Reduce privileges for SST-user

https://mariadb.com/kb/en/mariabackup-sst-method/#authentication-and-privileges Only a sub-set is required for SST to function
OpenConext · Dec 11, 2023 · 5022c31 · 5022c31
1 parent 6fa4c59
commit 5022c31
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/roles/galera/tasks/cluster_nodes.yml b/roles/galera/tasks/cluster_nodes.yml
@@ -215,7 +215,7 @@
   mysql_user:
     name: "{{ mariadb_cluster_user }}"
     password: "{{ mariadb_cluster_password }}"
-    priv: "*.*:ALL"
+    priv: "*.*:GRANT RELOAD,PROCESS,LOCK TABLES,REPLICATION CLIENT ON"
     state: present
     login_user: root
     login_password: "{{ mariadb_root_password  }}"