Mariadb Helm

MariaDB Operator — Helm Charts

Repository: https://mariadb-operator.github.io/mariadb-operator
OCI: oci://ghcr.io/mariadb-operator/charts

Charts (3)

App version: 26.6.0
Images: ghcr.io/mariadb-operator/mariadb-operator:26.6.0 (single image used for controller, webhook, cert-controller)

Quick Install

helm repo add mariadb-operator https://mariadb-operator.github.io/mariadb-operator
helm repo update

# 1. Install CRDs (separate chart to prevent accidental deletion)
helm install mariadb-operator-crds mariadb-operator/mariadb-operator-crds \
  --version 26.6.0

# 2. Install operator
helm install mariadb-operator mariadb-operator/mariadb-operator \
  --namespace mariadb-operator --create-namespace \
  --version 26.6.0

# 3. (Optional) Provision a MariaDB cluster
helm install mariadb-cluster mariadb-operator/mariadb-cluster \
  --namespace mariadb-operator \
  --version 26.6.0

Using OCI Registry

helm pull oci://ghcr.io/mariadb-operator/charts/mariadb-operator --version 26.6.0
helm pull oci://ghcr.io/mariadb-operator/charts/mariadb-operator-crds --version 26.6.0
helm pull oci://ghcr.io/mariadb-operator/charts/mariadb-cluster --version 26.6.0

mariadb-operator-crds

Manages CRDs independently. Safer than crds.enabled: true on the operator chart.

helm install mariadb-operator-crds mariadb-operator/mariadb-operator-crds \
  --version 26.6.0

This chart has no values — it only ships CRDs.

mariadb-operator

Deploys the controller, webhook, cert-controller, RBAC, service accounts, and ServiceMonitors.

Requirements

• Kubernetes >= 1.26
• Prometheus operator (optional, for ServiceMonitors)
• cert-manager (optional, for webhook certs — otherwise cert-controller handles them)

Installation with HA

helm install mariadb-operator mariadb-operator/mariadb-operator \
  --namespace mariadb-operator \
  --set ha.enabled=true \
  --set 'metrics.enabled=true' \
  --set 'webhook.ha.enabled=true' \
  --set 'certController.ha.enabled=true'

Key Values

Controller

Metrics

Webhook

Cert-Controller

Config (operator defaults)

HA Production Example

ha:
  enabled: true
  replicas: 3
metrics:
  enabled: true
  serviceMonitor:
    enabled: true
webhook:
  enabled: true
  ha:
    enabled: true
    replicas: 3
  cert:
    certManager:
      enabled: true
      issuerRef:
        name: letsencrypt-prod
        kind: ClusterIssuer
certController:
  enabled: true
  ha:
    enabled: true
    replicas: 3
affinity:
  podAntiAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
      - labelSelector:
          matchExpressions:
            - key: app.kubernetes.io/name
              operator: In
              values:
                - mariadb-operator
        topologyKey: kubernetes.io/hostname
resources:
  requests:
    cpu: 100m
    memory: 64Mi
  limits:
    cpu: 500m
    memory: 256Mi
pdb:
  enabled: true
  maxUnavailable: 1

mariadb-cluster

Provisions a MariaDB cluster (CRD resources). Generates MariaDB, Database, User, Grant, Backup, etc. CRs.

Requirements

• mariadb-operator-crds installed
• mariadb-operator deployed and running

Installation

helm install mariadb-cluster mariadb-operator/mariadb-cluster \
  --namespace mariadb-operator \
  --version 26.6.0 \
  --set mariadb.replicas=3 \
  --set mariadb.galera.enabled=true \
  --set mariadb.storage.size=10Gi

Key Values

MariaDB CR

Databases, Users, Grants

Backups

Cluster with Apps Example

mariadb:
  replicas: 3
  galera:
    enabled: true
  storage:
    size: 50Gi
  rootPasswordSecretKeyRef:
    generate: true

databases:
  - name: myapp
    characterSet: utf8mb4
    collate: utf8mb4_unicode_ci

users:
  - name: myapp
    passwordSecretKeyRef:
      name: myapp-password
      key: password
      generate: true
    maxUserConnections: 50

grants:
  - name: myapp-rw
    privileges:
      - "ALL PRIVILEGES"
    database: "myapp"
    table: "*"
    username: myapp
    grantOption: true

backups:
  - name: nightly-s3
    schedule:
      cron: "0 0 * * *"
    compression: gzip
    maxRetention: 720h
    storage:
      s3:
        bucket: mariadb-backups
        prefix: cluster
        endpoint: s3.amazonaws.com
        region: us-east-1
        accessKeyIdSecretKeyRef:
          name: s3-creds
          key: access-key-id
        secretAccessKeySecretKeyRef:
          name: s3-creds
          key: secret-access-key

Upgrading

helm repo update

# Upgrade CRDs first
helm upgrade mariadb-operator-crds mariadb-operator/mariadb-operator-crds \
  --version 26.6.0

# Then upgrade operator
helm upgrade mariadb-operator mariadb-operator/mariadb-operator \
  --namespace mariadb-operator \
  --version 26.6.0 \
  --values values.yaml

Upgrade Notes

• Upgrade CRDs before the operator to ensure schema compatibility.
• Controller restarts are expected during upgrade (webhook certs may need re-issuance).
• MariaDB clusters managed by the operator are not affected by operator upgrades.
• Check the GitHub releases for breaking changes.

Uninstalling

# Uninstall cluster first (this deletes MariaDB CRs = data loss)
helm uninstall mariadb-cluster --namespace mariadb-operator

# Uninstall operator
helm uninstall mariadb-operator --namespace mariadb-operator

# Uninstall CRDs (⚠️ DELETES ALL MariaDB CRs in the cluster)
helm uninstall mariadb-operator-crds

⚠️ WARNING: If crds.enabled: true was set on mariadb-operator, uninstalling it deletes ALL CRDs, which cascades to delete ALL MariaDB instances across ALL namespaces.

Common Mistakes

• CRDs not installed first — Without mariadb-operator-crds, the operator and cluster chart fail with "no matching CRD found".
• crds.enabled: true risk — Only set during initial deploy. If you uninstall the operator chart with this enabled, all MariaDB instances are deleted.
• mariadb-cluster without operator — The cluster chart CRs require the operator running to reconcile.
• Metrics ServiceMonitor needs prometheus-operator — ServiceMonitors require the prometheus-operator CRDs installed.
• cert-manager vs cert-controller — Default is cert-controller (built-in). Set webhook.cert.certManager.enabled: true to use cert-manager instead.
• HA without anti-affinity — Controller replicas may schedule on the same node. Set affinity.podAntiAffinity for true HA.
• Default image tags — Operator defaults to mariadb 11.8.8 and maxscale 23.08.5. Override config.* to change defaults.
• logLevel — Valid values: DEBUG, INFO, WARN, ERROR. Default is INFO.
• currentNamespaceOnly — When true, operator only watches CRs in its own namespace. Doesn't affect cluster-scoped CRDs.
• Root password auto-generation — generate: true on rootPasswordSecretKeyRef creates the Secret automatically. Don't create a Secret with the same name.