We have done the testing and confirmed the following system behavior of MariaDB-Galera clustering:

  • The first-time bootstrap always needs to get everything correct, including the sst_user credentials in wsrep_sst_auth, and if choose to use SSL, socket.ssl related properties in wsrep_provider_options.

  • After the first successful clustering joining, we can re-bootstrap the existing nodes even with a wrong password for the sst_user, and still get a successful joining.
    We guess the MariaDB-Galera software has a design for error tolerance. Confirm?

  • The error tolerance above does not include the SSL certificates.
    So, when using SSL, if re-bootstrap with wrong certificates, e.g., the self-signing CA and Server certificates have the same Common Name. In this case, the Donor can still start but the Joiner will fail to join in, with log events of WSREP: Handshake failed: tlsv1 alert unknown ca.

Our Questions:

  • Could we confirm whether there exists an "error tolerance" function on sst_user credential after the first-time successful joining?

  • If yes, what is the mechanism?

  • Do we have a reference or link to the documentation?

We highly appreciate any hints and suggestions.


See the below screenshot for the versions in the system under test.

# yum list installed | grep -i -e "maria" -e "galera" -e "garb"
MariaDB-backup.x86_64            10.5.23-1.el7.centos        @mariadb
MariaDB-client.x86_64            10.5.23-1.el7.centos        @mariadb
MariaDB-common.x86_64            10.5.23-1.el7.centos        @mariadb
MariaDB-compat.x86_64            10.5.23-1.el7.centos        @mariadb
MariaDB-server.x86_64            10.5.23-1.el7.centos        @mariadb
MariaDB-shared.x86_64            10.5.23-1.el7.centos        @mariadb
galera-4.x86_64                  26.4.16-1.el7.centos        @mariadb


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.