SST with JOINER at version 5.7.22 failed from DONOR at version 5.7.19 with xtrabackupv2, when using encryption and keyring-file plugin.
The problem came from the script located at /usr/bin/wsrep_sst_xtrabackup-v2
It stems from the new condition that checks for keyring/vault on both donor and joiner, which does a version check (line 1674) and the version is empty.
This in turn comes from a bug at line 1249, where the mysql version is set by :
MYSQL_VERSION=$($(dirname $0)/mysqld --version 2>&1 | grep -oe '[0-9]\.[0-9][\.0-9]' | head -n1)*
Dirname resolves to /usr/bin, but mysqld is in /usr/sbin. So result is empty.
Replace by the following line :
MYSQL_VERSION=$($(dirname $0)/mysql --version 2>&1 | grep -oe '[0-9]\.[0-9][\.0-9]' | sed -n '2p')*
Because mysql binary is in the same dir /usr/bin, it avoids seraching for the path to mysqld ; the second line is read instead of the first one because it's the second version number for the mysql client (to get 5.x.xx).
Another solution would be to get the correct mysql path and keep the original line while only modifying said path, for instance using which ?
With this edit made on all cluster nodes, version detection finally worked OK and the SST was able to complete correctly.