MySQL & MariaDB High Availability in 2026
Every Clustering Option, Compared Honestly
From Tungsten Cluster and InnoDB Cluster to Galera, ProxySQL, Vitess, Kubernetes operators, and managed cloud — what each solution actually does, where it shines, and where it doesn't. Covering MySQL, MariaDB, and Percona Server, including the 2026 independent Jepsen findings on Galera Cluster.
The 2026 Landscape: Seven Ways to Keep MySQL & MariaDB Available
High availability is not one problem. Local failover, cross-site disaster recovery, multi-site writes, horizontal scale, and zero-downtime operations are different requirements with different best answers. Here is every serious option.
Tungsten Cluster
A complete clustering product: Tungsten Manager (topology and failover orchestration), Tungsten Connector (transaction-aware intelligent proxy), and Tungsten Replicator (asynchronous replication) — tested, versioned, and supported as one system for over two decades.
- Composite clusters: orchestrated cross-site, cross-cloud, and hybrid topologies — active/passive or active/active
- Applications connect through the Connector unchanged; failover is transparent to sessions
- Durable, ordered write path: commit, reads, and failover all follow a single tracked transaction history
- Zero-downtime maintenance operations as a core workflow
- Uniform support for MySQL, MariaDB, and Percona Server; heterogeneous replication to PostgreSQL and beyond
- One 24/7/365 support contract for the whole stack
- Commercial software — not open source
- Active/active uses asynchronous replication with an explicit write-ownership and conflict-avoidance model (by design; not synchronous write-anywhere)
ProxySQL + Orchestrator
The leading open-source assembly: Orchestrator manages replication topology and failover; ProxySQL provides query-aware routing. Now under common ProxySQL stewardship with tightening integration — coordinated drain and hostgroup updates during recovery.
- Free, excellent individual components, large community
- Query rules, caching, and mature traffic management
- Works across MySQL, MariaDB, and Percona Server
- Still separate deployables — you own integration, testing, and failure policy end to end
- No composite multi-site cluster concept or coordinated maintenance workflows
- No single support contract covering the whole failure path
Kubernetes Operators
Oracle MySQL Operator, Percona Operators for MySQL/PXC, and MariaDB Operator fold failover, backup, upgrades, and reconciliation into the Kubernetes control plane — HA becomes a platform feature.
- Declarative lifecycle; natural fit for platform teams
- Standardized backup and observability integration
- Kubernetes-only operating model
- Cross-cluster disaster orchestration and external traffic movement still require design work
- Operator quality and support vary significantly
Aurora MySQL, RDS, Cloud SQL, Azure, HeatWave
HA as a checkbox: Multi-AZ failover is standard, and Aurora Global Database adds managed cross-region replication with switchover and failover. The path of least resistance for cloud-first teams.
- Minimal operational burden; backup, monitoring, patching included
- Consumption pricing on the existing cloud bill
- Single-provider boundary: no cross-cloud or cloud-to-on-premises topology
- Engine drift (Aurora is not community MySQL), restricted internals, provider-controlled maintenance
- Cross-region replication and egress costs scale steeply with write volume
MariaDB Enterprise Platform + MaxScale
MariaDB Server, Enterprise Cluster (Galera), and MaxScale — a SQL-aware proxy with read/write splitting and automatic failover. With Galera now in-house, the strongest single-vendor portfolio in the MariaDB segment.
- Capable SQL-aware routing and primary detection
- One vendor for server, cluster, and proxy
- MariaDB Server-centric — not for MySQL or Percona Server estates; MySQL Galera support ends September 2026
- MaxScale is BSL-licensed: free for two servers, paid beyond
- A portfolio of separate subsystems, not one composite cluster product; geo-DR still rides on Galera semantics — see the Jepsen findings under the Galera profile
MySQL InnoDB Cluster & ClusterSet
Oracle's built-in HA: Group Replication for consensus-based local failover, MySQL Router with SQL-aware read/write splitting, and ClusterSet linking clusters across sites for disaster recovery. Included with MySQL Community Edition.
- Free, in-the-box, strong AdminAPI tooling
- Router automatically follows cluster topology
- ClusterSet gives managed cross-site topology
- Site failover is administrator-triggered; emergency failover can lose unreplicated acknowledged writes
- Invalidated clusters need manual repair and rejoin
- MySQL only — no MariaDB or mixed-estate coverage
Vitess / PlanetScale & TiDB
Vitess (CNCF, built at YouTube) shards MySQL horizontally behind VTGate; PlanetScale offers it as a polished managed service. TiDB is a MySQL-compatible distributed SQL database. Both solve scale-plus-resilience, not conventional HA/DR.
- Genuine answer for extreme write scale and online resharding
- PlanetScale's developer experience (branching, safe schema changes) is best in class
- Adopting a sharding control plane — or a new engine — is heavy for a conventional HA/DR requirement
- Self-hosted Vitess requires rare expertise; PlanetScale means a managed SaaS
- Compatibility and workflow constraints vary by workload
Galera: MariaDB Galera Cluster & Percona XtraDB Cluster
Virtually synchronous, certification-based multi-writer clustering — the most widely deployed HA approach in the ecosystem. MariaDB plc acquired Codership, Galera's maker, in May 2025 and now owns the codebase and roadmap.
- Proven, widely deployed technology for low-latency, single-datacenter clusters
- Multi-writer works for partitionable, low-conflict workloads
- Free and open source, with a large ecosystem and hiring pool
- Certification-based commit acknowledges before cluster-wide apply completes — the architectural root of the Jepsen anomalies (durability under overlapping failures; Lost Update and stale reads under normal concurrency)
- Commit latency bound by round-trip to the farthest node; throughput throttled by the slowest applier under flow control — stretched WAN clusters are operationally unattractive for most OLTP
- State transfers (SST) and major-version transitions need careful choreography
- Single-vendor roadmap: codebase now owned by MariaDB plc, with the MySQL build discontinued (see above)
innodb_flush_log_at_trx_commit=1 per Jepsen's recommendation. Further reading: Continuent's analyses of what Jepsen found and the clustering trade-offs in practice.Side-by-Side Capability Comparison
Capabilities are stated with their operating model — a "yes" that requires custom engineering is not the same as a "yes" that ships in the product.
| Capability | InnoDB Cluster / ClusterSet | Galera / PXC / MariaDB | ProxySQL + Orchestrator | Vitess / PlanetScale | Managed Cloud | Tungsten Cluster |
|---|---|---|---|---|---|---|
| Automated local failover | Yes | Yes | Yes | Yes | Yes | Yes |
| SQL-aware proxy / routing | YesRouter R/W splitting | YesMaxScale (MariaDB only, BSL) | YesProxySQL | YesVTGate | Partialendpoints / RDS Proxy | YesConnector, transaction-aware |
| Cross-site topology management | PartialClusterSet, admin-triggered failover | LimitedWAN-sensitive by design | Customno site abstraction | Partialcell/shard design | Partialprovider-bound (e.g. Aurora Global) | Yescomposite clusters |
| Multi-site active/active | No | Constrainedlatency physics over WAN | No | Via sharding | Nosingle-writer per region | Yesasync, explicit write-ownership model |
| Independent Jepsen analysis of durability & consistency | Not testedno public analysis of current versions | Anomalies found2026: committed-write loss, Lost Update, stale reads; unresolved at publication | Not testedcomponent assembly | Not testedcurrent versions | Not testedcurrent versions | Not testedsingle-writer ordered-log design avoids the multi-writer certification window at issue |
| Zero-downtime maintenance workflows | Partialrolling, version limits | PartialSST / upgrade planning | Manualcustomer choreography | Yesmanaged platform | Partialprovider-scheduled windows | Yescore product workflow |
| MySQL + MariaDB + Percona coverage | MySQL only | NarrowingMySQL build EOL Sept 30, 2026 | Yes | MySQL-compatible | Engine-dependent | Yesuniform across all three |
| Cross-cloud & hybrid (on-prem + cloud) | Custom | Custom | Custom | Self-hosted only | Nosingle provider | Yescore use case |
| Heterogeneous replication (→ PostgreSQL etc.) | No | No | No | No | DMS-style tools | YesTungsten Replicator |
| Single accountable 24/7 vendor for the full stack | Oracle EEsubscription | Support vendors | Nomulti-component | PlanetScale SaaS | Provider SLAs | Yes |
| Open-source core | Yes | Yes | Yes | YesVitess | N/A | Nocommercial product |
Notes: "Multi-site active/active" models differ fundamentally — Galera uses synchronous certification (LAN-oriented), Group Replication multi-primary is workload-constrained, and Tungsten uses asynchronous replication between clusters with an explicit write-ownership and conflict-avoidance contract. On the Jepsen row: a public analysis can demonstrate the presence of anomalies, not their absence elsewhere — "not tested" is not a certification. What is on record: the March 2026 Jepsen report documents unresolved durability and consistency anomalies in MariaDB Galera Cluster 12.1.2, and MariaDB has announced end of support for the MySQL build of Galera effective September 30, 2026.
Which Solution Should You Choose?
An honest decision guide. Start from your actual requirement, not from a product.
"I need HA in one datacenter or region."
InnoDB Cluster (MySQL), Galera/PXC, or your cloud provider's Multi-AZ offering will serve you well — often at no license cost. If you evaluate Galera, read the 2026 Jepsen findings first and configure full durability (innodb_flush_log_at_trx_commit=1). Tungsten also covers this, but it's not where it's uniquely valuable.
"I need horizontal write scale, tens of TB, sharding."
Look at Vitess (self-hosted or via PlanetScale) or TiDB. Clustering middleware doesn't shard; this is a different problem class.
"I'm all-in on one cloud and want zero operations."
Aurora MySQL with Global Database (or the equivalent on your provider) is hard to argue with — as long as you accept the provider boundary, engine drift, and egress economics.
"I have a strong DBA team and want open source end to end."
ProxySQL + Orchestrator is the best open assembly, and its integration is improving. Budget for building, testing, and owning the failure path yourself.
"I'm running Galera on MySQL today."
You have a decision to make: MariaDB ends MySQL Galera support on September 30, 2026. Options are migrating to MariaDB Galera Cluster (in-place path available), moving to Percona XtraDB Cluster, adopting InnoDB Cluster — or taking the opportunity to re-evaluate the architecture in light of the Jepsen findings and consider an ordered-log clustering model like Tungsten.
"My database must survive a site, region, or cloud failure — and a commit must stay committed."
This is where the assembled and single-vendor options run out, and where Tungsten Cluster is built to live: composite multi-site clusters across any mix of clouds and datacenters, a durable ordered write path where acknowledged transactions survive failover, transparent application failover, zero-downtime operations, and one accountable vendor — for MySQL, MariaDB, and Percona Server alike.
Why Teams Choose Tungsten Cluster
Most alternatives now offer good failover or a capable proxy. What none of them offer is the integrated combination — tested and supported as one product.
A Commit Means Committed
Writes are serialized through a designated primary into a durable replication log; failover promotes the most advanced log position. Commit, reads, and recovery advance one shared transaction history — the design property at the heart of the 2026 Jepsen discussion.
Geo-Distributed by Design
Composite clusters span sites, regions, and clouds using asynchronous replication — no WAN certification penalty on every commit. Active/passive or active/active with an explicit, documented write-ownership model.
Failover Applications Don't Notice
The Tungsten Connector is a transaction-aware proxy that understands cluster topology. Primaries move; connection strings, sessions, and applications don't. Read freshness is governed by explicit routing policy, not assumed from cluster symmetry.
Maintenance Without Windows
Rolling upgrades, schema operations, node and site maintenance are orchestrated product workflows — not runbooks you write and rehearse yourself.
One Product for Mixed Estates
MySQL, MariaDB, and Percona Server under one operating model — plus heterogeneous replication to PostgreSQL and other targets for migration and coexistence.
One Throat to Choke
24/7/365 support from the team that builds the product — with publicly cited under-3-minute urgent response times — covering proxy, orchestration, and replication, with two decades of production history.
Frequently Asked Questions
What did the 2026 Jepsen analysis find in Galera Cluster?
Kyle Kingsbury's independent Jepsen report (March 16, 2026) on MariaDB Galera Cluster 12.1.2 documented four issues, all unresolved at publication: loss of committed transactions when nodes crash in quick succession (MDEV-38974 — under MariaDB's then-recommended innodb_flush_log_at_trx_commit=0 setting), occasional loss of committed transactions under process crashes plus network partitions even with full durability settings (MDEV-38976), Lost Update (MDEV-38977), and stale reads (MDEV-38999) — the latter two occurring in healthy clusters with no faults injected. Jepsen concluded the observed behavior did not meet Galera's documented isolation claims. The root cause traces to Galera's optimistic certification model, where commit acknowledgement reflects certification agreement rather than completed, durable cluster-wide apply. Continuent's analysis of the findings and trade-off comparison cover the operational implications. Fair caveat, stated in both: Jepsen can demonstrate the presence of anomalies, not their absence in untested systems.
Is MariaDB really ending Galera support for MySQL?
Yes. Following its acquisition of Codership, MariaDB announced that maintenance and binary releases for all current MySQL Galera Cluster versions end on September 30, 2026, after which new clustering features land only in MariaDB Galera Cluster. MariaDB offers an in-place migration from MySQL Galera to MariaDB Galera Cluster; Percona XtraDB Cluster remains the main Galera-based alternative for those staying on the MySQL/Percona side. MySQL Galera users should treat this as a forced architecture decision — and a natural moment to re-evaluate clustering models altogether.
Is Galera synchronous replication "safer" than asynchronous clustering?
The 2026 Jepsen findings complicate the traditional assumption. Galera's certification is synchronous, but acknowledgement occurs before cluster-wide apply completes — and Jepsen documented committed-transaction loss under overlapping failures plus Lost Update and stale reads in healthy clusters. Meanwhile the same synchrony makes commits sensitive to the farthest node and throughput sensitive to the slowest one. Asynchronous geo-clustering (as in Tungsten composite clusters) accepts a defined, monitored replication lag in exchange for site independence and a single ordered transaction history where commit, reads, and failover agree. The right question isn't "sync or async" but "what does a commit acknowledgement actually guarantee, and what RPO/RTO does each topology deliver under real failure conditions."
MySQL Router now does read/write splitting — do I still need an intelligent proxy?
Router's SQL-classified splitting is a real capability and a fair baseline. The differences appear during failure and maintenance: how sessions, transactions, and prepared statements are handled while a primary moves, how routing follows multi-site topology, and how traffic is drained for zero-downtime operations. Evaluate proxies on failover behavior under load, not on feature checklists.
What does "active/active" really mean across these products?
At least three different things. Galera and Group Replication multi-primary mean synchronous write-anywhere within one cluster — workload-constrained, latency-bound, and (per Jepsen) exposed to Lost Update in Galera's case. Sharded systems (Vitess) mean each shard has one writer, distributed by key. Tungsten composite active/active means each site runs a full cluster accepting writes, replicated asynchronously between sites with an explicit write-ownership and conflict-avoidance model. Match the model to your application's semantics before comparing anything else.
Is Aurora Global Database equivalent to a multi-site cluster?
For AWS-only estates it covers managed cross-region DR well. It does not address cross-cloud or on-premises topologies, uses an Aurora-specific engine rather than community MySQL, and puts failover and maintenance policy on the provider's terms. Whether that matters depends entirely on your portability and control requirements.
Do these solutions support MariaDB as well as MySQL?
It varies widely — and the gap is widening. InnoDB Cluster is MySQL-only. MaxScale and Enterprise Cluster are MariaDB-centric, and Galera's MySQL build is discontinued after September 2026. ProxySQL works across the family. Tungsten Cluster supports MySQL, MariaDB, and Percona Server under one operating model — one of its core differentiators for mixed estates.