Resources describes the compute resource requirements.

    securityContext

    SecurityContext holds security configuration that will be applied to a container.

    spec

    mariaDbRef

    MariaDBRef is a reference to a MariaDB object.

    Required: {}

    characterSet string

    CharacterSet to use in the Database.

    utf8

    collate string

    Collate to use in the Database.

    utf8_general_ci

    name string

    Name overrides the default Database name provided by metadata.name.

    MaxLength: 80

    MaxScaleSpec
    MariaDBSpec
  • MaxScaleSpec

  • args string array

    Args to be used in the Container.

    port integer

    Port where the exporter will be listening for connections.

    resources

    Resources describes the compute resource requirements.

    podMetadata

    PodMetadata defines extra metadata for the Pod.

    securityContext

    SecurityContext holds container-level security attributes.

    podSecurityContext

    SecurityContext holds pod-level security attributes and common container settings.

    affinity

    Affinity to be used in the Pod.

    nodeSelector object (keys:string, values:string)

    NodeSelector to be used in the Pod.

    tolerations array

    Tolerations to be used in the Pod.

    priorityClassName string

    PriorityClassName to be used in the Pod.

    spec

    inheritMetadata

    InheritMetadata defines the metadata to be inherited by children resources.

    host string

    Hostname of the external MariaDB.

    Required: {}

    port integer

    Port of the external MariaDB.

    3306

    username string

    Username is the username to connect to the external MariaDB.

    Required: {}

    passwordSecretKeyRef

    PasswordSecretKeyRef is a reference to the password to connect to the external MariaDB.

    tls

    TLS defines the PKI to be used with the external MariaDB.

    connection

    Connection defines a template to configure a Connection for the external MariaDB.

    galeraLibPath string

    GaleraLibPath is a path inside the MariaDB image to the wsrep provider plugin. It is defaulted if not provided. More info: https://galeracluster.com/library/documentation/mysql-wsrep-options.html#wsrep-provider.

    replicaThreads integer

    ReplicaThreads is the number of replica threads used to apply Galera write sets in parallel. More info: https://mariadb.com/kb/en/galera-cluster-system-variables/#wsrep_slave_threads.

    providerOptions object (keys:string, values:string)

    ProviderOptions is map of Galera configuration parameters. More info: https://mariadb.com/kb/en/galera-cluster-system-variables/#wsrep_provider_options.

    agent

    Agent is a sidecar agent that co-operates with mariadb-enterprise-operator.

    recovery

    GaleraRecovery is the recovery process performed by the operator whenever the Galera cluster is not healthy. More info: https://galeracluster.com/library/documentation/crash-recovery.html.

    initContainer

    InitContainer is an init container that runs in the MariaDB Pod and co-operates with mariadb-enterprise-operator.

    initJob

    InitJob defines a Job that co-operates with mariadb-enterprise-operator by performing initialization tasks.

    config

    GaleraConfig defines storage options for the Galera configuration files.

    clusterName string

    ClusterName is the name of the cluster to be used in the Galera config file.

    enabled boolean

    Enabled is a flag to enable Galera.

    clusterHealthyTimeout

    ClusterHealthyTimeout represents the duration at which a Galera cluster, that consistently failed health checks, is considered unhealthy, and consequently the Galera recovery process will be initiated by the operator.

    clusterBootstrapTimeout

    ClusterBootstrapTimeout is the time limit for bootstrapping a cluster. Once this timeout is reached, the Galera recovery state is reset and a new cluster bootstrap will be attempted.

    clusterUpscaleTimeout

    ClusterUpscaleTimeout represents the maximum duration for upscaling the cluster's StatefulSet during the recovery process.

    clusterDownscaleTimeout

    ClusterDownscaleTimeout represents the maximum duration for downscaling the cluster's StatefulSet during the recovery process.

    podRecoveryTimeout

    PodRecoveryTimeout is the time limit for recevorying the sequence of a Pod during the cluster recovery.

    podSyncTimeout

    PodSyncTimeout is the time limit for a Pod to join the cluster after having performed a cluster bootstrap during the cluster recovery.

    forceClusterBootstrapInPod string

    ForceClusterBootstrapInPod allows you to manually initiate the bootstrap process in a specific Pod. IMPORTANT: Use this option only in exceptional circumstances. Not selecting the Pod with the highest sequence number may result in data loss. IMPORTANT: Ensure you unset this field after completing the bootstrap to allow the operator to choose the appropriate Pod to bootstrap from in an event of cluster recovery.

    job

    Job defines a Job that co-operates with mariadb-enterprise-operator by performing the Galera cluster recovery .

    galeraLibPath string

    GaleraLibPath is a path inside the MariaDB image to the wsrep provider plugin. It is defaulted if not provided. More info: https://galeracluster.com/library/documentation/mysql-wsrep-options.html#wsrep-provider.

    replicaThreads integer

    ReplicaThreads is the number of replica threads used to apply Galera write sets in parallel. More info: https://mariadb.com/kb/en/galera-cluster-system-variables/#wsrep_slave_threads.

    providerOptions object (keys:string, values:string)

    ProviderOptions is map of Galera configuration parameters. More info: https://mariadb.com/kb/en/galera-cluster-system-variables/#wsrep_provider_options.

    agent

    Agent is a sidecar agent that co-operates with mariadb-enterprise-operator.

    recovery

    GaleraRecovery is the recovery process performed by the operator whenever the Galera cluster is not healthy. More info: https://galeracluster.com/library/documentation/crash-recovery.html.

    initContainer

    InitContainer is an init container that runs in the MariaDB Pod and co-operates with mariadb-enterprise-operator.

    initJob

    InitJob defines a Job that co-operates with mariadb-enterprise-operator by performing initialization tasks.

    config

    GaleraConfig defines storage options for the Galera configuration files.

    clusterName string

    ClusterName is the name of the cluster to be used in the Galera config file.

    ReplicaReplication

    spec

    mariaDbRef

    MariaDBRef is a reference to a MariaDB object.

    Required: {}

    privileges string array

    Privileges to use in the Grant.

    MinItems: 1 Required: {}

    database string

    Database to use in the Grant.

    *

    table string

    Table to use in the Grant.

    *

    username string

    Username to use in the Grant.

    Required: {}

    host string

    Host to use in the Grant. It can be localhost, an IP or '%'.

    grantOption boolean

    GrantOption to use in the Grant.

    false

    scheme

    envFrom array

    EnvFrom represents the references (via ConfigMap and Secrets) to environment variables to be injected in the container.

    volumeMounts array

    VolumeMounts to be used in the Container.

    livenessProbe

    LivenessProbe to be used in the Container.

    readinessProbe

    ReadinessProbe to be used in the Container.

    startupProbe

    StartupProbe to be used in the Container.

    resources

    Resources describes the compute resource requirements.

    securityContext

    SecurityContext holds security configuration that will be applied to a container.

    image string

    Image name to be used by the MariaDB instances. The supported format is <image>:<tag>.

    Required: {}

    imagePullPolicy

    ImagePullPolicy is the image pull policy. One of Always, Never or IfNotPresent. If not defined, it defaults to IfNotPresent.

    Enum: [Always Never IfNotPresent]

    tolerations array

    Tolerations to be used in the Pod.

    resources

    Resources describes the compute resource requirements.

    args string array

    Args to be used in the Container.

    serviceAccountName string

    ServiceAccountName is the name of the ServiceAccount to be used by the Pods.

    affinity

    Affinity to be used in the Pod.

    nodeSelector object (keys:string, values:string)

    NodeSelector to be used in the Pod.

    tolerations array

    Tolerations to be used in the Pod.

    priorityClassName string

    PriorityClassName to be used in the Pod.

    ConfigMapVolumeSource
  • ConnectionSpec

  • EnvFromSource

  • Exporter

  • ExternalMariaDBSpec

  • GeneratedSecretKeyRef

  • JobPodTemplate

  • MariaDBSpec

  • MaxScalePodTemplate

  • MaxScaleSpec

  • MaxScaleTLS

  • PhysicalBackupPodTemplate

  • PhysicalBackupSpec

  • PodTemplate

  • ReplicaBootstrapFrom

  • RestoreSource

  • RestoreSpec

  • SecretKeySelector

  • SqlJobSpec

  • TLS

  • spec

    services array

    Services define how the traffic is forwarded to the MariaDB servers.

    monitor

    Monitor monitors MariaDB server instances.

    admin

    Admin configures the admin REST API and GUI.

    config

    Config defines the MaxScale configuration.

    auth

    Auth defines the credentials required for MaxScale to connect to MariaDB.

    metrics

    Metrics configures metrics and how to scrape them.

    tls

    TLS defines the PKI to be used with MaxScale.

    connection

    Connection provides a template to define the Connection for MaxScale.

    replicas integer

    Replicas indicates the number of desired instances.

    podDisruptionBudget

    PodDisruptionBudget defines the budget for replica availability.

    updateStrategy

    UpdateStrategy defines the update strategy for the StatefulSet object.

    kubernetesService

    KubernetesService defines a template for a Kubernetes Service object to connect to MaxScale.

    guiKubernetesService

    GuiKubernetesService define a template for a Kubernetes Service object to connect to MaxScale's GUI.

    requeueInterval

    RequeueInterval is used to perform requeue reconciliations.

    MaxScaleSpec
  • PhysicalBackupSpec

  • RestoreSpec

  • SqlJobSpec

  • UserSpec

  • waitForIt boolean

    WaitForIt indicates whether the controller using this reference should wait for MariaDB to be ready.

    true

    envFrom array

    EnvFrom represents the references (via ConfigMap and Secrets) to environment variables to be injected in the container.

    volumeMounts array

    VolumeMounts to be used in the Container.

    livenessProbe

    LivenessProbe to be used in the Container.

    readinessProbe

    ReadinessProbe to be used in the Container.

    startupProbe

    StartupProbe to be used in the Container.

    resources

    Resources describes the compute resource requirements.

    securityContext

    SecurityContext holds security configuration that will be applied to a container.

    podMetadata

    PodMetadata defines extra metadata for the Pod.

    imagePullSecrets array

    ImagePullSecrets is the list of pull Secrets to be used to pull the image.

    initContainers array

    InitContainers to be used in the Pod.

    sidecarContainers array

    SidecarContainers to be used in the Pod.

    podSecurityContext

    SecurityContext holds pod-level security attributes and common container settings.

    serviceAccountName string

    ServiceAccountName is the name of the ServiceAccount to be used by the Pods.

    affinity

    Affinity to be used in the Pod.

    nodeSelector object (keys:string, values:string)

    NodeSelector to be used in the Pod.

    tolerations array

    Tolerations to be used in the Pod.

    volumes array

    Volumes to be used in the Pod.

    priorityClassName string

    PriorityClassName to be used in the Pod.

    topologySpreadConstraints array

    TopologySpreadConstraints to be used in the Pod.

    suspend boolean

    Suspend indicates whether the current resource should be suspended or not. This can be useful for maintenance, as disabling the reconciliation prevents the operator from interfering with user operations during maintenance activities.

    false

    image string

    Image name to be used by the MariaDB instances. The supported format is <image>:<tag>. Only MariaDB official images are supported.

    imagePullPolicy

    ImagePullPolicy is the image pull policy. One of Always, Never or IfNotPresent. If not defined, it defaults to IfNotPresent.

    Enum: [Always Never IfNotPresent]

    inheritMetadata

    InheritMetadata defines the metadata to be inherited by children resources.

    rootPasswordSecretKeyRef

    RootPasswordSecretKeyRef is a reference to a Secret key containing the root password.

    rootEmptyPassword boolean

    RootEmptyPassword indicates if the root password should be empty. Don't use this feature in production, it is only intended for development and test environments.

    database string

    Database is the name of the initial Database.

    username string

    Username is the initial username to be created by the operator once MariaDB is ready. The initial User will have ALL PRIVILEGES in the initial Database.

    passwordSecretKeyRef

    PasswordSecretKeyRef is a reference to a Secret that contains the password to be used by the initial User. If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the password.

    passwordHashSecretKeyRef

    PasswordHashSecretKeyRef is a reference to the password hash to be used by the initial User. If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the password hash. It requires the 'skip-strict-password-validation' option to be set. See: https://mariadb.com/docs/server/ref/mdb/cli/mariadbd/strict-password-validation/.

    passwordPlugin

    PasswordPlugin is a reference to the password plugin and arguments to be used by the initial User. It requires the 'skip-strict-password-validation' option to be set. See: https://mariadb.com/docs/server/ref/mdb/cli/mariadbd/strict-password-validation/.

    myCnf string

    MyCnf allows to specify the my.cnf file mounted by Mariadb. Updating this field will trigger an update to the Mariadb resource.

    myCnfConfigMapKeyRef

    MyCnfConfigMapKeyRef is a reference to the my.cnf config file provided via a ConfigMap. If not provided, it will be defaulted with a reference to a ConfigMap containing the MyCnf field. If the referred ConfigMap is labeled with "enterprise.mariadb.com/watch", an update to the Mariadb resource will be triggered when the ConfigMap is updated.

    timeZone string

    TimeZone sets the default timezone. If not provided, it defaults to SYSTEM and the timezone data is not loaded.

    bootstrapFrom

    BootstrapFrom defines a source to bootstrap from.

    storage

    Storage defines the storage options to be used for provisioning the PVCs mounted by MariaDB.

    metrics

    Metrics configures metrics and how to scrape them.

    tls

    TLS defines the PKI to be used with MariaDB.

    replication

    Replication configures high availability via replication. This feature is still in alpha, use Galera if you are looking for a more production-ready HA.

    galera

    Galera configures high availability via Galera.

    maxScaleRef

    MaxScaleRef is a reference to a MaxScale resource to be used with the current MariaDB. Providing this field implies delegating high availability tasks such as primary failover to MaxScale.

    maxScale

    MaxScale is the MaxScale specification that defines the MaxScale resource to be used with the current MariaDB. When enabling this field, MaxScaleRef is automatically set.

    replicas integer

    Replicas indicates the number of desired instances.

    1

    replicasAllowEvenNumber boolean

    disables the validation check for an odd number of replicas.

    false

    port integer

    Port where the instances will be listening for connections.

    3306

    servicePorts array

    ServicePorts is the list of additional named ports to be added to the Services created by the operator.

    podDisruptionBudget

    PodDisruptionBudget defines the budget for replica availability.

    updateStrategy

    UpdateStrategy defines how a MariaDB resource is updated.

    service

    Service defines a template to configure the general Service object. The network traffic of this Service will be routed to all Pods.

    connection

    Connection defines a template to configure the general Connection object. This Connection provides the initial User access to the initial Database. It will make use of the Service to route network traffic to all Pods.

    primaryService

    PrimaryService defines a template to configure the primary Service object. The network traffic of this Service will be routed to the primary Pod.

    primaryConnection

    PrimaryConnection defines a template to configure the primary Connection object. This Connection provides the initial User access to the initial Database. It will make use of the PrimaryService to route network traffic to the primary Pod.

    secondaryService

    SecondaryService defines a template to configure the secondary Service object. The network traffic of this Service will be routed to the secondary Pods.

    secondaryConnection

    SecondaryConnection defines a template to configure the secondary Connection object. This Connection provides the initial User access to the initial Database. It will make use of the SecondaryService to route network traffic to the secondary Pods.

    username string

    Username is the username of the monitoring user used by the exporter.

    passwordSecretKeyRef

    PasswordSecretKeyRef is a reference to the password of the monitoring user used by the exporter. If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the password.

    spec

    deleteDefaultAdmin boolean

    DeleteDefaultAdmin determines whether the default admin user should be deleted after the initial configuration. If not provided, it defaults to true.

    metricsUsername string

    MetricsUsername is an metrics username to call the REST API. It is defaulted if metrics are enabled.

    metricsPasswordSecretKeyRef

    MetricsPasswordSecretKeyRef is Secret key reference to the metrics password to call the admib REST API. It is defaulted if metrics are enabled.

    clientUsername string

    ClientUsername is the user to connect to MaxScale. It is defaulted if not provided.

    clientPasswordSecretKeyRef

    ClientPasswordSecretKeyRef is Secret key reference to the password to connect to MaxScale. It is defaulted if not provided. If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the password.

    clientMaxConnections integer

    ClientMaxConnections defines the maximum number of connections that the client can establish. If HA is enabled, make sure to increase this value, as more MaxScale replicas implies more connections. It defaults to 30 times the number of MaxScale replicas.

    serverUsername string

    ServerUsername is the user used by MaxScale to connect to MariaDB server. It is defaulted if not provided.

    serverPasswordSecretKeyRef

    ServerPasswordSecretKeyRef is Secret key reference to the password used by MaxScale to connect to MariaDB server. It is defaulted if not provided. If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the password.

    serverMaxConnections integer

    ServerMaxConnections defines the maximum number of connections that the server can establish. If HA is enabled, make sure to increase this value, as more MaxScale replicas implies more connections. It defaults to 30 times the number of MaxScale replicas.

    monitorUsername string

    MonitorUsername is the user used by MaxScale monitor to connect to MariaDB server. It is defaulted if not provided.

    monitorPasswordSecretKeyRef

    MonitorPasswordSecretKeyRef is Secret key reference to the password used by MaxScale monitor to connect to MariaDB server. It is defaulted if not provided. If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the password.

    monitorMaxConnections integer

    MonitorMaxConnections defines the maximum number of connections that the monitor can establish. If HA is enabled, make sure to increase this value, as more MaxScale replicas implies more connections. It defaults to 30 times the number of MaxScale replicas.

    syncUsername string

    MonitoSyncUsernamerUsername is the user used by MaxScale config sync to connect to MariaDB server. It is defaulted when HA is enabled.

    syncPasswordSecretKeyRef

    SyncPasswordSecretKeyRef is Secret key reference to the password used by MaxScale config to connect to MariaDB server. It is defaulted when HA is enabled. If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the password.

    syncMaxConnections integer

    SyncMaxConnections defines the maximum number of connections that the sync can establish. If HA is enabled, make sure to increase this value, as more MaxScale replicas implies more connections. It defaults to 30 times the number of MaxScale replicas.

    protocol string

    Protocol is the MaxScale protocol to use when communicating with the client. If not provided, it defaults to MariaDBProtocol.

    params object (keys:string, values:string)

    Params defines extra parameters to pass to the listener. Any parameter supported by MaxScale may be specified here. See reference: https://mariadb.com/kb/en/mariadb-maxscale-2308-mariadb-maxscale-configuration-guide/#listener_1.

    interval

    Interval used to monitor MariaDB servers. It is defaulted if not provided.

    cooperativeMonitoring

    CooperativeMonitoring enables coordination between multiple MaxScale instances running monitors. It is defaulted when HA is enabled.

    Enum: [majority_of_all majority_of_running]

    params object (keys:string, values:string)

    Params defines extra parameters to pass to the monitor. Any parameter supported by MaxScale may be specified here. See reference: https://mariadb.com/kb/en/mariadb-maxscale-2308-common-monitor-parameters/. Monitor specific parameter are also supported: https://mariadb.com/kb/en/mariadb-maxscale-2308-galera-monitor/#galera-monitor-optional-parameters. https://mariadb.com/kb/en/mariadb-maxscale-2308-mariadb-monitor/#configuration.

    serviceAccountName string

    ServiceAccountName is the name of the ServiceAccount to be used by the Pods.

    affinity

    Affinity to be used in the Pod.

    nodeSelector object (keys:string, values:string)

    NodeSelector to be used in the Pod.

    tolerations array

    Tolerations to be used in the Pod.

    priorityClassName string

    PriorityClassName to be used in the Pod.

    topologySpreadConstraints array

    TopologySpreadConstraints to be used in the Pod.

    protocol string

    Protocol is the MaxScale protocol to use when communicating with this MariaDB server. If not provided, it defaults to MariaDBBackend.

    maintenance boolean

    Maintenance indicates whether the server is in maintenance mode.

    params object (keys:string, values:string)

    Params defines extra parameters to pass to the server. Any parameter supported by MaxScale may be specified here. See reference: https://mariadb.com/kb/en/mariadb-maxscale-2308-mariadb-maxscale-configuration-guide/#server_1.

    listener

    MaxScaleListener defines how the MaxScale server will listen for connections.

    Required: {}

    params object (keys:string, values:string)

    Params defines extra parameters to pass to the service. Any parameter supported by MaxScale may be specified here. See reference: https://mariadb.com/kb/en/mariadb-maxscale-2308-mariadb-maxscale-configuration-guide/#service_1. Router specific parameter are also supported: https://mariadb.com/kb/en/mariadb-maxscale-2308-readwritesplit/#configuration. https://mariadb.com/kb/en/mariadb-maxscale-2308-readconnroute/#configuration.

    envFrom array

    EnvFrom represents the references (via ConfigMap and Secrets) to environment variables to be injected in the container.

    volumeMounts array

    VolumeMounts to be used in the Container.

    livenessProbe

    LivenessProbe to be used in the Container.

    readinessProbe

    ReadinessProbe to be used in the Container.

    startupProbe

    StartupProbe to be used in the Container.

    resources

    Resources describes the compute resource requirements.

    securityContext

    SecurityContext holds security configuration that will be applied to a container.

    podMetadata

    PodMetadata defines extra metadata for the Pod.

    imagePullSecrets array

    ImagePullSecrets is the list of pull Secrets to be used to pull the image.

    podSecurityContext

    SecurityContext holds pod-level security attributes and common container settings.

    serviceAccountName string

    ServiceAccountName is the name of the ServiceAccount to be used by the Pods.

    affinity

    Affinity to be used in the Pod.

    nodeSelector object (keys:string, values:string)

    NodeSelector to be used in the Pod.

    tolerations array

    Tolerations to be used in the Pod.

    priorityClassName string

    PriorityClassName to be used in the Pod.

    topologySpreadConstraints array

    TopologySpreadConstraints to be used in the Pod.

    suspend boolean

    Suspend indicates whether the current resource should be suspended or not. This can be useful for maintenance, as disabling the reconciliation prevents the operator from interfering with user operations during maintenance activities.

    false

    mariaDbRef

    MariaDBRef is a reference to the MariaDB that MaxScale points to. It is used to initialize the servers field.

    primaryServer string

    PrimaryServer specifies the desired primary server. Setting this field triggers a switchover operation in MaxScale to the desired server. This option is only valid when using monitors that support switchover, currently limited to the MariaDB monitor.

    servers array

    Servers are the MariaDB servers to forward traffic to. It is required if 'spec.mariaDbRef' is not provided.

    image string

    Image name to be used by the MaxScale instances. The supported format is <image>:<tag>. Only MaxScale official images are supported.

    imagePullPolicy

    ImagePullPolicy is the image pull policy. One of Always, Never or IfNotPresent. If not defined, it defaults to IfNotPresent.

    Enum: [Always Never IfNotPresent]

    inheritMetadata

    InheritMetadata defines the metadata to be inherited by children resources.

    services array

    Services define how the traffic is forwarded to the MariaDB servers. It is defaulted if not provided.

    monitor

    Monitor monitors MariaDB server instances. It is required if 'spec.mariaDbRef' is not provided.

    admin

    Admin configures the admin REST API and GUI.

    config

    Config defines the MaxScale configuration.

    auth

    Auth defines the credentials required for MaxScale to connect to MariaDB.

    metrics

    Metrics configures metrics and how to scrape them.

    tls

    TLS defines the PKI to be used with MaxScale.

    connection

    Connection provides a template to define the Connection for MaxScale.

    replicas integer

    Replicas indicates the number of desired instances.

    1

    podDisruptionBudget

    PodDisruptionBudget defines the budget for replica availability.

    updateStrategy

    UpdateStrategy defines the update strategy for the StatefulSet object.

    kubernetesService

    KubernetesService defines a template for a Kubernetes Service object to connect to MaxScale.

    guiKubernetesService

    GuiKubernetesService defines a template for a Kubernetes Service object to connect to MaxScale's GUI.

    requeueInterval

    RequeueInterval is used to perform requeue reconciliations. If not defined, it defaults to 10s.

    adminCASecretRef

    AdminCASecretRef is a reference to a Secret containing the admin certificate authority keypair. It is used to establish trust and issue certificates for the MaxScale's administrative REST API and GUI. One of: - Secret containing both the 'ca.crt' and 'ca.key' keys. This allows you to bring your own CA to Kubernetes to issue certificates. - Secret containing only the 'ca.crt' in order to establish trust. In this case, either adminCertSecretRef or adminCertIssuerRef fields must be provided. If not provided, a self-signed CA will be provisioned to issue the server certificate.

    adminCertSecretRef

    AdminCertSecretRef is a reference to a TLS Secret used by the MaxScale's administrative REST API and GUI.

    adminCertIssuerRef

    AdminCertIssuerRef is a reference to a cert-manager issuer object used to issue the MaxScale's administrative REST API and GUI certificate. cert-manager must be installed previously in the cluster. It is mutually exclusive with adminCertSecretRef. By default, the Secret field 'ca.crt' provisioned by cert-manager will be added to the trust chain. A custom trust bundle may be specified via adminCASecretRef.

    adminCertConfig

    AdminCertConfig allows configuring the admin certificates, either issued by the operator or cert-manager. If not set, the default settings will be used.

    listenerCASecretRef

    ListenerCASecretRef is a reference to a Secret containing the listener certificate authority keypair. It is used to establish trust and issue certificates for the MaxScale's listeners. One of: - Secret containing both the 'ca.crt' and 'ca.key' keys. This allows you to bring your own CA to Kubernetes to issue certificates. - Secret containing only the 'ca.crt' in order to establish trust. In this case, either listenerCertSecretRef or listenerCertIssuerRef fields must be provided. If not provided, a self-signed CA will be provisioned to issue the listener certificate.

    listenerCertSecretRef

    ListenerCertSecretRef is a reference to a TLS Secret used by the MaxScale's listeners.

    listenerCertIssuerRef

    ListenerCertIssuerRef is a reference to a cert-manager issuer object used to issue the MaxScale's listeners certificate. cert-manager must be installed previously in the cluster. It is mutually exclusive with listenerCertSecretRef. By default, the Secret field 'ca.crt' provisioned by cert-manager will be added to the trust chain. A custom trust bundle may be specified via listenerCASecretRef.

    listenerCertConfig

    ListenerCertConfig allows configuring the listener certificates, either issued by the operator or cert-manager. If not set, the default settings will be used.

    serverCASecretRef

    ServerCASecretRef is a reference to a Secret containing the MariaDB server CA certificates. It is used to establish trust with MariaDB servers. The Secret should contain a 'ca.crt' key in order to establish trust. If not provided, and the reference to a MariaDB resource is set (mariaDbRef), it will be defaulted to the referred MariaDB CA bundle.

    serverCertSecretRef

    ServerCertSecretRef is a reference to a TLS Secret used by MaxScale to connect to the MariaDB servers. If not provided, and the reference to a MariaDB resource is set (mariaDbRef), it will be defaulted to the referred MariaDB client certificate (clientCertSecretRef).

    verifyPeerCertificate boolean

    VerifyPeerCertificate specifies whether the peer certificate's signature should be validated against the CA. It is disabled by default.

    verifyPeerHost boolean

    VerifyPeerHost specifies whether the peer certificate's SANs should match the peer host. It is disabled by default.

    replicationSSLEnabled boolean

    ReplicationSSLEnabled specifies whether the replication SSL is enabled. If enabled, the SSL options will be added to the server configuration. It is enabled by default when the referred MariaDB instance (via mariaDbRef) has replication enabled. If the MariaDB servers are manually provided by the user via the 'servers' field, this must be set by the user as well.

    GaleraRecoveryJob
  • Job

  • JobPodTemplate

  • MariaDBSpec

  • MaxScalePodTemplate

  • MaxScaleSpec

  • PhysicalBackupPodTemplate

  • PhysicalBackupSpec

  • PhysicalBackupVolumeSnapshot

  • PodTemplate

  • RestoreSpec

  • SecretTemplate

  • ServiceTemplate

  • SqlJobSpec

  • VolumeClaimTemplate

  • storageClassName string

    spec

    serviceAccountName string

    ServiceAccountName is the name of the ServiceAccount to be used by the Pods.

    tolerations array

    Tolerations to be used in the Pod.

    priorityClassName string

    PriorityClassName to be used in the Pod.

    podMetadata

    PodMetadata defines extra metadata for the Pod.

    imagePullSecrets array

    ImagePullSecrets is the list of pull Secrets to be used to pull the image.

    podSecurityContext

    SecurityContext holds pod-level security attributes and common container settings.

    serviceAccountName string

    ServiceAccountName is the name of the ServiceAccount to be used by the Pods.

    tolerations array

    Tolerations to be used in the Pod.

    priorityClassName string

    PriorityClassName to be used in the Pod.

    mariaDbRef

    MariaDBRef is a reference to a MariaDB object.

    Required: {}

    compression

    Compression algorithm to be used in the Backup.

    Enum: [none bzip2 gzip]

    stagingStorage

    StagingStorage defines the temporary storage used to keep external backups (i.e. S3) while they are being processed. It defaults to an emptyDir volume, meaning that the backups will be temporarily stored in the node where the PhysicalBackup Job is scheduled. The staging area gets cleaned up after each backup is completed, consider this for sizing it appropriately.

    storage

    Storage defines the final storage for backups.

    Required: {}

    schedule

    Schedule defines when the PhysicalBackup will be taken.

    maxRetention

    MaxRetention defines the retention policy for backups. Old backups will be cleaned up by the Backup Job. It defaults to 30 days.

    timeout

    Timeout defines the maximum duration of a PhysicalBackup job or snapshot. If this duration is exceeded, the job or snapshot is considered expired and is deleted by the operator. A new job or snapshot will then be created according to the schedule. It defaults to 1 hour.

    podAffinity boolean

    PodAffinity indicates whether the Jobs should run in the same Node as the MariaDB Pods to be able to attach the PVC. It defaults to true.

    backoffLimit integer

    BackoffLimit defines the maximum number of attempts to successfully take a PhysicalBackup.

    restartPolicy

    RestartPolicy to be added to the PhysicalBackup Pod.

    OnFailure

    Enum: [Always OnFailure Never]

    inheritMetadata

    InheritMetadata defines the metadata to be inherited by children resources.

    successfulJobsHistoryLimit integer

    SuccessfulJobsHistoryLimit defines the maximum number of successful Jobs to be displayed. It defaults to 5.

    Minimum: 0

    volumeSnapshot

    VolumeSnapshot is a Kubernetes VolumeSnapshot specification.

    MaxScalePodTemplate
  • MaxScaleSpec

  • PhysicalBackupPodTemplate

  • PhysicalBackupSpec

  • PodTemplate

  • RestoreSpec

  • SqlJobSpec

  • runAsNonRoot boolean

    supplementalGroups integer array

    fsGroup integer

    fsGroupChangePolicy

    seccompProfile

    appArmorProfile

    sidecarContainers array

    SidecarContainers to be used in the Pod.

    podSecurityContext

    SecurityContext holds pod-level security attributes and common container settings.

    serviceAccountName string

    ServiceAccountName is the name of the ServiceAccount to be used by the Pods.

    affinity

    Affinity to be used in the Pod.

    nodeSelector object (keys:string, values:string)

    NodeSelector to be used in the Pod.

    tolerations array

    Tolerations to be used in the Pod.

    volumes array

    Volumes to be used in the Pod.

    priorityClassName string

    PriorityClassName to be used in the Pod.

    topologySpreadConstraints array

    TopologySpreadConstraints to be used in the Pod.

    MaxScaleSpec

    initialDelaySeconds integer

    timeoutSeconds integer

    periodSeconds integer

    successThreshold integer

    failureThreshold integer

    maxLagSeconds integer

    MaxLagSeconds is the maximum number of seconds that replicas are allowed to lag behind the primary. If a replica exceeds this threshold, it is marked as not ready and read queries will no longer be forwarded to it. If not provided, it defaults to 0, which means that replicas are not allowed to lag behind the primary (recommended). Lagged replicas will not be taken into account as candidates for the new primary during failover, and they will block other operations, such as switchover and upgrade. This field is not taken into account by MaxScale, you can define the maximum lag as router parameters. See: https://mariadb.com/docs/maxscale/reference/maxscale-routers/maxscale-readwritesplit#max_replication_lag.

    syncTimeout

    SyncTimeout defines the timeout for the synchronization phase during switchover and failover operations. During switchover, all replicas must be synced with the current primary before promoting the new primary. During failover, the new primary must be synced before being promoted as primary. This implies processing all the events in the relay log. When the timeout is reached, the operator restarts the operation from the beginning. It defaults to 10s. See: https://mariadb.com/docs/server/reference/sql-functions/secondary-functions/miscellaneous-functions/master_gtid_wait

    bootstrapFrom

    ReplicaBootstrapFrom defines the data sources used to bootstrap new replicas. This will be used as part of the scaling out and recovery operations, when new replicas are created. If not provided, scale out and recovery operations will return an error.

    recovery

    ReplicaRecovery defines how the replicas should be recovered after they enter an error state. This process deletes data from faulty replicas and recreates them using the source defined in the bootstrapFrom field. It is disabled by default, and it requires the bootstrapFrom field to be set.

    semiSyncEnabled boolean

    SemiSyncEnabled determines whether semi-synchronous replication is enabled. Semi-synchronous replication requires that at least one replica should have sent an ACK to the primary node before committing the transaction back to the client. See: https://mariadb.com/docs/server/ha-and-performance/standard-replication/semisynchronous-replication It is enabled by default

    semiSyncAckTimeout

    SemiSyncAckTimeout for the replica to acknowledge transactions to the primary. It requires semi-synchronous replication to be enabled. See: https://mariadb.com/docs/server/ha-and-performance/standard-replication/semisynchronous-replication#rpl_semi_sync_master_timeout

    semiSyncWaitPoint

    SemiSyncWaitPoint determines whether the transaction should wait for an ACK after having synced the binlog (AfterSync) or after having committed to the storage engine (AfterCommit, the default). It requires semi-synchronous replication to be enabled. See: https://mariadb.com/kb/en/semisynchronous-replication/#rpl_semi_sync_master_wait_point.

    Enum: [AfterSync AfterCommit]

    syncBinlog integer

    SyncBinlog indicates after how many events the binary log is synchronized to the disk. See: https://mariadb.com/docs/server/ha-and-performance/standard-replication/replication-and-binary-log-system-variables#sync_binlog

    initContainer

    InitContainer is an init container that runs in the MariaDB Pod and co-operates with mariadb-enterprise-operator.

    agent

    Agent is a sidecar agent that runs in the MariaDB Pod and co-operates with mariadb-enterprise-operator.

    standaloneProbes boolean

    StandaloneProbes indicates whether to use the default non-HA startup and liveness probes. It is disabled by default

    enabled boolean

    Enabled is a flag to enable replication.

    semiSyncEnabled boolean

    SemiSyncEnabled determines whether semi-synchronous replication is enabled. Semi-synchronous replication requires that at least one replica should have sent an ACK to the primary node before committing the transaction back to the client. See: https://mariadb.com/docs/server/ha-and-performance/standard-replication/semisynchronous-replication It is enabled by default

    semiSyncAckTimeout

    SemiSyncAckTimeout for the replica to acknowledge transactions to the primary. It requires semi-synchronous replication to be enabled. See: https://mariadb.com/docs/server/ha-and-performance/standard-replication/semisynchronous-replication#rpl_semi_sync_master_timeout

    semiSyncWaitPoint

    SemiSyncWaitPoint determines whether the transaction should wait for an ACK after having synced the binlog (AfterSync) or after having committed to the storage engine (AfterCommit, the default). It requires semi-synchronous replication to be enabled. See: https://mariadb.com/kb/en/semisynchronous-replication/#rpl_semi_sync_master_wait_point.

    Enum: [AfterSync AfterCommit]

    syncBinlog integer

    SyncBinlog indicates after how many events the binary log is synchronized to the disk. See: https://mariadb.com/docs/server/ha-and-performance/standard-replication/replication-and-binary-log-system-variables#sync_binlog

    initContainer

    InitContainer is an init container that runs in the MariaDB Pod and co-operates with mariadb-enterprise-operator.

    agent

    Agent is a sidecar agent that runs in the MariaDB Pod and co-operates with mariadb-enterprise-operator.

    standaloneProbes boolean

    StandaloneProbes indicates whether to use the default non-HA startup and liveness probes. It is disabled by default

    Exporter
  • GaleraInitJob

  • GaleraRecoveryJob

  • InitContainer

  • Job

  • JobContainerTemplate

  • MariaDBSpec

  • MaxScaleSpec

  • PhysicalBackupSpec

  • RestoreSpec

  • SqlJobSpec

  • spec

    targetRecoveryTime

    TargetRecoveryTime is a RFC3339 (1970-01-01T00:00:00Z) date and time that defines the point in time recovery objective. It is used to determine the closest restoration source in time.

    stagingStorage

    StagingStorage defines the temporary storage used to keep external backups (i.e. S3) while they are being processed. It defaults to an emptyDir volume, meaning that the backups will be temporarily stored in the node where the Restore Job is scheduled.

    podMetadata

    PodMetadata defines extra metadata for the Pod.

    imagePullSecrets array

    ImagePullSecrets is the list of pull Secrets to be used to pull the image.

    podSecurityContext

    SecurityContext holds pod-level security attributes and common container settings.

    serviceAccountName string

    ServiceAccountName is the name of the ServiceAccount to be used by the Pods.

    affinity

    Affinity to be used in the Pod.

    nodeSelector object (keys:string, values:string)

    NodeSelector to be used in the Pod.

    tolerations array

    Tolerations to be used in the Pod.

    priorityClassName string

    PriorityClassName to be used in the Pod.

    backupRef

    BackupRef is a reference to a Backup object. It has priority over S3 and Volume.

    s3

    S3 defines the configuration to restore backups from a S3 compatible storage. It has priority over Volume.

    volume

    Volume is a Kubernetes Volume object that contains a backup.

    targetRecoveryTime

    TargetRecoveryTime is a RFC3339 (1970-01-01T00:00:00Z) date and time that defines the point in time recovery objective. It is used to determine the closest restoration source in time.

    stagingStorage

    StagingStorage defines the temporary storage used to keep external backups (i.e. S3) while they are being processed. It defaults to an emptyDir volume, meaning that the backups will be temporarily stored in the node where the Restore Job is scheduled.

    mariaDbRef

    MariaDBRef is a reference to a MariaDB object.

    Required: {}

    database string

    Database defines the logical database to be restored. If not provided, all databases available in the backup are restored. IMPORTANT: The database must previously exist.

    logLevel string

    LogLevel to be used n the Backup Job. It defaults to 'info'.

    info

    backoffLimit integer

    BackoffLimit defines the maximum number of attempts to successfully perform a Backup.

    5

    restartPolicy

    RestartPolicy to be added to the Backup Job.

    OnFailure

    Enum: [Always OnFailure Never]

    inheritMetadata

    InheritMetadata defines the metadata to be inherited by children resources.

    RestoreSpec

    prefix string

    Prefix indicates a folder/subfolder in the bucket. For example: mariadb/ or mariadb/backups. A trailing slash '/' is added if not provided.

    accessKeyIdSecretKeyRef

    AccessKeyIdSecretKeyRef is a reference to a Secret key containing the S3 access key id.

    secretAccessKeySecretKeyRef

    AccessKeyIdSecretKeyRef is a reference to a Secret key containing the S3 secret key.

    sessionTokenSecretKeyRef

    SessionTokenSecretKeyRef is a reference to a Secret key containing the S3 session token.

    tls

    TLS provides the configuration required to establish TLS connections with S3.

    MariaDBSpec
  • PasswordPlugin

  • S3

  • SqlJobSpec

  • TLSS3

  • UserSpec

  • usernameKey string

    UsernameKey to be used in the Secret.

    passwordKey string

    PasswordKey to be used in the Secret.

    hostKey string

    HostKey to be used in the Secret.

    portKey string

    PortKey to be used in the Secret.

    databaseKey string

    DatabaseKey to be used in the Secret.

    InitContainer
  • JobContainerTemplate

  • MariaDBSpec

  • MaxScaleSpec

  • PhysicalBackupSpec

  • RestoreSpec

  • SqlJobSpec

  • runAsGroup integer

    runAsNonRoot boolean

    readOnlyRootFilesystem boolean

    allowPrivilegeEscalation boolean

    scrapeTimeout string

    ScrapeTimeout defines the timeout for scraping metrics.

    loadBalancerSourceRanges string array

    LoadBalancerSourceRanges Service field.

    externalTrafficPolicy

    ExternalTrafficPolicy Service field.

    sessionAffinity

    SessionAffinity Service field.

    allocateLoadBalancerNodePorts boolean

    AllocateLoadBalancerNodePorts Service field.

    spec

    podMetadata

    PodMetadata defines extra metadata for the Pod.

    imagePullSecrets array

    ImagePullSecrets is the list of pull Secrets to be used to pull the image.

    podSecurityContext

    SecurityContext holds pod-level security attributes and common container settings.

    serviceAccountName string

    ServiceAccountName is the name of the ServiceAccount to be used by the Pods.

    affinity

    Affinity to be used in the Pod.

    nodeSelector object (keys:string, values:string)

    NodeSelector to be used in the Pod.

    tolerations array

    Tolerations to be used in the Pod.

    priorityClassName string

    PriorityClassName to be used in the Pod.

    successfulJobsHistoryLimit integer

    SuccessfulJobsHistoryLimit defines the maximum number of successful Jobs to be displayed.

    Minimum: 0

    failedJobsHistoryLimit integer

    FailedJobsHistoryLimit defines the maximum number of failed Jobs to be displayed.

    Minimum: 0

    timeZone string

    TimeZone defines the timezone associated with the cron expression.

    mariaDbRef

    MariaDBRef is a reference to a MariaDB object.

    Required: {}

    schedule

    Schedule defines when the SqlJob will be executed.

    username string

    Username to be impersonated when executing the SqlJob.

    Required: {}

    passwordSecretKeyRef

    UserPasswordSecretKeyRef is a reference to the impersonated user's password to be used when executing the SqlJob.

    Required: {}

    tlsCASecretRef

    TLSCACertSecretRef is a reference toa CA Secret used to establish trust when executing the SqlJob. If not provided, the CA bundle provided by the referred MariaDB is used.

    tlsClientCertSecretRef

    TLSClientCertSecretRef is a reference to a Kubernetes TLS Secret used as authentication when executing the SqlJob. If not provided, the client certificate provided by the referred MariaDB is used.

    database string

    Username to be used when executing the SqlJob.

    dependsOn array

    DependsOn defines dependencies with other SqlJob objectecs.

    sql string

    Sql is the script to be executed by the SqlJob.

    sqlConfigMapKeyRef

    SqlConfigMapKeyRef is a reference to a ConfigMap containing the Sql script. It is defaulted to a ConfigMap with the contents of the Sql field.

    backoffLimit integer

    BackoffLimit defines the maximum number of attempts to successfully execute a SqlJob.

    5

    restartPolicy

    RestartPolicy to be added to the SqlJob Pod.

    OnFailure

    Enum: [Always OnFailure Never]

    inheritMetadata

    InheritMetadata defines the metadata to be inherited by children resources.

    resizeInUseVolumes boolean

    ResizeInUseVolumes indicates whether the PVCs can be resized. The 'StorageClassName' used should have 'allowVolumeExpansion' set to 'true' to allow resizing. It defaults to true.

    waitForVolumeResize boolean

    WaitForVolumeResize indicates whether to wait for the PVCs to be resized before marking the MariaDB object as ready. This will block other operations such as cluster recovery while the resize is in progress. It defaults to true.

    volumeClaimTemplate

    VolumeClaimTemplate provides a template to define the PVCs.

    RestoreSource
  • RestoreSpec

  • Volume

  • VolumeSource

  • hostPath

    persistentVolumeClaim

    MaxScaleSpec

    serverCASecretRef

    ServerCASecretRef is a reference to a Secret containing the server certificate authority keypair. It is used to establish trust and issue server certificates. One of: - Secret containing both the 'ca.crt' and 'ca.key' keys. This allows you to bring your own CA to Kubernetes to issue certificates. - Secret containing only the 'ca.crt' in order to establish trust. In this case, either serverCertSecretRef or serverCertIssuerRef must be provided. If not provided, a self-signed CA will be provisioned to issue the server certificate.

    serverCertSecretRef

    ServerCertSecretRef is a reference to a TLS Secret containing the server certificate. It is mutually exclusive with serverCertIssuerRef.

    serverCertIssuerRef

    ServerCertIssuerRef is a reference to a cert-manager issuer object used to issue the server certificate. cert-manager must be installed previously in the cluster. It is mutually exclusive with serverCertSecretRef. By default, the Secret field 'ca.crt' provisioned by cert-manager will be added to the trust chain. A custom trust bundle may be specified via serverCASecretRef.

    serverCertConfig

    ServerCertConfig allows configuring the server certificates, either issued by the operator or cert-manager. If not set, the default settings will be used.

    clientCASecretRef

    ClientCASecretRef is a reference to a Secret containing the client certificate authority keypair. It is used to establish trust and issue client certificates. One of: - Secret containing both the 'ca.crt' and 'ca.key' keys. This allows you to bring your own CA to Kubernetes to issue certificates. - Secret containing only the 'ca.crt' in order to establish trust. In this case, either clientCertSecretRef or clientCertIssuerRef fields must be provided. If not provided, a self-signed CA will be provisioned to issue the client certificate.

    clientCertSecretRef

    ClientCertSecretRef is a reference to a TLS Secret containing the client certificate. It is mutually exclusive with clientCertIssuerRef.

    clientCertIssuerRef

    ClientCertIssuerRef is a reference to a cert-manager issuer object used to issue the client certificate. cert-manager must be installed previously in the cluster. It is mutually exclusive with clientCertSecretRef. By default, the Secret field 'ca.crt' provisioned by cert-manager will be added to the trust chain. A custom trust bundle may be specified via clientCASecretRef.

    clientCertConfig

    ClientCertConfig allows configuring the client certificates, either issued by the operator or cert-manager. If not set, the default settings will be used.

    galeraSSTEnabled boolean

    GaleraSSTEnabled determines whether Galera SST connections should use TLS. It disabled by default.

    galeraServerSSLMode string

    GaleraServerSSLMode defines the server SSL mode for a Galera Enterprise cluster. This field is only supported and applicable for Galera Enterprise >= 10.6 instances. Refer to the MariaDB Enterprise docs for more detail: https://mariadb.com/docs/galera-cluster/galera-security/mariadb-enterprise-cluster-security#wsrep-tls-modes

    Enum: [PROVIDER SERVER SERVER_X509]

    galeraClientSSLMode string

    GaleraClientSSLMode defines the client SSL mode for a Galera Enterprise cluster. This field is only supported and applicable for Galera Enterprise >= 10.6 instances. Refer to the MariaDB Enterprise docs for more detail: https://mariadb.com/docs/galera-cluster/galera-security/mariadb-enterprise-cluster-security#sst-tls-modes

    Enum: [DISABLED REQUIRED VERIFY_CA VERIFY_IDENTITY]

    privateKeySize integer

    PrivateKeyAlgorithm is the key size to be used for the CA and leaf certificate private keys. Supported values: ECDSA(256, 384, 521), RSA(2048, 3072, 4096)

    subject string

    Subject indicates that the TLS certificate provided by the user must have a specific subject.

    labelSelector

    minDomains integer

    nodeAffinityPolicy

    nodeTaintsPolicy

    matchLabelKeys string array

    spec

    mariaDbRef

    MariaDBRef is a reference to a MariaDB object.

    Required: {}

    passwordSecretKeyRef

    PasswordSecretKeyRef is a reference to the password to be used by the User. If not provided, the account will be locked and the password will expire. If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the password.

    passwordHashSecretKeyRef

    PasswordHashSecretKeyRef is a reference to the password hash to be used by the User. If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the password hash. It requires the 'skip-strict-password-validation' option to be set. See: https://mariadb.com/docs/server/ref/mdb/cli/mariadbd/strict-password-validation/.

    passwordPlugin

    PasswordPlugin is a reference to the password plugin and arguments to be used by the User. It requires the 'skip-strict-password-validation' option to be set. See: https://mariadb.com/docs/server/ref/mdb/cli/mariadbd/strict-password-validation/.

    require

    Require specifies TLS requirements for the user to connect. See: https://mariadb.com/kb/en/securing-connections-for-client-and-server/#requiring-tls.

    maxUserConnections integer

    MaxUserConnections defines the maximum number of simultaneous connections that the User can establish.

    10

    name string

    Name overrides the default name provided by metadata.name.

    MaxLength: 80

    host string

    Host related to the User.

    MaxLength: 255

    csi

    hostPath

    persistentVolumeClaim

    secret

    configMap

    storageClassName string

    metadata

    Refer to Kubernetes API documentation for fields of metadata.

    MariaDBSpec
  • MaxScaleSpec

  • subPath string

    hostPath

    persistentVolumeClaim

    secret

    configMap

    podAntiAffinity PodAntiAffinity

    nodeAffinity NodeAffinity

    podAntiAffinity PodAntiAffinity

    nodeAffinity NodeAffinity

    antiAffinityEnabled boolean

    AntiAffinityEnabled configures PodAntiAffinity so each Pod is scheduled in a different Node, enabling HA. Make sure you have at least as many Nodes available as the replicas to not end up with unscheduled Pods.

    command string array

    Command to be used in the Container.

    args string array

    Args to be used in the Container.

    env EnvVar array

    Env represents the environment variables to be injected in a container.

    apiVersion string

    enterprise.mariadb.com/v1alpha1

    kind string

    Backup

    metadata ObjectMeta

    Refer to Kubernetes API documentation for fields of metadata.

    Logical

    BackupContentTypeLogical represents a logical backup created using mariadb-dump.

    Physical

    BackupContentTypePhysical represents a physical backup created using mariadb-backup.

    args string array

    Args to be used in the Container.

    resources ResourceRequirements

    Resources describes the compute resource requirements.

    securityContext SecurityContext

    SecurityContext holds security configuration that will be applied to a container.

    persistentVolumeClaim PersistentVolumeClaimSpec

    PersistentVolumeClaim is a Kubernetes PVC specification.

    volume StorageVolumeSource

    Volume is a Kubernetes volume specification.

    s3 S3

    S3 defines the configuration to store backups in a S3 compatible storage.

    persistentVolumeClaim PersistentVolumeClaimSpec

    PersistentVolumeClaim is a Kubernetes PVC specification.

    volume StorageVolumeSource

    Volume is a Kubernetes volume specification.

    enabled boolean

    Enabled is a flag to enable BasicAuth

    username string

    Username to be used for basic authentication

    passwordSecretKeyRef GeneratedSecretKeyRef

    PasswordSecretKeyRef to be used for basic authentication

    backupRef TypedLocalObjectReference

    BackupRef is reference to a backup object. If the Kind is not specified, a logical Backup is assumed. This field takes precedence over S3 and Volume sources.

    volumeSnapshotRef LocalObjectReference

    VolumeSnapshotRef is a reference to a VolumeSnapshot object. This field takes precedence over S3 and Volume sources.

    backupContentType BackupContentType

    BackupContentType is the backup content type available in the source to bootstrap from. It is inferred based on the BackupRef and VolumeSnapshotRef fields. If inference is not possible, it defaults to Logical. Set this field explicitly when using physical backups from S3 or Volume sources.

    driver string

    readOnly boolean

    fsType string

    Skip

    CleanupPolicySkip indicates that the resource will NOT be deleted from the database after the CR is deleted.

    Delete

    CleanupPolicyDelete indicates that the resource will be deleted from the database after the CR is deleted.

    none

    No compression

    bzip2

    Bzip2 compression. Good compression ratio, but slower compression/decompression speed compared to gzip.

    gzip

    Gzip compression. Good compression/decompression speed, but worse compression ratio compared to bzip2.

    name string

    key string

    name string

    defaultMode integer

    apiVersion string

    enterprise.mariadb.com/v1alpha1

    kind string

    Connection

    metadata ObjectMeta

    Refer to Kubernetes API documentation for fields of metadata.

    secretName string

    SecretName to be used in the Connection.

    secretTemplate SecretTemplate

    SecretTemplate to be used in the Connection.

    healthCheck HealthCheck

    HealthCheck to be used in the Connection.

    secretName string

    SecretName to be used in the Connection.

    secretTemplate SecretTemplate

    SecretTemplate to be used in the Connection.

    healthCheck HealthCheck

    HealthCheck to be used in the Connection.

    name string

    Name to be given to the container.

    image string

    Image name to be used by the container. The supported format is <image>:<tag>.

    Required: {}

    imagePullPolicy PullPolicy

    ImagePullPolicy is the image pull policy. One of Always, Never or IfNotPresent. If not defined, it defaults to IfNotPresent.

    command string array

    Command to be used in the Container.

    args string array

    Args to be used in the Container.

    env EnvVar array

    Env represents the environment variables to be injected in a container.

    majority_of_all

    CooperativeMonitoringMajorityOfAll requires a lock from the majority of the MariaDB servers, even the ones that are down.

    majority_of_running

    CooperativeMonitoringMajorityOfRunning requires a lock from the majority of the MariaDB servers.

    successfulJobsHistoryLimit integer

    SuccessfulJobsHistoryLimit defines the maximum number of successful Jobs to be displayed.

    Minimum: 0

    failedJobsHistoryLimit integer

    FailedJobsHistoryLimit defines the maximum number of failed Jobs to be displayed.

    Minimum: 0

    timeZone string

    TimeZone defines the timezone associated with the cron expression.

    apiVersion string

    enterprise.mariadb.com/v1alpha1

    kind string

    Database

    metadata ObjectMeta

    Refer to Kubernetes API documentation for fields of metadata.

    requeueInterval Duration

    RequeueInterval is used to perform requeue reconciliations.

    retryInterval Duration

    RetryInterval is the interval used to perform retries.

    cleanupPolicy CleanupPolicy

    CleanupPolicy defines the behavior for cleaning up a SQL resource.

    medium StorageMedium

    sizeLimit Quantity

    prefix string

    configMapRef LocalObjectReference

    secretRef LocalObjectReference

    name string

    Name of the environment variable. Must be a C_IDENTIFIER.

    value string

    valueFrom EnvVarSource

    fieldRef ObjectFieldSelector

    configMapKeyRef ConfigMapKeySelector

    secretKeyRef SecretKeySelector

    command string array

    image string

    Image name to be used as metrics exporter. The supported format is <image>:<tag>.

    imagePullPolicy PullPolicy

    ImagePullPolicy is the image pull policy. One of Always, Never or IfNotPresent. If not defined, it defaults to IfNotPresent.

    Enum: [Always Never IfNotPresent]

    imagePullSecrets LocalObjectReference array

    ImagePullSecrets is the list of pull Secrets to be used to pull the image.

    apiVersion string

    enterprise.mariadb.com/v1alpha1

    kind string

    ExternalMariaDB

    metadata ObjectMeta

    Refer to Kubernetes API documentation for fields of metadata.

    image string

    Image name to be used to perform operations on the external MariaDB, for example, for taking backups. The supported format is <image>:<tag>. Only MariaDB official images are supported. If not provided, the MariaDB image version be inferred by the operator in runtime. The default MariaDB image will be used in this case,

    imagePullPolicy PullPolicy

    ImagePullPolicy is the image pull policy. One of Always, Never or IfNotPresent. If not defined, it defaults to IfNotPresent.

    Enum: [Always Never IfNotPresent]

    imagePullSecrets LocalObjectReference array

    ImagePullSecrets is the list of pull Secrets to be used to pull the image.

    primary PrimaryGalera

    Primary is the Galera configuration for the primary node.

    sst SST

    SST is the Snapshot State Transfer used when new Pods join the cluster. More info: https://galeracluster.com/library/documentation/sst.html.

    Enum: [rsync mariabackup mysqldump]

    availableWhenDonor boolean

    AvailableWhenDonor indicates whether a donor node should be responding to queries. It defaults to false.

    reuseStorageVolume boolean

    ReuseStorageVolume indicates that storage volume used by MariaDB should be reused to store the Galera configuration files. It defaults to false, which implies that a dedicated volume for the Galera configuration files is provisioned.

    volumeClaimTemplate VolumeClaimTemplate

    VolumeClaimTemplate is a template for the PVC that will contain the Galera configuration files shared between the InitContainer, Agent and MariaDB.

    metadata Metadata

    Refer to Kubernetes API documentation for fields of metadata.

    resources ResourceRequirements

    Resources describes the compute resource requirements.

    enabled boolean

    Enabled is a flag to enable GaleraRecovery.

    minClusterSize IntOrString

    MinClusterSize is the minimum number of replicas to consider the cluster healthy. It can be either a number of replicas (1) or a percentage (50%). If Galera consistently reports less replicas than this value for the given 'ClusterHealthyTimeout' interval, a cluster recovery is initiated. It defaults to '1' replica, and it is highly recommendeded to keep this value at '1' in most cases. If set to more than one replica, the cluster recovery process may restart the healthy replicas as well.

    clusterMonitorInterval Duration

    ClusterMonitorInterval represents the interval used to monitor the Galera cluster health.

    metadata Metadata

    Refer to Kubernetes API documentation for fields of metadata.

    resources ResourceRequirements

    Resources describes the compute resource requirements.

    podAffinity boolean

    PodAffinity indicates whether the recovery Jobs should run in the same Node as the MariaDB Pods. It defaults to true.

    primary PrimaryGalera

    Primary is the Galera configuration for the primary node.

    sst SST

    SST is the Snapshot State Transfer used when new Pods join the cluster. More info: https://galeracluster.com/library/documentation/sst.html.

    Enum: [rsync mariabackup mysqldump]

    availableWhenDonor boolean

    AvailableWhenDonor indicates whether a donor node should be responding to queries. It defaults to false.

    name string

    key string

    generate boolean

    Generate indicates whether the Secret should be generated if the Secret referenced is not present.

    false

    apiVersion string

    enterprise.mariadb.com/v1alpha1

    kind string

    Grant

    metadata ObjectMeta

    Refer to Kubernetes API documentation for fields of metadata.

    requeueInterval Duration

    RequeueInterval is used to perform requeue reconciliations.

    retryInterval Duration

    RetryInterval is the interval used to perform retries.

    cleanupPolicy CleanupPolicy

    CleanupPolicy defines the behavior for cleaning up a SQL resource.

    CurrentPos

    GtidCurrentPos indicates the union of gtid_binlog_pos and gtid_slave_pos will be used when replicating from master.

    SlavePos

    GtidSlavePos indicates that gtid_slave_pos will be used when replicating from master.

    path string

    port IntOrString

    host string

    interval Duration

    Interval used to perform health checks.

    retryInterval Duration

    RetryInterval is the interval used to perform health check retries.

    path string

    type string

    command string array

    Command to be used in the Container.

    args string array

    Args to be used in the Container.

    env EnvVar array

    Env represents the environment variables to be injected in a container.

    metadata Metadata

    Refer to Kubernetes API documentation for fields of metadata.

    affinity AffinityConfig

    Affinity to be used in the Pod.

    nodeSelector object (keys:string, values:string)

    NodeSelector to be used in the Pod.

    args string array

    Args to be used in the Container.

    resources ResourceRequirements

    Resources describes the compute resource requirements.

    securityContext SecurityContext

    SecurityContext holds security configuration that will be applied to a container.

    podMetadata Metadata

    PodMetadata defines extra metadata for the Pod.

    imagePullSecrets LocalObjectReference array

    ImagePullSecrets is the list of pull Secrets to be used to pull the image.

    podSecurityContext PodSecurityContext

    SecurityContext holds pod-level security attributes and common container settings.

    enabled boolean

    Enabled is a flag to enable KubernetesAuth

    authDelegatorRoleName string

    AuthDelegatorRoleName is the name of the ClusterRoleBinding that is associated with the "system:auth-delegator" ClusterRole. It is necessary for creating TokenReview objects in order for the agent to validate the service account token.

    matchLabels object (keys:string, values:string)

    matchExpressions LabelSelectorRequirement array

    key string

    operator LabelSelectorOperator

    values string array

    name string

    apiVersion string

    enterprise.mariadb.com/v1alpha1

    kind string

    MariaDB

    metadata ObjectMeta

    Refer to Kubernetes API documentation for fields of metadata.

    enabled boolean

    Enabled is a flag to enable a MaxScale instance to be used with the current MariaDB.

    image string

    Image name to be used by the MaxScale instances. The supported format is <image>:<tag>. Only MariaDB official images are supported.

    imagePullPolicy PullPolicy

    ImagePullPolicy is the image pull policy. One of Always, Never or IfNotPresent. If not defined, it defaults to IfNotPresent.

    name string

    namespace string

    kind string

    Kind of the referent.

    command string array

    Command to be used in the Container.

    args string array

    Args to be used in the Container.

    env EnvVar array

    Env represents the environment variables to be injected in a container.

    enabled boolean

    Enabled is a flag to enable Metrics

    exporter Exporter

    Exporter defines the metrics exporter container.

    serviceMonitor ServiceMonitor

    ServiceMonitor defines the ServiceMonior object.

    apiVersion string

    enterprise.mariadb.com/v1alpha1

    kind string

    MaxScale

    metadata ObjectMeta

    Refer to Kubernetes API documentation for fields of metadata.

    port integer

    Port where the admin REST API and GUI will be exposed.

    guiEnabled boolean

    GuiEnabled indicates whether the admin GUI should be enabled.

    generate boolean

    Generate defies whether the operator should generate users and grants for MaxScale to work. It only supports MariaDBs specified via spec.mariaDbRef.

    adminUsername string

    AdminUsername is an admin username to call the admin REST API. It is defaulted if not provided.

    adminPasswordSecretKeyRef GeneratedSecretKeyRef

    AdminPasswordSecretKeyRef is Secret key reference to the admin password to call the admin REST API. It is defaulted if not provided.

    params object (keys:string, values:string)

    Params is a key value pair of parameters to be used in the MaxScale static configuration file. Any parameter supported by MaxScale may be specified here. See reference: https://mariadb.com/kb/en/mariadb-maxscale-2308-mariadb-maxscale-configuration-guide/#global-settings.

    volumeClaimTemplate VolumeClaimTemplate

    VolumeClaimTemplate provides a template to define the PVCs for storing MaxScale runtime configuration files. It is defaulted if not provided.

    sync MaxScaleConfigSync

    Sync defines how to replicate configuration across MaxScale replicas. It is defaulted when HA is enabled.

    database string

    Database is the MariaDB logical database where the 'maxscale_config' table will be created in order to persist and synchronize config changes. If not provided, it defaults to 'mysql'.

    interval Duration

    Interval defines the config synchronization interval. It is defaulted if not provided.

    timeout Duration

    Interval defines the config synchronization timeout. It is defaulted if not provided.

    suspend boolean

    Suspend indicates whether the current resource should be suspended or not. This can be useful for maintenance, as disabling the reconciliation prevents the operator from interfering with user operations during maintenance activities.

    false

    name string

    Name is the identifier of the listener. It is defaulted if not provided

    port integer

    Port is the network port where the MaxScale server will listen.

    enabled boolean

    Enabled is a flag to enable Metrics

    exporter Exporter

    Exporter defines the metrics exporter container.

    serviceMonitor ServiceMonitor

    ServiceMonitor defines the ServiceMonior object.

    suspend boolean

    Suspend indicates whether the current resource should be suspended or not. This can be useful for maintenance, as disabling the reconciliation prevents the operator from interfering with user operations during maintenance activities.

    false

    name string

    Name is the identifier of the monitor. It is defaulted if not provided.

    module MonitorModule

    Module is the module to use to monitor MariaDB servers. It is mandatory when no MariaDB reference is provided.

    podMetadata Metadata

    PodMetadata defines extra metadata for the Pod.

    imagePullSecrets LocalObjectReference array

    ImagePullSecrets is the list of pull Secrets to be used to pull the image.

    podSecurityContext PodSecurityContext

    SecurityContext holds pod-level security attributes and common container settings.

    name string

    Name is the identifier of the MariaDB server.

    Required: {}

    address string

    Address is the network address of the MariaDB server.

    Required: {}

    port integer

    Port is the network port of the MariaDB server. If not provided, it defaults to 3306.

    suspend boolean

    Suspend indicates whether the current resource should be suspended or not. This can be useful for maintenance, as disabling the reconciliation prevents the operator from interfering with user operations during maintenance activities.

    false

    name string

    Name is the identifier of the MaxScale service.

    Required: {}

    router ServiceRouter

    Router is the type of router to use.

    command string array

    Command to be used in the Container.

    args string array

    Args to be used in the Container.

    env EnvVar array

    Env represents the environment variables to be injected in a container.

    enabled boolean

    Enabled indicates whether TLS is enabled, determining if certificates should be issued and mounted to the MaxScale instance. It is enabled by default when the referred MariaDB instance (via mariaDbRef) has TLS enabled and enforced.

    adminVersions string array

    Versions specifies the supported TLS versions in the MaxScale REST API. By default, the MaxScale's default supported versions are used. See: https://mariadb.com/kb/en/mariadb-maxscale-25-mariadb-maxscale-configuration-guide/#admin_ssl_version

    items:Enum: [TLSv10 TLSv11 TLSv12 TLSv13 MAX]

    serverVersions string array

    ServerVersions specifies the supported TLS versions in both the servers and listeners managed by this MaxScale instance. By default, the MaxScale's default supported versions are used. See: https://mariadb.com/kb/en/mariadb-maxscale-25-mariadb-maxscale-configuration-guide/#ssl_version.

    labels object (keys:string, values:string)

    Labels to be added to children resources.

    annotations object (keys:string, values:string)

    Annotations to be added to children resources.

    mariadbmon

    MonitorModuleMariadb is a monitor to be used with MariaDB servers.

    galeramon

    MonitorModuleGalera is a monitor to be used with Galera servers.

    server string

    path string

    readOnly boolean

    requiredDuringSchedulingIgnoredDuringExecution NodeSelector

    preferredDuringSchedulingIgnoredDuringExecution PreferredSchedulingTerm array

    nodeSelectorTerms NodeSelectorTerm array

    key string

    operator NodeSelectorOperator

    values string array

    matchExpressions NodeSelectorRequirement array

    matchFields NodeSelectorRequirement array

    apiVersion string

    fieldPath string

    name string

    namespace string

    pluginNameSecretKeyRef SecretKeySelector

    PluginNameSecretKeyRef is a reference to the authentication plugin to be used by the User. If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the authentication plugin.

    pluginArgSecretKeyRef SecretKeySelector

    PluginArgSecretKeyRef is a reference to the arguments to be provided to the authentication plugin for the User. If the referred Secret is labeled with "enterprise.mariadb.com/watch", updates may be performed to the Secret in order to update the authentication plugin arguments.

    accessModes PersistentVolumeAccessMode array

    selector LabelSelector

    resources VolumeResourceRequirements

    claimName string

    readOnly boolean

    apiVersion string

    enterprise.mariadb.com/v1alpha1

    kind string

    PhysicalBackup

    metadata ObjectMeta

    Refer to Kubernetes API documentation for fields of metadata.

    podMetadata Metadata

    PodMetadata defines extra metadata for the Pod.

    imagePullSecrets LocalObjectReference array

    ImagePullSecrets is the list of pull Secrets to be used to pull the image.

    podSecurityContext PodSecurityContext

    SecurityContext holds pod-level security attributes and common container settings.

    cron string

    Cron is a cron expression that defines the schedule.

    suspend boolean

    Suspend defines whether the schedule is active or not.

    false

    immediate boolean

    Immediate indicates whether the first backup should be taken immediately after creating the PhysicalBackup.

    args string array

    Args to be used in the Container.

    resources ResourceRequirements

    Resources describes the compute resource requirements.

    securityContext SecurityContext

    SecurityContext holds security configuration that will be applied to a container.

    s3 S3

    S3 defines the configuration to store backups in a S3 compatible storage.

    persistentVolumeClaim PersistentVolumeClaimSpec

    PersistentVolumeClaim is a Kubernetes PVC specification.

    volume StorageVolumeSource

    Volume is a Kubernetes volume specification.

    metadata Metadata

    Refer to Kubernetes API documentation for fields of metadata.

    volumeSnapshotClassName string

    VolumeSnapshotClassName is the VolumeSnapshot class to be used to take snapshots.

    Required: {}

    labelSelector LabelSelector

    topologyKey string

    requiredDuringSchedulingIgnoredDuringExecution PodAffinityTerm array

    preferredDuringSchedulingIgnoredDuringExecution WeightedPodAffinityTerm array

    minAvailable IntOrString

    MinAvailable defines the number of minimum available Pods.

    maxUnavailable IntOrString

    MaxUnavailable defines the number of maximum unavailable Pods.

    seLinuxOptions SELinuxOptions

    runAsUser integer

    runAsGroup integer

    podMetadata Metadata

    PodMetadata defines extra metadata for the Pod.

    imagePullSecrets LocalObjectReference array

    ImagePullSecrets is the list of pull Secrets to be used to pull the image.

    initContainers Container array

    InitContainers to be used in the Pod.

    weight integer

    preference NodeSelectorTerm

    podIndex integer

    PodIndex is the StatefulSet index of the primary node. The user may change this field to perform a manual switchover.

    autoFailover boolean

    AutoFailover indicates whether the operator should automatically update PodIndex to perform an automatic primary failover.

    podIndex integer

    PodIndex is the StatefulSet index of the primary node. The user may change this field to perform a manual switchover.

    autoFailover boolean

    AutoFailover indicates whether the operator should automatically update PodIndex to perform an automatic primary failover. It is enabled by default.

    autoFailoverDelay Duration

    AutoFailoverDelay indicates the duration before performing an automatic primary failover. By default, no extra delay is added.

    exec ExecAction

    httpGet HTTPGetAction

    tcpSocket TCPSocketAction

    exec ExecAction

    httpGet HTTPGetAction

    tcpSocket TCPSocketAction

    physicalBackupTemplateRef LocalObjectReference

    PhysicalBackupTemplateRef is a reference to a PhysicalBackup object that will be used as template to create a new PhysicalBackup object used synchronize the data from an up to date replica to the new replica to be bootstrapped.

    Required: {}

    restoreJob Job

    RestoreJob defines additional properties for the Job used to perform the restoration.

    enabled boolean

    Enabled is a flag to enable replica recovery.

    Required: {}

    errorDurationThreshold Duration

    ErrorDurationThreshold defines the time duration after which, if a replica continues to report errors, the operator will initiate the recovery process for that replica. This threshold applies only to error codes not identified as recoverable by the operator. Errors identified as recoverable will trigger the recovery process immediately. It defaults to 5 minutes.

    replPasswordSecretKeyRef GeneratedSecretKeyRef

    ReplPasswordSecretKeyRef provides a reference to the Secret to use as password for the replication user. By default, a random password will be generated.

    gtid Gtid

    Gtid indicates which Global Transaction ID (GTID) position mode should be used when connecting a replica to the master. By default, CurrentPos is used. See: https://mariadb.com/docs/server/reference/sql-statements/administrative-sql-statements/replication-statements/change-master-to#master_use_gtid.

    Enum: [CurrentPos SlavePos]

    connectionRetrySeconds integer

    ConnectionRetrySeconds is the number of seconds that the replica will wait between connection retries. See: https://mariadb.com/docs/server/reference/sql-statements/administrative-sql-statements/replication-statements/change-master-to#master_connect_retry.

    primary PrimaryReplication

    Primary is the replication configuration for the primary node.

    replica ReplicaReplication

    ReplicaReplication is the replication configuration for the replica nodes.

    gtidStrictMode boolean

    GtidStrictMode determines whether the GTID strict mode is enabled. See: https://mariadb.com/docs/server/ha-and-performance/standard-replication/gtid#gtid_strict_mode. It is enabled by default.

    primary PrimaryReplication

    Primary is the replication configuration for the primary node.

    replica ReplicaReplication

    ReplicaReplication is the replication configuration for the replica nodes.

    gtidStrictMode boolean

    GtidStrictMode determines whether the GTID strict mode is enabled. See: https://mariadb.com/docs/server/ha-and-performance/standard-replication/gtid#gtid_strict_mode. It is enabled by default.

    apiVersion string

    enterprise.mariadb.com/v1alpha1

    kind string

    Restore

    metadata ObjectMeta

    Refer to Kubernetes API documentation for fields of metadata.

    backupRef LocalObjectReference

    BackupRef is a reference to a Backup object. It has priority over S3 and Volume.

    s3 S3

    S3 defines the configuration to restore backups from a S3 compatible storage. It has priority over Volume.

    volume StorageVolumeSource

    Volume is a Kubernetes Volume object that contains a backup.

    args string array

    Args to be used in the Container.

    resources ResourceRequirements

    Resources describes the compute resource requirements.

    securityContext SecurityContext

    SecurityContext holds security configuration that will be applied to a container.

    bucket string

    Bucket is the name Name of the bucket to store backups.

    Required: {}

    endpoint string

    Endpoint is the S3 API endpoint without scheme.

    Required: {}

    region string

    Region is the S3 region name to use.

    requeueInterval Duration

    RequeueInterval is used to perform requeue reconciliations.

    retryInterval Duration

    RetryInterval is the interval used to perform retries.

    cleanupPolicy CleanupPolicy

    CleanupPolicy defines the behavior for cleaning up a SQL resource.

    rsync

    SSTRsync is an SST based on rsync.

    mariabackup

    SSTMariaBackup is an SST based on mariabackup. It is the recommended SST.

    mysqldump

    SSTMysqldump is an SST based on mysqldump.

    cron string

    Cron is a cron expression that defines the schedule.

    Required: {}

    suspend boolean

    Suspend defines whether the schedule is active or not.

    false

    name string

    key string

    metadata Metadata

    Refer to Kubernetes API documentation for fields of metadata.

    key string

    Key to be used in the Secret.

    format string

    Format to be used in the Secret.

    secretName string

    defaultMode integer

    capabilities Capabilities

    privileged boolean

    runAsUser integer

    prometheusRelease string

    PrometheusRelease is the release label to add to the ServiceMonitor object.

    jobLabel string

    JobLabel to add to the ServiceMonitor object.

    interval string

    Interval for scraping metrics.

    name string

    port integer

    readwritesplit

    ServiceRouterReadWriteSplit splits the load based on the queries. Write queries are performed on master and read queries on the replicas.

    readconnroute

    ServiceRouterReadConnRoute splits the load based on the connections. Each connection is assigned to a server.

    type ServiceType

    Type is the Service type. One of ClusterIP, NodePort or LoadBalancer. If not defined, it defaults to ClusterIP.

    ClusterIP

    Enum: [ClusterIP NodePort LoadBalancer]

    metadata Metadata

    Refer to Kubernetes API documentation for fields of metadata.

    loadBalancerIP string

    LoadBalancerIP Service field.

    apiVersion string

    enterprise.mariadb.com/v1alpha1

    kind string

    SqlJob

    metadata ObjectMeta

    Refer to Kubernetes API documentation for fields of metadata.

    args string array

    Args to be used in the Container.

    resources ResourceRequirements

    Resources describes the compute resource requirements.

    securityContext SecurityContext

    SecurityContext holds security configuration that will be applied to a container.

    ephemeral boolean

    Ephemeral indicates whether to use ephemeral storage in the PVCs. It is only compatible with non HA MariaDBs.

    size Quantity

    Size of the PVCs to be mounted by MariaDB. Required if not provided in 'VolumeClaimTemplate'. It supersedes the storage size specified in 'VolumeClaimTemplate'.

    storageClassName string

    StorageClassName to be used to provision the PVCS. It supersedes the 'StorageClassName' specified in 'VolumeClaimTemplate'. If not provided, the default 'StorageClass' configured in the cluster is used.

    emptyDir EmptyDirVolumeSource

    nfs NFSVolumeSource

    csi CSIVolumeSource

    suspend boolean

    Suspend indicates whether the current resource should be suspended or not. This can be useful for maintenance, as disabling the reconciliation prevents the operator from interfering with user operations during maintenance activities.

    false

    port IntOrString

    host string

    enabled boolean

    Enabled indicates whether TLS is enabled, determining if certificates should be issued and mounted to the MariaDB instance. It is enabled by default.

    required boolean

    Required specifies whether TLS must be enforced for all connections. User TLS requirements take precedence over this. It disabled by default.

    versions string array

    Versions specifies the supported TLS versions for this MariaDB instance. By default, the MariaDB's default supported versions are used. See: https://mariadb.com/kb/en/ssltls-system-variables/#tls_version.

    caLifetime Duration

    CALifetime defines the CA certificate validity.

    certLifetime Duration

    CertLifetime defines the certificate validity.

    privateKeyAlgorithm string

    PrivateKeyAlgorithm is the algorithm to be used for the CA and leaf certificate private keys. One of: ECDSA or RSA

    ssl boolean

    SSL indicates that the user must connect via TLS.

    x509 boolean

    X509 indicates that the user must provide a valid x509 certificate to connect.

    issuer string

    Issuer indicates that the TLS certificate provided by the user must be issued by a specific issuer.

    enabled boolean

    Enabled is a flag to enable TLS.

    caSecretKeyRef SecretKeySelector

    CASecretKeyRef is a reference to a Secret key containing a CA bundle in PEM format used to establish TLS connections with S3. By default, the system trust chain will be used, but you can use this field to add more CAs to the bundle.

    maxSkew integer

    topologyKey string

    whenUnsatisfiable UnsatisfiableConstraintAction

    name string

    Name of the referent.

    kind string

    Kind of the referent.

    type UpdateType

    Type defines the type of updates. One of ReplicasFirstPrimaryLast, RollingUpdate or OnDelete. If not defined, it defaults to ReplicasFirstPrimaryLast.

    ReplicasFirstPrimaryLast

    Enum: [ReplicasFirstPrimaryLast RollingUpdate OnDelete Never]

    rollingUpdate RollingUpdateStatefulSetStrategy

    RollingUpdate defines parameters for the RollingUpdate type.

    autoUpdateDataPlane boolean

    AutoUpdateDataPlane indicates whether the Galera data-plane version (agent and init containers) should be automatically updated based on the operator version. It defaults to false. Updating the operator will trigger updates on all the MariaDB instances that have this flag set to true. Thus, it is recommended to progressively set this flag after having updated the operator.

    ReplicasFirstPrimaryLast

    ReplicasFirstPrimaryLastUpdateType indicates that the update will be applied to all replica Pods first and later on to the primary Pod. The updates are applied one by one waiting until each Pod passes the readiness probe i.e. the Pod gets synced and it is ready to receive traffic.

    RollingUpdate

    RollingUpdateUpdateType indicates that the update will be applied by the StatefulSet controller using the RollingUpdate strategy. This strategy is unaware of the roles that the Pod have (primary or replica) and it will perform the update following the StatefulSet ordinal, from higher to lower.

    OnDelete

    OnDeleteUpdateType indicates that the update will be applied by the StatefulSet controller using the OnDelete strategy. The update will be done when the Pods get manually deleted by the user.

    Never

    NeverUpdateType indicates that the StatefulSet will never be updated. This can be used to roll out updates progressively to a fleet of instances.

    apiVersion string

    enterprise.mariadb.com/v1alpha1

    kind string

    User

    metadata ObjectMeta

    Refer to Kubernetes API documentation for fields of metadata.

    requeueInterval Duration

    RequeueInterval is used to perform requeue reconciliations.

    retryInterval Duration

    RetryInterval is the interval used to perform retries.

    cleanupPolicy CleanupPolicy

    CleanupPolicy defines the behavior for cleaning up a SQL resource.

    name string

    emptyDir EmptyDirVolumeSource

    nfs NFSVolumeSource

    accessModes PersistentVolumeAccessMode array

    selector LabelSelector

    resources VolumeResourceRequirements

    name string

    This must match the Name of a Volume.

    readOnly boolean

    mountPath string

    emptyDir EmptyDirVolumeSource

    nfs NFSVolumeSource

    csi CSIVolumeSource

    AfterSync

    WaitPointAfterSync indicates that the primary waits for the replica ACK before committing the transaction to the storage engine. It trades off performance for consistency.

    AfterCommit

    WaitPointAfterCommit indicates that the primary commits the transaction to the storage engine and waits for the replica ACK afterwards. It trades off consistency for performance.

    weight integer

    podAffinityTerm PodAffinityTerm

    Backup
    Connection
    Database
    ExternalMariaDB
    AffinityConfig
    BackupSpec
    Exporter
    Job
    JobPodTemplate
    Galera
    GaleraSpec
    Replication
    ReplicationSpec
    BootstrapFrom
    Backup
    BackupSpec
    BootstrapFrom
    PhysicalBackupSpec
    RestoreSource
    BackupSpec
    Agent
    MariaDBSpec
    StorageVolumeSource
    Volume
    VolumeSource
    DatabaseSpec
    GrantSpec
    SQLTemplate
    UserSpec
    BackupSpec
    PhysicalBackupSpec
    EnvVarSource
    MariaDBSpec
    SqlJobSpec
    Volume
    VolumeSource
    Connection
    ConnectionSpec
    ExternalMariaDBSpec
    MariaDBMaxScaleSpec
    MariaDBSpec
    MariaDBSpec
    PodTemplate
    Agent
    InitContainer
    MariaDBSpec
    MaxScaleSpec
    MaxScaleMonitor
    BackupSpec
    SqlJobSpec
    Database
    StorageVolumeSource
    Volume
    VolumeSource
    Agent
    ContainerTemplate
    InitContainer
    MariaDBSpec
    Agent
    Container
    ContainerTemplate
    InitContainer
    EnvVar
    Probe
    ProbeHandler
    MariadbMetrics
    MaxScaleMetrics
    ExternalMariaDB
    MariaDBSpec
    Galera
    GaleraSpec
    Galera
    GaleraSpec
    Galera
    GaleraSpec
    GaleraRecovery
    Galera
    BasicAuth
    MariaDBSpec
    MariadbMetrics
    MaxScaleAuth
    Grant
    ReplicaReplication
    Probe
    ProbeHandler
    ConnectionSpec
    ConnectionTemplate
    StorageVolumeSource
    Volume
    VolumeSource
    Galera
    GaleraSpec
    Replication
    ReplicationSpec
    BootstrapFrom
    ReplicaBootstrapFrom
    BackupSpec
    PhysicalBackupSpec
    RestoreSpec
    SqlJobSpec
    BackupSpec
    RestoreSpec
    SqlJobSpec
    Agent
    PodAffinityTerm
    LabelSelector
    BackupSpec
    BootstrapFrom
    CSIVolumeSource
    ConfigMapKeySelector
    MariaDBSpec
    BackupSpec
    ConnectionSpec
    DatabaseSpec
    GrantSpec
    MariaDB
    MariaDBSpec
    MariaDBMaxScaleSpec
    MaxScaleSpec
    MariaDBMaxScaleSpec
    MaxScaleSpec
    MariaDBMaxScaleSpec
    MaxScaleSpec
    MaxScaleConfig
    MaxScaleService
    MariaDBMaxScaleSpec
    MaxScaleSpec
    MariaDBMaxScaleSpec
    MaxScaleSpec
    MaxScaleSpec
    MaxScaleSpec
    MariaDBMaxScaleSpec
    MaxScaleSpec
    MaxScale
    MariaDBMaxScaleSpec
    MaxScaleSpec
    BackupSpec
    Exporter
    ExternalMariaDBSpec
    GaleraInitJob
    MaxScaleMonitor
    StorageVolumeSource
    Volume
    VolumeSource
    Affinity
    AffinityConfig
    NodeAffinity
    NodeSelectorTerm
    NodeSelector
    PreferredSchedulingTerm
    EnvVarSource
    ConnectionSpec
    MariaDBRef
    MariaDBSpec
    MariaDBSpec
    UserSpec
    BackupStagingStorage
    BackupStorage
    PhysicalBackupStorage
    VolumeClaimTemplate
    StorageVolumeSource
    Volume
    VolumeSource
    PhysicalBackupSpec
    PhysicalBackupSpec
    PhysicalBackup
    PhysicalBackupSpec
    PhysicalBackupStorage
    PodAntiAffinity
    WeightedPodAffinityTerm
    Affinity
    AffinityConfig
    MariaDBMaxScaleSpec
    MariaDBSpec
    MaxScaleSpec
    BackupSpec
    Exporter
    JobPodTemplate
    MariaDBSpec
    MariaDBSpec
    NodeAffinity
    Galera
    GaleraSpec
    Replication
    ReplicationSpec
    Agent
    ContainerTemplate
    InitContainer
    MariaDBSpec
    Probe
    ReplicaReplication
    ReplicaReplication
    Replication
    ReplicationSpec
    MariaDBSpec
    Replication
    Agent
    BackupSpec
    Container
    ContainerTemplate
    RestoreSpec
    Restore
    BackupStorage
    BootstrapFrom
    PhysicalBackupStorage
    RestoreSource
    DatabaseSpec
    GrantSpec
    UserSpec
    Galera
    GaleraSpec
    BackupSpec
    SqlJobSpec
    ConnectionSpec
    EnvVarSource
    ExternalMariaDBSpec
    GeneratedSecretKeyRef
    ConnectionSpec
    ConnectionTemplate
    Volume
    VolumeSource
    Agent
    BackupSpec
    ContainerTemplate
    Exporter
    MariadbMetrics
    MaxScaleMetrics
    MariaDBSpec
    MaxScaleService
    MariaDBMaxScaleSpec
    MariaDBSpec
    MaxScaleSpec
    SqlJob
    MariaDBSpec
    BackupStagingStorage
    BackupStorage
    BootstrapFrom
    PhysicalBackupStorage
    MariaDBSpec
    MaxScaleListener
    MaxScaleMonitor
    MaxScaleService
    Probe
    ProbeHandler
    ExternalMariaDBSpec
    MariaDBSpec
    MaxScaleTLS
    TLS
    UserSpec
    S3
    MariaDBSpec
    MaxScalePodTemplate
    MaxScaleSpec
    PodTemplate
    BootstrapFrom
    MariaDBSpec
    UpdateStrategy
    User
    MariaDBSpec
    PodTemplate
    GaleraConfig
    MaxScaleConfig
    Storage
    Agent
    Container
    ContainerTemplate
    InitContainer
    Volume
    Replication
    ReplicationSpec
    PodAntiAffinity

    Enum: [Logical Physical]

    Enum: [Always Never IfNotPresent]

    Enum: [Skip Delete]

    Enum: [Skip Delete]

    Enum: [Always Never IfNotPresent]

    Required: {}

    Enum: [readwritesplit readconnroute] Required: {}

    items:Enum: [TLSv10 TLSv11 TLSv12 TLSv13 MAX]

    Enum: [Skip Delete]

    items:Enum: [TLSv1.0 TLSv1.1 TLSv1.2 TLSv1.3]

    Enum: [ECDSA RSA]

    Enum: [Skip Delete]

    EnvFromSource
    VolumeMount
    Probe
    Probe
    Probe
    ResourceRequirements
    SecurityContext
    PullPolicy
    KubernetesAuth
    BasicAuth
    Duration
    BackupSpec
    Metadata
    LocalObjectReference
    PodSecurityContext
    AffinityConfig
    Toleration
    MariaDBRef
    CompressAlgorithm
    BackupStagingStorage
    BackupStorage
    Schedule
    Duration
    RestartPolicy
    Metadata
    S3
    StorageVolumeSource
    Time
    BackupStagingStorage
    Job
    LocalObjectReference
    ConnectionSpec
    MariaDBRef
    ObjectReference
    SecretKeySelector
    LocalObjectReference
    EnvVar
    VolumeMount
    ResourceRequirements
    EnvFromSource
    VolumeMount
    Probe
    Probe
    Probe
    ResourceRequirements
    SecurityContext
    DatabaseSpec
    MariaDBRef
    ResourceRequirements
    Metadata
    SecurityContext
    PodSecurityContext
    AffinityConfig
    Toleration
    ExternalMariaDBSpec
    Metadata
    SecretKeySelector
    TLS
    ConnectionTemplate
    Agent
    GaleraRecovery
    InitContainer
    GaleraInitJob
    GaleraConfig
    Duration
    Duration
    Duration
    Duration
    Duration
    Duration
    GaleraRecoveryJob
    Agent
    GaleraRecovery
    InitContainer
    GaleraInitJob
    GaleraConfig
    GrantSpec
    MariaDBRef
    URIScheme
    EnvFromSource
    VolumeMount
    Probe
    Probe
    Probe
    ResourceRequirements
    SecurityContext
    PullPolicy
    Toleration
    ResourceRequirements
    AffinityConfig
    Toleration
    MariaDBSpec
    MaxScaleService
    MaxScaleMonitor
    MaxScaleAdmin
    MaxScaleConfig
    MaxScaleAuth
    MaxScaleMetrics
    MaxScaleTLS
    ConnectionTemplate
    PodDisruptionBudget
    StatefulSetUpdateStrategy
    ServiceTemplate
    ServiceTemplate
    Duration
    EnvFromSource
    VolumeMount
    Probe
    Probe
    Probe
    ResourceRequirements
    SecurityContext
    Metadata
    LocalObjectReference
    Container
    Container
    PodSecurityContext
    AffinityConfig
    Toleration
    Volume
    TopologySpreadConstraint
    PullPolicy
    Metadata
    GeneratedSecretKeyRef
    GeneratedSecretKeyRef
    SecretKeySelector
    PasswordPlugin
    ConfigMapKeySelector
    BootstrapFrom
    Storage
    MariadbMetrics
    TLS
    Replication
    Galera
    ObjectReference
    MariaDBMaxScaleSpec
    ServicePort
    PodDisruptionBudget
    UpdateStrategy
    ServiceTemplate
    ConnectionTemplate
    ServiceTemplate
    ConnectionTemplate
    ServiceTemplate
    ConnectionTemplate
    GeneratedSecretKeyRef
    MaxScaleSpec
    GeneratedSecretKeyRef
    GeneratedSecretKeyRef
    GeneratedSecretKeyRef
    GeneratedSecretKeyRef
    GeneratedSecretKeyRef
    Duration
    CooperativeMonitoring
    AffinityConfig
    Toleration
    TopologySpreadConstraint
    MaxScaleListener
    EnvFromSource
    VolumeMount
    Probe
    Probe
    Probe
    ResourceRequirements
    SecurityContext
    Metadata
    LocalObjectReference
    PodSecurityContext
    AffinityConfig
    Toleration
    TopologySpreadConstraint
    MariaDBRef
    MaxScaleServer
    PullPolicy
    Metadata
    MaxScaleService
    MaxScaleMonitor
    MaxScaleAdmin
    MaxScaleConfig
    MaxScaleAuth
    MaxScaleMetrics
    MaxScaleTLS
    ConnectionTemplate
    PodDisruptionBudget
    StatefulSetUpdateStrategy
    ServiceTemplate
    ServiceTemplate
    Duration
    LocalObjectReference
    LocalObjectReference
    ObjectReference
    TLSConfig
    LocalObjectReference
    LocalObjectReference
    ObjectReference
    TLSConfig
    LocalObjectReference
    LocalObjectReference
    PhysicalBackupSpec
    Toleration
    Metadata
    LocalObjectReference
    PodSecurityContext
    Toleration
    MariaDBRef
    CompressAlgorithm
    BackupStagingStorage
    PhysicalBackupStorage
    PhysicalBackupSchedule
    Duration
    Duration
    RestartPolicy
    Metadata
    PhysicalBackupVolumeSnapshot
    PodFSGroupChangePolicy
    SeccompProfile
    AppArmorProfile
    Container
    PodSecurityContext
    AffinityConfig
    Toleration
    Volume
    TopologySpreadConstraint
    Duration
    ReplicaBootstrapFrom
    ReplicaRecovery
    Duration
    WaitPoint
    InitContainer
    Agent
    Duration
    WaitPoint
    InitContainer
    Agent
    RestoreSpec
    Time
    BackupStagingStorage
    Metadata
    LocalObjectReference
    PodSecurityContext
    AffinityConfig
    Toleration
    LocalObjectReference
    S3
    StorageVolumeSource
    Time
    BackupStagingStorage
    MariaDBRef
    RestartPolicy
    Metadata
    SecretKeySelector
    SecretKeySelector
    SecretKeySelector
    TLSS3
    ServiceExternalTrafficPolicyType
    ServiceAffinity
    SqlJobSpec
    Metadata
    LocalObjectReference
    PodSecurityContext
    AffinityConfig
    Toleration
    MariaDBRef
    Schedule
    SecretKeySelector
    LocalObjectReference
    LocalObjectReference
    LocalObjectReference
    ConfigMapKeySelector
    RestartPolicy
    Metadata
    VolumeClaimTemplate
    HostPathVolumeSource
    PersistentVolumeClaimVolumeSource
    LocalObjectReference
    LocalObjectReference
    ObjectReference
    TLSConfig
    LocalObjectReference
    LocalObjectReference
    ObjectReference
    TLSConfig
    LabelSelector
    NodeInclusionPolicy
    NodeInclusionPolicy
    UserSpec
    MariaDBRef
    SecretKeySelector
    SecretKeySelector
    PasswordPlugin
    TLSRequirements
    CSIVolumeSource
    HostPathVolumeSource
    PersistentVolumeClaimVolumeSource
    SecretVolumeSource
    ConfigMapVolumeSource
    Metadata
    HostPathVolumeSource
    PersistentVolumeClaimVolumeSource
    SecretVolumeSource
    ConfigMapVolumeSource
    MariaDB Enterprise Repository - "MariaDB Tools"
    MariaDB Server
    Set up the repository for each monitored MariaDB Server and MaxScale
    MariaDB Enterprise Docker Registry
    MariaDB Enterprise Repository - "MariaDB Tools"
    CREATE USER
    GRANT
    privileges supported by MariaDB
    CREATE DATABASE
    strict-password-validation
    MariaDB authentication plugins
    MariaDB PASSWORD
    MariaDB authentication plugins
    MariaDB docs
    configuration file (my.cnf)
    configuration option
    system variable
    MariaDB docs
    MariaDB docs
    MariaDB docs

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.

    This page is: Copyright © 2025 MariaDB. All rights reserved.