How to get started with Managed MySQL

Published on: October 26, 2026

Managed MySQL runs MySQL®, the open-source relational database, as a service. You choose the size and the network, and UpCloud runs the database nodes for you. New services run MySQL 8.4.

This guide walks you through creating a Managed MySQL service in the Control Panel or with the UpCloud API, connecting to it with the mysql client, and using it from a Python application.

Before you start

For the API steps, you need an API token. To create one, see How to get started using the UpCloud API.

For plans, see Managed MySQL configurations. For prices, see the pricing page.

Choose your options

Before you create the service, decide on these options. They set where the service runs, what it costs and who can connect to it. The steps for setting them in the Control Panel or with the API come after, in Create the service.

Two of the options can't be undone: the hostname prefix can't be changed, and once the service is attached to an SDN Private Network, it can't go back to the Utility network.

Location

Create the service close to the clients that will use it. If they're Cloud Servers, put the service in their location so that they can connect to it privately. For the list of locations, see Managed MySQL availability.

Compute and storage

The compute plan sets the CPU cores and memory of each node. The plans come in three families:

Developer plans have 1 core and run on a single node, for development, testing and small workloads.
Standard plans have balanced CPU and memory for most production workloads.
High Memory plans have more memory per core, for workloads that keep a lot of data in memory.

Storage is the disk space for your data. Every node keeps a full copy of the data, so each node gets the storage you choose. The sizes on offer depend on the compute plan. For every plan and its storage range, see Managed MySQL configurations.

Nodes and backups

The number of nodes, from 1 to 3, decides whether the service has standby nodes:

With 1 node, the service has no standby node.
With 2 nodes, a standby node takes over automatically if the primary node fails.
With 3 nodes, the service has a second standby node.

Standby nodes also answer read-only queries through the service's replica hostname, described in Connect to the service. For how failover works, see Managed MySQL High availability.

The backup tier sets how long backups are kept: Mini for 3 days, Regular for 15 days and Extended for 31 days. Developer plans come with Mini only, and Standard and High Memory plans with Regular or Extended. You can restore the database to any point within that time: see How to restore a Managed Database to a point in time.

Connection access

The private connection decides which private network your Cloud Servers use to reach the service:

The Utility network is the default. Servers in the same location can connect over their Utility network interface, with nothing else to set up.
An SDN Private Network can be attached instead, and then only servers on that network can connect privately. The network must be attached to an SDN Router: see How to connect private networks using SDN Router.

Make this choice when you create the service. You can attach a network later, but once the service is on an SDN Private Network, it can't switch back to the Utility network. Detaching the network doesn't bring the Utility network back: it leaves the service without a private connection.

The public connection is off by default. Turn it on when you want to connect over the public internet through the public hostnames. The public hostnames accept connections only while the public connection is on, and only from the addresses in the allowed IP list.

Allowed IP access

Two settings decide which addresses can connect:

Automatic access from Utility network servers is on by default and lets every Cloud Server in the same location connect over the Utility network. To allow only some of them, turn it off and add their Utility network addresses to the allowed IP list.
The allowed IP list holds IPv4 addresses in CIDR notation, for example 203.0.113.10/32. It controls connections through the public hostnames, and also Utility network connections while automatic access is off.

With an empty list, nobody can connect through the public hostnames. Servers on an attached SDN Private Network don't need to be in the list.

Maintenance schedule

Choose the day and the start time (UTC) for maintenance updates. Updates are installed during a four-hour period that starts at that time. During maintenance, the service switches between nodes, which can cause a short interruption. The hostnames stay the same, so always connect by hostname. See Managed MySQL Maintenance.

Termination protection

Termination protection is off by default. Turn it on for a service you can't afford to lose by accident: while it's on, the service can't be deleted or shut down until you turn protection off again.

Service name and hostname prefix

The service name is just for you, and you can change it later. The hostname prefix becomes the first part of the service's hostnames. It must be unique, start with a letter and contain only lowercase letters, numbers and dashes, and you can't change it later.

Create the service

In the Control Panel, go to Databases and click Create Managed Database.
Under Location, select the location.
Under Database, select MySQL.
Under Compute, select Developer, Standard or High Memory, then a plan. The list shows the monthly price of one node. Under Storage, select the storage for each node.
Under Nodes and Backups, select the number of nodes and the backup tier.
Under Connection access, turn on Public connection if you need it. For the private connection, keep Utility network, or click Attach private network, select the network under Network and click Attach.
Under Allowed IP access, keep Automatic access from Utility network servers on, or turn it off. The switch is shown only while the service uses the Utility network. Add addresses to IPv4 CIDR addresses: Servers IP picks addresses from your Cloud Servers, and Add my IP adds the address you're browsing from.
With the defaults, Cloud Servers in the same location can connect over the Utility network, and nothing can connect over the public internet.
Set the Maintenance schedule, and turn on Termination protection if you want it.
Enter a Service name and a Hostname prefix, check the total in the Summary, then click Create Database.

The service's page opens, and the service is ready to use once its status changes to Started.

This request sets every option described above. Replace the values with your own:

POST /1.3/database

{
  "title": "<service-name>",
  "hostname_prefix": "<hostname-prefix>",
  "type": "mysql",
  "zone": "de-fra1",
  "plan_compute": "rdb.standard.2CPU-8GB",
  "plan_node_count": 2,
  "plan_storage_gib": 20,
  "plan_backups": "regular",
  "properties": {
    "public_access": false,
    "automatic_utility_network_ip_filter": true,
    "ip_filter": []
  },
  "maintenance": {
    "dow": "sunday",
    "time": "05:00:00"
  },
  "termination_protection": false
}

title: the service name.
hostname_prefix: the hostname prefix.
zone: the location.
plan_compute: the compute plan, from the Identifier column of Managed MySQL configurations.
plan_node_count: the number of nodes, 1 to 3.
plan_storage_gib: the storage of each node, in GiB.
plan_backups: the backup tier, mini, regular or extended.
public_access: the public connection, true for on.
automatic_utility_network_ip_filter: automatic access from Utility network servers, true for on.
ip_filter: the allowed IP list, for example ["203.0.113.10/32"].
maintenance: the maintenance day (dow) and start time in UTC. Without it, the service gets a maintenance schedule automatically.
termination_protection: termination protection, true for on.

To connect the service to an SDN Private Network instead of the Utility network, add networks to the request. For example, a 1-node service on an SDN Private Network:

{
  "title": "<service-name>",
  "hostname_prefix": "<hostname-prefix>",
  "type": "mysql",
  "zone": "de-fra1",
  "plan_compute": "rdb.standard.2CPU-8GB",
  "plan_node_count": 1,
  "plan_storage_gib": 20,
  "plan_backups": "regular",
  "networks": [
    {
      "name": "<attachment-name>",
      "type": "private",
      "family": "IPv4",
      "uuid": "<network-uuid>"
    }
  ]
}

The network must be attached to an SDN Router: see How to connect private networks using SDN Router. If it isn't, the API refuses the request with Network '<network-uuid>' should be attached to a router.

The response includes the service's UUID in uuid. Use it to check on the service: it's ready once GET /1.3/database/<service-uuid> returns "state": "running".

Connect to the service

To try out the connection, you need a computer with the mysql client. How it connects depends on where it is:

A Cloud Server in the same location as the service can connect privately, without going over the public internet.
Any other computer, such as your own, connects over the public internet through the public hostnames. Turn on public connection and add the computer's public address to the allowed IP list first.

Find the connection details

Go to Databases and open the service. The Overview tab shows:

Connection: the connection string, host and port. Private has the details for private connections, and Public for connections over the public internet. While public connection is off, Public shows only the switch that turns it on.
Auth: the username, upadmin, the password, the database name, defaultdb, and the CA certificate. Click Show to see the password.

Connection section of the service's Overview tab

Auth section of the service's Overview tab

Connect at the top of the page shows a ready-to-run mysql command with the password filled in.

Connect button at the top of the service's page

GET /1.3/database/<service-uuid>

service_uri is the connection string, in the form mysql://upadmin:<password>@<hostname>:<port>/defaultdb?ssl-mode=REQUIRED.
service_uri_params has the same details as separate fields: host, port, user, password and dbname.
components lists every hostname of the service with its port. component is mysql for the connections this guide uses, usage is primary or replica, and route is dynamic for private access or public for public access.

All of the service's hostnames end in .db.upclouddatabases.com:

<hostname-prefix>-<id> points to the primary node. Use it for reads and writes.
replica-<hostname-prefix>-<id> points to the standby nodes, on services with more than one node. It's handy for reads that you want to keep off the primary, but it's read-only: writes through it fail with The MySQL server is running with the --read-only option so it cannot execute this statement.
public-<hostname-prefix>-<id> and public-replica-<hostname-prefix>-<id> are the same two over the public internet. They're listed only while public connection is on, and they accept connections only from addresses in the allowed IP list.

The private hostnames work from servers in the same location over the Utility network, and from servers on an SDN Private Network attached to the service.

Connect with the mysql client

Install the mysql client on the computer you'll connect from. On Ubuntu 26.04, this installs mysql 8.4:

sudo apt update
sudo apt install mysql-client

For other systems, see MySQL Community Downloads.

The mysql client takes the connection details as separate options: the host, the port, the user upadmin and the database defaultdb. In the Control Panel, which tab to take the host and port from depends on where you run the commands:

On a Cloud Server in the same location as the service, use the Private tab.
On any other computer, use the Public tab.

With the API, service_uri_params has the private host and port.

--password makes the client ask for the password, and --ssl-mode=REQUIRED makes it encrypt the connection with TLS.

Turn on TLS in your client

The service also accepts connections without TLS, so whether a connection is encrypted depends on the client. With mysql, always use --ssl-mode=REQUIRED or --ssl-mode=VERIFY_IDENTITY. With other clients and libraries, check that TLS is turned on.

Check that you can reach the service by asking for its version:

mysql --host=<hostname> --port=<port> --user=upadmin --password --ssl-mode=REQUIRED defaultdb -e 'SELECT VERSION();'

Output
Enter password:
+-----------+
| VERSION() |
+-----------+
| 8.4.11    |
+-----------+

Now create a table, add a row and read it back:

mysql --host=<hostname> --port=<port> --user=upadmin --password --ssl-mode=REQUIRED defaultdb -e "
  CREATE TABLE greetings (id INT AUTO_INCREMENT PRIMARY KEY, message VARCHAR(255) NOT NULL);
  INSERT INTO greetings (message) VALUES ('Hello from Managed MySQL');
  SELECT * FROM greetings;"

Output
Enter password:
+----+--------------------------+
| id | message                  |
+----+--------------------------+
|  1 | Hello from Managed MySQL |
+----+--------------------------+

The service's SQL mode includes ANSI_QUOTES, so text in double quotes is read as a column name. Put strings in single quotes, as above.

To work in an interactive session instead, leave out -e and the statements, and type exit to leave.

Check the server's certificate

--ssl-mode=REQUIRED encrypts the connection, but it doesn't check that the certificate belongs to your service. To check that too, use the service's CA certificate. One CA certificate covers all of your Managed MySQL services.

Save the CA certificate as ca.pem in the directory you run mysql from. In the Control Panel, the certificate is next to CA certificate on the service's Overview tab: Download saves it on the computer you're browsing from, and on a Cloud Server, you can click the copy icon next to it and paste it into a new file named ca.pem. With the API, GET /1.3/database/certificate returns it in certificate.

Connect with --ssl-mode=VERIFY_IDENTITY and point --ssl-ca at the file:

mysql --host=<hostname> --port=<port> --user=upadmin --password --ssl-mode=VERIFY_IDENTITY --ssl-ca=ca.pem defaultdb -e 'SELECT 1;'

Output
Enter password:
+---+
| 1 |
+---+
| 1 |
+---+

The service's certificate is signed by this CA, not by a public certificate authority, so --ssl-ca has to point at ca.pem: the system's trusted certificates don't include it.

Connect from an application

Applications connect the same way, with a MySQL client library and the details from the connection string. This example uses MySQL Connector/Python, MySQL's own driver for Python, which encrypts the connection with TLS by default.

Install it in a virtual environment. On Ubuntu 26.04:

sudo apt install python3-venv
python3 -m venv venv
source venv/bin/activate
pip install mysql-connector-python

Save this short program as app.py. It reads the connection string from an environment variable, adds a row to the greetings table and prints every message in it:

import os
from urllib.parse import unquote, urlsplit

import mysql.connector

url = urlsplit(os.environ["DATABASE_URL"])
conn = mysql.connector.connect(
    host=url.hostname,
    port=url.port,
    user=unquote(url.username),
    password=unquote(url.password),
    database=url.path.lstrip("/"),
)
cursor = conn.cursor()
cursor.execute(
    "CREATE TABLE IF NOT EXISTS greetings (id INT AUTO_INCREMENT PRIMARY KEY, message VARCHAR(255) NOT NULL)"
)
cursor.execute("INSERT INTO greetings (message) VALUES (%s)", ("Hello from Python",))
conn.commit()
cursor.execute("SELECT message FROM greetings ORDER BY id")
for (message,) in cursor:
    print(message)
conn.close()

Run it with your connection string in DATABASE_URL. In the Control Panel, the copy icon next to Connection string, on the same tab you took the host from, copies it to your clipboard, including the password. With the API, service_uri has the connection string with the private hostname.

export DATABASE_URL='mysql://upadmin:<password>@<hostname>:<port>/defaultdb?ssl-mode=REQUIRED'
python app.py

Output
Hello from Managed MySQL
Hello from Python

This example connects as upadmin, the service's main user. To give an application a user of its own with only the access it needs, see How to restrict user access in Managed MySQL.

Delete the service

Go to Databases and open the service.
Click Shut down, then click Shut down in the dialog. The status changes to Stopped. While the service is started, Delete isn't available.
Open the menu next to Start and select Delete.
Click Delete to confirm.

The service's menu with Delete, after the service is stopped

The Control Panel returns to the list of databases.

If termination protection is on, the Shut down dialog tells you so and won't let you continue. Cancel it, turn off the Termination protection switch on the service's Overview tab, and start again.

DELETE /1.3/database/<service-uuid>

The API answers with 204 No Content. While the service is being removed, GET /1.3/database/<service-uuid> can still return it, with a state such as pending, and once it's gone, the request returns 404.

If termination protection is on, the API refuses the request with Service cannot be deleted, termination protection is enabled. Turn protection off first:

PATCH /1.3/database/<service-uuid>

{
  "termination_protection": false
}

Troubleshooting

ERROR 1045 (28000): Access denied for user 'upadmin'@'<address>' (using password: YES)
The password is wrong. Copy it again from the connection details.
ERROR 2026 (HY000): SSL connection error: CA certificate is required if ssl-mode is VERIFY_CA or VERIFY_IDENTITY
The client used --ssl-mode=VERIFY_IDENTITY without --ssl-ca. Download the CA certificate and add --ssl-ca=ca.pem, as in Check the server's certificate.
ERROR 2026 (HY000): SSL connection error: error:0A000086:SSL routines::certificate verify failed
The client checked the server's certificate against the wrong CA certificate, for example the system's trusted certificates. Set --ssl-ca to the service's CA certificate, ca.pem.
ERROR 1290 (HY000) at line 1: The MySQL server is running with the --read-only option so it cannot execute this statement
The client connected to a standby node through the replica hostname. Send writes to the primary hostname.
ERROR 1054 (42S22) at line 1: Unknown column 'Hello' in 'field list'
A string was in double quotes, which the service reads as a column name. Put strings in single quotes.
Connections from a new server in the same location fail with ERROR 2003 (HY000): Can't connect to MySQL server on '<hostname>:<port>' (110)
A Cloud Server created after the service can take a while to get access over the Utility network. To let it connect straight away, add the server's Utility network address to the allowed IP list, for example 10.4.15.173/32. Use the Utility network address, not the public one, because that's the address the server connects from.
Connections through a public hostname fail with ERROR 2003 (HY000): Can't connect to MySQL server on '<hostname>:<port>' (110)
Either public connection is off, or the address you're connecting from isn't in the allowed IP list. Turn public connection on and add the address to the list, or connect from a server over a private network.
Connections from a server on the SDN Private Network fail with ERROR 2003 (HY000): Can't connect to MySQL server on '<hostname>:<port>' (110)
A server that joined the network before the service did only gets the route to the service when it renews its DHCP lease. Find the server's interface on the SDN Private Network with ip -br addr, then renew the lease. On Ubuntu:
```
sudo networkctl renew <interface>
```

Next steps

How to restrict user access in Managed MySQL creates users with only the access an application needs.
How to restore a Managed Database to a point in time shows how to get your data back from backups.
How to migrate MySQL database to UpCloud Managed Databases using the migration tool moves an existing database to the service.
How to customise Managed Database properties changes the service's MySQL settings.
Connecting to Managed MySQL describes the private and public connection options.

For the other database engines, see How to get started with Managed PostgreSQL, How to get started with Managed Valkey or How to get started with OpenSearch on Managed Databases.

MySQL is a registered trademark of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Contributed by: Samir Haliru