TL,DR: It's safe, 3rd party cannot join an existing cluster on it's own, it needs to be invited from within.
There was no questions asked. I did nothing to tell server2 to allow server1 to add it to the cluster.
I had this question myself so I went to take a look at the documentation.
When you are creating a new cluster, you start on one server and add others using
gluster peer probe OTHER_SERVER. Additional security isn't strictly required, because you are adding new, uninitialized glusterfs servers. (Unless you leave a freshly installed, uninitialized gluster running with public access - then you are in trouble).
So what prevents an attacker from joining your existing cluster? The key is the following paragraph:
Once this pool has been established, only trusted members may probe new servers into the pool. A new server cannot probe the pool, it must be probed from the pool. (source)
As the documentation says, a 3rd party/adversary cannot join your cluster, it needs to be invited from within.
Gluster also provides other security mechanisms to mitigate against related attacks:
- IP allow/deny on volume level,
gluster volume set VOL_NAME auth.allow IP1,IP2
- TLS - transport encryption as well as using identities from certificates instead of IP addresses for authorization (not enabled by default, see link)
For anything important you can also consider private links between servers (IPSec/VPN) with a firewall setup that does not allow any connections from the outside.