Release notes v2.5.0

Release highlights

Release statusNew featuresImprovementsLimitationsUpgrade instructions

Version name: ClusterControl 2.5.0
State: Latest
First release date: July 21^st, 2026
Maintenance status: Active
Total maintenance builds: 3
Last release date: August 20^th, 2026

ClickHouse support — automated deployment of single-node and replicated clusters (with embedded ClickHouse Keeper), monitoring and alerting, backup and restore, scaling, import of existing clusters, and s9s CLI/API support, with SSL-encrypted inter-node communication. ClusterControl's first entry into the analytics / OLAP space.
Streaming PostgreSQL backups to S3 with pg_basebackup — stream backups directly to S3-compatible object storage, eliminating local disk staging.
Incremental PostgreSQL backups with pg_basebackup on PostgreSQL 17+, including S3 upload.
PostgreSQL database user management from the ClusterControl UI — create and edit users and roles, manage database/schema/table-level privileges with explicit object selectors, lock/disable/enable users, edit and reorder pg_hba.conf rules with change tracking, and search/filter users by role and status.
Usage metering and operator billing (Pay-As-You-Go) — hourly usage snapshots across the managed estate, cryptographically-sealed and independently-verifiable billing reports, and a new operator billing page in the multi-controller UI (generate, verify, export as JSON/CSV). Feature-flagged and off by default. See Usage Metering and Billing.
Cluster-wide database configuration management — change a parameter across all nodes of a cluster in a single action, with dynamic parameters applied at runtime (no restart required).
Multithreaded installation — cluster deployments now install and configure nodes in parallel, significantly reducing deployment times for PostgreSQL and MySQL clusters.

Scalable controllers pool — UI-driven upgrade of remote pool members from the main controller, automatic version-mismatch alarms, safer pool joins, and better resilience for large fleets.
Kubernetes database support — expanded GitOps workflows (database clusters and backup schedules delivered through Git pull requests), observability (structured logging, Prometheus metrics, default dashboards), more reliable cluster health reporting, and operator compatibility and security updates.
Specify custom pg_hba.conf rules during new PostgreSQL cluster deployments.
ProxySQL management moved from a pop-up dialog to a dedicated, shareable page.
Filter the audit log in the UI and export it.
Content-Security-Policy (CSP) headers implemented in the ClusterControl UI.
Redis/Valkey Sentinel logs are now included in Error Reports for easier failover debugging.
Choose between the release and LTS repositories when installing ClusterControl.
Specify a temporary directory when adding a new replica via backup.
Improved resilience of long-running backup jobs if the CMON database becomes unavailable mid-job.

High availability for the CMON controller pool continues to be hardened; some pool-HA capabilities are delivered incrementally across releases.

ClusterControl 2.5.0 is a standard (non-LTS) release. ClusterControl 2.4.0 remains the current long-term support (LTS) line.
Follow standard upgrade procedures as outlined in the documentation.

Maintenance Release: August 20^th, 2026

Build:
- clustercontrol-controller-2.5.0-23026
- clustercontrol-mcc-2.5.0-1103
- clustercontrol2-2.5.0-2481
- clustercontrol-proxy-2.5.0-223
Bug Fixes:
- Backups
  - Fixed creating a cluster from an incremental backup restored from cloud storage, which previously failed outright. Full and incremental backups to S3 can now be used as the source for a new cluster. (CLUS-8324)
  - Fixed two wal-g PostgreSQL restore correctness problems in a single change. A plain restore without a point-in-time target used to roll forward past the backup you selected — restoring a pre-drop backup could still leave the table dropped — because the wal-g path ignored the immediate-stop setting every other restore method honours. Separately, a point-in-time restore failed when the requested target was later than the last committed transaction. (CLUS-8179)
  - Fixed "Create datastore from backup" failing on recent builds for both pg_basebackup and wal-g sources. (CLUS-8379)
  - Fixed wal-g backups failing for clusters whose S3 bucket lives outside us-east-1, which previously aborted with an incorrect region error. ClusterControl also no longer overwrites an existing /etc/wal-g/wal-g.json written during host provisioning, and no longer arms a wal-g archive command on clusters that do not use wal-g as their backup method — which had disabled point-in-time recovery for pg_basebackup clusters after a node add or upgrade. (CLUS-7684)
- Security & Access Control
  - ClusterControl no longer grants SUPER to the backup user when deploying MySQL 8.0 and later. XtraBackup 8.x does not require it, so the account is now created with the minimum documented privilege set instead. (CLUS-8230)
  - Fixed the multi-controller UI logging the operator out when the billing service returned an authentication error. A service-to-service authentication failure was being misread as an expired user session, so a valid session was terminated and no diagnostic information was shown. The underlying error is now surfaced instead. (CLUS-8292)
- Monitoring & Deployment
  - Fixed HAProxy configuration changes made under Manage → Configuration not taking effect. The service is now reloaded automatically after the configuration is saved. (CLUS-8235)
  - Fixed PostgreSQL 17 deployments being rejected when the PostGIS extension was selected on RHEL 9. The package is available and installable; ClusterControl was declaring the combination unsupported before reaching installation. (CLUS-8341)
  - Fixed the PostgreSQL sampler falling back to a pre-9.2 pg_stat_activity query against modern servers, which flooded the PostgreSQL log with column "procpid" does not exist errors roughly every five seconds. (CLUS-8343)
  - Fixed the PostgreSQL exporter account being created without the pg_monitor role, which caused pg_ls_waldir() scrapes to fail once a minute with permission denied on every node running an exporter. (CLUS-8370)
  - Fixed the PostgreSQL major-version upgrade path via the s9s CLI allowing unsupported version jumps — for example a direct upgrade from PostgreSQL 14 to 17. The upgrade guards now apply to standalone clusters as well. (CLUS-8299)
- Replication & Stability
  - Fixed cluster removal in controller-pool mode, where the removal job reported success but the clusters remained present. (CLUS-6791)
- UI
  - Fixed replica lag not being displayed under Nodes → Topology for TimescaleDB clusters, including PostgreSQL streaming clusters where the TimescaleDB plugin was enabled after deployment. (CLUS-8362)
  - Fixed the pg_hba "Save as preset" option in the PostgreSQL deployment wizard not appearing in the deployment preview, and being lost when a failed deployment job was retried. (CLUS-8188)

Maintenance Release: August 12^th, 2026

Build:
- clustercontrol-controller-2.5.0-22794
- clustercontrol-mcc-2.5.0-1071
- clustercontrol2-2.5.0-2453
Improvements:
- Valkey Sentinel clusters can now be deployed with transport encryption turned off, matching the behaviour already available for Redis Sentinel. The "Enable SSL encryption" toggle in the Deploy wizard is no longer forced on, and non-TLS configuration templates are selected automatically when it is disabled. (CLUS-7628, CLUS-8220)
- MySQL 8.4 deployments can now enable the legacy mysql_native_password authentication plugin through database parameter groups, easing migration from MySQL 8.0 for applications that still depend on it. (CLUS-8131)
- The ClusterControl demo environment now hides a set of administrative actions that are not appropriate for a shared demo — multi-controller, controller-pool and Kubernetes enablement, certificate deletion, and various edit paths. (CLUS-7459)
Bug Fixes:
- Backups
  - Fixed partial backup restore and verification failing on MariaDB 11.x. When the target server version could not be determined, ClusterControl passed the removed --apply-log-only flag and the deprecated mariabackup invocation, causing the backup-verification job to fail. Version detection is now recovered correctly and the obsolete options are no longer passed. (CLUS-8286)
  - Verifying a Redis or Valkey Sentinel backup on a standalone host no longer requires downloading the remi repository package from the internet, so verification now works on air-gapped and restricted-network hosts. (CLUS-8080)
- Security & Access Control
  - Fixed ClusterControl occasionally generating a password for the backup credentials file (mysql/secrets-backup.cnf) that the configuration parser could not read back. Generated passwords containing certain brace characters caused the parser to consume across line boundaries, corrupting the surrounding configuration. (CLUS-6615)
- Monitoring & Deployment
  - Fixed PostgreSQL 18 deployments failing when the PostGIS extension was selected on RHEL and Rocky Linux — ClusterControl computed a package name that does not exist in the upstream repository. PostGIS now installs successfully. (CLUS-8093)
- Replication & Stability
  - Fixed the controller halting all job dispatch across every managed cluster when one cluster's queue was jammed by a stuck restore. A single blocked cluster could leave hundreds of jobs — scheduled backups, node additions, cluster removals — waiting indefinitely; job dispatch is now isolated per cluster so one jammed queue no longer stops the rest. (CLUS-8193)
  - Fixed promoting a replica in a Redis or Valkey Sentinel cluster occasionally promoting the wrong node. ClusterControl adjusted replica priority and triggered failover immediately, before Sentinel had re-read the replica state, so Sentinel could act on stale information. The promotion now waits for Sentinel to observe the new priority before failing over. (CLUS-8251)
  - Fixed SQL Server Always On asynchronous replica promotion leaving the former primary in a failed state. The resume and suspend operations on the availability group could race during promotion; the sequence is now ordered so the old primary rejoins correctly. (CLUS-8311)
  - Fixed adding a node to a MariaDB Galera 10.11 cluster failing during system-table installation. (CLUS-6037)
- UI
  - Fixed the database-engine icon in Manage → Configuration → Change Parameters showing MariaDB for clusters running Percona. The icon now reflects the cluster's actual database engine. (CLUS-8211)

Maintenance Release: August 2^nd, 2026

Build:
- clustercontrol-controller-2.5.0-22492
- clustercontrol-mcc-2.5.0-1042
- clustercontrol2-2.5.0-2434
Improvements:
- The deleteCluster job now accepts a force flag that performs a full cleanup — removing the cluster configuration file from disk and clearing all related database entries — so a cluster left in an inconsistent state can always be removed. Default behaviour is unchanged, and certificates are kept untouched unless explicitly removed. (CLUS-7713)
- Default monitoring exporter flags can now be set centrally in the controller configuration, letting operators cut the volume of metrics scraped per database node instead of accepting the full default collector set on every deployment. (CLUS-8032)
Bug Fixes:
- Backups
  - Creating a cluster from a PostgreSQL backup stored in cloud (S3) storage now works. The backup is retrieved from cloud storage before the restore begins, and the restore uses an absolute path so the backup file is found. (CLUS-8218)
  - Creating a cluster from an incremental pg_basebackup backup now succeeds. The restored data directory is given to the PostgreSQL user so the server can read it and start; previously the restore was reported as failed and no cluster was created. (CLUS-8227)
  - The Default backup directory setting is now honoured for ClickHouse clusters — the configured directory is created and used instead of being ignored. (CLUS-8061)
  - The ClickHouse Backup Verification Server is now polled like any other host, so it reports a real online/offline status instead of remaining Unknown in the node list indefinitely. (CLUS-8120)
- Monitoring & Deployment
  - Newly created clusters no longer appear with Unknown host statuses for up to an hour and a half while the cluster is already running internally. The cluster-information cache refresh interval is now bounded and decays automatically, and the observed refresh interval is exposed in the cache statistics for diagnosis. (CLUS-8194)
  - A minor version upgrade of Percona/MySQL or MariaDB on a host with a custom data directory no longer breaks the server. On Debian-family systems the package upgrade could silently re-point the MySQL configuration to the distribution default — dropping the custom data directory — and then restart the service; the upgrade now protects the configuration and no longer starts the service on a failed configuration restore. (CLUS-7994)
  - ClickHouse Keeper nodes deployed without an explicit port now correctly default to the Keeper client port 9281 instead of inheriting the data-node port 9440. (CLUS-8075)
  - The controller now rejects ClickHouse import jobs that spell out more than one node. Import relies on auto-discovery from a single endpoint, and a manually enumerated topology could previously be registered without discovery. (CLUS-8084)
  - ClickHouse Keeper and replication-loss alarms are now accurate: a Keeper going offline while quorum still holds raises an alarm, the replication-health alarm names the affected replica rather than a healthy observer, and a data node that loses its Keeper session is reported as such instead of simply offline. (CLUS-8212)
- Replication & Stability
  - Adding a node to a MySQL or MariaDB replication cluster no longer stages the new replica from a shut-down former primary. After a failover the old primary could remain in the cluster with cached state that still identified it as the source, causing every add-node attempt to fail; unreachable candidates are now skipped and the current primary is selected. (CLUS-8169)
  - Scaling up a SQL Server Always On cluster no longer fails when the primary uses a non-default data directory — the new node is created with the correct data directory and log-file path. (CLUS-6875)
  - The MySQL client read and write timeouts used by the controller were cross-wired, so each was applied to the opposite operation. They are now set correctly, giving predictable timeout behaviour on controller-to-database connections. (CLUS-8214)
  - A ClickHouse cluster that has lost its Keeper quorum is now reported as failed rather than remaining operational. Keeper state is read directly from the Keeper nodes, quorum-less keepers are marked failed instead of offline, and a critical alarm names the node and the Keeper failure — even when the cluster holds no replicated tables. (CLUS-8089)
- UI
  - The Create Cluster action is now available in the actions menu for pg_basebackup backups, so a new cluster can be created from such a backup directly from the interface instead of only through the API or CLI. (CLUS-8225)

Initial Release: July 21^st, 2026

Build:
- clustercontrol-controller-2.5.0-22113
- clustercontrol-mcc-2.5.0-1010
- clustercontrol2-2.5.0-2412
- clustercontrol-proxy-2.5.0-208
- s9s-tools 1.9.2026072116

We're pleased to announce the release of ClusterControl v2.5.0, which introduces ClickHouse as a new supported database engine for analytics/OLAP workloads, delivers major PostgreSQL backup improvements, brings full PostgreSQL database user management to the UI, adds built-in usage metering with an operator billing page for consumption-based (Pay-As-You-Go) models, continues hardening the scalable controllers pool, brings back cluster-wide database configuration management, speeds up deployments with multithreaded installation, and further improves our Kubernetes database-operator support.

ClickHouse Support

ClusterControl adds ClickHouse — the high-performance, column-oriented database designed for online analytical processing (OLAP) — to its supported database engines, extending the portfolio into the analytics and data-warehouse space.

Automated deployment of ClickHouse — single-node and replicated clusters with embedded ClickHouse Keeper
Monitoring and alerting through ClusterControl's unified dashboard
Backup and restore operations
Scaling capabilities for growing analytical workloads
Import of existing ClickHouse clusters into ClusterControl management, plus s9s CLI and API support
SSL-encrypted inter-node communication with per-node certificates

PostgreSQL Backup Enhancements

A significant improvement to PostgreSQL backup workflows, focused on cloud-native, space-efficient backups.

Streaming backup to S3 with pg_basebackup — instead of writing backups to local disk first and then uploading, ClusterControl now streams pg_basebackup output directly to S3-compatible cloud storage (Amazon S3, MinIO, Google Cloud Storage in S3-compatible mode, DigitalOcean Spaces, Wasabi, and any other S3-API compatible storage). This removes the local-disk staging requirement, shortens the backup-to-cloud pipeline, and reduces the overall backup window.
Incremental backup with pg_basebackup (PostgreSQL 17+) — ClusterControl now supports PostgreSQL 17's native incremental backup in pg_basebackup, including S3 upload integration.

PostgreSQL Database User Management

ClusterControl v2.5.0 completes the PostgreSQL Database User Management initiative, giving DBAs full control over PostgreSQL users, roles, and access rules directly from the ClusterControl UI — no manual psql or config-file editing required.

Create and edit PostgreSQL users and roles, with passwords, metadata, and role assignments
View and edit database, schema, and table-level privileges, with explicit object-type selectors replacing wildcard grants
Lock, disable, and enable users across their lifecycle
Edit, override, and reorder pg_hba.conf rules from the UI, with all modifications tracked
Search and filter users by role or status

Usage Metering & Operator Billing (Pay-As-You-Go)

ClusterControl v2.5.0 introduces built-in usage metering to support consumption-based and Pay-As-You-Go commercial models.

Hourly usage snapshots collected per controller across the managed estate
Billing reports generated on demand — estate-wide or filtered by tag/cluster — with cryptographic sealing and independent report verification
An operator billing page in the multi-controller UI: view estate health, generate reports, verify seals, and export (JSON / CSV)
Feature-flagged, so it is only surfaced for operators who enable metering

Scalable Controllers Pool

Continued hardening of the scalable controllers pool, which allows a pool of CMON controllers to manage a large fleet of clusters.

UI-driven upgrade of remote pool members from the main controller, with an alarm raised automatically when a pool member's version drifts from the main controller
Safer pool joins — only stable controllers may join the pool; site information is shown on clusters deployed in pool mode
Operational resilience — retry for failed add controller jobs, and correct network grants for the cmon user on cluster deployments

Cluster-wide Database Configuration Management

ClusterControl v2.5.0 brings back cluster-wide database configuration management, familiar from ClusterControl v1.

Change the same parameter across all nodes of a cluster in a single action
Dynamic parameters are applied at runtime immediately — no per-node config edit and restart cycle required
Reduces downtime for configuration changes on production database services

Multithreaded Installation — Faster Database Deployments

Deploying a new database cluster previously installed and configured nodes one at a time, in sequence. In v2.5.0 the installation is multithreaded: independent node installations run in parallel, cutting overall deployment time — especially noticeable on larger clusters.

Applies to PostgreSQL and MySQL cluster deployments
No workflow changes required — the same deployment wizard and jobs, just faster
The degree of parallelism is tunable via the parallel_node_setup_limit setting in cmon.cnf — the maximum number of nodes set up in parallel during deployment (default: 4)

Kubernetes Database Support

Continued enhancements to production-grade deployment and management of databases on Kubernetes using database operators (CloudNativePG for PostgreSQL, MOCO for MySQL). The v2.5.0 work concentrates on GitOps-native operations, observability, and operational robustness.

Expanded GitOps workflows — database cluster deployments and backup schedules can now be delivered through the GitOps flow: manifests are proposed as Git pull requests, reviewed and merged in your repository, instead of being applied directly to the cluster. Secrets are handled safely within the Git workflow, add-on changes made in the deployment wizard propagate through Git, and the UI gains an on-demand sync from Git control.
Observability — structured logging with end-to-end request-ID correlation across the Kubernetes components, Prometheus metrics for the proxy/agent layer with a Prometheus agent on workload clusters, and default dashboards.
More reliable cluster health reporting — the agent now watches the underlying operator resources so database cluster health and phase propagate correctly to the UI, and stale cluster listings after deletions have been fixed.
Operator compatibility & supply-chain resilience — the default MySQL operator (MOCO) version is raised for compatibility with Kubernetes 1.34+, CloudNativePG operator-manifest versioning is fixed, and third-party chart dependencies and images are mirrored to the Severalnines artifact registry.
Security hardening — cluster configurations and certificates can be migrated from config files to Kubernetes secrets, and bundled components are updated to clear CVE scan findings.