Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Running MariaDB Server on Kubernetes: Discover ...

Running MariaDB Server on Kubernetes: Discover how to run MariaDB in Kubernetes using the MariaDB Operator

This session on MariaDB Operator for Kubernetes was presented at MariaDB & MySQL on Kubernetes

Avatar for lefred

lefred

June 25, 2026

More Decks by lefred

Other Decks in Technology

Transcript

  1. Running MariaDB Server on Kubernetes Discover How To Run MariaDB

    in Kubernetes Using the MariaDB Operator Frédéric Descamps Community Advocate MariaDB Foundation DB Mastery Series - June 2026
  2. • @lefred • @lefredbe.bsky.social • @[email protected] • MariaDB Community Advocate

    since 2026 • using MySQL since version 3.20 • devops believer • living in • https://lefred.be Frédéric Descamps Copyright @ 2026 MariaDB Foundation. 3
  3. Why Companies Support the MariaDB Foundation Companies support the Foundation

    to participate in how MariaDB-based systems are defined and adopted. Supporting the Foundation complements investment in MariaDB by: • strengthening the ecosystem in which MariaDB is used • improving how technologies are positioned within real architectures • increasing visibility at the point of infrastructure decision Support also ensures: • long-term openness and continuity of MariaDB Server • independent governance and freedom from lock-in Copyright @ 2026 MariaDB Foundation. 8
  4. • stable identity • durable storage • ordered startup/shutdown •

    backups and restores • upgrades • failover • safe day-2 operations Why this talk? Kubernetes is excellent at keeping containers running. Databases need more: The operator turns database runbooks into Kubernetes reconciliation. Copyright @ 2026 MariaDB Foundation. 12
  5. Agenda 1. The Kubernetes primitives MariaDB depends on 2. What

    the MariaDB Operator adds 3. Installing the operator 4. Creating a first MariaDB instance 5. Databases, users, grants and app connections 6. Backups, restore and high availability 7. Practical tips for production Copyright @ 2026 MariaDB Foundation. 13
  6. First principle Do not start with "How do I run

    a container?" Copyright @ 2026 MariaDB Foundation. 14
  7. First principle Do not start with "How do I run

    a container?" Start with "How do I operate the database?" Copyright @ 2026 MariaDB Foundation. 14
  8. First principle Do not start with "How do I run

    a container?" Start with "How do I operate the database?" Database operations include provisioning, configuration, access, lifecycle, backups, restore, failover, observability and upgrades. Copyright @ 2026 MariaDB Foundation. 14
  9. First principle Do not start with "How do I run

    a container?" Start with "How do I operate the database?" Database operations include provisioning, configuration, access, lifecycle, backups, restore, failover, observability and upgrades. Database provisioning is the process of setting up, and preparing a database to be used by applications or users. It encompasses installing the necessary database software, defining the schema, allocating storage, applying security settings, and ensuring it is ready for deployment. It often includes adding data to the database too (from a backup). Copyright @ 2026 MariaDB Foundation. 14
  10. • Pod: runs MariaDB Server containers • Service: stable network

    endpoint • Secret: credentials • ConfigMap: configuration • PersistentVolumeClaim: storage request • StatefulSet: stable identity + ordered lifecycle • CustomResourceDefinition: new Kubernetes API types • Controller / Operator: reconciliation loop Kubernetes objects you will meet Copyright @ 2026 MariaDB Foundation. 15
  11. Why StatefulSet matters? StatefulSet gives stateful workloads: • predictable Pod

    names and DNS names • stable persistent storage per Pod • ordered graceful deployment and rolling updates This is a major building block for databases. Copyright @ 2026 MariaDB Foundation. 16
  12. Why StatefulSet matters? StatefulSet gives stateful workloads: • predictable Pod

    names and DNS names • stable persistent storage per Pod • ordered graceful deployment and rolling updates This is a major building block for databases. But StatefulSet is not a DBA. Copyright @ 2026 MariaDB Foundation. 16
  13. Why StatefulSet matters? StatefulSet gives stateful workloads: • predictable Pod

    names and DNS names • stable persistent storage per Pod • ordered graceful deployment and rolling updates This is a major building block for databases. But StatefulSet is not a DBA. Copyright @ 2026 MariaDB Foundation. StatefulSets are essential for applications where each instance needs to remember "who it is" and "where its data is". Comparison: Deployment vs. StatefulSet +--------------+--------------------------------+-----------------------------+ | Feature | Deployment | StatefulSet | +--------------+--------------------------------+-----------------------------+ | Pod Identity | Identical/Interchangeable | Unique/Sticky | | Naming | Random suffix (e.g., web-ab12) | Ordinal index (e.g., web-0) | | Storage | Shared or ephemeral | Dedicated per Pod | | Startup | Order Parallel (any order) | Sequential (ordered) | | Updates | Rolling update | Ordered rolling update | +--------------+--------------------------------+-----------------------------+ 16
  14. StatefulSet gives you • identity • storage binding • ordered

    lifecycle • restart behavior StatefulSet is necessary, not sufficient Copyright @ 2026 MariaDB Foundation. 18
  15. StatefulSet gives you • identity • storage binding • ordered

    lifecycle • restart behavior You still need • backup policy • restore workflow • users and grants • topology awareness • failure handling • safe upgrades StatefulSet is necessary, not sufficient Copyright @ 2026 MariaDB Foundation. 18
  16. • MariaDB • Database • User • Grant • Connection

    • SqlJob • Backup / Restore • PhysicalBackup / PITR-related resources • MaxScale* MariaDB What is mariadb-operator? mariadb-operator is an open source Kubernetes operator to run and operate MariaDB Server in a cloud-native way. It extends the Kubernetes API with MariaDB-specific resources such as: Copyright @ 2026 MariaDB Foundation. 20
  17. • Day-1 is the deployment and initial setup phase (building

    the database) ◦ provisioning ◦ configuration & migration ◦ schema creation • Day-2 refers to the sustained post- deployment operations phase (maintaining and running it) ◦ monitoring & alerting ◦ maintenance (backups, upgrades, ...) ◦ scaling Reminder Copyright @ 2026 MariaDB Foundation. 22
  18. Operator pattern in on slide Desired state Actual state -------------

    ------------ MariaDB YAML ---> operator ---> StatefulSet Database YAML ---> reconcile --> SQL database User YAML ---> reconcile --> SQL user Grant YAML ---> reconcile --> privileges Backup YAML ---> reconcile --> CronJob / Job The operator continuously compares desired state with actual state and acts to converge them. Copyright @ 2026 MariaDB Foundation. 23
  19. Install options Common installation paths: helm repo helm repo add

    add mariadb-operator https://helm.mariadb.com/mariadb-operator mariadb-operator https://helm.mariadb.com/mariadb-operator helm helm install install mariadb-operator-crds mariadb-operator/mariadb-operator-crds mariadb-operator-crds mariadb-operator/mariadb-operator-crds helm helm install install mariadb-operator mariadb-operator/mariadb-operator mariadb-operator mariadb-operator/mariadb-operator Also available through OperatorHub / OLM and static manifests. Copyright @ 2026 MariaDB Foundation. 24
  20. Install options Common installation paths: helm repo helm repo add

    add mariadb-operator https://helm.mariadb.com/mariadb-operator mariadb-operator https://helm.mariadb.com/mariadb-operator helm helm install install mariadb-operator-crds mariadb-operator/mariadb-operator-crds mariadb-operator-crds mariadb-operator/mariadb-operator-crds helm helm install install mariadb-operator mariadb-operator/mariadb-operator mariadb-operator mariadb-operator/mariadb-operator Also available through OperatorHub / OLM and static manifests. Copyright @ 2026 MariaDB Foundation. Install CRDs (Custom Resource Definitions) before applying any MariaDB, Database, User or Grant resources. 24
  21. Compatibility checkpoints Before a demo or production rollout, verify: •

    Kubernetes version supported by your operator release • MariaDB image compatibility • storage class behavior • CSI snapshot support if using snapshot-based backups • whether you need community operator or MariaDB Enterprise Operator Copyright @ 2026 MariaDB Foundation. 25
  22. Compatibility checkpoints Before a demo or production rollout, verify: •

    Kubernetes version supported by your operator release • MariaDB image compatibility • storage class behavior • CSI snapshot support if using snapshot-based backups • whether you need community operator or MariaDB Enterprise Operator Copyright @ 2026 MariaDB Foundation. Pin operator chart versions in GitOps; do not float on latest. 25
  23. First MariaDB Server instance apiVersion: k8s.mariadb.com/v1alpha1 kind: MariaDB metadata: name:

    mariadb spec: rootPasswordSecretKeyRef: name: mariadb-root key: password storage: size: 10Gi resources: requests: cpu: 500m memory: 1Gi limits: memory: 1Gi Copyright @ 2026 MariaDB Foundation. 26
  24. What gets created? After applying a MariaDB resource, expect Kubernetes

    objects similar to: kubectl get mariadbs kubectl get mariadbs kubectl get statefulsets kubectl get statefulsets kubectl get pods kubectl get pods kubectl get pvc kubectl get pvc kubectl get services kubectl get services The operator reconciles the MariaDB custom resource into lower-level Kubernetes objects. Copyright @ 2026 MariaDB Foundation. 27
  25. What gets created? After applying a MariaDB resource, expect Kubernetes

    objects similar to: kubectl get mariadbs kubectl get mariadbs kubectl get statefulsets kubectl get statefulsets kubectl get pods kubectl get pods kubectl get pvc kubectl get pvc kubectl get services kubectl get services The operator reconciles the MariaDB custom resource into lower-level Kubernetes objects. Copyright @ 2026 MariaDB Foundation. Teach people to inspect both the custom resource status and the generated Kubernetes objects. 27
  26. Database as code apiVersion apiVersion: : k8s.mariadb.com/v1alpha1 k8s.mariadb.com/v1alpha1 kind kind:

    : Database Database metadata metadata: : name name: : appdb appdb spec spec: : mariaDbRef mariaDbRef: : name name: : mariadb mariadb characterSet characterSet: : utf8mb4 utf8mb4 collate collate: : utf8mb4_unicode_ci utf8mb4_unicode_ci The database definition becomes a Kubernetes resource. Copyright @ 2026 MariaDB Foundation. 28
  27. User as code apiVersion apiVersion: : k8s.mariadb.com/v1alpha1 k8s.mariadb.com/v1alpha1 kind kind:

    : User User metadata metadata: : name name: : appuser appuser spec spec: : mariaDbRef mariaDbRef: : name name: : mariadb mariadb passwordSecretKeyRef passwordSecretKeyRef: : name name: : appuser appuser- -password password key key: : password password host host: : "%" "%" maxUserConnections maxUserConnections: : 50 50 Copyright @ 2026 MariaDB Foundation. 29
  28. User as code apiVersion apiVersion: : k8s.mariadb.com/v1alpha1 k8s.mariadb.com/v1alpha1 kind kind:

    : User User metadata metadata: : name name: : appuser appuser spec spec: : mariaDbRef mariaDbRef: : name name: : mariadb mariadb passwordSecretKeyRef passwordSecretKeyRef: : name name: : appuser appuser- -password password key key: : password password host host: : "%" "%" maxUserConnections maxUserConnections: : 50 50 Copyright @ 2026 MariaDB Foundation. Do not store passwords in Git; use sealed secrets, external secrets, SOPS, Vault or your platform equivalent. 29
  29. Grants as code apiVersion apiVersion: : k8s.mariadb.com/v1alpha1 k8s.mariadb.com/v1alpha1 kind kind:

    : Grant Grant metadata metadata: : name name: : appuser appuser- -appdb appdb spec spec: : mariaDbRef mariaDbRef: : name name: : mariadb mariadb privileges privileges: : - - SELECT SELECT - - INSERT INSERT - - UPDATE UPDATE - - DELETE DELETE database database: : appdb appdb table table: : "*" "*" username username: : appuser appuser host host: : "%" "%" Least privilege becomes reviewable YAML. Copyright @ 2026 MariaDB Foundation. 30
  30. Connection secrets for applications apiVersion apiVersion: : k8s.mariadb.com/v1alpha1 k8s.mariadb.com/v1alpha1 kind

    kind: : Connection Connection metadata metadata: : name name: : app app- -connection connection spec spec: : mariaDbRef mariaDbRef: : name name: : mariadb mariadb username username: : appuser appuser passwordSecretKeyRef passwordSecretKeyRef: : name name: : appuser appuser- -password password key key: : password password database database: : appdb appdb secretName secretName: : app app- -connection connection Applications mount or read the generated Secret instead of assembling DSNs (Data Source Names) manually. Copyright @ 2026 MariaDB Foundation. 31
  31. Use cases: • schema bootstrap • small repeatable migrations •

    demo data • operational one-shot scripts kind kind: : SqlJob SqlJob spec spec: : mariaDbRef mariaDbRef: : name name: : mariadb mariadb database database: : appdb appdb sql sql: : | | CREATE TABLE IF NOT EXISTS CREATE TABLE IF NOT EXISTS demo(id INT PRIMARY KEY); demo(id INT PRIMARY KEY); SQL jobs SqlJob lets you run SQL through Kubernetes Jobs. Copyright @ 2026 MariaDB Foundation. 32
  32. Use cases: • schema bootstrap • small repeatable migrations •

    demo data • operational one-shot scripts kind kind: : SqlJob SqlJob spec spec: : mariaDbRef mariaDbRef: : name name: : mariadb mariadb database database: : appdb appdb sql sql: : | | CREATE TABLE IF NOT EXISTS CREATE TABLE IF NOT EXISTS demo(id INT PRIMARY KEY); demo(id INT PRIMARY KEY); SQL jobs SqlJob lets you run SQL through Kubernetes Jobs. Copyright @ 2026 MariaDB Foundation. Keep complex migrations in a dedicated migration tool; use SqlJob where Kubernetes-native orchestration helps. 32
  33. Backup: make it boring apiVersion apiVersion: : k8s.mariadb.com/v1alpha1 k8s.mariadb.com/v1alpha1 kind

    kind: : Backup Backup metadata metadata: : name name: : backup backup- -daily daily spec spec: : mariaDbRef mariaDbRef: : name name: : mariadb mariadb schedule schedule: : cron cron: : "0 2 * * *" "0 2 * * *" maxRetentionDays maxRetentionDays: : 14 14 storage storage: : persistentVolumeClaim persistentVolumeClaim: : resources resources: : requests requests: : storage storage: : 20Gi 20Gi accessModes accessModes: : - - ReadWriteOnce ReadWriteOnce Backups should be scheduled, retained and observable. Copyright @ 2026 MariaDB Foundation. 33
  34. Restore: the test everyone skips apiVersion apiVersion: : k8s.mariadb.com/v1alpha1 k8s.mariadb.com/v1alpha1

    kind kind: : Restore Restore metadata metadata: : name name: : restore restore- -demo demo spec spec: : mariaDbRef mariaDbRef: : name name: : mariadb mariadb backupRef backupRef: : name name: : backup backup- -daily daily A backup strategy is incomplete until restore is tested. Copyright @ 2026 MariaDB Foundation. 34
  35. Restore: the test everyone skips apiVersion apiVersion: : k8s.mariadb.com/v1alpha1 k8s.mariadb.com/v1alpha1

    kind kind: : Restore Restore metadata metadata: : name name: : restore restore- -demo demo spec spec: : mariaDbRef mariaDbRef: : name name: : mariadb mariadb backupRef backupRef: : name name: : backup backup- -daily daily A backup strategy is incomplete until restore is tested. Copyright @ 2026 MariaDB Foundation. Rehearse restores in a separate namespace or cluster. Record RPO/RTO with real measurements. 34
  36. Bootstrap from backup A powerful pattern: apiVersion apiVersion: : k8s.mariadb.com/v1alpha1

    k8s.mariadb.com/v1alpha1 kind kind: : MariaDB MariaDB metadata metadata: : name name: : mariadb mariadb- -copy copy spec spec: : bootstrapFrom bootstrapFrom: : backupRef backupRef: : name name: : backup backup- -daily daily rootPasswordSecretKeyRef rootPasswordSecretKeyRef: : name name: : mariadb mariadb- -root root key key: : password password storage storage: : size size: : 10Gi 10Gi Use it for recovery drills, test environments and cloning production- like data safely. Copyright @ 2026 MariaDB Foundation. 36
  37. High availability options MariaDB on Kubernetes can use different HA

    patterns: • single instance with strong backup/ restore discipline • replication topology • Galera topology • MaxScale for routing and proxying Pick topology based on workload, failure domain, latency and operational maturity. Copyright @ 2026 MariaDB Foundation. 37
  38. High availability options MariaDB on Kubernetes can use different HA

    patterns: • single instance with strong backup/ restore discipline • replication topology • Galera topology • MaxScale for routing and proxying Pick topology based on workload, failure domain, latency and operational maturity. Copyright @ 2026 MariaDB Foundation. HA is not a checkbox; define which failures you want to survive. 37
  39. Replication example shape apiVersion apiVersion: : k8s.mariadb.com/v1alpha1 k8s.mariadb.com/v1alpha1 kind kind:

    : MariaDB MariaDB metadata metadata: : name name: : mariadb mariadb- -repl repl spec spec: : replicas replicas: : 3 3 storage storage: : size size: : 10Gi 10Gi replication replication: : enabled enabled: : true true This expresses topology intent; the operator handles much of the operational wiring. Copyright @ 2026 MariaDB Foundation. 38
  40. • routing • read/write split patterns • topology-aware access •

    a stable access layer in front of MariaDB MaxScale in the picture MaxScale can provide: Application -> Service -> MaxScale -> MariaDB Pods Copyright @ 2026 MariaDB Foundation. 39
  41. • routing • read/write split patterns • topology-aware access •

    a stable access layer in front of MariaDB MaxScale in the picture MaxScale can provide: Application -> Service -> MaxScale -> MariaDB Pods Copyright @ 2026 MariaDB Foundation. Put connection behavior in the platform, not in every application. 39
  42. Observability Watch three layers: 1. Kubernetes: Pods, PVCs, events, StatefulSets

    2. Operator: custom resource status, reconciliation errors 3. MariaDB: connections, InnoDB, replication/Galera, slow queries, backups The operator supports Prometheus-operator integration through ServiceMonitor resources. Copyright @ 2026 MariaDB Foundation. 42
  43. Observability Watch three layers: 1. Kubernetes: Pods, PVCs, events, StatefulSets

    2. Operator: custom resource status, reconciliation errors 3. MariaDB: connections, InnoDB, replication/Galera, slow queries, backups The operator supports Prometheus-operator integration through ServiceMonitor resources. Copyright @ 2026 MariaDB Foundation. Alert on failed backups and missing recent restore tests, not only CPU and memory. 42
  44. Storage tips Databases are storage-sensitive. • choose the storage class

    intentionally • understand volume binding mode • check latency, IOPS and fsync behavior • validate snapshot semantics • set realistic PVC sizes • test node drain and rescheduling Copyright @ 2026 MariaDB Foundation. 43
  45. Storage tips Databases are storage-sensitive. • choose the storage class

    intentionally • understand volume binding mode • check latency, IOPS and fsync behavior • validate snapshot semantics • set realistic PVC sizes • test node drain and rescheduling Copyright @ 2026 MariaDB Foundation. Never benchmark only in an empty cluster. 43
  46. Resource tips For MariaDB Pods: • set memory requests and

    limits deliberately • avoid CPU limits unless you know why • leave headroom for buffer pool, connections and temp tables • tune probes for startup time • keep configuration in reviewed ConfigMaps or CR fields Copyright @ 2026 MariaDB Foundation. 44
  47. Resource tips For MariaDB Pods: • set memory requests and

    limits deliberately • avoid CPU limits unless you know why • leave headroom for buffer pool, connections and temp tables • tune probes for startup time • keep configuration in reviewed ConfigMaps or CR fields Copyright @ 2026 MariaDB Foundation. OOMKilled is a database outage with a Kubernetes label. 44
  48. Security tips • use Secrets integration; never commit passwords •

    separate app users from admin users • use least privilege grants • enable TLS where required • restrict network access with NetworkPolicies • use Pod Security Standards / restricted contexts • manage image provenance and upgrades Copyright @ 2026 MariaDB Foundation. 45
  49. Security tips • use Secrets integration; never commit passwords •

    separate app users from admin users • use least privilege grants • enable TLS where required • restrict network access with NetworkPolicies • use Pod Security Standards / restricted contexts • manage image provenance and upgrades Copyright @ 2026 MariaDB Foundation. Make user and grant reviews a part of application pull requests. 45
  50. Recommended repository shape: clusters/ clusters/ prod/ prod/ mariadb-operator/ mariadb-operator/ databases/

    databases/ users/ users/ grants/ grants/ backups/ backups/ apps/ apps/ my-app/ my-app/ connection-ref.yaml connection-ref.yaml Guardrails: • separate CRD/operator rollout from database resources • pin chart and image versions • use progressive environments • review destructive cleanup policies carefully GitOps tips Copyright @ 2026 MariaDB Foundation. 46
  51. Upgrades: plan the chain Before upgrading: 1. read release notes

    2. upgrade progressively; do not skip required intermediate versions 3. confirm CRD changes 4. check backup freshness 5. test in staging with production-like data 6. monitor reconciliation after upgrade Copyright @ 2026 MariaDB Foundation. 47
  52. Upgrades: plan the chain Before upgrading: 1. read release notes

    2. upgrade progressively; do not skip required intermediate versions 3. confirm CRD changes 4. check backup freshness 5. test in staging with production-like data 6. monitor reconciliation after upgrade Copyright @ 2026 MariaDB Foundation. Treat operator upgrades like database platform upgrades, not just Helm chart upgrades. 47
  53. Troubleshooting checklist If something goes wrong, check: kubectl get mariadbs,databases,users,grants,connections,backups

    kubectl get mariadbs,databases,users,grants,connections,backups kubectl describe mariadb mariadb kubectl describe mariadb mariadb kubectl get events --sort-by kubectl get events --sort-by= =.lastTimestamp .lastTimestamp kubectl logs deploy/mariadb-operator kubectl logs deploy/mariadb-operator kubectl get sts,pod,pvc,svc kubectl get sts,pod,pvc,svc kubectl describe pod mariadb-0 kubectl describe pod mariadb-0 Copyright @ 2026 MariaDB Foundation. 48
  54. Troubleshooting checklist (2) Common causes: • CRDs missing or wrong

    version • Secret name/key mismatch • storage class problem • insufficient memory • slow startup vs probe thresholds • network policy or DNS issue Copyright @ 2026 MariaDB Foundation. 49
  55. Production readiness checklist • supported Kubernetes + operator + MariaDB

    versions • storage class tested under failure • backups scheduled and monitored • restore tested and documented • resource sizing reviewed • security model reviewed • observability dashboards and alerts • upgrade path tested • disaster recovery owner identified Copyright @ 2026 MariaDB Foundation. 50
  56. Demo Flow Running MariaDB Server on Kubernetes with the MariaDB

    Operator Copyright @ 2026 MariaDB Foundation. 51
  57. Demo flow # 1. install operator helm install mariadb-operator-crds mariadb-operator/mariadb-operator-crds

    helm install mariadb-operator mariadb-operator/mariadb-operator # 2. create secret + MariaDB kubectl apply -f 01-mariadb.yaml # 3. declare DB access kubectl apply -f 02-database.yaml kubectl apply -f 03-user.yaml kubectl apply -f 04-grant.yaml kubectl apply -f 05-connection.yaml # 4. backup and restore kubectl apply -f 06-backup.yaml kubectl apply -f 07-restore.yaml Copyright @ 2026 MariaDB Foundation. 52
  58. Key takeaways 1. StatefulSet gives MariaDB stable identity and storage,

    but not full operations. 2. The MariaDB Operator makes MariaDB operations declarative. 3. CRDs such as MariaDB, Database, User, Grant, Connection, Backup and Restore move platform work into GitOps workflows. 4. Production success depends on storage, backups, restore tests, observability and upgrade discipline. Copyright @ 2026 MariaDB Foundation. 53
  59. Resources GitHub: github.com/mariadb-operator/mariadb-operator Docs and examples: github.com/mariadb-operator/mariadb-operator/ tree/main/docs MariaDB Foundation

    article: mariadb.org/mariadb-in-kubernetes-with- mariadb-operator/ Copyright @ 2026 MariaDB Foundation. 55