docs/content/stable/releases/yba-releases/v2025.2.md
What follows are the release notes for all releases in the YugabyteDB Anywhere (YBA) v2025.2 series. Content will be added as new notable features and changes are available in the patch releases of the YBA v2025.2 series.
For an RSS feed of all release series, point your feed reader to the RSS feed for releases.
{{< warning title="On-premises legacy provisioning deprecated" >}}
Legacy node provisioning for on-premises universe nodes is deprecated.
Update your node provisioning automation and workflows to support the node agent script.
To migrate universe nodes to the new automated provisioning, follow the node patching procedure.
{{< /warning >}}
{{< warning title="S3 storage and certificate validation" >}} v2025.2 and later requires certificate validation for S3 storage. If you are using S3 storage with custom self-signed or CA certificates, to connect to your S3 storage, you must add the certificates to the YugabyteDB Anywhere Trust Store before upgrading. {{< /warning >}}
Before upgrading, review the information in Prepare to upgrade YugabyteDB Anywhere.
Build: 2025.2.2.2-b11
Third-party licenses: YugabyteDB, YugabyteDB Anywhere
feature_flags.enable_chunked_encoding to disable chunked transfer encoding for S3 in AWS API config. PLAT-19375,PLAT-20246Build: 2025.2.2.1-b1
Third-party licenses: YugabyteDB, YugabyteDB Anywhere
{{< warning title="Use v2025.2.2.1.">}}
v2025.2.2.0 includes an issue affecting LDAP in YugabyteDB Anywhere. In some circumstances, redacted values in ysql_hba_conf_csv can be overwritten during YBA-based universe operations, potentially leading to misconfigured database LDAP settings or authentication failures. Use v2025.2.2.1.
{{< /warning >}}
| <div style="width:150px">Feature</div> | Description |
|---|---|
| {{<tags/feature/ga idea="1372">}}Backup throughput limit | You can set a limit for backup throughput in MB/s, providing more precise control over resource allocation.<hr style="margin: 0.5em 0;">To use: Feature enabled by default. You can set disk read/write bytes per second as part of configuring backup performance parameters for your universe. |
| {{<tags/feature/ea idea="2004">}}YugabyteDB Kubernetes Operator import universe | Added a capability to live-migrate an existing K8s universe that is managed by YBA to one that is managed by the K8s Operator. Additional improvements include adding CRDs that allow support for multi-region universes (spanning multiple K8s clusters).<hr style="margin: 0.5em 0;">To use: The feature can be used via API only and the K8s operator must be installed on YBA. See Before you begin. |
use_memory_defaults_optimized_for_ysql based on YSQL usage to optimize memory. PLAT-16880yb-servers to pick up ulimit changes without rebooting. PLAT-19474tserver_export metrics collection in support bundles. PLAT-17837topology_kubernetes.io to az_name in container metrics for accurate pod identification. PLAT-17863GFlagsUtil.java by correcting string placeholders. PLAT-19631RebootNode module enhancing stability in non-sudo onprem tests. PLAT-19526masterHttpPort. PLAT-19291,PLAT-19663skip_tls_verify setting when using node agent provisioning. PLAT-19864X-Forwarded-Proto for correct HTTPS handling. PLAT-19012X-Forwarded-Proto=https is set. PLAT-19012enableBackupsDuringDDL is passed to child backup tasks. PLAT-19554useRoles field to ScheduleResp model to display info on the UI. PLAT-19512Build: 2025.2.1.0-b141
Third-party licenses: YugabyteDB, YugabyteDB Anywhere
We're excited to announce the key features and enhancements in the 2025.2.1.0 release, designed to improve performance, usability, and management of your database environments.
| <div style="width:150px">Feature</div> | Description |
|---|---|
| {{<tags/feature/ga idea="153">}}xCluster DR automatic mode | Seamless automated replication of YSQL DDL changes across xCluster DR, eliminating the need to manually apply DDLs on both source and target clusters. This simplifies DDL operations and reduces management overhead.<hr style="margin: 0.5em 0;">To use: Enabled by default for universes running v2025.2.1 or later. |
| {{<tags/feature/ga idea="22">}}Automatic YB-Master failover | If a node with Master process fails unexpectedly (reducing health, but not causing service downtime), YBA auto-heals the universe by starting a Master process on a suitable surviving node (if one exists).<hr style="margin: 0.5em 0;">To use: Enabled by default for universes running v2.20.3 or later. |
| <div style="width:150px">Feature</div> | Description |
|---|---|
| {{<tags/feature/ea idea="986">}}Azure Managed Identity for VM-based backups | When taking backups of a VM-based universe to Azure Blob Storage, instead of using an SAS token, you can use the Azure IAM roles assigned to YugabyteDB Anywhere and database nodes to authenticate.<hr style="margin: 0.5em 0;">To use: Feature enabled by default. Assign a managed identity to your YugabyteDB Anywhere and database node VMs, and create an Azure storage configuration that uses the same managed identity. |
| {{<tags/feature/ga idea="989">}}Restore to a point in time | Restore PITR-enabled backups to a specific point in time. Similar to instant database cloning, quickly recover from accidental SQL or CQL human errors that cause data loss or corruption by restoring at a time immediately prior to the incident.<hr style="margin: 0.5em 0;">To use: Feature enabled by default. Create a backup schedule with ability to restore to point-in-time. |
| {{<tags/feature/ga idea="2340">}}Improvements to Kubernetes cert-manager | YugabyteDB Anywhere now supports scenarios in which cert-manager manages only partial certificate chains (specifically, cert-manager only holds the root CA, without intermediate certificates).<hr style="margin: 0.5em 0;">To use: Feature enabled by default when using cert-manager for encryption in transit. |
| {{<tags/feature/ga idea="2559">}}IO2 EBS Volume Support on AWS | Use IO2 EBS volumes for disk storage in universes deployed on AWS.<hr style="margin: 0.5em 0;">To use: Feature enabled by default. Select IO2 EBS volumes when creating or modifying universes. |
Encryption in Transit during Kubernetes universe creation incorrectly disables both client-server and node-to-node options. PLAT-19135feature_flags.off_cluster_pitr_enabled is ON. PLAT-19209allow_connection_pooling by default. PLAT-19061listPitrConfigs API calls. PLAT-18842enableClientToNodeEncrypt is false when both TLS options are disabled. PLAT-19002BackupTableYbc task during retries with multiple backups. PLAT-19172bootstrap_producer_timeout to 20 minutes to reduce xCluster setup failures. PLAT-19283log_line_prefix in ysql_pg_conf_csv flag. PLAT-19074automaticDdlMode. PLAT-19136getRawClientRootCA as a required field to maintain backward compatibility. PLAT-19176concated_crd in the charts repository. PLAT-19213scripts/log to logs. PLAT-19453ynp_version to yugabyte to avoid cleanup issues. PLAT-19460yb-servers to pick up ulimit changes without rebooting. PLAT-19474nc instead of ping to validate NTP servers, ensuring reliability across network configurations. PLAT-16715ybp_health_check_tserver metrics were missing for RF1 clusters. PLAT-18636audit_logging_enabled flag by default. PLAT-19032severity field in custom_details to yba_severity. PLAT-19084createServicePerPod is enabled. PLAT-19206yb.support_bundle.application_logs_regex_pattern. PLAT-19369undefok during upgrades. PLAT-18833overrideNodePorts setting like YSQL. PLAT-19165Build: 2025.2.0.1-b1
Third-party licenses: YugabyteDB, YugabyteDB Anywhere
concatenated_crd.yaml in the charts repository. PLAT-19213createServicePerPod is enabled. PLAT-19206Build: 2025.2.0.0-b131
Third-party licenses: YugabyteDB, YugabyteDB Anywhere
We're excited to announce the key features and enhancements in the 2025.2.0.0 release, designed to improve performance, usability, and management of your database environments.
PostgreSQL features enabled by default on new universes
For new universes running v2025.2 or later, the following YSQL features are now enabled by default when you deploy using YugabyteDB Anywhere:
In addition, if you upgrade to v2025.2 and the universe already has cost-based optimizer enabled, the following features are enabled by default:
Note that, apart from the exceptions noted, upgrading existing universes does not change the defaults for any of these features.
For more information on PostgreSQL features developed in YugabyteDB for enhanced compatibility, refer to Enhanced PostgreSQL Compatibility Mode.
YSQL Audit Logs {{<tags/feature/ga idea="1773">}} <!--Also IDEA-792-->
Support for producing and exporting audit logs of PostgreSQL statements (which is often required for compliance with government, financial, or ISO certifications) to a log aggregator. This is based on the pgaudit extension.
For more information, refer to YSQL Audit Logs.
ARM processor support for Kubernetes universes {{<tags/feature/ga idea="1486">}}
Added support for running Kubernetes-based universes on ARM CPUs.
For information on deploying on Kubernetes, refer to Create a multi-zone universe.
Support for LDAP/OIDC groups and custom roles in YugabyteDB Anywhere {{<tags/feature/ga idea="1501">}}
Enhance Role-based Access Control (RBAC) by assigning custom roles to groups sourced from an OIDC-based Identity Provider (IDP) in a scalable and secure way.
For more information, refer to Support for LDAP/OIDC groups and custom roles in YugabyteDB Anywhere.
Relaxed Python version requirements in YugabyteDB Anywhere {{<tags/feature/ga idea="2091">}}
YugabyteDB Anywhere Python version requirements have been significantly relaxed, thanks to the removal of Ansible dependency. This change simplifies deployment.
Improved time synchronization across nodes for on-premises, AWS, and GCP environments {{<tags/feature/ea idea="2133">}}
Time synchronization across nodes has been enhanced through the use of the ClockBound library, resulting in improved P99 latency for certain workloads (those with near simultaneous writes and reads).
For more information, refer to ClockBound.
CDC Observability. YugabyteDB Anywhere supports monitoring the status of replication slots when using PostgreSQL Logical Replication Protocol for Change Data Capture (CDC). {{<tags/feature/ga idea="709">}}
Azure support for multiple Resource Groups (one per region). Added support for Azure configurations with one Azure Resource Group per region (and also one network per Azure Resource Group), a configuration providing better network management and resilience. {{<tags/feature/ga idea="1606">}}
Non-root installation of YBA. You can install YugabyteDB Anywhere as a de-privileged user; a root-privileged user is no longer required. This reduces friction and security concerns during initial testing, setup, and proof of concepts. {{<tags/feature/ga idea="1521">}}
Kubernetes
Kubernetes immutability. Added support to deploy code via immutable Helm images instead of at runtime, eliminating the use of 'kubectl cp' to push executables into the pod or container. {{<tags/feature/ga idea="1264">}}
Kubernetes service endpoint. For single-region universes in Kubernetes, added support for creating a unified service endpoint. This is in addition to the already-supported one service endpoint per availability zone (AZ). {{<tags/feature/ga idea ="1405">}}
Configurable common names for Kubernetes. You can configure a custom common name suffix for Kubernetes cert-manager. {{<tags/feature/ga idea="2065">}}
Rotate certificates. Enables retry for the TLS toggle task in Kubernetes and resolves node task failure for ClientToNode only universes. {{<tags/feature/ga idea="1714">}}
Export metrics. Support for exporting universe metrics to third-party tools for analysis and customization, and adds Dynatrace as a metric export sink. {{<tags/feature/ea idea="441">}}
CipherTrust support. You can now use Thales CipherTrust as the Key Management System (KMS) for encryption at rest. {{<tags/feature/ga idea="1227">}}
Alerts. Removed the DB Queue Overflow Alert to reduce unnecessary alert noise and enhance user experience. {{<tags/feature/ea idea="905">}}
Backup
{{< warning title="S3 storage and certificate validation" >}} v2025.2 and later now requires certificate validation for S3 storage. If you are using S3 storage with custom self-signed or CA certificates, to connect to your S3 storage, you must add the certificates to the YugabyteDB Anywhere Trust Store before upgrading. {{< /warning >}}
Backups with DDL. Backups succeed even when DDL changes are occurring during the backup process. {{<tags/feature/ea idea="1484">}}
Adjusts backup directory structure to include Universe Name, enhancing multi-tenancy and DB portability. {{<tags/feature/ga idea="1888">}}
Allows backup authorization for EKS using a service account annotated to each universe pod, eliminating the need for managing short-lived credentials. {{<tags/feature/ga idea="1924">}}
Backups now capture PostgreSQL users (aka roles) and their permissions (aka grants) (via API). {{<tags/feature/ea idea="394">}}
Back up and restore YBA. Adds support for regularly scheduled backups of your YugabyteDB Anywhere installation for recovery in case of the loss of the node running your YugabyteDB Anywhere instance. Store backups in remote storage buckets, and restore from the YugabyteDB Anywhere UI. {{<tags/feature/tp idea="1429">}}
Certify CIS-hardened RHEL 8 and RHEL 9 (x86) Facilitates running YugabyteDB with a CIS-hardened RHEL 8 and RHEL 9 image, enhancing security measures. {{<tags/feature/ga idea="1193">}} <!--Also IDEA-1716-->
Allows dynamic flag validation in YugabyteDB Anywhere when upgrading flags for cloud and Kubernetes provider-based universes, using the 'validateFlagValue' RPC. {{<tags/feature/ga idea="2058">}}
For universes with only client-to-node encryption enabled, if you are rotating certificates, a restart is required; choose either the rolling or concurrent restart options. Do not use the Apply all changes which do not require a restart immediately option (which is selected by default) in this configuration.
Although the API documentation indicates that the getRawClientRootCA is a required field in UniverseDefinitionTaskParams, it's not mandatory. This error will be fixed in our automated API generation code in a future release. PLAT-19176
system_postgres database from the xCluster Add/Remove Tables display and keeps replicated_ddls hidden. PLAT-17904sequences_data table, replacing the PG schema with _. PLAT-18078createNewRootCA and createNewClientRootCA to prevent certificate rotation failure in the UI. PLAT-19080Encryption in Transit during Kubernetes universe creation incorrectly disables both client-server and node-to-node options. PLAT-19135UNIVERSE.DEBUG for specific debugging actions, enhancing access control. PLAT-14856enable_backups_during_ddl, allowing control over running backups during DDL operations, and ensuring backups won't fail during a DDL as no catalogue version check is performed. PLAT-17392total_ysql_ycql_ops_per_sec and total_ysql_ycql_ops_latency metrics for YSQL and YCQL operations. PLAT-17751uninstall command details to yba-ctl help section for ease of use. PLAT-18377show-api-token flag. PLAT-17770otho8Aut prefix from PG log lines before export to customer sink in both PG logs and DBAL export. PLAT-18505allow_connection_pooling by default. PLAT-19061ON_ERROR_STOP during restore. PLAT-16613,PLAT-16614YBC flags on dedicated masters. PLAT-17472nproc limit to support larger T-Servers. PLAT-17490yba-ctl certs generate command. PLAT-17535yba-ctl. PLAT-17546To Be Removed. PLAT-17549yba-ctl rollback to better handle filesystem and service restoration. PLAT-17717use_sudo is needed for Ansible runbooks based on TServer status. PLAT-17963braces to version 3.0.3 to prevent memory exhaustion. PLAT-18011validateFlagValue RPC. PLAT-18095,PLAT-18097Node not found condition arises. PLAT-18131skip_runtime_gflag_validation default value is changed to false. PLAT-18228Path sections and updates logging to use journal in systemd files. PLAT-18249tserver liveness probes in the Helm chart. PLAT-18285systemctl commands for better stability during service management. PLAT-18321replicated_ddls from replication prechecks. PLAT-18346XClusterScheduler to prevent UI unresponsiveness during node failures. PLAT-18398cdcsdk_flush_lag metric. PLAT-18479query_id to string for compatibility in live queries. PLAT-18481use_privileges flag in YBC, enabling backup and restore of roles. PLAT-18588yugabyte as the default SSH user in the provider creation page if left blank, specifically for on-premise manual configurations. PLAT-18666yba-ctl status for global systemd. PLAT-18733illegal value type errors. PLAT-18820,PLAT-18788reset_password API. PLAT-16734CreateUniverse for on-prem nodes by modifying preflight checks. PLAT-17368collect_metrics.sh script re-uploads if a node name is reused. PLAT-17671pgsql_proxy_bind_address is set manually. PLAT-18058devops from the node-agent package extraction. PLAT-18149enable field from NodeAgentEnabler and makes node agent mandatory in live nodes after migration. PLAT-18337pgsql_proxy_bind_address to internalYsqlServerRpcPort when CP is enabled without restarting. PLAT-18434automaticDdlMode. PLAT-19136Create Universe, with tooltips, improved rank display, new review and summary step, better validation, error messages, and accessibility. PLAT-16236Hardware Settings page in the Create Universe section. PLAT-16239Create Universe process with enhanced user experience and cleaner code. PLAT-16244time module import and a retry loopin AWS elastic IPs deletion script. PLAT-16802Kubernetes config cannot be null error. PLAT-17053system_platform DB for performance comparison, with a retention period of 7 days. PLAT-17072-Dorg.approved_only=true to Yugaware via YBA K8S helm chart. PLAT-17482waitForServerReady into universe creation task to ensure stable tablet operation. PLAT-17741ocpCompatibility.enabled flag. PLAT-17919ocpCompatibility.enabled flag. PLAT-17919taskInfo. PLAT-17926machine_image in the edit universe flow. PLAT-18203Create Universe, adding PG Compatibility and fixing checkbox height. PLAT-18240Create Universe feature. PLAT-18327ybc.success_marker_download_timeout_secs. PLAT-18429list universe tables API with xClusterSupportedOnly=True. PLAT-18485withPlatform option. PLAT-18509pa folder in perf-advisor and ensures correct installation by initializing version string. PLAT-18512dump_role_check in backups to apply flags correctly. PLAT-18533ybp_universe_connection_pooling_status metric is consistently exported, even when the universe is paused. PLAT-18590-netty-shaded to version >=1.75.0 to address {{<cve "CVE-2025-55163">}} and upgrades -security-crypto from version 5.8.16 to 5.8.18 or higher. Also, migrates spring libraries from 5.x to 6.x. PLAT-18658install_otel_collector to true. PLAT-18662,PLAT-18661yb.attach_detach.enabled runtime configuration is not enabled. PLAT-18725metrics_export_enabled as public but disabled by default. PLAT-18772audit_logging_enabled flag by default. PLAT-19032use_system_python for system python usage. Ends script if venv isn't settable. PLAT-16111Encryption in Transit field in Security Settings and Connection Pool field in Database Settings with ports override feature. PLAT-16241,PLAT-16240ysql_pg_conf_csv after a concurrent flag upgrade and removes unnecessary red dot in the Actions dropdown of the Overview page. PLAT-17181yb.skip_version_checks to bypass software upgrade version checks. PLAT-17780publishNotReadyAddress for all cases, ensuring DNS records for not-ready pods remain available. PLAT-18438Running tables are added to xCluster replication edits. PLAT-17387yba-ctl clean succeeds even with incorrect configurations. PLAT-17547finalizeRequired and ysqlMajorVersionUpgrade in the audit table to facilitate smoother transition for YBM, even when auth is disabled in userIntent but enabled through flag override. PLAT-17586,PLAT-17244allow_loki. PLAT-17280,PLAT-17279,PLAT-17664authentication and access-management. PLAT-17841vm.max_map_count setting after reboot when is_cloud=true. PLAT-17967query_logging_enable, for enabling query logging in universes. PLAT-18040,PLAT-18037skipKeyValidateAndUpload flag for AWS provider setup to bypass SSH key validation. PLAT-18230hybrid_clock_error metric to YBA for better node health assessment. PLAT-18238ON_ERROR_STOP by default during restores on master. PLAT-18264host label with yugabyte.node_name for efficient query log export. PLAT-18332log_line_prefix from API until YBM confirms compatibility with new OTEL config filters. PLAT-18501universeDetached state and universe owner to universe details to regulate delete metadata operations and attach/detach flow. PLAT-18510,PLAT-17543,PLAT-17984allow_s3 to block S3 exporter support for log export. PLAT-18528revert_to_pre_roles_behaviour to true, impacting dump_role_checks and on_error_stop. PLAT-18594TryLock for HA returns an empty optional when lock acquisition fails. PLAT-18758