There are config changes in the galera CR that can't be implemented via the usual rolling update configureed by the mariadb-operator. For example:

• Moving galera from non-TLS to TLS. Each pod must have certificated mounted before they can connect to each other.
• mid-term: updating SST from rsync to mariabackup. Each pod must be configured to use the same SST method so they can connect to each other.
• long-term: major upgrade of mariadb. Each node must be upgraded to the new mariadb major version before they can cluster with each other.

Implement logics/mechanisms to stop all the galera pods before an cluster-incompatible update can be.