blog

ClusterControl now supports PowerBroker pbrun for secure privilege management

Kyle Buzzell

Published: July 9, 2025

hero image for clustercontrol release v2.3.3

We’re pleased to share the release of ClusterControl v2.3.3, introducing major enhancements for elevated user privileges with Privileged Access Management integration of BeyondTrust’s PowerBroker pbrun, as well as support for MongoDB 8.0 and MariaDB 11.8 major versions and dark mode for our recently added Watchlists feature.

PowerBroker pbrun integration

pbrun is a command-line utility provided by BeyondTrust’s PowerBroker that allows users to safely execute commands with elevated privileges—similar to sudo, but with centralized policy control, auditing, and logging.

Key advantages:

Enhanced Security: Secure execution of privileged commands without exposing root credentials.
Granular privilege delegation: Users are permitted to run specific commands only under controlled conditions.
Centralized policy enforcement: Access and permissions are defined by administrators in a central policy file.
Audit trails and logging: All actions via pbrun are logged for accountability and compliance.
Role-Based Access Control (RBAC): Assign distinct levels of privilege to different users or roles.
Seamless integration: Use pbrun within ClusterControl to align database management workflows with strict security policies.

This integration is especially valuable for enterprises with stringent privileged access requirements or environments requiring least privilege and auditability.

Feature	sudo	pbrun (PowerBroker)
Config	Decentralized (/etc/sudoers)	Centralized (policy server)
Control	Limited	Highly granular
Session Logging	Minimal	Full session logging, optional keystrokes
Approval Workflows	No	Yes (policy scripting)
Central Auditing	No	Yes
Use Cases	General privilege escalation	Enterprises needing SOX, HIPAA, PCI DSS compliance

You can enable elevated user privileges with pbrun when deploying or importing a database:

image of pbrun toggling in cluster deployment gui

N.B. A new CMON config parameter access_check_cmd is available to customize how CMON performs SSH connectivity checks on the host by executing /bin/true (default). It can be configured to /bin/echo or /usr/bin/id if /bin/echo is restricted under pbrun policies.

Support for latest MongoDB and MariaDB major versions

As always, we try to ensure that you have access to the latest major versions of our core databases so that you have access to the latest feature sets — let’s see what they bring.

MongoDB 8.0

MongoDB 8.0 delivers significant performance, security, and productivity improvements:

36% faster read throughput, 56% faster bulk writes.
Enhanced horizontal scaling and resharding performance.
Queryable encryption with range queries for secure, expressive data access.
Enhanced multi-document transactions and optimized aggregation pipelines.
Wildcard indexes, compound index enhancements, and command path optimization.

For detailed changes, see the MongoDB 8.0 release notes.

MariaDB 11.8

MariaDB 11.8, the latest LTS release, includes,

AI-readiness with native vector search and ML embedding storage for semantic search and RAG pipelines.
Future-proof TIMESTAMP handling beyond 2038.
Full Unicode support with utf8mb4 by default.
Query performance optimizations, including smarter single-table updates/deletes and index pushdowns.
Improved observability with new instrumentation and monitoring capabilities.
Post-quantum-ready PARSEC authentication and enhanced replication stability.
Developer enhancements like UUIDv4/UUIDv7 generation and helper functions for usability.

MariaDB 11.8 is designed for seamless in-place upgrades from previous LTS versions with minimal downtime. For detailed changes, see the release notes here.

Dark mode update for Watchlists

Introduced in v2.3.2, Watchlist allows users to monitor the database clusters in a full-screen view (a.k.a kiosk-mode), suitable for displaying the monitoring dashboards on a dedicated screen in an operations center. Administrators can curate a watchlist based on topics, where ClusterControl will visualize the related monitoring panels based on the chosen topics and clusters in full screen view. In this release a new dark mode theme is available to help reduce eye strain and provide improved readability in low-light environments.

Wrapping up

ClusterControl v2.3.3 makes it easier to align your database operations with enterprise security and compliance requirements while adding support for the latest MongoDB and MariaDB versions. Try CC v2.3.3 free for 30 days by following the install instructions below.

Install ClusterControl in 10-minutes.
Free 30-day Enterprise trial included!

Script Installation Instructions

The installer script is the simplest way to get ClusterControl up and running. Run it on your chosen host, and it will take care of installing all required packages and dependencies.

Offline environments are supported as well. See the Offline Installation guide for more details.

On the ClusterControl server, run the following commands:

wget https://severalnines.com/downloads/cmon/install-cc
chmod +x install-cc

With your install script ready, run the command below. Replace S9S_CMON_PASSWORD and S9S_ROOT_PASSWORD placeholders with your choice password, or remove the environment variables from the command to interactively set the passwords. If you have multiple network interface cards, assign one IP address for the HOST variable in the command using HOST=<ip_address>.

S9S_CMON_PASSWORD=<your_password> S9S_ROOT_PASSWORD=<your_password> HOST=<ip_address> ./install-cc # as root or sudo user

After the installation is complete, open a web browser, navigate to https://<ClusterControl_host>/, and create the first admin user by entering a username (note that “admin” is reserved) and a password on the welcome page. Once you’re in, you can deploy a new database cluster or import an existing one.

The installer script supports a range of environment variables for advanced setup. You can define them using export or by prefixing the install command.

See the list of supported variables and example use cases to tailor your installation.