Skip to content

Release notes v2.5.0

Release highlights

  • Version name: ClusterControl 2.5.0
  • State: Latest
  • First release date: July 21st, 2026
  • Maintenance status: Active
  • Total maintenance builds: 13
  • Last release date: October 18th, 2026
  • ClickHouse support — automated deployment of single-node and replicated clusters (with embedded ClickHouse Keeper), monitoring and alerting, backup and restore, scaling, import of existing clusters, and s9s CLI/API support, with SSL-encrypted inter-node communication. ClusterControl's first entry into the analytics / OLAP space.
  • Streaming PostgreSQL backups to S3 with pg_basebackup — stream backups directly to S3-compatible object storage, eliminating local disk staging.
  • Incremental PostgreSQL backups with pg_basebackup on PostgreSQL 17+, including S3 upload.
  • PostgreSQL database user management from the ClusterControl UI — create and edit users and roles, manage database/schema/table-level privileges with explicit object selectors, lock/disable/enable users, edit and reorder pg_hba.conf rules with change tracking, and search/filter users by role and status.
  • Usage metering and operator billing (Pay-As-You-Go) — hourly usage snapshots across the managed estate, cryptographically-sealed and independently-verifiable billing reports, and a new operator billing page in the multi-controller UI (generate, verify, export as JSON/CSV). Feature-flagged and off by default. See Usage Metering and Billing.
  • Cluster-wide database configuration management — change a parameter across all nodes of a cluster in a single action, with dynamic parameters applied at runtime (no restart required).
  • Multithreaded installation — cluster deployments now install and configure nodes in parallel, significantly reducing deployment times for PostgreSQL and MySQL clusters.
  • Scalable controllers pool — UI-driven upgrade of remote pool members from the main controller, automatic version-mismatch alarms, safer pool joins, and better resilience for large fleets.
  • Kubernetes database support — expanded GitOps workflows (database clusters and backup schedules delivered through Git pull requests), observability (structured logging, Prometheus metrics, default dashboards), more reliable cluster health reporting, and operator compatibility and security updates.
  • Specify custom pg_hba.conf rules during new PostgreSQL cluster deployments.
  • ProxySQL management moved from a pop-up dialog to a dedicated, shareable page.
  • Filter the audit log in the UI and export it.
  • Content-Security-Policy (CSP) headers implemented in the ClusterControl UI.
  • Redis/Valkey Sentinel logs are now included in Error Reports for easier failover debugging.
  • Choose between the release and LTS repositories when installing ClusterControl.
  • Specify a temporary directory when adding a new replica via backup.
  • Improved resilience of long-running backup jobs if the CMON database becomes unavailable mid-job.
  • High availability for the CMON controller pool continues to be hardened; some pool-HA capabilities are delivered incrementally across releases.
  1. ClusterControl 2.5.0 is a standard (non-LTS) release. ClusterControl 2.4.0 remains the current long-term support (LTS) line.
  2. Follow standard upgrade procedures as outlined in the documentation.

Maintenance Release: October 18th, 2026

  • Build:

    • clustercontrol-controller-2.5.0-25407
    • clustercontrol-mcc-2.5.0-1263
    • clustercontrol2-2.5.0-2605

  • Improvements:

    • The pgBackRest setup form in the ClusterControl GUI now has a Network choice, Monitoring or Data, for the SSH connections pgBackRest opens between hosts. It starts from the cluster's current pgbackrest_network setting, says that SSH must be reachable on the chosen network, and names the nodes that have no data IP. The setting arrived in an earlier patch; until now it could be changed only in the cluster's configuration. (CLUS-8729)
    • In pool mode, where several controllers share the work, a finished create_cluster job now reports the ID of the cluster it created in allocated_cluster_id, whichever controller ran it. Previously the job kept cluster ID 0, so a client had no way to find a cluster that another controller in the pool had created. (CLUS-8889)

  • Bug Fixes:

    • User Management
      • A password-only updateAccount on a MySQL or MariaDB account now changes the password and nothing else: the account's SSL requirement, resource limits and host are kept. Changes to the accounts ClusterControl itself works with — those named in cmon_user, backup_user, monitored_mysql_root_user, repl_user and db_exporter_user — are now refused. (CLUS-8951)
      • Changing the password of the cluster's configured SQL Server sysadmin login (mssql_sysadmin_username) with updateAccount now also updates the password ClusterControl stores for it (mssql_sysadmin_password), so a node added later uses the new password. The October 11th advice not to change that login's password no longer applies. (CLUS-8934, CLUS-8941)
    • Security & Access Control
      • Passwords are now escaped when ClusterControl creates a PostgreSQL or SQL Server account, so a password containing a single quote (') can no longer change the SQL statement that runs. Such passwords used to make the account creation fail. (CLUS-9017)
      • PostgreSQL updateAccount no longer returns the new password in plain text in its reply (Role attributes updated … PASSWORD '…'), and it refuses to change the roles ClusterControl itself connects, replicates and exports metrics with. (CLUS-8952)
    • Monitoring & Deployment
      • Fixed a removed node's exporters staying on the cluster's list of Prometheus exporters, shown in the GUI's Exporters dialog, and piling up with every node added and removed. They are now dropped when the node is removed, whoever manages the Prometheus instance. (CLUS-4567)
      • ProxySQL installed from the official tarball, which runs as proxysql.bin rather than proxysql, can now be registered and managed. Registering it used to fail with No proxysql process is running, and ClusterControl could not find the process to start, stop or recover it. Keepalived in front of ProxySQL now checks for either process name. Setting up Keepalived for ProxySQL now stops with an error when keepalived -v does not report a version, instead of continuing with a health check that cannot see proxysql.bin. (CLUS-8933)

Maintenance Release: October 11th, 2026

  • Build:

    • clustercontrol-controller-2.5.0-25177
    • clustercontrol-mcc-2.5.0-1247
    • clustercontrol2-2.5.0-2591

  • Improvements:

    • SQL Server 2022 and later can now write a cloud-only backup directly to S3-compatible storage and restore it from there, instead of storing it locally first and uploading it afterwards. A cloud-only backup that cannot stream — an older SQL Server, a provider other than S3, or missing credentials — is now refused with an error rather than written locally. (CLUS-7528)
    • A SQL Server login's password can now be changed through the RPC API's updateAccount call. The change is made on every server of the cluster, primary and replicas, and the login's SID is kept. The built-in sa login and the logins ClusterControl and the exporter connect with are refused, and the password is masked in every log and job message. Do not use it yet to change the password of the cluster's configured sysadmin login (mssql_sysadmin_username): the password ClusterControl stores for that login (mssql_sysadmin_password) is not updated, and adding a node later can use the old one. (CLUS-8934)
    • MariaDB and MySQL accounts can now be locked and unlocked through updateAccount with account_locked, on standalone, replication and Galera clusters, as PostgreSQL accounts already could. password and ssl_type are now optional on updateAccount, so a lock-only request needs just the user, host and account_locked. (CLUS-7664)
    • Installing pgBackRest from the ClusterControl GUI now warns that the process will restart the PostgreSQL database service on the affected nodes. (CLUS-8770)

  • Bug Fixes:

    • Backups
      • Fixed SQL Server differential and log backups taken after a restore being attached to the wrong full backup, so they could not be restored until the next full backup was taken. (CLUS-8930)
    • Security & Access Control
      • SQL Server job logs — and the error reports and support bundles that include them — no longer contain the sysadmin password. If you have shared SQL Server job logs or error reports, consider rotating that password. (CLUS-8735)
    • Monitoring & Deployment
      • Fixed ClusterControl's own database failing to install on MySQL 8.4 and other servers running in strict SQL mode, with BLOB, TEXT, GEOMETRY or JSON column 'properties' can't have a default value. A start-up step also reduced the column holding host properties back to 64 KB, so large host properties could be cut short; it no longer does. (CLUS-8921)
      • SQL Server's memory limit on new deployments and added nodes is now the smaller of 80% of the host's memory and its memory minus 1 GiB. It used to be 80% of the memory rounded up to a power of two, which on a 4 GB host let SQL Server take about 85% of real memory and could stall the host. Existing nodes keep their current setting. (CLUS-8714)
    • Replication & Stability
      • Fixed a node discovered automatically while importing a Galera cluster sometimes never getting a role. (CLUS-8891)
      • SQL Server Always On availability-group promotion is now provably lossless. Before switching, the controller checks that the new primary has hardened all of the current primary's log, and aborts rather than forcing over a secondary that has fallen behind. It also waits for the new primary to finish applying its log before the job completes. (CLUS-8465)

Maintenance Release: October 8th, 2026

  • Build:

    • clustercontrol-controller-2.5.0-24954

  • Improvements:

    • pgBackRest can now reach database and repository hosts over their data or internal network instead of only the management (monitoring) address. Set pgbackrest_network per cluster to monitoring (the default), data or internal. Previously backups failed with an SSH connection timeout wherever the management network is not routable between those hosts. A host that cannot be reached on the chosen network fails the job rather than silently using another address. (CLUS-8729)

  • Bug Fixes:

    • Backups
      • Fixed pgBackRest backups failing after a PostgreSQL failover. When the configured repository host is offline, failed or shut down, the backup now uses the current primary, and when no standby is reachable it runs against the primary instead of stopping with unable to find standby cluster. (CLUS-8784)
      • Fixed HAProxy reporting MySQL or PostgreSQL backends as down after a backup restore. The restore brought back the health-check account (s9smysqlchk / s9spostgresqlchk) with the password stored in the backup, out of step with the checker script on the node. The controller now re-synchronises it after any restore, onto the same cluster or another, and ignores commented-out password lines in a hand-edited checker script. (CLUS-8574)
    • Security & Access Control
      • Database names are now escaped when ClusterControl creates or drops a MySQL or MariaDB database, so a name containing a backtick can no longer change the SQL statement that runs. (CLUS-8750)
    • Monitoring & Deployment
      • Fixed deploying a cluster, importing one or adding a node failing with an error that the SSH user cannot run sudo non-interactively, even when sudo was configured correctly. (CLUS-8922)

Maintenance Release: October 6th, 2026

  • Build:

    • clustercontrol-notifications-2.5.0-406

  • Bug Fixes:

    • Security & Access Control
      • Fixed database authentication failures that prevented the notification service from loading its configuration and email recipients when the controller's MySQL or MariaDB database account used mysql_native_password. The service now accepts this authentication method without requiring changes to the database account, password, authentication plugin, or notification configuration. (CLUS-8899)

Maintenance Release: October 4th, 2026

  • Build:

    • clustercontrol-controller-2.5.0-24804
    • clustercontrol-mcc-2.5.0-1224
    • clustercontrol2-2.5.0-2576

  • Improvements:

    • Added a read-only RPC v2 getStuckJobs operation that lists running jobs which have stopped making progress, so external monitoring can ask whether any job is stuck. A job's progress is measured from the time of its most recent job message rather than only from its start time, so a long-running backup that is still working is not reported as stuck. Each result names the job's cluster. (CLUS-8053, CLUS-8060)

  • Bug Fixes:

    • Backups
      • When an S3 cloud credential does not say whether to use SSL, the controller now follows the endpoint: an http:// endpoint uses plain HTTP, and an endpoint without a scheme uses TLS. Credential validation errors now name the cloud provider that rejected the setting. (CLUS-8721)
    • Security & Access Control
      • Fixed ClusterControl reporting PostgreSQL audit logging as enabled when the pgAudit library was not actually loaded, in which case PostgreSQL recorded nothing. PostgreSQL 15 and later clusters deployed in CCX mode now have pgAudit installed. (CLUS-7547)
    • Monitoring & Deployment
      • Fixed the schema upgrade (cmon -u) printing a misleading Errors: line when there were no errors, for example in the log of a Kubernetes init container. (CLUS-8704)
    • Replication & Stability
      • Fixed a job stuck inside a remote command ignoring a kill request, which also blocked Remove Cluster and any other job queued behind it for as long as the stuck job ran. A kill now reaches the running remote command, the job ends as aborted, and the queue moves on. (CLUS-8708)
    • UI
      • Fixed the pgBackRest configuration file (/etc/pgbackrest.conf) not appearing under Configuration Management in the ClusterControl GUI, even after Refresh config had pulled it from the nodes. The configuration view now includes pgBackRest nodes. (CLUS-8825)

Maintenance Release: September 28th, 2026

  • Build:

    • clustercontrol-controller-2.5.0-24561
    • clustercontrol-mcc-2.5.0-1210
    • clustercontrol2-2.5.0-2567

  • Improvements:

    • The controller now keeps its configuration in an in-memory cache and writes it back periodically, with immediate writes for operations that must persist at once (such as creating a cluster or adding a node). This removes most repeated reads and writes of configuration storage — configuration files or Kubernetes secrets — and makes configuration-heavy operations substantially faster on controllers that manage many clusters. (CLUS-8521)
    • In controller-pool mode, a request for a cluster that is briefly unowned while it is handed over to another controller, or that cannot be placed because every controller is at capacity, now returns a specific error for each case instead of a generic "cluster not assigned" error. (CLUS-8734)
    • pgBackRest backups to cloud storage can now use an AWS cloud credential, with the S3 endpoint derived from the credential's region, in addition to an S3 credential with an explicit endpoint. The pgBackRest configuration dialog in the ClusterControl GUI no longer limits the credential list to S3-only credentials, so an AWS credential can be selected. (CLUS-7060, CLUS-8308)

  • Bug Fixes:

    • Backups
      • Fixed s9s backup --restore-controller failing at the Granting privileges for the Cmon Controllers step with role root does not exist when the saved controller included a PostgreSQL cluster. The grant command was built without the PostgreSQL operating-system user. (CLUS-8177)
    • Replication & Stability
      • Fixed the controller occasionally crashing while shutting down, when a background thread was still running as the process exited. (CLUS-7847)
      • Fixed replica promotion failing with Slave Promotion is not supported for non-gtid on GTID clusters when the controller had lost its connection to the candidate. An unreachable candidate is now reported as unreachable instead of as a GTID problem. (CLUS-8700)
    • UI
      • The S3 cloud-credential switch previously labelled Insecure SSL is now labelled Skip Certificate Verification, which describes what it does. (CLUS-8721)

Maintenance Release: September 20th, 2026

  • Build:

    • clustercontrol-controller-2.5.0-24285
    • clustercontrol-proxy-2.5.0-236

  • Bug Fixes:

    • Backups
      • Fixed pgBackRest backups to S3-compatible storage failing with an insufficient space error. The controller checked for free disk space on the local repository path before starting the backup, even when the backup was destined for object storage where that limit does not apply, so a backup larger than the local disk was refused despite ample space at the destination. The local free-space check is no longer applied to S3 repositories. (CLUS-8696)
    • Replication & Stability
      • Fixed semi-synchronous replication being left switched off on MySQL and MariaDB replication clusters. The controller decided whether to enable it by reading whether semi-sync was currently active rather than whether the cluster was configured to use it, and on a cluster with no replica yet connected that reads as inactive — so the node was set up with plain asynchronous replication. A transaction the database had already acknowledged to the application could therefore be lost if the primary failed over. The decision is now taken from the cluster's configured intent. (CLUS-8666)
      • Fixed failover to a new primary hanging indefinitely on MySQL and MariaDB replication clusters when the candidate replica still had unapplied relay log and the old primary was already dead. The wait loop only ended when the applied position caught up with the received position, which can never happen once the source has halted, so no node was promoted and the cluster was left with no writable node. (CLUS-8604)

Maintenance Release: September 13th, 2026

  • Build:

    • clustercontrol-controller-2.5.0-24068
    • clustercontrol-mcc-2.5.0-1188
    • clustercontrol2-2.5.0-2551

  • Improvements:

    • A new cc-architecture(7) manual page gives a compact overview of the ClusterControl components: the packages shipped, the binaries each package provides, and how every binary talks to the rest of the system, including the web interface. It is also published as documentation and as a PDF. (CLUS-8284)
    • cmon-pgbackrest(5) now documents two operational limits of multi-repository pgBackRest stanzas that were previously undocumented: write-ahead log archiving succeeds only when every configured repository accepts the segment, so one unhealthy repository stalls archiving for the whole stanza; and dropping a repository leaves its existing backup records in place. (CLUS-8571)

  • Bug Fixes:

    • Backups
      • Fixed restoring a MySQL replication cluster from an S3 cloud-only backup failing immediately after the restored primary restarted, with Couldn't determine the current master followed by an access-denied error. The recover step now waits for the primary to be identifiable before continuing. (CLUS-8573)
      • Backup jobs left running when the controller database becomes unavailable are now reconciled when the controller restarts, instead of remaining as stuck jobs that never complete. This affects clusters with long-running backups over large data sets. (CLUS-7162)
    • Monitoring & Deployment
      • Fixed Prometheus and exporter deployment not being triggered when a PostgreSQL cluster is created from a restored backup, leaving the new cluster without monitoring. (CLUS-8347)
      • Fixed database size and table statistics never being collected on most clusters. The internal schedule driving the collection used an hour expression the scheduler could not evaluate, so it matched no time at all and s9s cluster --list-databases reported zero size and zero tables indefinitely. (CLUS-8533)
      • Database growth sampling no longer issues a database-wide ANALYZE against user databases on the primary when CCX mode is enabled. A monitoring sampler should not modify the statistics of the database it is observing, and there was previously no way to opt out short of disabling growth collection entirely. (CLUS-8537)
      • Database growth failures now record the reason in the log. Previously a failure produced only the schedule line with no explanation, which made the cause impossible to determine from the log alone. (CLUS-8540)
      • Fixed an on-demand database refresh doing nothing on Microsoft SQL Server clusters. Requesting cluster information with a forced refresh returned whatever the periodic sampler had last stored, so database size, table count and the set of databases were never recomputed on request. (CLUS-8555)
      • Fixed Microsoft SQL Server accounts always reporting blank privileges. Only server-level logins were read, so server role membership, database-level roles, database-scope permissions and ownership were all missing. Privileges are now reported in the same format already used for MySQL and PostgreSQL. (CLUS-8556)
      • Fixed the reported size of a Microsoft SQL Server database including the transaction log and unused allocated space. Because a transaction log can be larger than the data it protects, the figure could be several times the real one and moved when the log grew even though nothing had been inserted — a 201 MB database was reported as 592 MB. (CLUS-8557)
      • Fixed a single unreachable MySQL node flooding the controller log, which previously emitted one error line per connection attempt with no de-duplication — roughly 72 lines a minute for as long as the node stayed down, burying every other cluster message at the point the log matters most. A duplicate log call that recorded access-denied failures twice per attempt was also removed. (CLUS-8526)
      • The routine skip that prevents a recurring job from overlapping a still-running instance of itself is no longer logged as an error. Nothing had failed — the skip is the designed overlap prevention — but it surfaced to operators as an ERROR once per schedule tick for as long as the earlier run continued. (CLUS-8525)
    • Replication & Stability
      • Fixed node recovery retrying without limit when it aborted because the database server was already running. The abort was reported as success, which reset the backoff counter on every cycle so the permanent-error ceiling could never be reached. On one affected deployment this produced 11,688 failed jobs — 86% of all controller job failures — with a single cluster retrying roughly every seven seconds for 19 hours. (CLUS-8443)
      • Fixed host records being silently discarded when writing a batch to the controller database. A single failing update ended the batch, and because the write cache had already been cleared the remaining hosts were lost with no retry and no error surfaced, letting the stored host state drift out of sync with the controller. (CLUS-8448)
      • Fixed elevated commands deadlocking on distributions where sudo runs commands through its own pseudo-terminal — the default on Ubuntu 22.04 and later and on Debian 12. The controller requested a pseudo-terminal as well, and neither side would release it, so the job thread was lost permanently. This was confirmed in the field, including one job stuck for seven weeks. (CLUS-8508)
      • MariaDB replication templates now set the semi-synchronous replication wait point, binary log flushing and relay log flushing. Without them a MariaDB cluster ran semi-sync in its weak mode, with an unflushed binary log and non-durable acknowledgements, so the configuration did not provide the guarantee it implies. (CLUS-8672)
      • Fixed the controller crashing during startup when loading a large number of clusters in controller-pool mode on Kubernetes. Collector startup is now staggered, rather than all collectors contending at once. (CLUS-7549)
      • The controller-assignment lookup no longer refuses to answer for clusters owned by another controller in the pool, and returns the recorded assignment instead. (CLUS-8303)
    • UI
      • Fixed long credential names being truncated in the pgBackRest S3 configuration wizard, which made otherwise similar credentials indistinguishable in the selection list. (CLUS-8539)

Maintenance Release: August 30th, 2026

  • Build:

    • clustercontrol-controller-2.5.0-23331
    • clustercontrol-mcc-2.5.0-1128
    • clustercontrol2-2.5.0-2504
    • clustercontrol-kuber-proxy-2.5.0-717

  • Improvements:

    • PostgreSQL backups to cloud storage with pgBackRest — a pgBackRest stanza can now hold two repositories in any combination of local and S3-compatible cloud storage, with write-ahead logs archived to both so point-in-time recovery can be driven from either one. Repositories can be added, dropped and re-added in any order, giving existing single-repository clusters a migration path to cloud storage without rebuilding the stanza. Cloud backups can be created directly from the ClusterControl UI. (CLUS-7060, CLUS-8308)
    • Cluster capacity limits can now be set from the ClusterControl UI on any controller in a pool, not only on the controller the interface is currently connected to. The request is routed to the intended pool member instead of the connected primary, and the previous restriction that pointed users to the command line has been removed. (CLUS-8062)

  • Bug Fixes:

    • Backups
      • Fixed point-in-time recovery targets being incorrectly reported as unreachable on pgBackRest 2.59 and later. The write-ahead log analyzer now runs as the postgres user with a writable temporary directory, so a valid recovery target is no longer misreported. (CLUS-8306)
      • The temporary InnoDB redo-log resize that ClusterControl applies for the duration of a hot physical backup is now disabled when CCX mode is enabled, leaving the redo-log configuration untouched on those deployments. (CLUS-8437)
    • Monitoring & Deployment
      • Fixed the controller health-check endpoint reporting healthy when the controller could not reach its own database. v2/controller?operation=ping previously returned HTTP 200 even when the controller was unable to serve requests, so external liveness probes did not detect the outage. (CLUS-8399)
      • Fixed intermittent Microsoft SQL Server deployment failures where a transient ODBC connection error during endpoint or availability-group creation aborted the entire deployment. (CLUS-6552)
      • Fixed a misleading error during Microsoft SQL Server availability-group deployment. A failure to create the database master key was ignored, so deployment continued and failed later at certificate creation with error 15581, blaming the certificate for a master-key problem. The master-key failure is now detected and reported against the host that produced it, and the certificate statements are idempotent so retries succeed. (CLUS-8453)
      • Fixed the bundled monitoring stack failing to deploy in Kubernetes environments, where the operator could start before its custom resource definitions and permissions were established, leaving Prometheus never deployed. (CLUS-8466)
    • Replication & Stability
      • Fixed adding a node to a Microsoft SQL Server availability group failing with automatic seeding FAILED ... Request Denied. A seeding request arriving between the join and the grant statement was denied and treated as fatal; the denial is now recoverable and no longer aborts the job. (CLUS-8414)
      • Fixed promoting a replica during Upgrade Nodes and Change Volume Type on Microsoft SQL Server availability groups, where data movement stayed suspended and the promote step never completed. Promotion is now confirmed against the state the server reports rather than the statements it accepted. (CLUS-8458)
      • Fixed the cluster information cache refresh interval oscillating indefinitely instead of settling, which caused continuous refresh churn on controllers managing large numbers of clusters. The routine interval adjustment is also no longer logged at WARNING, so normal behaviour no longer appears as a fault in the logs. (CLUS-8447, CLUS-8490)
      • Fixed the PostgreSQL rebuild-replica job hanging indefinitely after an automatic failover. (CLUS-8236)

Maintenance Release: August 21st, 2026

  • Build:

    • clustercontrol-kuber-proxy-2.5.0-708
    • clustercontrol-mcc-2.5.0-1109

  • Improvements:

    • Deploying a database operator no longer requires choosing a namespace up front — the field is now optional and defaults to the operator's own namespace. (CLUS-8298)
    • Removed the "Allow empty repository" checkbox from the environment wizard, which offered a choice that did not apply to the environments being connected. (CLUS-8363)

  • Bug Fixes:

    • Backups
      • Fixed scheduled backups always failing with a 403 when the destination was S3-compatible storage other than AWS. The object-store credentials were not resolved across namespaces, so the backup could never authenticate. (CLUS-8294)
    • Security & Access Control
      • Fixed namespace access grants conflicting with the role bindings created at chart install time, which could leave an environment with either too little access to operate or broader write access than was requested. Grants and install-time bindings are now reconciled instead of overwriting one another. (CLUS-8295)
    • Monitoring & Deployment
      • Fixed the bundled monitoring stack failing to install on environments connected without GitOps, where the agent lacked the permissions to create the addon and the install ended with a permissions error. (CLUS-8334)
      • Fixed application-bundle import being unavailable on environments connected without GitOps, which blocked importing existing workloads on those installations. (CLUS-8335)
      • Fixed editing a deployed operator reading the wrong namespace — the custom resource's own namespace was used instead of the operator's target namespace, so edits could be applied against the wrong scope. (CLUS-8297)
    • UI
      • Fixed the deploy wizard silently editing an existing database cluster when a new cluster was created with a name already in use in the same namespace, instead of reporting the conflict. (CLUS-8330)
      • Fixed backend validation errors surfacing in the UI as a bare 500 with no explanation. The underlying validation message is now shown. (CLUS-8331)
      • Fixed the connect-environment wizard submitting secrets management as enabled while GitOps was switched off — a combination that cannot work and left the environment misconfigured. (CLUS-8332)
      • Fixed Edit Cluster Configuration failing for clusters that had been relocated to a different namespace. (CLUS-8254)

Maintenance Release: August 20th, 2026

  • Build:

    • clustercontrol-controller-2.5.0-23026
    • clustercontrol-mcc-2.5.0-1103
    • clustercontrol2-2.5.0-2481
    • clustercontrol-proxy-2.5.0-223

  • Bug Fixes:

    • Backups
      • Fixed creating a cluster from an incremental backup restored from cloud storage, which previously failed outright. Full and incremental backups to S3 can now be used as the source for a new cluster. (CLUS-8324)
      • Fixed two wal-g PostgreSQL restore correctness problems in a single change. A plain restore without a point-in-time target used to roll forward past the backup you selected — restoring a pre-drop backup could still leave the table dropped — because the wal-g path ignored the immediate-stop setting every other restore method honours. Separately, a point-in-time restore failed when the requested target was later than the last committed transaction. (CLUS-8179)
      • Fixed "Create datastore from backup" failing on recent builds for both pg_basebackup and wal-g sources. (CLUS-8379)
      • Fixed wal-g backups failing for clusters whose S3 bucket lives outside us-east-1, which previously aborted with an incorrect region error. ClusterControl also no longer overwrites an existing /etc/wal-g/wal-g.json written during host provisioning, and no longer arms a wal-g archive command on clusters that do not use wal-g as their backup method — which had disabled point-in-time recovery for pg_basebackup clusters after a node add or upgrade. (CLUS-7684)
    • Security & Access Control
      • ClusterControl no longer grants SUPER to the backup user when deploying MySQL 8.0 and later. XtraBackup 8.x does not require it, so the account is now created with the minimum documented privilege set instead. (CLUS-8230)
      • Fixed the multi-controller UI logging the operator out when the billing service returned an authentication error. A service-to-service authentication failure was being misread as an expired user session, so a valid session was terminated and no diagnostic information was shown. The underlying error is now surfaced instead. (CLUS-8292)
    • Monitoring & Deployment
      • Fixed HAProxy configuration changes made under Manage → Configuration not taking effect. The service is now reloaded automatically after the configuration is saved. (CLUS-8235)
      • Fixed PostgreSQL 17 deployments being rejected when the PostGIS extension was selected on RHEL 9. The package is available and installable; ClusterControl was declaring the combination unsupported before reaching installation. (CLUS-8341)
      • Fixed the PostgreSQL sampler falling back to a pre-9.2 pg_stat_activity query against modern servers, which flooded the PostgreSQL log with column "procpid" does not exist errors roughly every five seconds. (CLUS-8343)
      • Fixed the PostgreSQL exporter account being created without the pg_monitor role, which caused pg_ls_waldir() scrapes to fail once a minute with permission denied on every node running an exporter. (CLUS-8370)
      • Fixed the PostgreSQL major-version upgrade path via the s9s CLI allowing unsupported version jumps — for example a direct upgrade from PostgreSQL 14 to 17. The upgrade guards now apply to standalone clusters as well. (CLUS-8299)
    • Replication & Stability
      • Fixed cluster removal in controller-pool mode, where the removal job reported success but the clusters remained present. (CLUS-6791)
    • UI
      • Fixed replica lag not being displayed under Nodes → Topology for TimescaleDB clusters, including PostgreSQL streaming clusters where the TimescaleDB plugin was enabled after deployment. (CLUS-8362)
      • Fixed the pg_hba "Save as preset" option in the PostgreSQL deployment wizard not appearing in the deployment preview, and being lost when a failed deployment job was retried. (CLUS-8188)

Maintenance Release: August 12th, 2026

  • Build:

    • clustercontrol-controller-2.5.0-22794
    • clustercontrol-mcc-2.5.0-1071
    • clustercontrol2-2.5.0-2453

  • Improvements:

    • Valkey Sentinel clusters can now be deployed with transport encryption turned off, matching the behaviour already available for Redis Sentinel. The "Enable SSL encryption" toggle in the Deploy wizard is no longer forced on, and non-TLS configuration templates are selected automatically when it is disabled. (CLUS-7628, CLUS-8220)
    • MySQL 8.4 deployments can now enable the legacy mysql_native_password authentication plugin through database parameter groups, easing migration from MySQL 8.0 for applications that still depend on it. (CLUS-8131)
    • The ClusterControl demo environment now hides a set of administrative actions that are not appropriate for a shared demo — multi-controller, controller-pool and Kubernetes enablement, certificate deletion, and various edit paths. (CLUS-7459)

  • Bug Fixes:

    • Backups
      • Fixed partial backup restore and verification failing on MariaDB 11.x. When the target server version could not be determined, ClusterControl passed the removed --apply-log-only flag and the deprecated mariabackup invocation, causing the backup-verification job to fail. Version detection is now recovered correctly and the obsolete options are no longer passed. (CLUS-8286)
      • Verifying a Redis or Valkey Sentinel backup on a standalone host no longer requires downloading the remi repository package from the internet, so verification now works on air-gapped and restricted-network hosts. (CLUS-8080)
    • Security & Access Control
      • Fixed ClusterControl occasionally generating a password for the backup credentials file (mysql/secrets-backup.cnf) that the configuration parser could not read back. Generated passwords containing certain brace characters caused the parser to consume across line boundaries, corrupting the surrounding configuration. (CLUS-6615)
    • Monitoring & Deployment
      • Fixed PostgreSQL 18 deployments failing when the PostGIS extension was selected on RHEL and Rocky Linux — ClusterControl computed a package name that does not exist in the upstream repository. PostGIS now installs successfully. (CLUS-8093)
    • Replication & Stability
      • Fixed the controller halting all job dispatch across every managed cluster when one cluster's queue was jammed by a stuck restore. A single blocked cluster could leave hundreds of jobs — scheduled backups, node additions, cluster removals — waiting indefinitely; job dispatch is now isolated per cluster so one jammed queue no longer stops the rest. (CLUS-8193)
      • Fixed promoting a replica in a Redis or Valkey Sentinel cluster occasionally promoting the wrong node. ClusterControl adjusted replica priority and triggered failover immediately, before Sentinel had re-read the replica state, so Sentinel could act on stale information. The promotion now waits for Sentinel to observe the new priority before failing over. (CLUS-8251)
      • Fixed SQL Server Always On asynchronous replica promotion leaving the former primary in a failed state. The resume and suspend operations on the availability group could race during promotion; the sequence is now ordered so the old primary rejoins correctly. (CLUS-8311)
      • Fixed adding a node to a MariaDB Galera 10.11 cluster failing during system-table installation. (CLUS-6037)
    • UI
      • Fixed the database-engine icon in Manage → Configuration → Change Parameters showing MariaDB for clusters running Percona. The icon now reflects the cluster's actual database engine. (CLUS-8211)

Maintenance Release: August 2nd, 2026

  • Build:

    • clustercontrol-controller-2.5.0-22492
    • clustercontrol-mcc-2.5.0-1042
    • clustercontrol2-2.5.0-2434

  • Improvements:

    • The deleteCluster job now accepts a force flag that performs a full cleanup — removing the cluster configuration file from disk and clearing all related database entries — so a cluster left in an inconsistent state can always be removed. Default behaviour is unchanged, and certificates are kept untouched unless explicitly removed. (CLUS-7713)
    • Default monitoring exporter flags can now be set centrally in the controller configuration, letting operators cut the volume of metrics scraped per database node instead of accepting the full default collector set on every deployment. (CLUS-8032)

  • Bug Fixes:

    • Backups
      • Creating a cluster from a PostgreSQL backup stored in cloud (S3) storage now works. The backup is retrieved from cloud storage before the restore begins, and the restore uses an absolute path so the backup file is found. (CLUS-8218)
      • Creating a cluster from an incremental pg_basebackup backup now succeeds. The restored data directory is given to the PostgreSQL user so the server can read it and start; previously the restore was reported as failed and no cluster was created. (CLUS-8227)
      • The Default backup directory setting is now honoured for ClickHouse clusters — the configured directory is created and used instead of being ignored. (CLUS-8061)
      • The ClickHouse Backup Verification Server is now polled like any other host, so it reports a real online/offline status instead of remaining Unknown in the node list indefinitely. (CLUS-8120)
    • Monitoring & Deployment
      • Newly created clusters no longer appear with Unknown host statuses for up to an hour and a half while the cluster is already running internally. The cluster-information cache refresh interval is now bounded and decays automatically, and the observed refresh interval is exposed in the cache statistics for diagnosis. (CLUS-8194)
      • A minor version upgrade of Percona/MySQL or MariaDB on a host with a custom data directory no longer breaks the server. On Debian-family systems the package upgrade could silently re-point the MySQL configuration to the distribution default — dropping the custom data directory — and then restart the service; the upgrade now protects the configuration and no longer starts the service on a failed configuration restore. (CLUS-7994)
      • ClickHouse Keeper nodes deployed without an explicit port now correctly default to the Keeper client port 9281 instead of inheriting the data-node port 9440. (CLUS-8075)
      • The controller now rejects ClickHouse import jobs that spell out more than one node. Import relies on auto-discovery from a single endpoint, and a manually enumerated topology could previously be registered without discovery. (CLUS-8084)
      • ClickHouse Keeper and replication-loss alarms are now accurate: a Keeper going offline while quorum still holds raises an alarm, the replication-health alarm names the affected replica rather than a healthy observer, and a data node that loses its Keeper session is reported as such instead of simply offline. (CLUS-8212)
    • Replication & Stability
      • Adding a node to a MySQL or MariaDB replication cluster no longer stages the new replica from a shut-down former primary. After a failover the old primary could remain in the cluster with cached state that still identified it as the source, causing every add-node attempt to fail; unreachable candidates are now skipped and the current primary is selected. (CLUS-8169)
      • Scaling up a SQL Server Always On cluster no longer fails when the primary uses a non-default data directory — the new node is created with the correct data directory and log-file path. (CLUS-6875)
      • The MySQL client read and write timeouts used by the controller were cross-wired, so each was applied to the opposite operation. They are now set correctly, giving predictable timeout behaviour on controller-to-database connections. (CLUS-8214)
      • A ClickHouse cluster that has lost its Keeper quorum is now reported as failed rather than remaining operational. Keeper state is read directly from the Keeper nodes, quorum-less keepers are marked failed instead of offline, and a critical alarm names the node and the Keeper failure — even when the cluster holds no replicated tables. (CLUS-8089)
    • UI
      • The Create Cluster action is now available in the actions menu for pg_basebackup backups, so a new cluster can be created from such a backup directly from the interface instead of only through the API or CLI. (CLUS-8225)

Initial Release: July 21st, 2026

  • Build:
    • clustercontrol-controller-2.5.0-22113
    • clustercontrol-mcc-2.5.0-1010
    • clustercontrol2-2.5.0-2412
    • clustercontrol-proxy-2.5.0-208
    • s9s-tools 1.9.2026072116

We're pleased to announce the release of ClusterControl v2.5.0, which introduces ClickHouse as a new supported database engine for analytics/OLAP workloads, delivers major PostgreSQL backup improvements, brings full PostgreSQL database user management to the UI, adds built-in usage metering with an operator billing page for consumption-based (Pay-As-You-Go) models, continues hardening the scalable controllers pool, brings back cluster-wide database configuration management, speeds up deployments with multithreaded installation, and further improves our Kubernetes database-operator support.

ClickHouse Support

ClusterControl adds ClickHouse — the high-performance, column-oriented database designed for online analytical processing (OLAP) — to its supported database engines, extending the portfolio into the analytics and data-warehouse space.

  • Automated deployment of ClickHouse — single-node and replicated clusters with embedded ClickHouse Keeper
  • Monitoring and alerting through ClusterControl's unified dashboard
  • Backup and restore operations
  • Scaling capabilities for growing analytical workloads
  • Import of existing ClickHouse clusters into ClusterControl management, plus s9s CLI and API support
  • SSL-encrypted inter-node communication with per-node certificates

PostgreSQL Backup Enhancements

A significant improvement to PostgreSQL backup workflows, focused on cloud-native, space-efficient backups.

  • Streaming backup to S3 with pg_basebackup — instead of writing backups to local disk first and then uploading, ClusterControl now streams pg_basebackup output directly to S3-compatible cloud storage (Amazon S3, MinIO, Google Cloud Storage in S3-compatible mode, DigitalOcean Spaces, Wasabi, and any other S3-API compatible storage). This removes the local-disk staging requirement, shortens the backup-to-cloud pipeline, and reduces the overall backup window.
  • Incremental backup with pg_basebackup (PostgreSQL 17+) — ClusterControl now supports PostgreSQL 17's native incremental backup in pg_basebackup, including S3 upload integration.

PostgreSQL Database User Management

ClusterControl v2.5.0 completes the PostgreSQL Database User Management initiative, giving DBAs full control over PostgreSQL users, roles, and access rules directly from the ClusterControl UI — no manual psql or config-file editing required.

  • Create and edit PostgreSQL users and roles, with passwords, metadata, and role assignments
  • View and edit database, schema, and table-level privileges, with explicit object-type selectors replacing wildcard grants
  • Lock, disable, and enable users across their lifecycle
  • Edit, override, and reorder pg_hba.conf rules from the UI, with all modifications tracked
  • Search and filter users by role or status

Usage Metering & Operator Billing (Pay-As-You-Go)

ClusterControl v2.5.0 introduces built-in usage metering to support consumption-based and Pay-As-You-Go commercial models.

  • Hourly usage snapshots collected per controller across the managed estate
  • Billing reports generated on demand — estate-wide or filtered by tag/cluster — with cryptographic sealing and independent report verification
  • An operator billing page in the multi-controller UI: view estate health, generate reports, verify seals, and export (JSON / CSV)
  • Feature-flagged, so it is only surfaced for operators who enable metering

Scalable Controllers Pool

Continued hardening of the scalable controllers pool, which allows a pool of CMON controllers to manage a large fleet of clusters.

  • UI-driven upgrade of remote pool members from the main controller, with an alarm raised automatically when a pool member's version drifts from the main controller
  • Safer pool joins — only stable controllers may join the pool; site information is shown on clusters deployed in pool mode
  • Operational resilience — retry for failed add controller jobs, and correct network grants for the cmon user on cluster deployments

Cluster-wide Database Configuration Management

ClusterControl v2.5.0 brings back cluster-wide database configuration management, familiar from ClusterControl v1.

  • Change the same parameter across all nodes of a cluster in a single action
  • Dynamic parameters are applied at runtime immediately — no per-node config edit and restart cycle required
  • Reduces downtime for configuration changes on production database services

Multithreaded Installation — Faster Database Deployments

Deploying a new database cluster previously installed and configured nodes one at a time, in sequence. In v2.5.0 the installation is multithreaded: independent node installations run in parallel, cutting overall deployment time — especially noticeable on larger clusters.

  • Applies to PostgreSQL and MySQL cluster deployments
  • No workflow changes required — the same deployment wizard and jobs, just faster
  • The degree of parallelism is tunable via the parallel_node_setup_limit setting in cmon.cnf — the maximum number of nodes set up in parallel during deployment (default: 4)

Kubernetes Database Support

Continued enhancements to production-grade deployment and management of databases on Kubernetes using database operators (CloudNativePG for PostgreSQL, MOCO for MySQL). The v2.5.0 work concentrates on GitOps-native operations, observability, and operational robustness.

  • Expanded GitOps workflows — database cluster deployments and backup schedules can now be delivered through the GitOps flow: manifests are proposed as Git pull requests, reviewed and merged in your repository, instead of being applied directly to the cluster. Secrets are handled safely within the Git workflow, add-on changes made in the deployment wizard propagate through Git, and the UI gains an on-demand sync from Git control.
  • Observability — structured logging with end-to-end request-ID correlation across the Kubernetes components, Prometheus metrics for the proxy/agent layer with a Prometheus agent on workload clusters, and default dashboards.
  • More reliable cluster health reporting — the agent now watches the underlying operator resources so database cluster health and phase propagate correctly to the UI, and stale cluster listings after deletions have been fixed.
  • Operator compatibility & supply-chain resilience — the default MySQL operator (MOCO) version is raised for compatibility with Kubernetes 1.34+, CloudNativePG operator-manifest versioning is fixed, and third-party chart dependencies and images are mirrored to the Severalnines artifact registry.
  • Security hardening — cluster configurations and certificates can be migrated from config files to Kubernetes secrets, and bundled components are updated to clear CVE scan findings.
Copyright © 2014-2026 Severalnines AB. All rights reserved.

Severalnines and ClusterControl are registered trademarks in the US, UK, and EU. The 3rd-party trademarks on this site are property of their respective owners and are used for referential purposes only.

Made with Material for MkDocs