MySQL Cluster - Percona XtraBackup SST Issue

[MichaelLove-design]

Hi,

I’m encountering issues with this hardened image when attempting to add a MySQL node to a Percona cluster. The issue appears to be related to the Percona XtraBackup SST function on the hardened template. I have replicated the same environment without the hardening and have no issue. I’ve ruled out potential problems with AppArmor, PSAD, hosts.allow, iptables, sshd_config.d (hardening), sbin, and libpam-tmpdir (adjustments were required for these settings to get to the final stage of Percona XtraBackup SST where the node attempts to sync data from the original node)

Has anyone else experienced a similar issue or have insights on resolving it?

Ports that are allowed:
22 (SSH)
ICMP (echo reply/request)
3306 (MySQL)
4444 (SST)
4567 TCP/UDP (Galera)
4568 (Galera IST)
9200 (HAProxy health check)
9101 (HAProxy Exporter)
9100 (Node Exporter)
9011 (Process Exporter)

Error:
messageid: 82957
jobid: 2374
cid: 18
message: IP:3306: node state GALERA_NODE_MYSQL_DISCONNECTED, expected state GALERA_NODE_SYNCED - waiting (timeout in 290 secs).
properties: {
"class_name": "CmonJobMessage",
"created": "2024-11-05T03:08:57.000Z",
"file_name": "/root/cmonsrc/src/Galera.cpp",
"job_id": 2374,
"line_number": 4909,
"message_id": -1,
"message_status": "JOB_SUCCESS",
"message_text": "IP:3306: node state GALERA_NODE_MYSQL_DISCONNECTED, expected state GALERA_NODE_SYNCED - waiting (timeout in 290 secs)."
}
exit_code: 0
report_ts: 2024-11-05 03:08:57
********** 439. row **********
messageid: 82956
jobid: 2374
cid: 18
message: IP:3306: node state GALERA_NODE_MYSQL_DISCONNECTED, expected state GALERA_NODE_SYNCED - waiting (timeout in 300 secs).
properties: {
"class_name": "CmonJobMessage",
"created": "2024-11-05T03:08:47.000Z",
"file_name": "/root/cmonsrc/src/Galera.cpp",
"job_id": 2374,
"line_number": 4909,
"message_id": -1,
"message_status": "JOB_SUCCESS",
"message_text": "IP:3306: node state GALERA_NODE_MYSQL_DISCONNECTED, expected state GALERA_NODE_SYNCED - waiting (timeout in 300 secs)."
}
exit_code: 0
report_ts: 2024-11-05 03:08:47

[konstruktoid]

Try running sudo aa-complain <process name> and see if there's any policy changes required.
To update the profile afterwards, run sudo aa-logprof and then enforce the profile again.