The latest from the MySQL community

Starting with Percona XtraDB Cluster (PXC) 8.0, replication traffic encryption is enabled by default. That said, it’s common to find clusters running without TLS that suddenly need it: a new compliance requirement, an audit finding, a network segment that is no longer considered trusted.

PXC has a variable for exactly that case, pxc-encrypt-cluster-traffic, which handles SSL encryption for inter-node traffic, including State Snapshot Transfer (SST), Incremental State Transfer (IST), and the group communication the nodes use for replication.

The variable is not dynamic, and turning it on normally costs a full cluster restart since the node that encrypts traffic listens on ssl:// while its peers are still on tcp://. If a node joins the cluster with TLS enabled while remaining nodes don’t, the restarting node fails to reach out to the other peers with the following error:

2026-09-02T02:16:02.359992Z 0 [Note] [MY-000000] …

MySQL HeatWave telemetry is the built-in capability for exporting selected MySQL server logs to an observability destination. When telemetry is configured with OCI Log Analytics, it export MySQL log natively for search and analysis – supporting security investigations, database and operational errors troubleshooting, identification of costly SQL and performance bottlenecks, and centralized audit records for […]

Manage recurring maintenance windows, defer disruptive maintenance, and audit maintenance activity with a reusable Bash utility. MySQL HeatWave on Oracle Cloud Infrastructure gives administrators control over when scheduled maintenance can occur and, with maintenance-disabled windows, the ability to temporarily defer non-critical maintenance that would cause downtime. That flexibility is useful when a DB System supports […]

When setting up a new database for an application, high availability (HA) is one of the main priorities. Let’s assume for this example that you chose to use a Percona XtraDB (PXC) cluster to host your database. But how does the application know which PXC node is healthy and can receive application traffic? Introducing a cluster of ProxySQLs can solve this problem, as ProxySQL will healthcheck the database nodes and route the application traffic to the healthy nodes. However, now the HA problem comes up again: how does the application know which ProxySQL host is healthy?

Putting “one more component” in front of your servers to make them highly available just shifts the problem up by one layer. From making the database HA, to making ProxySQL HA, to needing to make HAProxy HA and so on…

At some point, you may land on the common HA strategy, keepalived, but BGP ECMP is a powerful alternative worth considering.

What …

Twitter login with Node breaks every few years because the pieces move under it. I rebuilt this app on the current releases and fixed each place where the old code stops working, so you can follow it step by step and finish with a working sign-in. Live Demo Download Code Pick the right X auth […]

As we have discussed through the new MySQL Community Engagement initiative, we are sharing metrics that highlight how the community contributes to MySQL. These measures help us understand the growth of community participation, recognize the people helping improve the product, and identify where we can continue to strengthen the contributor experience. The MySQL community delivered […]

In this guide, we explain 150+ SQL commands in simple words, covering everything from basic queries to advanced functions for 2026. We cover almost every SQL command that exists in one single place, so you never have to go search for anything anywhere else. If you master these 150 commands, you will become an SQL […]

An engineer leaves your company. You disable their single sign-on account, and their access to the wiki, the cloud console, and the CI system goes with it. Typically, access to database resources doesn't follow such a simple plan. Database user and role maintenance too often happens within the database, oblivious to single sign-on. User accounts carry a password which has to be managed and rotated (and the password is probably already sprawled out across shell history and a shared password manager).

An easier way to manage this is to bring the identity-provider model to the database. This is what the VillageSQL Server vsql-oauth2 extension does. It adds an authentication method that accepts an OAuth2/OpenID Connect token (a JWT) from your identity provider in place of a password. Your identity provider decides who can log in, MySQL privileges decide what they can do …

SQL problems become manageable when you turn the prompt into decisions about rows, columns, grouping, and result order, and I ran the worked example below with Python 3.11.16 and SQLite 3.53.1 so you can inspect how each clause changes the result. Start with the requested result Before writing SQL, mark the rows the prompt should […]

Percona Server for MySQL now ships with a fully open source OpenID Connect (OIDC) authentication plugin, available starting with Percona Server for MySQL 8.4.11-11 and 9.7.2-2 (not yet released as of this writing). It allows a MySQL account to authenticate against any standards-compliant Identity Provider (IdP) instead of relying on a locally stored password, closing the gap with MySQL Enterprise Edition, which has offered OIDC authentication since MySQL 9.1 and, in several respects, going beyond it.

Oracle offers the same category of functionality, but its server-side plugin is part of the paid MySQL Enterprise Edition. Percona’s implementation is open source and adds three capabilities the Enterprise plugin does not provide: automatic signing-key synchronization from a JWKS endpoint, IdP group-to-role mapping, and proxy-user support. This article explains how the plugin works and why those differences …