MySQL & MariaDB High Availability in 2026

Every Clustering Option, Compared Honestly

From Tungsten Cluster and InnoDB Cluster to Galera, ProxySQL, Vitess, Kubernetes operators, and managed cloud — what each solution actually does, where it shines, and where it doesn't. Covering MySQL, MariaDB, and Percona Server, including the 2026 independent Jepsen findings on Galera Cluster.

Last updated:

The 2026 Landscape: Seven Ways to Keep MySQL & MariaDB Available

High availability is not one problem. Local failover, cross-site disaster recovery, multi-site writes, horizontal scale, and zero-downtime operations are different requirements with different best answers. Here is every serious option.

Async + Proxy

ProxySQL + Orchestrator

The leading open-source assembly: Orchestrator manages replication topology and failover; ProxySQL provides query-aware routing. Now under common ProxySQL stewardship with tightening integration — coordinated drain and hostgroup updates during recovery.

  • Free, excellent individual components, large community
  • Query rules, caching, and mature traffic management
  • Works across MySQL, MariaDB, and Percona Server
  • Still separate deployables — you own integration, testing, and failure policy end to end
  • No composite multi-site cluster concept or coordinated maintenance workflows
  • No single support contract covering the whole failure path
Best fit: strong in-house DBA/SRE teams building and owning their own HA stack.
Kubernetes

Kubernetes Operators

Oracle MySQL Operator, Percona Operators for MySQL/PXC, and MariaDB Operator fold failover, backup, upgrades, and reconciliation into the Kubernetes control plane — HA becomes a platform feature.

  • Declarative lifecycle; natural fit for platform teams
  • Standardized backup and observability integration
  • Kubernetes-only operating model
  • Cross-cluster disaster orchestration and external traffic movement still require design work
  • Operator quality and support vary significantly
Best fit: containerized greenfield deployments on an established Kubernetes platform.
Managed Cloud

Aurora MySQL, RDS, Cloud SQL, Azure, HeatWave

HA as a checkbox: Multi-AZ failover is standard, and Aurora Global Database adds managed cross-region replication with switchover and failover. The path of least resistance for cloud-first teams.

  • Minimal operational burden; backup, monitoring, patching included
  • Consumption pricing on the existing cloud bill
  • Single-provider boundary: no cross-cloud or cloud-to-on-premises topology
  • Engine drift (Aurora is not community MySQL), restricted internals, provider-controlled maintenance
  • Cross-region replication and egress costs scale steeply with write volume
Best fit: single-cloud workloads where zero operations outweighs control and portability.
MariaDB Stack

MariaDB Enterprise Platform + MaxScale

MariaDB Server, Enterprise Cluster (Galera), and MaxScale — a SQL-aware proxy with read/write splitting and automatic failover. With Galera now in-house, the strongest single-vendor portfolio in the MariaDB segment.

  • Capable SQL-aware routing and primary detection
  • One vendor for server, cluster, and proxy
  • MariaDB Server-centric — not for MySQL or Percona Server estates; MySQL Galera support ends September 2026
  • MaxScale is BSL-licensed: free for two servers, paid beyond
  • A portfolio of separate subsystems, not one composite cluster product; geo-DR still rides on Galera semantics — see the Jepsen findings under the Galera profile
Best fit: committed MariaDB-only environments wanting one commercial vendor.
Native MySQL

MySQL InnoDB Cluster & ClusterSet

Oracle's built-in HA: Group Replication for consensus-based local failover, MySQL Router with SQL-aware read/write splitting, and ClusterSet linking clusters across sites for disaster recovery. Included with MySQL Community Edition.

  • Free, in-the-box, strong AdminAPI tooling
  • Router automatically follows cluster topology
  • ClusterSet gives managed cross-site topology
  • Site failover is administrator-triggered; emergency failover can lose unreplicated acknowledged writes
  • Invalidated clusters need manual repair and rejoin
  • MySQL only — no MariaDB or mixed-estate coverage
Best fit: single-region HA for Oracle MySQL 8.0+/8.4+ estates with DBA-managed DR.
Scale-Out

Vitess / PlanetScale & TiDB

Vitess (CNCF, built at YouTube) shards MySQL horizontally behind VTGate; PlanetScale offers it as a polished managed service. TiDB is a MySQL-compatible distributed SQL database. Both solve scale-plus-resilience, not conventional HA/DR.

  • Genuine answer for extreme write scale and online resharding
  • PlanetScale's developer experience (branching, safe schema changes) is best in class
  • Adopting a sharding control plane — or a new engine — is heavy for a conventional HA/DR requirement
  • Self-hosted Vitess requires rare expertise; PlanetScale means a managed SaaS
  • Compatibility and workflow constraints vary by workload
Best fit: tens of terabytes with massive write fan-out, or teams that want a managed sharded platform.
Synchronous

Galera: MariaDB Galera Cluster & Percona XtraDB Cluster

Virtually synchronous, certification-based multi-writer clustering — the most widely deployed HA approach in the ecosystem. MariaDB plc acquired Codership, Galera's maker, in May 2025 and now owns the codebase and roadmap.

MySQL support ending: MariaDB has announced it is discontinuing Galera Cluster for MySQL — maintenance and binary releases for the MySQL build end September 30, 2026, with new clustering features landing only in MariaDB Galera Cluster. MySQL Galera users must migrate (MariaDB offers an in-place path; Percona XtraDB Cluster is the main alternative).
Jepsen findings (March 2026): An independent Jepsen analysis of MariaDB Galera Cluster 12.1.2 found loss of committed transactions under coordinated node crashes (MDEV-38974) — notably under MariaDB's own recommended settings — and under crash-plus-partition even with full durability settings (MDEV-38976), plus Lost Update (MDEV-38977) and stale reads (MDEV-38999) in healthy clusters with no faults injected. All four issues were unresolved at publication. Jepsen concluded the observed behavior fell short of the documented "between Serializable and Repeatable Read" isolation claim.
  • Proven, widely deployed technology for low-latency, single-datacenter clusters
  • Multi-writer works for partitionable, low-conflict workloads
  • Free and open source, with a large ecosystem and hiring pool
  • Certification-based commit acknowledges before cluster-wide apply completes — the architectural root of the Jepsen anomalies (durability under overlapping failures; Lost Update and stale reads under normal concurrency)
  • Commit latency bound by round-trip to the farthest node; throughput throttled by the slowest applier under flow control — stretched WAN clusters are operationally unattractive for most OLTP
  • State transfers (SST) and major-version transitions need careful choreography
  • Single-vendor roadmap: codebase now owned by MariaDB plc, with the MySQL build discontinued (see above)
Best fit: cost-sensitive, lower-risk workloads on MariaDB where teams accept the documented consistency/durability envelope; set innodb_flush_log_at_trx_commit=1 per Jepsen's recommendation. Further reading: Continuent's analyses of what Jepsen found and the clustering trade-offs in practice.

Side-by-Side Capability Comparison

Capabilities are stated with their operating model — a "yes" that requires custom engineering is not the same as a "yes" that ships in the product.

Scroll the table sideways to see every column »
Capability InnoDB Cluster / ClusterSet Galera / PXC / MariaDB ProxySQL + Orchestrator Vitess / PlanetScale Managed Cloud Tungsten Cluster
Automated local failover Yes Yes Yes Yes Yes Yes
SQL-aware proxy / routing YesRouter R/W splitting YesMaxScale (MariaDB only, BSL) YesProxySQL YesVTGate Partialendpoints / RDS Proxy YesConnector, transaction-aware
Cross-site topology management PartialClusterSet, admin-triggered failover LimitedWAN-sensitive by design Customno site abstraction Partialcell/shard design Partialprovider-bound (e.g. Aurora Global) Yescomposite clusters
Multi-site active/active No Constrainedlatency physics over WAN No Via sharding Nosingle-writer per region Yesasync, explicit write-ownership model
Independent Jepsen analysis of durability & consistency Not testedno public analysis of current versions Anomalies found2026: committed-write loss, Lost Update, stale reads; unresolved at publication Not testedcomponent assembly Not testedcurrent versions Not testedcurrent versions Not testedsingle-writer ordered-log design avoids the multi-writer certification window at issue
Zero-downtime maintenance workflows Partialrolling, version limits PartialSST / upgrade planning Manualcustomer choreography Yesmanaged platform Partialprovider-scheduled windows Yescore product workflow
MySQL + MariaDB + Percona coverage MySQL only NarrowingMySQL build EOL Sept 30, 2026 Yes MySQL-compatible Engine-dependent Yesuniform across all three
Cross-cloud & hybrid (on-prem + cloud) Custom Custom Custom Self-hosted only Nosingle provider Yescore use case
Heterogeneous replication (→ PostgreSQL etc.) No No No No DMS-style tools YesTungsten Replicator
Single accountable 24/7 vendor for the full stack Oracle EEsubscription Support vendors Nomulti-component PlanetScale SaaS Provider SLAs Yes
Open-source core Yes Yes Yes YesVitess N/A Nocommercial product

Notes: "Multi-site active/active" models differ fundamentally — Galera uses synchronous certification (LAN-oriented), Group Replication multi-primary is workload-constrained, and Tungsten uses asynchronous replication between clusters with an explicit write-ownership and conflict-avoidance contract. On the Jepsen row: a public analysis can demonstrate the presence of anomalies, not their absence elsewhere — "not tested" is not a certification. What is on record: the March 2026 Jepsen report documents unresolved durability and consistency anomalies in MariaDB Galera Cluster 12.1.2, and MariaDB has announced end of support for the MySQL build of Galera effective September 30, 2026.

Which Solution Should You Choose?

An honest decision guide. Start from your actual requirement, not from a product.

"I need HA in one datacenter or region."

InnoDB Cluster (MySQL), Galera/PXC, or your cloud provider's Multi-AZ offering will serve you well — often at no license cost. If you evaluate Galera, read the 2026 Jepsen findings first and configure full durability (innodb_flush_log_at_trx_commit=1). Tungsten also covers this, but it's not where it's uniquely valuable.

"I need horizontal write scale, tens of TB, sharding."

Look at Vitess (self-hosted or via PlanetScale) or TiDB. Clustering middleware doesn't shard; this is a different problem class.

"I'm all-in on one cloud and want zero operations."

Aurora MySQL with Global Database (or the equivalent on your provider) is hard to argue with — as long as you accept the provider boundary, engine drift, and egress economics.

"I have a strong DBA team and want open source end to end."

ProxySQL + Orchestrator is the best open assembly, and its integration is improving. Budget for building, testing, and owning the failure path yourself.

"I'm running Galera on MySQL today."

You have a decision to make: MariaDB ends MySQL Galera support on September 30, 2026. Options are migrating to MariaDB Galera Cluster (in-place path available), moving to Percona XtraDB Cluster, adopting InnoDB Cluster — or taking the opportunity to re-evaluate the architecture in light of the Jepsen findings and consider an ordered-log clustering model like Tungsten.

"My database must survive a site, region, or cloud failure — and a commit must stay committed."

This is where the assembled and single-vendor options run out, and where Tungsten Cluster is built to live: composite multi-site clusters across any mix of clouds and datacenters, a durable ordered write path where acknowledged transactions survive failover, transparent application failover, zero-downtime operations, and one accountable vendor — for MySQL, MariaDB, and Percona Server alike.

Why Teams Choose Tungsten Cluster

Most alternatives now offer good failover or a capable proxy. What none of them offer is the integrated combination — tested and supported as one product.

A Commit Means Committed

Writes are serialized through a designated primary into a durable replication log; failover promotes the most advanced log position. Commit, reads, and recovery advance one shared transaction history — the design property at the heart of the 2026 Jepsen discussion.

Geo-Distributed by Design

Composite clusters span sites, regions, and clouds using asynchronous replication — no WAN certification penalty on every commit. Active/passive or active/active with an explicit, documented write-ownership model.

Failover Applications Don't Notice

The Tungsten Connector is a transaction-aware proxy that understands cluster topology. Primaries move; connection strings, sessions, and applications don't. Read freshness is governed by explicit routing policy, not assumed from cluster symmetry.

Maintenance Without Windows

Rolling upgrades, schema operations, node and site maintenance are orchestrated product workflows — not runbooks you write and rehearse yourself.

One Product for Mixed Estates

MySQL, MariaDB, and Percona Server under one operating model — plus heterogeneous replication to PostgreSQL and other targets for migration and coexistence.

One Throat to Choke

24/7/365 support from the team that builds the product — with publicly cited under-3-minute urgent response times — covering proxy, orchestration, and replication, with two decades of production history.

Frequently Asked Questions

What did the 2026 Jepsen analysis find in Galera Cluster?

Kyle Kingsbury's independent Jepsen report (March 16, 2026) on MariaDB Galera Cluster 12.1.2 documented four issues, all unresolved at publication: loss of committed transactions when nodes crash in quick succession (MDEV-38974 — under MariaDB's then-recommended innodb_flush_log_at_trx_commit=0 setting), occasional loss of committed transactions under process crashes plus network partitions even with full durability settings (MDEV-38976), Lost Update (MDEV-38977), and stale reads (MDEV-38999) — the latter two occurring in healthy clusters with no faults injected. Jepsen concluded the observed behavior did not meet Galera's documented isolation claims. The root cause traces to Galera's optimistic certification model, where commit acknowledgement reflects certification agreement rather than completed, durable cluster-wide apply. Continuent's analysis of the findings and trade-off comparison cover the operational implications. Fair caveat, stated in both: Jepsen can demonstrate the presence of anomalies, not their absence in untested systems.

Is MariaDB really ending Galera support for MySQL?

Yes. Following its acquisition of Codership, MariaDB announced that maintenance and binary releases for all current MySQL Galera Cluster versions end on September 30, 2026, after which new clustering features land only in MariaDB Galera Cluster. MariaDB offers an in-place migration from MySQL Galera to MariaDB Galera Cluster; Percona XtraDB Cluster remains the main Galera-based alternative for those staying on the MySQL/Percona side. MySQL Galera users should treat this as a forced architecture decision — and a natural moment to re-evaluate clustering models altogether.

Is Galera synchronous replication "safer" than asynchronous clustering?

The 2026 Jepsen findings complicate the traditional assumption. Galera's certification is synchronous, but acknowledgement occurs before cluster-wide apply completes — and Jepsen documented committed-transaction loss under overlapping failures plus Lost Update and stale reads in healthy clusters. Meanwhile the same synchrony makes commits sensitive to the farthest node and throughput sensitive to the slowest one. Asynchronous geo-clustering (as in Tungsten composite clusters) accepts a defined, monitored replication lag in exchange for site independence and a single ordered transaction history where commit, reads, and failover agree. The right question isn't "sync or async" but "what does a commit acknowledgement actually guarantee, and what RPO/RTO does each topology deliver under real failure conditions."

MySQL Router now does read/write splitting — do I still need an intelligent proxy?

Router's SQL-classified splitting is a real capability and a fair baseline. The differences appear during failure and maintenance: how sessions, transactions, and prepared statements are handled while a primary moves, how routing follows multi-site topology, and how traffic is drained for zero-downtime operations. Evaluate proxies on failover behavior under load, not on feature checklists.

What does "active/active" really mean across these products?

At least three different things. Galera and Group Replication multi-primary mean synchronous write-anywhere within one cluster — workload-constrained, latency-bound, and (per Jepsen) exposed to Lost Update in Galera's case. Sharded systems (Vitess) mean each shard has one writer, distributed by key. Tungsten composite active/active means each site runs a full cluster accepting writes, replicated asynchronously between sites with an explicit write-ownership and conflict-avoidance model. Match the model to your application's semantics before comparing anything else.

Is Aurora Global Database equivalent to a multi-site cluster?

For AWS-only estates it covers managed cross-region DR well. It does not address cross-cloud or on-premises topologies, uses an Aurora-specific engine rather than community MySQL, and puts failover and maintenance policy on the provider's terms. Whether that matters depends entirely on your portability and control requirements.

Do these solutions support MariaDB as well as MySQL?

It varies widely — and the gap is widening. InnoDB Cluster is MySQL-only. MaxScale and Enterprise Cluster are MariaDB-centric, and Galera's MySQL build is discontinued after September 2026. ProxySQL works across the family. Tungsten Cluster supports MySQL, MariaDB, and Percona Server under one operating model — one of its core differentiators for mixed estates.