PLATOPS-684 feat: add ignoredReplicaTables support for external replication denylist

Makefile

@@ -14,7 +14,7 @@ endif
 SHELL = /usr/bin/env bash -o pipefail
 .SHELLFLAGS = -ec
 
-VERSION ?= 26.6.0-bandwidth.8
+VERSION ?= 26.6.0-bandwidth.9
 
 # mariadb-operator
 IMG_NAME ?= ghcr.io/mariadb-operator/mariadb-operator

api/v1alpha1/mariadb_replication_types.go

@@ -255,13 +255,24 @@ type ReplicaFromExternal struct {
 	// +optional
 	// +operator-sdk:csv:customresourcedefinitions:type=spec
 	FilteredReplicaTables []string `json:"filteredReplicaTables,omitempty"`
+	// IgnoredReplicaTables is an optional list of tables in "database.table" format to exclude from replication.
+	// When set, the replication will be configured with replicate_ignore_table for each entry. GTID strict mode
+	// is automatically disabled when this field is set, as partial replication is incompatible with it.
+	// +optional
+	// +operator-sdk:csv:customresourcedefinitions:type=spec
+	IgnoredReplicaTables []string `json:"ignoredReplicaTables,omitempty"`
 }
 
 // HasFilteredTables returns true when at least one filtered table is defined.
 func (r *ReplicaFromExternal) HasFilteredTables() bool {
 	return len(r.FilteredReplicaTables) > 0
 }
 
+// HasIgnoredTables returns true when at least one ignored table is defined.
+func (r *ReplicaFromExternal) HasIgnoredTables() bool {
+	return len(r.IgnoredReplicaTables) > 0
+}
+
 // SetDefaults fills the current ReplicaReplication object with DefaultReplicationSpec.
 // This enables having minimal ReplicaReplication objects and provides sensible defaults.
 func (r *ReplicaReplication) SetDefaults(mdb *MariaDB) {
@@ -466,8 +477,9 @@ func (r *Replication) SetDefaults(mdb *MariaDB, env *environment.OperatorEnv) er
 	}
 
 	if r.GtidStrictMode == nil {
-		// Filtered replica is incompatible with GTID strict mode; disable it automatically.
-		if r.IsExternalReplication() && r.ReplicaFromExternal.HasFilteredTables() {
+		// Filtered/ignored replica is incompatible with GTID strict mode; disable it automatically.
+		if r.IsExternalReplication() &&
+			(r.ReplicaFromExternal.HasFilteredTables() || r.ReplicaFromExternal.HasIgnoredTables()) {
 			r.GtidStrictMode = ptr.To(false)
 		} else {
 			r.GtidStrictMode = ptr.To(true)

config/crd/bases/k8s.mariadb.com_mariadbs.yaml

@@ -5450,6 +5450,14 @@ spec:
                         description: HealthCheckInterval to be used when the replica
                           connects to the primary.
                         type: string
+                      ignoredReplicaTables:
+                        description: |-
+                          IgnoredReplicaTables is an optional list of tables in "database.table" format to exclude from replication.
+                          When set, the replication will be configured with replicate_ignore_table for each entry. GTID strict mode
+                          is automatically disabled when this field is set, as partial replication is incompatible with it.
+                        items:
+                          type: string
+                        type: array
                       mariaDbRef:
                         description: MariaDBRef is a reference to a MariaDB object.
                         properties:

deploy/charts/mariadb-cluster/Chart.yaml

@@ -4,7 +4,7 @@ description: Create MariaDB cluster managed by mariadb-operator
 home: https://github.com/mariadb-operator/mariadb-operator
 icon: https://mariadb-operator.github.io/mariadb-operator/assets/mariadb_profile.svg
 type: application
-version: 26.6.0-bandwidth.8
+version: 26.6.0-bandwidth.9
 appVersion: "0.0.0"
 kubeVersion: ">=1.26.0-0"
 maintainers:

deploy/charts/mariadb-cluster/README.md

@@ -2,7 +2,7 @@
 
 [//]: # (README.md generated by gotmpl. DO NOT EDIT.)
 
-![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![Version: 26.6.0-bandwidth.8](https://img.shields.io/badge/Version-26.6.0--bandwidth.8-informational?style=flat-square) ![AppVersion: 0.0.0](https://img.shields.io/badge/AppVersion-0.0.0-informational?style=flat-square)
+![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![Version: 26.6.0-bandwidth.9](https://img.shields.io/badge/Version-26.6.0--bandwidth.9-informational?style=flat-square) ![AppVersion: 0.0.0](https://img.shields.io/badge/AppVersion-0.0.0-informational?style=flat-square)
 
 Create MariaDB cluster managed by mariadb-operator
 

deploy/charts/mariadb-operator-crds/Chart.yaml

@@ -4,7 +4,7 @@ description: mariadb-operator CRDs
 home: https://github.com/mariadb-operator/mariadb-operator
 icon: https://mariadb-operator.github.io/mariadb-operator/assets/mariadb_profile.svg
 type: application
-version: 26.6.0-bandwidth.8
+version: 26.6.0-bandwidth.9
 appVersion: "0.0.0"
 kubeVersion: ">=1.26.0-0"
 maintainers:

deploy/charts/mariadb-operator-crds/templates/crds.yaml

@@ -7631,6 +7631,14 @@ spec:
                         description: HealthCheckInterval to be used when the replica
                           connects to the primary.
                         type: string
+                      ignoredReplicaTables:
+                        description: |-
+                          IgnoredReplicaTables is an optional list of tables in "database.table" format to exclude from replication.
+                          When set, the replication will be configured with replicate_ignore_table for each entry. GTID strict mode
+                          is automatically disabled when this field is set, as partial replication is incompatible with it.
+                        items:
+                          type: string
+                        type: array
                       mariaDbRef:
                         description: MariaDBRef is a reference to a MariaDB object.
                         properties:

deploy/charts/mariadb-operator/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: mariadb-operator-crds
   repository: file://../mariadb-operator-crds
-  version: 26.6.0-bandwidth.8
-digest: sha256:b0951d96d44b099790a5d53d1b3a27ad7f331cd60749f40708e14250850607c5
-generated: "2026-09-18T17:14:32.642796078Z"
+  version: 26.6.0-bandwidth.9
+digest: sha256:a5ef40448b273ed42b39335d383c5a205224dc2562676789f744a846199d2606
+generated: "2026-10-06T12:59:27.219777751-04:00"

deploy/charts/mariadb-operator/Chart.yaml

@@ -4,8 +4,8 @@ description: Run and operate MariaDB in a cloud native way
 home: https://github.com/mariadb-operator/mariadb-operator
 icon: https://mariadb-operator.github.io/mariadb-operator/assets/mariadb_profile.svg
 type: application
-version: 26.6.0-bandwidth.8
-appVersion: "26.6.0-bandwidth.8"
+version: 26.6.0-bandwidth.9
+appVersion: "26.6.0-bandwidth.9"
 kubeVersion: ">=1.26.0-0"
 maintainers:
   - email: martin.montes@mariadb.com
@@ -19,6 +19,6 @@ keywords:
   - maxscale
 dependencies:
   - name: mariadb-operator-crds
-    version: "26.6.0-bandwidth.8"
+    version: "26.6.0-bandwidth.9"
     condition: crds.enabled
     repository: file://../mariadb-operator-crds

deploy/charts/mariadb-operator/README.md

@@ -2,7 +2,7 @@
 
 [//]: # (README.md generated by gotmpl. DO NOT EDIT.)
 
-![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![Version: 26.6.0-bandwidth.8](https://img.shields.io/badge/Version-26.6.0--bandwidth.8-informational?style=flat-square) ![AppVersion: 26.6.0-bandwidth.8](https://img.shields.io/badge/AppVersion-26.6.0--bandwidth.8-informational?style=flat-square)
+![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![Version: 26.6.0-bandwidth.9](https://img.shields.io/badge/Version-26.6.0--bandwidth.9-informational?style=flat-square) ![AppVersion: 26.6.0-bandwidth.9](https://img.shields.io/badge/AppVersion-26.6.0--bandwidth.9-informational?style=flat-square)
 
 Run and operate MariaDB in a cloud native way
 

deploy/crds/crds.yaml

@@ -7631,6 +7631,14 @@ spec:
                         description: HealthCheckInterval to be used when the replica
                           connects to the primary.
                         type: string
+                      ignoredReplicaTables:
+                        description: |-
+                          IgnoredReplicaTables is an optional list of tables in "database.table" format to exclude from replication.
+                          When set, the replication will be configured with replicate_ignore_table for each entry. GTID strict mode
+                          is automatically disabled when this field is set, as partial replication is incompatible with it.
+                        items:
+                          type: string
+                        type: array
                       mariaDbRef:
                         description: MariaDBRef is a reference to a MariaDB object.
                         properties:

docs/api_reference.md

@@ -2644,6 +2644,7 @@ _Appears in:_
 | `healthCheckInterval` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#duration-v1-meta)_ | HealthCheckInterval to be used when the replica connects to the primary. |  |  |
 | `serverIdOffset` _integer_ | ServerIdOffset to be used on the replicas. Each replica gets server_id = podIndex + offset.<br />If not set, the operator auto-discovers a non-colliding offset by querying the external MariaDB<br />for the server ids already in use, leaving room above them for scale out and other clusters. The<br />discovered value is persisted to status.externalReplication.serverIdOffset and computed only once. |  |  |
 | `filteredReplicaTables` _string array_ | FilteredReplicaTables is an optional list of tables in "database.table" format to replicate.<br />When set, the logical backup will only include these tables and the replication will be<br />configured with replicate_do_table for each entry. GTID strict mode is automatically<br />disabled when this field is set, as partial replication is incompatible with it. |  |  |
+| `ignoredReplicaTables` _string array_ | IgnoredReplicaTables is an optional list of tables in "database.table" format to exclude from replication.<br />When set, the replication will be configured with replicate_ignore_table for each entry. GTID strict mode<br />is automatically disabled when this field is set, as partial replication is incompatible with it. |  |  |
 
 
 #### ReplicaRecovery

docs/docker.md

@@ -36,7 +36,7 @@
     </tr>
     <tr>
       <td>MariaDB Operator</td>
-	    <td><code>ghcr.io/mariadb-operator/mariadb-operator:26.6.0-bandwidth.8</code></td>
+	    <td><code>ghcr.io/mariadb-operator/mariadb-operator:26.6.0-bandwidth.9</code></td>
       <td><code>amd64</code> <code>arm64</code></td>
     </tr>
   </tbody>

examples/manifests/mariadb_replication.yaml

@@ -66,10 +66,10 @@ spec:
     # syncBinlog: 1
     # Init container that cooperates with mariadb-operator.
     # initContainer:
-    #   image: ghcr.io/mariadb-operator/mariadb-operator:26.6.0-bandwidth.8
+    #   image: ghcr.io/mariadb-operator/mariadb-operator:26.6.0-bandwidth.9
     # Agent sidecar that cooperates with mariadb-operator.
     # agent:
-    #   image: ghcr.io/mariadb-operator/mariadb-operator:26.6.0-bandwidth.8
+    #   image: ghcr.io/mariadb-operator/mariadb-operator:26.6.0-bandwidth.9
 
   service:
     type: LoadBalancer

hack/config/minio.yaml

@@ -1,3 +1,11 @@
+# Official MinIO images are no longer publicly available in quay.io nor docker.io.
+image:
+  repository: docker.io/pgsty/minio
+  tag: RELEASE.2026-08-04T00-00-00Z
+mcImage:
+  repository: docker.io/pgsty/mc
+  tag: RELEASE.2026-09-16T00-00-00Z
+
 minioAPIPort: "9000"
 minioConsolePort: "9001"
 

pkg/builder/container_builder.go

@@ -659,6 +659,12 @@ func externalReplEnvVars(mariadb *mariadbv1alpha1.MariaDB) []corev1.EnvVar {
 			Value: strings.Join(ext.FilteredReplicaTables, ","),
 		})
 	}
+	if ext.HasIgnoredTables() {
+		env = append(env, corev1.EnvVar{
+			Name:  "MARIADB_EXTERNAL_REPL_IGNORED_TABLES",
+			Value: strings.Join(ext.IgnoredReplicaTables, ","),
+		})
+	}
 	return env
 }
 

pkg/controller/replication/config.go

@@ -94,6 +94,7 @@ func NewReplicationConfig(env *env.PodEnvironment) ([]byte, error) {
 	}
 
 	filteredTables := env.ExternalReplFilteredTables()
+	ignoredTables := env.ExternalReplIgnoredTables()
 
 	// To facilitate switchover/failover and avoid clashing with MaxScale, this configuration allows any Pod to act either as a primary or a replica.
 	// See: https://mariadb.com/docs/server/ha-and-performance/standard-replication/semisynchronous-replication#enabling-semisynchronous-replication
@@ -123,6 +124,9 @@ sync_binlog={{ . }}
 {{- range .ReplicateDoTables }}
 replicate_do_table={{ . }}
 {{- end }}
+{{- range .IgnoredReplicaTables }}
+replicate_ignore_table={{ . }}
+{{- end }}
 `)
 	buf := new(bytes.Buffer)
 	err = tpl.Execute(buf, struct {
@@ -135,6 +139,7 @@ replicate_do_table={{ . }}
 		SyncBinlog              *int
 		ServerID                int
 		ReplicateDoTables       []string
+		IgnoredReplicaTables    []string
 	}{
 		LogName:                 env.MariadbName,
 		GtidStrictMode:          gtidStrictMode,
@@ -145,6 +150,7 @@ replicate_do_table={{ . }}
 		ServerID:                sId,
 		SyncBinlog:              syncBinlog,
 		ReplicateDoTables:       filteredTables,
+		IgnoredReplicaTables:    ignoredTables,
 	})
 	if err != nil {
 		return nil, err

pkg/environment/environment.go

@@ -72,6 +72,7 @@ type PodEnvironment struct {
 	MariaDBExternalReplEnabled         string `env:"MARIADB_EXTERNAL_REPL_ENABLED"`
 	MariaDBExternalReplServerIdOffset  string `env:"MARIADB_EXTERNAL_REPL_SERVER_ID_OFFSET"`
 	MariaDBExternalReplFilteredTables  string `env:"MARIADB_EXTERNAL_REPL_FILTERED_TABLES"`
+	MariaDBExternalReplIgnoredTables   string `env:"MARIADB_EXTERNAL_REPL_IGNORED_TABLES"`
 	MariaDBReplGtidStrictMode          string `env:"MARIADB_REPL_GTID_STRICT_MODE"`
 	MariaDBReplGtidDomainID            string `env:"MARIADB_REPL_GTID_DOMAIN_ID"`
 	MariaDBReplServerIDStartIndex      string `env:"MARIADB_REPL_SERVER_ID_START_INDEX"`
@@ -203,6 +204,15 @@ func (e *PodEnvironment) ExternalReplFilteredTables() []string {
 	return strings.Split(e.MariaDBExternalReplFilteredTables, ",")
 }
 
+// ExternalReplIgnoredTables returns the list of "database.table" entries to exclude from replication,
+// or nil when ignored tables are not configured.
+func (e *PodEnvironment) ExternalReplIgnoredTables() []string {
+	if e.MariaDBExternalReplIgnoredTables == "" {
+		return nil
+	}
+	return strings.Split(e.MariaDBExternalReplIgnoredTables, ",")
+}
+
 func GetPodEnv(ctx context.Context) (*PodEnvironment, error) {
 	var env PodEnvironment
 	if err := envconfig.Process(ctx, &env); err != nil {