Merge pull request #445 from OpenConext/patch/reduce-sst-privileges

Reduce privileges for backup- and SST-user
OpenConext · Dec 14, 2023 · 67eb7e4 · 67eb7e4
2 parents f367f4d + e293503
commit 67eb7e4
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/roles/galera/tasks/cluster_nodes.yml b/roles/galera/tasks/cluster_nodes.yml
@@ -215,7 +215,7 @@
   mysql_user:
     name: "{{ mariadb_cluster_user }}"
     password: "{{ mariadb_cluster_password }}"
-    priv: "*.*:ALL"
+    priv: "*.*:GRANT RELOAD,PROCESS,LOCK TABLES,BINLOG MONITOR"
     state: present
     login_user: root
     login_password: "{{ mariadb_root_password  }}"
@@ -227,7 +227,7 @@
   mysql_user:
     name: "{{ mariadb_backup_user }}"
     password: "{{ mariadb_backup_password  }}"
-    priv: "*.*:SELECT,LOCK TABLES,SHOW VIEW"
+    priv: "*.*:GRANT RELOAD,PROCESS,LOCK TABLES,BINLOG MONITOR,CONNECTION ADMIN"
     state: present
     login_user: root
     login_password: "{{ mariadb_root_password }}"