From 29a025d8c5aa7e9d65b8253403d307ec8558c5e7 Mon Sep 17 00:00:00 2001
From: Magnus <magnus@apecloud.com>
Date: Mon, 6 Jul 2026 17:02:29 +0800
Subject: [PATCH] fix(mariadb): stop persisting wsrep_sst_auth root credential
 to the data volume

galera-start.sh wrote wsrep_sst_auth=root:password into
${DATA_DIR}/.galera-sst-auth.cnf. That credential is unused (the addon
uses wsrep_sst_method=rsync, which does not authenticate via
wsrep_sst_auth) and the data volume is needSnapshot:true, so the plaintext
root password rode into every volume snapshot / backup.

Stop writing it and drop the --defaults-extra-file that loaded it; also
remove any stale .galera-sst-auth.cnf left on existing PVs so upgrades
scrub the already-leaked file. If mariabackup SST is adopted later,
wsrep_sst_auth must come from a non-snapshot path (mounted Secret /
conf.d), not ${DATA_DIR}. Adds contract spec; full mariadb suite green.

Fixes #3056
---
 .../scripts-ut-spec/galera_start_spec.sh      | 23 +++++++++++++++++++
 addons/mariadb/scripts/galera-start.sh        | 17 +++++++-------
 2 files changed, 31 insertions(+), 9 deletions(-)

diff --git a/addons/mariadb/scripts-ut-spec/galera_start_spec.sh b/addons/mariadb/scripts-ut-spec/galera_start_spec.sh
index 9b654d407..8f612073f 100644
--- a/addons/mariadb/scripts-ut-spec/galera_start_spec.sh
+++ b/addons/mariadb/scripts-ut-spec/galera_start_spec.sh
@@ -199,4 +199,27 @@ EOF
       The output should equal "OK"
     End
   End
+
+  Describe "wsrep_sst_auth is not persisted (H11)"
+    # rsync SST does not use wsrep_sst_auth; writing it to DATA_DIR (a
+    # needSnapshot volume) leaked the plaintext root password into snapshots.
+
+    It "does not write wsrep_sst_auth to any file"
+      When run sh -c "grep -nE 'wsrep_sst_auth=.*>|> +\"?\\\$?\\{?sst_conf' \"$(script_file)\" || true"
+      The status should be success
+      The output should equal ""
+    End
+
+    It "does not load a defaults-extra-file for SST auth"
+      When run sh -c "grep -F 'defaults-extra-file=' \"$(script_file)\" | grep -F 'sst' || true"
+      The status should be success
+      The output should equal ""
+    End
+
+    It "removes any stale .galera-sst-auth.cnf left by a previous chart version"
+      When call script_contains "rm -f \"\${DATA_DIR}/.galera-sst-auth.cnf\""
+      The status should be success
+      The output should include ".galera-sst-auth.cnf"
+    End
+  End
 End
diff --git a/addons/mariadb/scripts/galera-start.sh b/addons/mariadb/scripts/galera-start.sh
index 9dd4da571..3a5a2c332 100644
--- a/addons/mariadb/scripts/galera-start.sh
+++ b/addons/mariadb/scripts/galera-start.sh
@@ -199,17 +199,16 @@ main() {
   local cluster_address
   cluster_address=$(build_cluster_address)
 
-  # wsrep_sst_auth must not appear on the command line (visible in ps output).
-  # Write it to a file under DATA_DIR (the persistent volume, always writable)
-  # and load it via --defaults-extra-file so MariaDB picks it up at startup.
-  local sst_conf="${DATA_DIR}/.galera-sst-auth.cnf"
-  printf '[mysqld]\nwsrep_sst_auth=%s:%s\n' \
-    "${MARIADB_ROOT_USER}" "${MARIADB_ROOT_PASSWORD}" > "$sst_conf"
-  chown mysql:mysql "$sst_conf"
-  chmod 600 "$sst_conf"
+  # Do NOT persist wsrep_sst_auth. It is only consumed by the mariabackup/
+  # xtrabackup/mysqldump SST methods; this addon uses `wsrep_sst_method = rsync`
+  # (config/mariadb-galera.tpl), which does not authenticate via wsrep_sst_auth,
+  # so the credential was unused. Worse, it was written to DATA_DIR — a
+  # `needSnapshot: true` volume — so the plaintext root password rode into every
+  # volume snapshot / backup. Remove any stale file left by a previous chart
+  # version; do not recreate it.
+  rm -f "${DATA_DIR}/.galera-sst-auth.cnf" 2>/dev/null || true
 
   local wsrep_args=(
-    "--defaults-extra-file=${sst_conf}"
     "--wsrep-cluster-address=${cluster_address}"
     "--wsrep-cluster-name=${CLUSTER_NAME:-mariadb-galera}"
     "--wsrep-node-name=${POD_NAME}"