Repository: mariadb-operator/mariadb-operator

Issue:
[Bug] Grant privileges are not revoked after Grant deletion if User's .meta.name differs from .spec.name
When we clean up after Grant deletion, [here](https://github.com/mariadb-operator/mariadb-operator/blob/d34b814b87fbf6ab02b2b8328ca8f33933d7874c/internal/controller/grant_controller_finalizer.go#L58) we look up the corresponding User via [userKey()](https://github.com/mariadb-operator/mariadb-operator/blob/d34b814b87fbf6ab02b2b8328ca8f33933d7874c/internal/controller/grant_controller.go#L158). 

But it is not guaranteed that User's `.meta.name` will be equal to Grant's `.spec.username` since User allows having a custom name via `.spec.name`. Unfortunately, my setup requires my User resources to have different `.meta.name` and `.spec.name`. So in my Grants `.spec.username` refers to User's `.spec.name` and website-operator does not clean up privileges as expected because it cannot find such a User. 

Discussion:

Solution patch:
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index a5ead1e8..d2032aac 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -2,7 +2,7 @@
     "name": "Go",
     "image": "mcr.microsoft.com/devcontainers/go:1.24-bookworm",
     "features": {
-        "ghcr.io/devcontainers/features/docker-in-docker:2.12.2": {
+        "ghcr.io/devcontainers/features/docker-in-docker:2.12.3": {
             "moby": true,
             "installDockerBuildx": true,
             "version": "latest",
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 81736c8f..aafac586 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -34,10 +34,10 @@ jobs:
     if: ${{ needs.detect-noop.outputs.noop != 'true' }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version-file: "go.mod"
           cache: true
@@ -54,10 +54,10 @@ jobs:
     if: ${{ needs.detect-noop.outputs.noop != 'true' }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Find typos
-        uses: crate-ci/typos@v1.34.0
+        uses: crate-ci/typos@v1.36.2
         with:
           files: ./api ./cmd ./internal ./pkg
           config: ./.typos.toml
@@ -69,10 +69,10 @@ jobs:
     if: ${{ needs.detect-noop.outputs.noop != 'true' }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version-file: "go.mod"
           cache: true
@@ -90,10 +90,10 @@ jobs:
     if: ${{ needs.detect-noop.outputs.noop != 'true' }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version-file: "go.mod"
           cache: true
@@ -110,10 +110,10 @@ jobs:
     if: ${{ needs.detect-noop.outputs.noop != 'true' }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version-file: "go.mod"
           cache: true
@@ -160,7 +160,7 @@ jobs:
     if: ${{ needs.detect-noop.outputs.noop != 'true' }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Generate
         run: make gen
diff --git a/.github/workflows/helm-release-crds.yml b/.github/workflows/helm-release-crds.yml
index 95eaa1db..cc119c76 100644
--- a/.github/workflows/helm-release-crds.yml
+++ b/.github/workflows/helm-release-crds.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/helm-release.yml b/.github/workflows/helm-release.yml
index d1938855..5bfe5fc2 100644
--- a/.github/workflows/helm-release.yml
+++ b/.github/workflows/helm-release.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
@@ -42,7 +42,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/helm.yml b/.github/workflows/helm.yml
index 45c13bbc..8d58829a 100644
--- a/.github/workflows/helm.yml
+++ b/.github/workflows/helm.yml
@@ -21,7 +21,7 @@ jobs:
       CT_CONFIG: hack/config/chart-testing/mariadb-cluster.yaml
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
@@ -30,7 +30,7 @@ jobs:
         with:
           version: ${{ env.HELM_VERSION }}
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.9"
 
@@ -56,7 +56,7 @@ jobs:
       CT_CONFIG: hack/config/chart-testing/mariadb-operator-crds.yaml
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
@@ -65,7 +65,7 @@ jobs:
         with:
           version: ${{ env.HELM_VERSION }}
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.9"
 
@@ -99,7 +99,7 @@ jobs:
       CT_CONFIG: hack/config/chart-testing/mariadb-operator.yaml
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
@@ -108,7 +108,7 @@ jobs:
         with:
           version: ${{ env.HELM_VERSION }}
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.9"
 
@@ -147,7 +147,7 @@ jobs:
     if: github.ref == 'refs/heads/main'
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
           token: "${{ secrets.GHA_TOKEN }}"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ae81b4ef..56544d7d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,7 +18,7 @@ jobs:
       RELEASE_ARGS: ${{ steps.args.outputs.RELEASE_ARGS }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
@@ -60,7 +60,7 @@ jobs:
     needs: args
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
@@ -106,7 +106,7 @@ jobs:
       - release
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
@@ -132,7 +132,7 @@ jobs:
       - goreleaser
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
           token: "${{ secrets.GHA_TOKEN }}"
@@ -166,7 +166,7 @@ jobs:
       - helm
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
           token: "${{ secrets.GHA_TOKEN }}"
diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml
index 49497e7a..72d5dc18 100644
--- a/.github/workflows/stale.yaml
+++ b/.github/workflows/stale.yaml
@@ -7,7 +7,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@v10
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           stale-issue-message: 'This issue is stale because it has been open 60 days with no activity.'
diff --git a/.github/workflows/test-image-ubi.yml b/.github/workflows/test-image-ubi.yml
index 2cf157de..943daa2d 100644
--- a/.github/workflows/test-image-ubi.yml
+++ b/.github/workflows/test-image-ubi.yml
@@ -22,10 +22,10 @@ jobs:
           docker run --rm ${{ inputs.mariadb_image }} mariadbd --version
 
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version-file: "go.mod"
           cache: true
diff --git a/.github/workflows/test-image.yml b/.github/workflows/test-image.yml
index dca52428..55b1fb6d 100644
--- a/.github/workflows/test-image.yml
+++ b/.github/workflows/test-image.yml
@@ -22,10 +22,10 @@ jobs:
           docker run --rm ${{ inputs.mariadb_image }} mariadbd --version
 
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version-file: "go.mod"
           cache: true
diff --git a/api/v1alpha1/restore_types.go b/api/v1alpha1/restore_types.go
index 667784e6..f4bbcbf0 100644
--- a/api/v1alpha1/restore_types.go
+++ b/api/v1alpha1/restore_types.go
@@ -24,7 +24,7 @@ type RestoreSource struct {
 	// Volume is a Kubernetes Volume object that contains a backup.
 	// +optional
 	// +operator-sdk:csv:customresourcedefinitions:type=spec
-	Volume *StorageVolumeSource `json:"volume,omitempty" webhook:"inmutableinit"`
+	Volume *StorageVolumeSource `json:"volume,omitempty"`
 	// TargetRecoveryTime is a RFC3339 (1970-01-01T00:00:00Z) date and time that defines the point in time recovery objective.
 	// It is used to determine the closest restoration source in time.
 	// +optional
diff --git a/docs/physical_backup.md b/docs/physical_backup.md
index bbf0556e..e0ba39c3 100644
--- a/docs/physical_backup.md
+++ b/docs/physical_backup.md
@@ -542,4 +542,10 @@ spec:
     innodb_log_file_size=200M
 ```
 
-Refer to [MDEV-36159](https://jira.mariadb.org/browse/MDEV-36237) for further details on this issue.
\ No newline at end of file
+Refer to [MDEV-36159](https://jira.mariadb.org/browse/MDEV-36237) for further details on this issue.
+
+#### `mariadb-backup` `Job` fails to start because the `Pod` cannot mount `MariaDB` PVC created with [openebs/lvm-localpv](https://github.com/openebs/lvm-localpv) `StorageClass` provider
+
+Without explicitly enabled [shared option](https://github.com/openebs/lvm-localpv/blob/develop/design%2Flvm%2Fstorageclass-parameters%2Fshared.md) the `ReadWriteOnce` access mode is treated as `ReadWriteOncePod`.
+
+Refer to [openebs/lvm-localpv#281](https://github.com/openebs/lvm-localpv/issues/281) for further details on this issue.
diff --git a/go.mod b/go.mod
index 72e16fb4..337b999f 100644
--- a/go.mod
+++ b/go.mod
@@ -19,12 +19,12 @@ require (
 	github.com/minio/minio-go/v7 v7.0.95
 	github.com/onsi/ginkgo/v2 v2.23.4
 	github.com/onsi/gomega v1.38.0
-	github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.84.0
+	github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.85.0
 	github.com/robfig/cron/v3 v3.0.1
 	github.com/sethvargo/go-envconfig v1.3.0
 	github.com/sethvargo/go-password v0.3.1
 	github.com/spf13/cobra v1.9.1
-	github.com/stretchr/testify v1.10.0
+	github.com/stretchr/testify v1.11.1
 	go.uber.org/zap v1.27.0
 	golang.org/x/sync v0.16.0
 	k8s.io/api v0.33.3
@@ -168,7 +168,7 @@ require (
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/apiextensions-apiserver v0.33.2 // indirect
+	k8s.io/apiextensions-apiserver v0.33.3 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
 	sigs.k8s.io/gateway-api v1.1.0 // indirect
diff --git a/go.sum b/go.sum
index 75e21639..67b30438 100644
--- a/go.sum
+++ b/go.sum
@@ -281,8 +281,8 @@ github.com/pquerna/otp v1.4.0 h1:wZvl1TIVxKRThZIBiwOOHOGP/1+nZyWBil9Y2XNEDzg=
 github.com/pquerna/otp v1.4.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
 github.com/prashantv/gostub v1.1.0 h1:BTyx3RfQjRHnUWaGF9oQos79AlQ5k8WNktv7VGvVH4g=
 github.com/prashantv/gostub v1.1.0/go.mod h1:A5zLQHz7ieHGG7is6LLXLz7I8+3LZzsrV0P1IAHhP5U=
-github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.84.0 h1:V/HLst0rSw4BZp8nIqhaTnnW4/EGxEoYbgjcDqzPJ5U=
-github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.84.0/go.mod h1:MruMqbSS9aYrKhBImrO9X9g52hwz3I0B+tcoeAwkmuM=
+github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.85.0 h1:oY+F5FZFmCjCyzkHWPjVQpzvnvEB/0FP+iyzDUUlqFc=
+github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.85.0/go.mod h1:VB7wtBmDT6W2RJHzsvPZlBId+EnmeQA0d33fFTXvraM=
 github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
 github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
 github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
@@ -326,8 +326,8 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/texttheater/golang-levenshtein v1.0.1 h1:+cRNoVrfiwufQPhoMzB6N0Yf/Mqajr6t1lOv8GyGE2U=
 github.com/texttheater/golang-levenshtein v1.0.1/go.mod h1:PYAKrbF5sAiq9wd+H82hs7gNaen0CplQ9uvm6+enD/8=
 github.com/tinylib/msgp v1.3.0 h1:ULuf7GPooDaIlbyvgAxBV/FI7ynli6LZ1/nVUNu+0ww=
@@ -428,8 +428,8 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 k8s.io/api v0.33.3 h1:SRd5t//hhkI1buzxb288fy2xvjubstenEKL9K51KBI8=
 k8s.io/api v0.33.3/go.mod h1:01Y/iLUjNBM3TAvypct7DIj0M0NIZc+PzAHCIo0CYGE=
-k8s.io/apiextensions-apiserver v0.33.2 h1:6gnkIbngnaUflR3XwE1mCefN3YS8yTD631JXQhsU6M8=
-k8s.io/apiextensions-apiserver v0.33.2/go.mod h1:IvVanieYsEHJImTKXGP6XCOjTwv2LUMos0YWc9O+QP8=
+k8s.io/apiextensions-apiserver v0.33.3 h1:qmOcAHN6DjfD0v9kxL5udB27SRP6SG/MTopmge3MwEs=
+k8s.io/apiextensions-apiserver v0.33.3/go.mod h1:oROuctgo27mUsyp9+Obahos6CWcMISSAPzQ77CAQGz8=
 k8s.io/apimachinery v0.33.3 h1:4ZSrmNa0c/ZpZJhAgRdcsFcZOw1PQU1bALVQ0B3I5LA=
 k8s.io/apimachinery v0.33.3/go.mod h1:BHW0YOu7n22fFv/JkYOEfkUYNRN0fj0BlvMFWA7b+SM=
 k8s.io/client-go v0.33.3 h1:M5AfDnKfYmVJif92ngN532gFqakcGi6RvaOF16efrpA=
diff --git a/internal/controller/grant_controller.go b/internal/controller/grant_controller.go
index 8b1daa9d..4f26a95e 100644
--- a/internal/controller/grant_controller.go
+++ b/internal/controller/grant_controller.go
@@ -10,7 +10,6 @@ import (
 	"github.com/mariadb-operator/mariadb-operator/v25/pkg/controller/sql"
 	"github.com/mariadb-operator/mariadb-operator/v25/pkg/refresolver"
 	sqlClient "github.com/mariadb-operator/mariadb-operator/v25/pkg/sql"
-	"k8s.io/apimachinery/pkg/types"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
@@ -154,10 +153,3 @@ func (wr *wrappedGrantReconciler) privilegesToRevoke() []string {
 	}
 	return revokePrivileges
 }
-
-func userKey(grant *mariadbv1alpha1.Grant) types.NamespacedName {
-	return types.NamespacedName{
-		Name:      grant.Spec.Username,
-		Namespace: grant.Namespace,
-	}
-}
diff --git a/internal/controller/grant_controller_finalizer.go b/internal/controller/grant_controller_finalizer.go
index 02328638..a4a823d2 100644
--- a/internal/controller/grant_controller_finalizer.go
+++ b/internal/controller/grant_controller_finalizer.go
@@ -3,13 +3,10 @@ package controller
 import (
 	"context"
 	"fmt"
-	"time"
 
 	mariadbv1alpha1 "github.com/mariadb-operator/mariadb-operator/v25/api/v1alpha1"
 	"github.com/mariadb-operator/mariadb-operator/v25/pkg/controller/sql"
 	sqlClient "github.com/mariadb-operator/mariadb-operator/v25/pkg/sql"
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/apimachinery/pkg/util/wait"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 )
@@ -53,28 +50,19 @@ func (wf *wrappedGrantFinalizer) ContainsFinalizer() bool {
 }
 
 func (wf *wrappedGrantFinalizer) Reconcile(ctx context.Context, mdbClient *sqlClient.Client) error {
-	err := wait.PollUntilContextTimeout(ctx, 1*time.Second, 10*time.Second, true, func(ctx context.Context) (bool, error) {
-		var user mariadbv1alpha1.User
-		if err := wf.Get(ctx, userKey(wf.grant), &user); err != nil {
-			if apierrors.IsNotFound(err) {
-				return true, nil
-			}
-			return true, err
-		}
-		return false, nil
-	})
-	// User does not exist
-	if err == nil {
-		return nil
-	}
-	if !wait.Interrupted(err) {
+	exists, err := mdbClient.UserExists(ctx, wf.grant.Spec.Username, wf.grant.HostnameOrDefault())
+	if err != nil {
 		return fmt.Errorf("error checking if user exists in MariaDB: %v", err)
 	}
+	if !exists {
+		return nil
+	}
 
 	var opts []sqlClient.GrantOption
 	if wf.grant.Spec.GrantOption {
 		opts = append(opts, sqlClient.WithGrantOption())
 	}
+
 	if err := mdbClient.Revoke(
 		ctx,
 		wf.grant.Spec.Privileges,
diff --git a/pkg/builder/batch_container_builder.go b/pkg/builder/batch_container_builder.go
index 183c4c99..09fa8453 100644
--- a/pkg/builder/batch_container_builder.go
+++ b/pkg/builder/batch_container_builder.go
@@ -97,10 +97,7 @@ func jobPhysicalBackupVolumes(storageVolume mariadbv1alpha1.StorageVolumeSource,
 			},
 		},
 	})
-	volumeMounts = append(volumeMounts, corev1.VolumeMount{
-		Name:      StorageVolume,
-		MountPath: MariadbStorageMountPath,
-	})
+	volumeMounts = append(volumeMounts, mariadbStorageVolumeMount(mariadb))
 
 	return volumes, volumeMounts
 }
diff --git a/pkg/builder/container_builder.go b/pkg/builder/container_builder.go
index bd61984b..7905907e 100644
--- a/pkg/builder/container_builder.go
+++ b/pkg/builder/container_builder.go
@@ -469,6 +469,20 @@ func mariadbEnv(mariadb *mariadbv1alpha1.MariaDB) []corev1.EnvVar {
 	return env
 }
 
+func mariadbStorageVolumeMount(mariadb *mariadbv1alpha1.MariaDB) corev1.VolumeMount {
+	galera := ptr.Deref(mariadb.Spec.Galera, mariadbv1alpha1.Galera{})
+	reuseStorageVolume := ptr.Deref(galera.Config.ReuseStorageVolume, false)
+
+	storageVolumeMount := corev1.VolumeMount{
+		Name:      StorageVolume,
+		MountPath: MariadbStorageMountPath,
+	}
+	if mariadb.IsGaleraEnabled() && reuseStorageVolume {
+		storageVolumeMount.SubPath = StorageVolume
+	}
+	return storageVolumeMount
+}
+
 func mariadbVolumeMounts(mariadb *mariadbv1alpha1.MariaDB, opts ...mariadbPodOpt) []corev1.VolumeMount {
 	mariadbOpts := newMariadbPodOpts(opts...)
 	volumeMounts := []corev1.VolumeMount{
@@ -483,17 +497,7 @@ func mariadbVolumeMounts(mariadb *mariadbv1alpha1.MariaDB, opts ...mariadbPodOpt
 		volumeMounts = append(volumeMounts, tlsVolumeMounts...)
 	}
 
-	galera := ptr.Deref(mariadb.Spec.Galera, mariadbv1alpha1.Galera{})
-	reuseStorageVolume := ptr.Deref(galera.Config.ReuseStorageVolume, false)
-
-	storageVolumeMount := corev1.VolumeMount{
-		Name:      StorageVolume,
-		MountPath: MariadbStorageMountPath,
-	}
-	if mariadb.IsGaleraEnabled() && reuseStorageVolume {
-		storageVolumeMount.SubPath = StorageVolume
-	}
-	volumeMounts = append(volumeMounts, storageVolumeMount)
+	volumeMounts = append(volumeMounts, mariadbStorageVolumeMount(mariadb))
 
 	if mariadb.Replication().Enabled && ptr.Deref(mariadb.Replication().ProbesEnabled, false) {
 		volumeMounts = append(volumeMounts, corev1.VolumeMount{
@@ -511,6 +515,9 @@ func mariadbVolumeMounts(mariadb *mariadbv1alpha1.MariaDB, opts ...mariadbPodOpt
 		galeraConfigVolumeMount := corev1.VolumeMount{
 			MountPath: galeraresources.GaleraConfigMountPath,
 		}
+		galera := ptr.Deref(mariadb.Spec.Galera, mariadbv1alpha1.Galera{})
+		reuseStorageVolume := ptr.Deref(galera.Config.ReuseStorageVolume, false)
+
 		if reuseStorageVolume {
 			galeraConfigVolumeMount.Name = StorageVolume
 			galeraConfigVolumeMount.SubPath = galeraresources.GaleraConfigVolume



Test patch:
diff --git a/pkg/builder/container_builder_test.go b/pkg/builder/container_builder_test.go
index e5e265b1..dc4b1b04 100644
--- a/pkg/builder/container_builder_test.go
+++ b/pkg/builder/container_builder_test.go
@@ -1931,6 +1931,61 @@ func TestMaxscaleContainers(t *testing.T) {
 	}
 }
 
+func TestMariadbStorageVolumeMount(t *testing.T) {
+	tests := []struct {
+		name        string
+		mariadb     *mariadbv1alpha1.MariaDB
+		wantSubPath string
+	}{
+		{
+			name:        "no galera configured",
+			mariadb:     &mariadbv1alpha1.MariaDB{Spec: mariadbv1alpha1.MariaDBSpec{}},
+			wantSubPath: "",
+		},
+		{
+			name: "galera enabled reuse disabled",
+			mariadb: &mariadbv1alpha1.MariaDB{
+				Spec: mariadbv1alpha1.MariaDBSpec{
+					Galera: &mariadbv1alpha1.Galera{
+						Enabled: true,
+						GaleraSpec: mariadbv1alpha1.GaleraSpec{
+							Config: mariadbv1alpha1.GaleraConfig{
+								ReuseStorageVolume: ptr.To(false),
+							},
+						},
+					},
+				},
+			},
+			wantSubPath: "",
+		},
+		{
+			name: "galera enabled reuse enabled",
+			mariadb: &mariadbv1alpha1.MariaDB{
+				Spec: mariadbv1alpha1.MariaDBSpec{
+					Galera: &mariadbv1alpha1.Galera{
+						Enabled: true,
+						GaleraSpec: mariadbv1alpha1.GaleraSpec{
+							Config: mariadbv1alpha1.GaleraConfig{
+								ReuseStorageVolume: ptr.To(true),
+							},
+						},
+					},
+				},
+			},
+			wantSubPath: StorageVolume,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			vm := mariadbStorageVolumeMount(tt.mariadb)
+			if vm.SubPath != tt.wantSubPath {
+				t.Fatalf("unexpected SubPath: want=%q got=%q", tt.wantSubPath, vm.SubPath)
+			}
+		})
+	}
+}
+
 func defaultEnv(overrides []corev1.EnvVar) []corev1.EnvVar {
 	mysqlTcpPort := corev1.EnvVar{
 		Name:  "MYSQL_TCP_PORT",