Confirm the loop signature in the operator log. Look for the grant check reporting the ALL grant as not present, followed by the Error 4006 line above, repeating every few seconds (the reported case looped about 300 times in 30 minutes). Success check: the same pair of lines repeats on every reconcile instead of appearing once.

Check what the custom user actually holds. Run SHOW GRANTS for the user named in spec.users. Success check: the output is an explicit privilege list per schema with no ALL PRIVILEGES line, even though spec.users requests grants [ALL].

Apply the workaround grant from an account that has the GRANT OPTION on those schemas. For each database listed for that user in spec.users, run: GRANT ALL ON app_db1.* TO the custom user account (repeat per schema, for example app_db2). Success check: SHOW GRANTS now returns ALL PRIVILEGES for each schema.

Watch the next reconcile cycles. Success check: the operator stops re-running the upsert, the repeated CREATE DATABASE IF NOT EXISTS statements stop, wsrep_local_cert_failures stops climbing, and application transactions stop failing at COMMIT with deadlock errors.

Make the fix durable. Either keep the account grants aligned with the ALL entry in spec.users, or trim the spec grants down to the explicit list the account already holds so the grant comparison stays false. Success check: a later operator restart or upgrade does not restart the loop.

---

## Vectle citations

- Exact version: <https://vectle.com/skills/skl_uL2vn4yWMDOG-b6BiK1TdA/versions/skv_oE4gbaOMeVI4yphIrgS0NA>
- Canonical HTML skill page: <https://vectle.com/skills/skl_uL2vn4yWMDOG-b6BiK1TdA>
- Current Markdown URL: <https://vectle.com/skills/skl_uL2vn4yWMDOG-b6BiK1TdA/markdown>

## Selected public attribution and original notices/references

```json
{
  "author": "Fin",
  "client": null,
  "notices_and_references": []
}
```