mirror of
https://github.com/rustfs/rustfs.git
synced 2026-09-08 21:25:59 +00:00
Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 houseme
|
b73bc1f76b |
@@ -1,2 +1,2 @@
|
||||
sha256-darwin=364f2329a7b72eb9f1608dbe1a3af37af4095354014f3cbe23ca448492d89961
|
||||
sha256-linux=60983f1ebe7068cf660d473c5f76c76a650410ccc99d71934ddca7fd67607987
|
||||
sha256-darwin=a5665318c9bdc0947514fb7008ba1b83b114b739fac775c3c446f207058b7c7a
|
||||
sha256-linux=45d80e1723de5d25bb5b81f3ef5c82f583efc3e4f036a8cd2bb99e4f1eca9e51
|
||||
|
||||
@@ -1 +1 @@
|
||||
sha256=0e338d305260229e17ccfb2adc48a6212dbdfea36a9ebfb5a4e0d38658e6cc45
|
||||
sha256=0fe8408874ccec3620262a9812d67920ddd72dc9edf0e36e0d0aed3f8bad026e
|
||||
|
||||
@@ -188,11 +188,7 @@
|
||||
"lane": "mrf-responsibility",
|
||||
"status": "pending",
|
||||
"description": "Durable MRF responsibility at every commit boundary",
|
||||
"requires": ["MRF responsibility oracle", "commit-boundary crash matrix"],
|
||||
"evidence_fields": [
|
||||
"mrf_responsibility_oracle",
|
||||
"commit_boundary_crash_matrix"
|
||||
]
|
||||
"requires": ["MRF responsibility oracle", "commit-boundary crash matrix"]
|
||||
},
|
||||
{
|
||||
"gate": "G08",
|
||||
@@ -200,12 +196,7 @@
|
||||
"lane": "mrf-responsibility",
|
||||
"status": "pending",
|
||||
"description": "MRF capacity, disk-full and replica-loss matrix",
|
||||
"requires": ["MRF capacity evidence", "disk-full matrix", "replica-loss matrix"],
|
||||
"evidence_fields": [
|
||||
"mrf_capacity_evidence",
|
||||
"disk_full_matrix",
|
||||
"replica_loss_matrix"
|
||||
]
|
||||
"requires": ["MRF capacity evidence", "disk-full matrix", "replica-loss matrix"]
|
||||
},
|
||||
{
|
||||
"gate": "G09",
|
||||
@@ -234,16 +225,7 @@
|
||||
"lane": "maintenance-producers",
|
||||
"status": "pending",
|
||||
"description": "Maintenance and complete producer coverage",
|
||||
"requires": [
|
||||
"maintenance producer matrix",
|
||||
"complete producer inventory",
|
||||
"segment activation preflight"
|
||||
],
|
||||
"evidence_fields": [
|
||||
"maintenance_producer_matrix",
|
||||
"complete_producer_inventory",
|
||||
"segment_activation_preflight"
|
||||
]
|
||||
"requires": ["maintenance producer matrix", "complete producer inventory"]
|
||||
},
|
||||
{
|
||||
"gate": "G12",
|
||||
@@ -267,20 +249,7 @@
|
||||
"lane": "ec8-4-multiset",
|
||||
"status": "pending",
|
||||
"description": "Same-window field evidence with 3x4 EC8+4 and multi-set/pool coverage",
|
||||
"requires": [
|
||||
"same-window field evidence",
|
||||
"3x4 EC8+4 evidence",
|
||||
"multi-set evidence",
|
||||
"multi-pool evidence",
|
||||
"distributed segment invalidation evidence"
|
||||
],
|
||||
"evidence_fields": [
|
||||
"same_window_field_evidence",
|
||||
"ec8_4_evidence",
|
||||
"multi_set_evidence",
|
||||
"multi_pool_evidence",
|
||||
"distributed_segment_invalidation_evidence"
|
||||
]
|
||||
"requires": ["same-window field evidence", "3x4 EC8+4 evidence", "multi-set evidence", "multi-pool evidence"]
|
||||
},
|
||||
{
|
||||
"gate": "P1",
|
||||
@@ -296,11 +265,7 @@
|
||||
"lane": "scheduler-pressure",
|
||||
"status": "pending",
|
||||
"description": "Measured post-stop convergence and cold segment reuse",
|
||||
"requires": ["post-stop convergence measurement", "cold segment reuse measurement"],
|
||||
"evidence_fields": [
|
||||
"post_stop_convergence_measurement",
|
||||
"cold_segment_reuse_measurement"
|
||||
]
|
||||
"requires": ["post-stop convergence measurement", "cold segment reuse measurement"]
|
||||
},
|
||||
{
|
||||
"gate": "P3",
|
||||
@@ -316,10 +281,7 @@
|
||||
"lane": "mrf-responsibility",
|
||||
"status": "pending",
|
||||
"description": "Measured MRF scale and replay cost with retained responsibility",
|
||||
"requires": ["MRF scale measurement", "MRF replay-cost measurement", "retained responsibility evidence", "cleanup/GC soak evidence"],
|
||||
"evidence_fields": [
|
||||
"mrf_cleanup_gc_soak_evidence"
|
||||
]
|
||||
"requires": ["MRF scale measurement", "MRF replay-cost measurement", "retained responsibility evidence"]
|
||||
},
|
||||
{
|
||||
"gate": "R-E",
|
||||
|
||||
@@ -129,22 +129,11 @@ jobs:
|
||||
: > target/debug/rustfs.features
|
||||
|
||||
- name: Run upgrade compatibility test
|
||||
env:
|
||||
RUSTFS_SCANNER_HEAL_G09_EVIDENCE_DIR: ${{ runner.temp }}/rustfs-upgrade-g09-evidence/${{ matrix.artifact }}
|
||||
run: |
|
||||
cargo test --locked -p e2e_test \
|
||||
"upgrade_compatibility_test::${{ matrix.test }}" \
|
||||
-- --ignored --exact --nocapture
|
||||
|
||||
- name: Upload scanner/heal G09 evidence
|
||||
if: always()
|
||||
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
|
||||
with:
|
||||
name: ${{ matrix.artifact }}-g09-evidence-${{ github.run_number }}
|
||||
path: ${{ runner.temp }}/rustfs-upgrade-g09-evidence/${{ matrix.artifact }}
|
||||
if-no-files-found: ignore
|
||||
retention-days: 14
|
||||
|
||||
- name: Upload server logs
|
||||
if: always()
|
||||
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
|
||||
|
||||
@@ -82,12 +82,6 @@ jobs:
|
||||
performance-test:
|
||||
runs-on: pf-testing
|
||||
timeout-minutes: 900
|
||||
env:
|
||||
RUSTFS_BENCH_SCRIPT: ${{ github.workspace }}/auto-testing/rustfs_performance_testing.sh
|
||||
RUSTFS_WARP_METHODS: ${{ inputs.test_method }}
|
||||
RUSTFS_WARP_SIZES: ${{ inputs.object_size }}
|
||||
RUSTFS_WARP_DURATION: ${{ inputs.warp_duration || '5m' }}
|
||||
RUSTFS_WARP_CONCURRENCY: ${{ inputs.warp_concurrency || '64' }}
|
||||
# Run on manual dispatch, or when the nightly build completed successfully.
|
||||
# Skipped when nightly failed.
|
||||
if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' }}
|
||||
@@ -164,15 +158,19 @@ jobs:
|
||||
- name: Run benchmark (GET/PUT/MIXED)
|
||||
id: benchmark
|
||||
run: |
|
||||
# Empty on automatic (workflow_run) runs -> full 30 rounds.
|
||||
# Manual dispatch can restrict method(s)/size(s).
|
||||
export WARP_METHODS="${{ inputs.test_method }}"
|
||||
export WARP_SIZES="${{ inputs.object_size }}"
|
||||
./auto-testing/rustfs_performance_test.sh \
|
||||
--step 5 -y \
|
||||
--warp-duration "${{ inputs.warp_duration || '5m' }}" \
|
||||
--warp-concurrency "${{ inputs.warp_concurrency || '64' }}" \
|
||||
--log-file "${LOG_FILE}"
|
||||
|
||||
- name: Analyze results
|
||||
if: ${{ steps.benchmark.conclusion == 'success' }}
|
||||
run: |
|
||||
export WARP_METHODS="${RUSTFS_WARP_METHODS}" WARP_SIZES="${RUSTFS_WARP_SIZES}"
|
||||
export WARP_DURATION="${RUSTFS_WARP_DURATION}" WARP_CONCURRENCY="${RUSTFS_WARP_CONCURRENCY}"
|
||||
./auto-testing/rustfs_performance_test.sh --step 6 -y --log-file "${LOG_FILE:-/dev/null}"
|
||||
|
||||
- name: Collect RustFS version info
|
||||
|
||||
@@ -52,7 +52,6 @@ docs
|
||||
__pycache__/
|
||||
!docs/
|
||||
docs/*
|
||||
!docs/README.md
|
||||
!docs/architecture/
|
||||
!docs/architecture/**
|
||||
!docs/operations/
|
||||
|
||||
@@ -7,30 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
||||
|
||||
## [Unreleased]
|
||||
|
||||
### Replication
|
||||
|
||||
- Object Lock replication PUTs now carry a required integrity header, fixing target rejection introduced by the plain-payload default ([#7097](https://github.com/rustfs/rustfs/pull/7097)). This changes the default outbound request for locked objects but adds no persisted format.
|
||||
- Multipart source objects stay on the multipart transport even when their checksum record is a whole-object checksum, so objects above the single-PUT limit remain replicable ([#7047](https://github.com/rustfs/rustfs/pull/7047)).
|
||||
- Targets that mint their own version IDs now use a per-target version ledger for tag, retention, legal-hold, and permanent-delete mutations; ambiguous pre-ledger matches fail with backoff instead of guessing ([#7368](https://github.com/rustfs/rustfs/pull/7368)). This adds dual-prefixed internal metadata keys that older readers ignore.
|
||||
- Single-part source checksums are forwarded as `x-amz-checksum-*` headers instead of user metadata, so the replica preserves checksum responses ([#7313](https://github.com/rustfs/rustfs/pull/7313)). This changes the default outbound headers for checksummed objects.
|
||||
- Site-replication outage recovery now uses a bounded 30-second retry drain plus the 600-second full reconciliation pass, persists destructive liabilities before local deletion, and fences replay settlement and peer edits ([#7148](https://github.com/rustfs/rustfs/pull/7148)). Persisted additions are optional and ignored by older readers.
|
||||
- IAM snapshot/deletion replay, target-assigned delete-marker purges, timestamp ordering, and best-effort peer broadcast now close the control-plane gaps found by the R6 review ([#7195](https://github.com/rustfs/rustfs/pull/7195)).
|
||||
- Upgrade and rollback: upgrade every node in one site consecutively and verify reconciliation before moving to the next site; do not intentionally run a site mixed-version. Target-version ledger keys are harmless on rollback, although old code cannot use their routing. Before rolling back past [#7307](https://github.com/rustfs/rustfs/pull/7307), drain or repair every pending version purge: older code can free a retained version's data directory before its remote purge is acknowledged. See `docs/operations/site-replication-operations.md`.
|
||||
|
||||
### Security
|
||||
- **Presigned URLs honour only signed headers** (GHSA-g8w9-qw9q-fghr): a SigV4 presigned request that carries an `x-amz-*` request header not listed in `X-Amz-SignedHeaders` is now rejected with `403 AccessDenied` ("There were headers present in the request which were not signed"), matching AWS S3. Previously the holder of a presigned `PutObject` URL could add unsigned `x-amz-tagging`, `x-amz-storage-class`, `x-amz-website-redirect-location`, ACL, metadata, Object Lock or SSE headers and have them applied. Presigners that intend a property must set it before signing so the SDK lists the header in `SignedHeaders`; `x-amz-cf-id` (CloudFront) remains tolerated unsigned. Header-signed SigV4 and SigV2 requests are unchanged.
|
||||
|
||||
### Fixed
|
||||
- **Fresh multi-pool bootstrap with distinct format creators**: a new deployment whose pools have their first endpoint on different nodes (for example two single-node pools) could never publish its initial `pool.bin`: each node held fresh-bootstrap proof only for the pool it formatted, the deployment-wide proof collapsed to none, and every node died with `pool metadata recovery required: no durable bootstrap identity or pool.bin replica is available` after the startup retry budget. The first pool's creator now mints the pending cluster identity on its own pool, every other creator copies that nonce-bound identity onto the pool it formatted first-hand, and the elected writer publishes `pool.bin` once every pool replica carries the same pending identity. Corrupt or disagreeing replicas, pools that merely have a format, expansion pools joining an initialized deployment, and restarts without first-hand proof still fail closed. Non-elected nodes that start before `pool.bin` exists, and the elected writer while it waits for the other creators, no longer latch their pool-metadata write gate for the life of the process. Refs rustfs/backlog#2338, rustfs/backlog#2375.
|
||||
- **Lock RPC timeout storms** (#7363): the remote lock client no longer evicts and re-dials the shared internode HTTP/2 channel on every request deadline. A timeout evicts only when the peer has not completed any lock RPC for two deadlines, evictions and transport-failure re-dials are rate limited per peer (`RUSTFS_OBJECT_LOCK_RPC_EVICTION_COOLDOWN_MS`, default 5 s), and a timed-out request is left running instead of being reset (bounded per peer by `RUSTFS_OBJECT_LOCK_RPC_DETACHED_LIMIT`, default 256), so a slow lock endpoint can no longer drive the `RST_STREAM`/`GOAWAY too_many_resets`/reconnect loop. A lock granted after its caller timed out is released immediately, and unlocks that fail the quick retries continue on a deferred 1/2/4/8/16 s schedule before the server lease reclaims them. New `rustfs_remote_lock_*` metrics cover timeouts, evictions, suppressed evictions, detached streams, late completions and late releases per peer. Operator guide at `docs/operations/lock-rpc-storm-protection.md`.
|
||||
- **KMS failures on the S3 data path carry an actionable status**: only "key not found" and a backend outage were classified; every other KMS failure — a disabled or pending-deletion key, a denied KMS grant, an encryption-context mismatch, an unsupported algorithm, a credential or timeout failure, a capability the backend does not have — collapsed onto `500 InternalError`. SDKs therefore applied exponential backoff to configuration errors that no retry can fix, and monitoring filed every one of them as a server fault. Unusable-key and request-side failures now return `400`, a denied grant `403`, transient backend failures `503` — including a key store the backend could not read, so an outage stays distinguishable from a missing key all the way to the client — and a missing backend capability `501`. Damaged or unreadable key material still returns `500`, which is what it is.
|
||||
- **SSE-C on buckets with default encryption**: a `PutObject` carrying a valid SSE-C header triple on a bucket that has default encryption configured no longer fails with `400 InvalidArgument` ("The SSE-C and managed server-side encryption headers cannot be used together"). PUT and the POST-object/extract path resolved the bucket default with a hard-coded "no explicit SSE-C" flag, so the default was layered onto the request and then tripped the request's own mutual-exclusion check; an SSE-C request now suppresses the bucket default on all three write paths, matching COPY and AWS S3. Every bucket with default encryption previously refused SSE-C single PUTs outright, while `CreateMultipartUpload` on the same bucket succeeded.
|
||||
- **Explicit SSE-S3 on SSE-KMS-default buckets**: `x-amz-server-side-encryption: AES256` against a bucket whose default is `aws:kms` no longer fails with `400 InvalidArgument`. The bucket default's KMS key id was inherited independently of the effective algorithm, producing a self-contradictory `AES256` + key-id pair; the key id is now inherited only when the effective algorithm is `aws:kms`. `PutBucketEncryption` fills in a default key id automatically, so this affected nearly every SSE-KMS-default bucket.
|
||||
- **Restore of encrypted or compressed multipart objects (silent data corruption)**: restoring a multipart object from a remote tier addressed the tier in *plaintext* coordinates while the copy-back reads the *stored* representation. Every part received a misaligned slice of the remote object whose length still satisfied the range, the hash reader and the completion size check, so the restore reported success and replaced the object's bytes. Restore now accumulates stored part sizes, passes the stored length to the hash reader alongside the plaintext length, and validates against the stored size. Objects restored by an affected release must be re-restored from the tier or recovered from a backup — this release does not detect or repair them retroactively.
|
||||
- **Restore no longer drifts the object ETag**: the copy-back digests stored (encrypted or compressed) bytes, so the recomputed MD5 is not the object's public ETag. Single-part and multipart restores now preserve the original object ETag, and each restored part keeps its own recorded part ETag.
|
||||
- **ILM archive no longer forwards encryption metadata to the tier**: transition requests carried the object's SSE headers and the RustFS-wrapped data key as request headers. Any S3 target rejected an SSE-C archive outright (`400`, no key supplied), an SSE-KMS archive asked the target to encrypt a second time under a key id it does not own, and the wrapped DEK left the cluster. The archive request now strips every SSE header and encryption marker using the same predicate the replication path uses; the local `xl.meta` keeps all of it, so read-through and restore are unaffected.
|
||||
- **KMS reload is no longer a no-op on a node whose KMS failed to start**: `POST /rustfs/admin/v3/kms/reload` short-circuited whenever the persisted configuration matched the in-memory one byte for byte. A node whose KMS failed to start (for example Vault briefly unreachable during a rolling restart) keeps that configuration and sits in `Error`, so the documented recovery call returned "reloaded successfully" while leaving the node down — and did the same on every peer through the reload broadcast. Reload now short-circuits only for a service that is actually running, and otherwise reconfigures, which starts the service.
|
||||
- **AWS KMS capability reporting**: the AWS backend no longer advertises `versioning` support through `GET /rustfs/admin/v3/kms/status`. AWS KMS key versions are not enumerable through this backend, as the backend documentation already stated.
|
||||
- **Multipart admission queue**: an `UploadPart` waiting for a foreground write permit now waits at most 10 s by default (`RUSTFS_PUT_MULTIPART_FOREGROUND_ADMISSION_WAIT_TIMEOUT_MS`, previously 30 s), so a queued part returns S3 `SlowDown` before the client's socket write timeout drops the connection. Separately, the API listener no longer forces a 4 MiB `SO_RCVBUF` on every accepted socket (kernel autotuning applies; `RUSTFS_HTTP_SOCKET_RECV_BUFFER_BYTES` restores a fixed size), so a queued part no longer lets up to 8 MiB of unread body accumulate in kernel memory per connection, which is what throttled whole nodes under SDK-default multipart concurrency. Fixes #7385.
|
||||
- **Helm Ingress**: `customAnnotations` are now merged with class-specific annotations (nginx/traefik) instead of being ignored when `ingress.className` is set.
|
||||
- **Per-pool erasure parity**: Erasure parity (STANDARD and reduced-redundancy) is now resolved independently for every pool instead of reusing the first pool's value. A heterogeneous topology — for example a 4-drive pool plus a 2-drive pool created during expansion — previously inherited the first pool's parity and could resolve to zero data shards in the smaller pool, panicking Reed-Solomon construction on write. Automatic parity now resolves per pool (for example `2+2` in the 4-drive pool and `1+1` in the 2-drive pool). Fixes #4801.
|
||||
@@ -72,18 +52,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
||||
- Four-layer regression-prevention tests guard against silent feature deletion: compile-time module assertion, module-presence unit test, cross-module `Protocol` enum assertion, end-to-end SSH banner test against the running binary
|
||||
|
||||
### Changed
|
||||
- **Encryption and KMS work merged since `1.0.0-rc.5`** (entries were missing from this section):
|
||||
- **Persisted KMS configuration secrets** are sealed field-by-field with `RUSTFS_KMS_CONFIG_SECRET`. **When the variable is unset the secrets are persisted in cleartext and the server only warns** (`persisted KMS configuration carries cleartext secrets`); it never refuses the write. Set it, identically, on every node, and re-save the configuration to seal an existing one.
|
||||
- **New v2 ciphertext frame format** with per-frame index binding and final-frame authentication. Its write switch `RUSTFS_ENCRYPTION_FRAME_V2` is **off by default**: v2 frames are unreadable by nodes without v2 read support, and encrypted ciphertext travels verbatim through transition, decommission and SSE-C replication passthrough, so turn it on only after every node — and every RustFS warm/replication target that receives raw ciphertext — runs a release with v2 read support. Reading v2 objects needs no switch.
|
||||
- **Per-key SSE-KMS authorization** (`RUSTFS_KMS_ENFORCE_SSE_KEY_POLICY`, default `false`). With it on, anonymous callers hold no KMS grants, so **a public bucket serving SSE-KMS objects is an incompatible combination** and those reads return `AccessDenied`.
|
||||
- Envelope context binding as KMS AAD (`ENV_KMS_ENVELOPE_AAD`, off by default; a node that predates the field cannot open bound envelopes).
|
||||
- Vault custom CA and mutual TLS; object-level DEK rewrap plus a batch rekey admin API; a backend-locality runtime signal on `kms/status`.
|
||||
- Single-pass decryption for encrypted GET, and encrypted single-part closed-range seek — the latter is now **on by default** (`RUSTFS_ENCRYPTED_RANGE_SEEK`, default `true`; the switch remains as a kill switch).
|
||||
- **Vault static tokens are now tracked and renewed**: with `Token` authentication RustFS hard-coded "this token has no lease", so the renewal task never started and no remaining-TTL gauge was published. `vault token create` grants a 768-hour TTL by default, which turned a healthy-looking cluster into one where every KMS call returned 403 about a month later, with no self-healing short of a restart or reconfigure. RustFS now calls `auth/token/lookup-self` at login and adopts what Vault reports: a non-expiring token behaves exactly as before, an expiring renewable one is renewed at half TTL like the other auth methods, and an expiring non-renewable one logs `vault_static_token_not_renewable` and publishes its remaining TTL. The probe never fails the login: a token whose policy omits `lookup-self` (Vault's `default` policy grants it), or a Vault that is unreachable at that moment, logs `vault_static_token_lookup_failed` and falls back to the previous no-lease behaviour, so no deployment that works today stops working.
|
||||
- **SSE-C over a plaintext transport is reported**: AWS S3 and MinIO refuse an SSE-C request that did not arrive over TLS, because the customer key travels in a request header. RustFS accepted them on any transport and still does by default — flipping to a rejection inside a release window would break plaintext staging and test deployments. Each such request now increments `rustfs_ssec_plaintext_requests_total` and logs one `ssec_request_without_tls` warning per process, and `RUSTFS_SSE_C_REQUIRE_TLS=true` opts into the AWS `400` now. The default is expected to flip in a later release; confirm the counter reads zero first. The verdict is per connection: a TLS listener satisfies it, and so does an `https` protocol forwarded by a proxy the trusted-proxy configuration accepts.
|
||||
- **Local KMS backend on a distributed deployment says what actually breaks**: the backend keeps key material and its Argon2id salt on each node's own disk, so two nodes derive different keys from the same `master_key` and an object encrypted on one node cannot be decrypted on another — intermittent 500s behind a load balancer. Configuring it while the deployment is distributed now logs `kms_node_local_backend_in_distributed_deployment` and appends that consequence to the `kms/configure` response, instead of only the generic "development only" positioning warning. It remains a warning, not a gate.
|
||||
- **SSE-KMS is refused when no KMS is running (breaking)**: a write requesting `x-amz-server-side-encryption: aws:kms` on a node with no KMS service no longer succeeds. Earlier releases wrapped the data key with the node-local `RUSTFS_SSE_S3_MASTER_KEY` while still writing `aws:kms` and the requested key id into the object metadata — metadata that claimed a KMS protection the object never had, under a key that was never consulted. Such a request now returns `400 InvalidRequest` when KMS was never configured and `503` when a configured service is not running; the refusal is evaluated after the per-key authorization gate, so an unauthorized caller still receives `403 AccessDenied`. **Upgrade note:** a deployment that relied on this write succeeding will start receiving 4xx/503. Either configure a KMS, or request `AES256` and keep the documented SSE-S3 local-master-key fallback, which is unchanged. Objects already written this way remain readable.
|
||||
- **Legacy ciphertext nonce layouts are now locked per segment**: while decrypting a v1 segment, the reader locks onto whichever of the three historical nonce layouts decoded the segment's first non-zero-index frame and rejects any later frame that needs a different one. Because a frame encrypted at block index zero authenticates under the pre-`1.0.0-alpha.91` reused-part-nonce layout at any position, an attacker able to rewrite the underlying shards could previously replay it and have the forged plaintext returned with `200`. New `RUSTFS_ENCRYPTION_LEGACY_NONCE_FALLBACK` (default `true`) drops that third layout entirely when set to `false`, which closes the residual case of a stream built purely from repeats of frame zero. Turn it off only after migrating pre-alpha.91 encrypted objects (rewrite in place with CopyObject); see [KMS backend security properties](docs/operations/kms-backend-security.md) for what the v1 frame layout does and does not authenticate.
|
||||
- **HTTP Server Stack**: Integrated `KeystoneAuthLayer` middleware from `rustfs-keystone` crate into service stack (positioned after ReadinessGateLayer)
|
||||
- **Storage-class validation on startup (upgrade note)**: A persisted explicit storage class (`RUSTFS_STORAGE_CLASS_STANDARD` / `RUSTFS_STORAGE_CLASS_RRS`, for example `EC:2`) is now validated against the actual per-pool drive counts at startup and rejected when a pool cannot satisfy it. This is fail-closed and correct, but a cluster that persisted a storage class larger than a small or heterogeneous pool can hold (for example `EC:2` alongside a 2-drive pool), which earlier releases accepted and silently resolved to an invalid layout, will now refuse to start after upgrade. To recover, unset `RUSTFS_STORAGE_CLASS_STANDARD` so the server derives a valid per-pool default automatically, or set it to a value every pool can satisfy.
|
||||
- **IAMAuth**: Enhanced `get_secret_key()` to return empty secret for Keystone credentials (bypasses signature validation)
|
||||
|
||||
Generated
-1
@@ -10578,7 +10578,6 @@ dependencies = [
|
||||
"serde_json",
|
||||
"sha1 0.11.0",
|
||||
"sha2 0.11.0",
|
||||
"temp-env",
|
||||
"thiserror 2.0.20",
|
||||
"tokio",
|
||||
"tokio-test",
|
||||
|
||||
+8
-25
@@ -46,31 +46,14 @@ RustFS 是一个基于 Rust 构建的高性能分布式对象存储系统。Rust
|
||||
- **完全开源**：采用 Apache 2.0 许可证，鼓励社区贡献和商业使用。
|
||||
- **简单易用**：设计简洁，易于部署和管理。
|
||||
|
||||
状态说明：✅ 可用 —— 已发布并有 CI 门禁覆盖；🧪 预览 —— 已发布但需显式开关，或兼容性承诺有边界。
|
||||
|
||||
| 功能 | 状态 | 功能 | 状态 |
|
||||
| :-------------------------- | :------ | :----------------------- | :------ |
|
||||
| **S3 核心功能** | ✅ 可用 | **分布式模式** | ✅ 可用 |
|
||||
| **上传 / 下载** | ✅ 可用 | **单机模式** | ✅ 可用 |
|
||||
| **版本控制** | ✅ 可用 | **Bitrot (防数据腐烂)** | ✅ 可用 |
|
||||
| **对象锁定 (WORM)** | ✅ 可用 | **修复与扫描器** | ✅ 可用 |
|
||||
| **服务端加密 (SSE)** | ✅ 可用 | **存储池扩容 / 下线** | ✅ 可用 |
|
||||
| **RustFS KMS** | ✅ 可用 | **存储桶复制** | ✅ 可用 |
|
||||
| **生命周期管理 (ILM)** | ✅ 可用 | **站点复制** | ✅ 可用 |
|
||||
| **ILM 分层 (远端 S3)** | ✅ 可用 | **存储桶配额** | ✅ 可用 |
|
||||
| **S3 Select** | ✅ 可用 | **事件通知** | ✅ 可用 |
|
||||
| **S3 Tables (Iceberg REST)**| 🧪 预览 | **审计日志** | ✅ 可用 |
|
||||
| **IAM / 策略** | ✅ 可用 | **日志与可观测性** | ✅ 可用 |
|
||||
| **OIDC / SSO** | ✅ 可用 | **Web 控制台** | ✅ 可用 |
|
||||
| **Keystone 认证** | ✅ 可用 | **K8s Helm Chart** | ✅ 可用 |
|
||||
| **Swift API** | ✅ 可用 | **FTPS / WebDAV** | ✅ 可用 |
|
||||
| **多租户** | ✅ 可用 | **SFTP** | ✅ 可用 |
|
||||
| **MinIO 磁盘格式兼容** | 🧪 预览 | | |
|
||||
|
||||
说明：
|
||||
|
||||
- **服务端加密**：支持 SSE-C、SSE-S3 与 SSE-KMS。SSE-KMS 必须先配置 KMS 服务；未配置 KMS 时请求 `aws:kms` 会被拒绝，不会降级到本地主密钥。
|
||||
- **RustFS KMS**：生产环境支持 Vault（KV2 / Transit）与 AWS KMS 后端；`Local` 与 `Static` 后端仅供开发与测试使用，详见 [KMS 后端安全属性](docs/operations/kms-backend-security.md)。
|
||||
| 功能 | 状态 | 功能 | 状态 |
|
||||
| :----------------- | :------ | :---------------------- | :-------- |
|
||||
| **S3 核心功能** | ✅ 可用 | **Bitrot (防数据腐烂)** | ✅ 可用 |
|
||||
| **上传 / 下载** | ✅ 可用 | **单机模式** | ✅ 可用 |
|
||||
| **版本控制** | ✅ 可用 | **存储桶复制** | ✅ 可用 |
|
||||
| **日志功能** | ✅ 可用 | **生命周期管理** | 🚧 测试中 |
|
||||
| **事件通知** | ✅ 可用 | **分布式模式** | 🚧 测试中 |
|
||||
| **K8s Helm Chart** | ✅ 可用 | **OPA (策略引擎)** | 🚧 测试中 |
|
||||
|
||||
## RustFS vs MinIO 性能对比
|
||||
|
||||
|
||||
@@ -609,36 +609,6 @@ pub const ENV_OBJECT_LOCK_RPC_TIMEOUT_MS: &str = "RUSTFS_OBJECT_LOCK_RPC_TIMEOUT
|
||||
/// Default remote lock RPC transport timeout: 3000 milliseconds.
|
||||
pub const DEFAULT_OBJECT_LOCK_RPC_TIMEOUT_MS: u64 = 3000;
|
||||
|
||||
/// Environment variable for the minimum interval between evictions of the
|
||||
/// cached lock RPC channel to one peer, in milliseconds.
|
||||
///
|
||||
/// A lock RPC that fails on transport, or that times out while the peer has
|
||||
/// not completed any lock RPC for two deadlines, evicts the shared HTTP/2
|
||||
/// channel so the next request re-dials. Evictions are rate limited per peer
|
||||
/// so one slow lock endpoint cannot drive a reset/GOAWAY/reconnect loop
|
||||
/// (issue #7363). `0` disables the cooldown.
|
||||
///
|
||||
/// Default: 5000 milliseconds.
|
||||
pub const ENV_OBJECT_LOCK_RPC_EVICTION_COOLDOWN_MS: &str = "RUSTFS_OBJECT_LOCK_RPC_EVICTION_COOLDOWN_MS";
|
||||
|
||||
/// Default minimum interval between lock RPC channel evictions per peer: 5000 milliseconds.
|
||||
pub const DEFAULT_OBJECT_LOCK_RPC_EVICTION_COOLDOWN_MS: u64 = 5000;
|
||||
|
||||
/// Environment variable for how many timed-out lock RPCs per peer may keep
|
||||
/// running in the background instead of being cancelled.
|
||||
///
|
||||
/// Cancelling a timed-out stream sends `RST_STREAM`; enough of them make the
|
||||
/// peer answer `GOAWAY too_many_resets` and drop every stream on the
|
||||
/// connection. A detached RPC ends on its own within the internode RPC
|
||||
/// timeout, and a lock it acquires after its caller gave up is released
|
||||
/// immediately. Beyond this budget timed-out RPCs are cancelled as before.
|
||||
///
|
||||
/// Default: 256.
|
||||
pub const ENV_OBJECT_LOCK_RPC_DETACHED_LIMIT: &str = "RUSTFS_OBJECT_LOCK_RPC_DETACHED_LIMIT";
|
||||
|
||||
/// Default per-peer budget of detached (timed-out but still running) lock RPCs: 256.
|
||||
pub const DEFAULT_OBJECT_LOCK_RPC_DETACHED_LIMIT: usize = 256;
|
||||
|
||||
/// Environment variable to enable object namespace lock diagnostics.
|
||||
///
|
||||
/// When enabled, RustFS emits slow lock acquisition and long lock hold
|
||||
|
||||
@@ -51,7 +51,7 @@ fn main() {
|
||||
}
|
||||
}
|
||||
let revision = git(&root, &["rev-parse", "HEAD"]).unwrap_or_else(|| "unknown".to_owned());
|
||||
let dirty = git(&root, &["status", "--porcelain", "--untracked-files=no"]).is_none_or(|status| !status.is_empty());
|
||||
let dirty = git(&root, &["status", "--porcelain", "--untracked-files=normal"]).is_none_or(|status| !status.is_empty());
|
||||
let lock = git(&root, &["hash-object", "Cargo.lock"]).unwrap_or_else(|| "unknown".to_owned());
|
||||
let mut features = std::env::vars()
|
||||
.filter_map(|(key, _)| {
|
||||
|
||||
@@ -188,15 +188,6 @@ fn write_next_test_port(port: u16) -> Result<(), Box<dyn std::error::Error + Sen
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn no_available_test_port_error(config: TestPortAllocatorConfig, attempts: u16, last_error: Option<&std::io::Error>) -> String {
|
||||
let max_inclusive = config.max_exclusive() - 1;
|
||||
let detail = last_error.map(|err| format!("; last bind error: {err}")).unwrap_or_default();
|
||||
format!(
|
||||
"no available E2E test port found in {}..={} after {} attempts{}",
|
||||
config.min, max_inclusive, attempts, detail
|
||||
)
|
||||
}
|
||||
|
||||
pub(crate) fn capture_command_logs(
|
||||
command: &mut Command,
|
||||
log_path: Option<&str>,
|
||||
@@ -703,23 +694,19 @@ impl RustFSTestEnvironment {
|
||||
let _guard = PortAllocatorGuard::acquire().await?;
|
||||
let config = test_port_allocator_config()?;
|
||||
let mut next_port = read_next_test_port(config);
|
||||
let mut last_error = None;
|
||||
|
||||
for _ in 0..config.range {
|
||||
let port = next_port;
|
||||
next_port = advance_test_port(next_port, config);
|
||||
write_next_test_port(next_port)?;
|
||||
|
||||
match TcpListener::bind(("127.0.0.1", port)) {
|
||||
Ok(listener) => {
|
||||
drop(listener);
|
||||
return Ok(port);
|
||||
}
|
||||
Err(err) => last_error = Some(err),
|
||||
if let Ok(listener) = TcpListener::bind(("127.0.0.1", port)) {
|
||||
drop(listener);
|
||||
return Ok(port);
|
||||
}
|
||||
}
|
||||
|
||||
Err(no_available_test_port_error(config, config.range, last_error.as_ref()).into())
|
||||
Err("no available E2E test port found".into())
|
||||
}
|
||||
|
||||
/// Kill any existing RustFS processes
|
||||
@@ -2214,19 +2201,6 @@ mod tests {
|
||||
assert!(parse_test_port_allocator_config(Some("not-a-port"), Some("128")).is_err());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn e2e_port_allocator_reports_attempt_window_and_last_bind_error() {
|
||||
let config = TestPortAllocatorConfig { min: 41000, range: 3 };
|
||||
let error = std::io::Error::from(ErrorKind::PermissionDenied);
|
||||
|
||||
let message = no_available_test_port_error(config, config.range, Some(&error));
|
||||
|
||||
assert!(message.contains("41000..=41002"));
|
||||
assert!(message.contains("after 3 attempts"));
|
||||
assert!(message.contains("last bind error"));
|
||||
assert!(message.contains("permission denied"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn resolves_rustfs_binary_in_configured_cargo_target_directory() {
|
||||
let workspace = Path::new("workspace");
|
||||
|
||||
@@ -26,7 +26,6 @@ use std::collections::{BTreeMap, HashSet};
|
||||
use std::io::{Read, Write};
|
||||
use std::path::{Path, PathBuf};
|
||||
use std::time::Duration;
|
||||
use tokio::time::{Instant, sleep};
|
||||
|
||||
const EC84_NODE_COUNT: usize = 3;
|
||||
const EC84_DRIVES_PER_NODE: usize = 4;
|
||||
@@ -34,8 +33,6 @@ const EC84_DATA_BLOCKS: usize = 8;
|
||||
const EC84_PARITY_BLOCKS: usize = 4;
|
||||
const EC84_TARGET_DRIVE_RESTART_CASE: &str = "ec84-target-drive-restart";
|
||||
const EC84_TARGET_DRIVE_RESTART_ORACLE: &str = "ec84-target-drive-restart.json";
|
||||
const EC84_HEAL_CONTROL_READY_TIMEOUT: Duration = Duration::from_secs(45);
|
||||
const EC84_HEAL_CONTROL_RETRY_DELAY: Duration = Duration::from_millis(250);
|
||||
|
||||
#[derive(Clone)]
|
||||
struct ExpectedShard {
|
||||
@@ -49,18 +46,6 @@ struct ScannerHealEvidenceContext {
|
||||
run: Value,
|
||||
}
|
||||
|
||||
struct ScannerHealEvidencePayload<'a> {
|
||||
dist: &'a DistCluster,
|
||||
bucket: &'a str,
|
||||
expected: &'a [ExpectedShard],
|
||||
outage_key: &'a str,
|
||||
outage_body: &'a [u8],
|
||||
replaced_drive: &'a Path,
|
||||
pid_before: u32,
|
||||
pid_after: u32,
|
||||
node_listings: Vec<Vec<String>>,
|
||||
}
|
||||
|
||||
fn file_sha256(path: &Path) -> TestResult<String> {
|
||||
let mut file = std::fs::File::open(path)?;
|
||||
let mut digest = Sha256::new();
|
||||
@@ -145,12 +130,23 @@ fn assert_ec84_geometry(census: &VersionShardCensus, key: &str) -> TestResult {
|
||||
Ok(())
|
||||
}
|
||||
|
||||
async fn write_scanner_heal_evidence(context: ScannerHealEvidenceContext, payload: ScannerHealEvidencePayload<'_>) -> TestResult {
|
||||
let verifier = payload.dist.client(0)?;
|
||||
async fn write_scanner_heal_evidence(
|
||||
context: ScannerHealEvidenceContext,
|
||||
dist: &DistCluster,
|
||||
bucket: &str,
|
||||
expected: &[ExpectedShard],
|
||||
outage_key: &str,
|
||||
outage_body: &[u8],
|
||||
replaced_drive: &Path,
|
||||
pid_before: u32,
|
||||
pid_after: u32,
|
||||
node_listings: Vec<Vec<String>>,
|
||||
) -> TestResult {
|
||||
let verifier = dist.client(0)?;
|
||||
let mut objects = Vec::new();
|
||||
for item in payload.expected {
|
||||
let actual = get_object_bytes(&verifier, payload.bucket, &item.key).await?;
|
||||
let physical = census_object_version_on_disk(payload.replaced_drive, payload.bucket, &item.key, None)?;
|
||||
for item in expected {
|
||||
let actual = get_object_bytes(&verifier, bucket, &item.key).await?;
|
||||
let physical = census_object_version_on_disk(replaced_drive, bucket, &item.key, None)?;
|
||||
objects.push(serde_json::json!({
|
||||
"key": item.key,
|
||||
"version_id": null,
|
||||
@@ -162,14 +158,14 @@ async fn write_scanner_heal_evidence(context: ScannerHealEvidenceContext, payloa
|
||||
"physical": physical,
|
||||
}));
|
||||
}
|
||||
let actual = get_object_bytes(&verifier, payload.bucket, payload.outage_key).await?;
|
||||
let physical = census_object_version_on_disk(payload.replaced_drive, payload.bucket, payload.outage_key, None)?;
|
||||
let actual = get_object_bytes(&verifier, bucket, outage_key).await?;
|
||||
let physical = census_object_version_on_disk(replaced_drive, bucket, outage_key, None)?;
|
||||
objects.push(serde_json::json!({
|
||||
"key": payload.outage_key,
|
||||
"key": outage_key,
|
||||
"version_id": null,
|
||||
"expected_bytes": payload.outage_body.len(),
|
||||
"expected_bytes": outage_body.len(),
|
||||
"actual_bytes": actual.len(),
|
||||
"expected_sha256": sha256_hex(payload.outage_body),
|
||||
"expected_sha256": sha256_hex(outage_body),
|
||||
"actual_sha256": sha256_hex(&actual),
|
||||
"expected_physical": null,
|
||||
"physical": physical,
|
||||
@@ -185,11 +181,11 @@ async fn write_scanner_heal_evidence(context: ScannerHealEvidenceContext, payloa
|
||||
"binary_sha256": string_field(&context.run, "binary.sha256")?,
|
||||
"test_binary_sha256": string_field(&context.run, "test_binary.sha256")?,
|
||||
"topology": {"nodes": EC84_NODE_COUNT, "drives_per_node": EC84_DRIVES_PER_NODE},
|
||||
"pid_before": payload.pid_before,
|
||||
"pid_after": payload.pid_after,
|
||||
"pid_before": pid_before,
|
||||
"pid_after": pid_after,
|
||||
"unclean_shutdown_marker": false,
|
||||
"objects": objects,
|
||||
"node_listings": payload.node_listings,
|
||||
"node_listings": node_listings,
|
||||
});
|
||||
let data = serde_json::to_vec(&evidence)?;
|
||||
if data.len() > 1024 * 1024 {
|
||||
@@ -214,29 +210,6 @@ fn assert_replaced_drive_empty(drive: &Path, bucket: &str, keys: &[String]) -> T
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn is_cluster_heal_coordination_unavailable(error: &(dyn std::error::Error + Send + Sync)) -> bool {
|
||||
let message = error.to_string();
|
||||
message.contains("500 Internal Server Error") && message.contains("cluster heal coordination unavailable")
|
||||
}
|
||||
|
||||
async fn start_ec84_root_heal_when_control_ready(
|
||||
heal_url: &str,
|
||||
heal_body: &str,
|
||||
access_key: &str,
|
||||
secret_key: &str,
|
||||
) -> TestResult {
|
||||
let deadline = Instant::now() + EC84_HEAL_CONTROL_READY_TIMEOUT;
|
||||
loop {
|
||||
match signed_admin_post(heal_url, Some(heal_body), access_key, secret_key).await {
|
||||
Ok(_) => return Ok(()),
|
||||
Err(error) if is_cluster_heal_coordination_unavailable(error.as_ref()) && Instant::now() < deadline => {
|
||||
sleep(EC84_HEAL_CONTROL_RETRY_DELAY).await;
|
||||
}
|
||||
Err(error) => return Err(error),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
async fn put_large_inventory(client: &Client, bucket: &str) -> TestResult<Vec<ExpectedShard>> {
|
||||
let mut expected = Vec::new();
|
||||
for index in 0..4 {
|
||||
@@ -330,7 +303,7 @@ async fn three_node_four_drive_ec8_4_root_heal_rebuilds_replaced_drive_after_res
|
||||
let heal_body =
|
||||
r#"{"recursive":true,"dryRun":false,"remove":false,"recreate":true,"scanMode":2,"updateParity":false,"nolock":false}"#;
|
||||
let heal_url = format!("{}/rustfs/admin/v3/heal/{bucket}?forceStart=true", dist.cluster.nodes[0].url);
|
||||
start_ec84_root_heal_when_control_ready(&heal_url, heal_body, &dist.cluster.access_key, &dist.cluster.secret_key).await?;
|
||||
signed_admin_post(&heal_url, Some(heal_body), &dist.cluster.access_key, &dist.cluster.secret_key).await?;
|
||||
|
||||
wait_until(
|
||||
Duration::from_secs(120),
|
||||
@@ -374,40 +347,18 @@ async fn three_node_four_drive_ec8_4_root_heal_rebuilds_replaced_drive_after_res
|
||||
if let Some(context) = evidence_context {
|
||||
write_scanner_heal_evidence(
|
||||
context,
|
||||
ScannerHealEvidencePayload {
|
||||
dist: &dist,
|
||||
bucket: &bucket,
|
||||
expected: &expected,
|
||||
outage_key,
|
||||
outage_body: &outage_body,
|
||||
replaced_drive: &replaced_drive,
|
||||
pid_before: target_pid_before,
|
||||
pid_after: target_pid_after,
|
||||
node_listings,
|
||||
},
|
||||
&dist,
|
||||
&bucket,
|
||||
&expected,
|
||||
outage_key,
|
||||
&outage_body,
|
||||
&replaced_drive,
|
||||
target_pid_before,
|
||||
target_pid_after,
|
||||
node_listings,
|
||||
)
|
||||
.await?;
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn cluster_heal_coordination_retry_is_exact() {
|
||||
let retryable: Box<dyn std::error::Error + Send + Sync> =
|
||||
"admin POST failed: 500 Internal Server Error cluster heal coordination unavailable".into();
|
||||
assert!(is_cluster_heal_coordination_unavailable(retryable.as_ref()));
|
||||
|
||||
let other_internal: Box<dyn std::error::Error + Send + Sync> =
|
||||
"admin POST failed: 500 Internal Server Error unrelated".into();
|
||||
assert!(!is_cluster_heal_coordination_unavailable(other_internal.as_ref()));
|
||||
|
||||
let wrong_status: Box<dyn std::error::Error + Send + Sync> =
|
||||
"admin POST failed: 503 Service Unavailable cluster heal coordination unavailable".into();
|
||||
assert!(!is_cluster_heal_coordination_unavailable(wrong_status.as_ref()));
|
||||
}
|
||||
}
|
||||
|
||||
@@ -2234,6 +2234,7 @@ async fn four_node_manual_transition_distributed_admission_conflict_reports_stat
|
||||
let bucket = format!("distributed-admission-{}", Uuid::new_v4().simple());
|
||||
let prefix = "transition/distributed-admission/";
|
||||
hot_client.create_bucket().bucket(&bucket).send().await?;
|
||||
put_lifecycle_with_transition_retry(&hot_client, &bucket, &tier_name).await?;
|
||||
for index in 0u8..64 {
|
||||
let key = format!("{prefix}object-{index:02}.bin");
|
||||
hot_client
|
||||
@@ -2244,7 +2245,6 @@ async fn four_node_manual_transition_distributed_admission_conflict_reports_stat
|
||||
.send()
|
||||
.await?;
|
||||
}
|
||||
put_lifecycle_with_transition_retry(&hot_client, &bucket, &tier_name).await?;
|
||||
|
||||
let (node0, node1) = tokio::join!(
|
||||
start_manual_transition_job_on_node(&hot, 0, &bucket, prefix, &tier_name, false, 64),
|
||||
|
||||
@@ -59,36 +59,6 @@ async fn test_kms_key_directory_unavailable() -> Result<(), Box<dyn std::error::
|
||||
|
||||
assert_eq!(put_response.server_side_encryption(), Some(&ServerSideEncryption::Aes256));
|
||||
|
||||
// A missing key in the healthy store is a client error, unlike a store outage.
|
||||
let missing_key_object = "test-missing-kms-key";
|
||||
let missing_key_error = s3_client
|
||||
.put_object()
|
||||
.bucket(TEST_BUCKET)
|
||||
.key(missing_key_object)
|
||||
.body(aws_sdk_s3::primitives::ByteStream::from_static(b"must not be published"))
|
||||
.server_side_encryption(ServerSideEncryption::AwsKms)
|
||||
.ssekms_key_id("rustfs-e2e-test-missing-key")
|
||||
.send()
|
||||
.await
|
||||
.expect_err("an unknown key in a healthy Local KMS store must reject the write");
|
||||
assert_eq!(missing_key_error.raw_response().map(|response| response.status().as_u16()), Some(400));
|
||||
assert_eq!(
|
||||
missing_key_error.as_service_error().and_then(ProvideErrorMetadata::code),
|
||||
Some("KMS.NotFoundException")
|
||||
);
|
||||
let missing_key_absence = s3_client
|
||||
.get_object()
|
||||
.bucket(TEST_BUCKET)
|
||||
.key(missing_key_object)
|
||||
.send()
|
||||
.await
|
||||
.expect_err("a write rejected by a missing KMS key must not publish an object");
|
||||
assert_eq!(missing_key_absence.raw_response().map(|response| response.status().as_u16()), Some(404));
|
||||
assert_eq!(
|
||||
missing_key_absence.as_service_error().and_then(ProvideErrorMetadata::code),
|
||||
Some("NoSuchKey")
|
||||
);
|
||||
|
||||
// Temporarily rename the key directory to simulate unavailability
|
||||
info!("🔧 Simulating key directory unavailability");
|
||||
let backup_dir = format!("{}.backup", kms_env.kms_keys_dir);
|
||||
|
||||
@@ -1137,12 +1137,7 @@ async fn test_odm_admin_config_is_redacted_and_status_counts_match_the_source()
|
||||
let miss = env.raw_get(bucket, miss_key).await?;
|
||||
assert_eq!(miss.status, 404, "{}", String::from_utf8_lossy(&miss.body));
|
||||
}
|
||||
let (listed, _, _) = tokio::try_join!(
|
||||
env.wait_local_listed(bucket, hit_key, SETTLE),
|
||||
env.wait_for_status_counter(bucket, "/counters/pulled_objects_total/inline", 1, SETTLE),
|
||||
env.wait_for_status_counter(bucket, "/counters/pulled_bytes_total", body.len() as u64, SETTLE),
|
||||
)?;
|
||||
assert!(listed);
|
||||
assert!(env.wait_local_listed(bucket, hit_key, SETTLE).await?);
|
||||
|
||||
let status = env.status_json(bucket).await?;
|
||||
assert_eq!(status.pointer("/configured").and_then(Value::as_bool), Some(true), "{status}");
|
||||
|
||||
@@ -4235,16 +4235,6 @@ async fn test_bucket_replication_acceptance_matrix_local_dual_targets() -> TestR
|
||||
<ExistingObjectReplication><Status>Enabled</Status></ExistingObjectReplication>
|
||||
<Destination><Bucket>{target_b_arn}</Bucket></Destination>
|
||||
</Rule>
|
||||
<Rule>
|
||||
<ID>matrix-and-tags</ID>
|
||||
<Priority>135</Priority>
|
||||
<Status>Enabled</Status>
|
||||
<Filter><And><Prefix>and-tags/</Prefix><Tag><Key>env</Key><Value>prod</Value></Tag><Tag><Key>tier</Key><Value>gold</Value></Tag></And></Filter>
|
||||
<DeleteMarkerReplication><Status>Disabled</Status></DeleteMarkerReplication>
|
||||
<DeleteReplication><Status>Enabled</Status></DeleteReplication>
|
||||
<ExistingObjectReplication><Status>Enabled</Status></ExistingObjectReplication>
|
||||
<Destination><Bucket>{target_b_arn}</Bucket></Destination>
|
||||
</Rule>
|
||||
<Rule>
|
||||
<ID>matrix-disabled</ID>
|
||||
<Priority>140</Priority>
|
||||
@@ -4299,7 +4289,6 @@ async fn test_bucket_replication_acceptance_matrix_local_dual_targets() -> TestR
|
||||
"matrix-prefix",
|
||||
"matrix-tag",
|
||||
"matrix-disabled",
|
||||
"matrix-and-tags",
|
||||
"matrix-priority-high",
|
||||
"Priority>200",
|
||||
"<Status>Disabled</Status>",
|
||||
@@ -4420,30 +4409,6 @@ async fn test_bucket_replication_acceptance_matrix_local_dual_targets() -> TestR
|
||||
put_single_tag_current(&source_client, source_bucket, "tagged/no-match.txt", "route", "tagged").await?;
|
||||
assert_replication_key_absent(&target_client_b, target_bucket_b, "tagged/no-match.txt", Duration::from_secs(3)).await?;
|
||||
|
||||
// S3 and MinIO both read `And.Tags` as AND: an object carrying only one of
|
||||
// the required tags is not admitted. Matching any single tag would push
|
||||
// data to a destination the rule never selected (backlog#2366 P1-1), and
|
||||
// the two-tag rule is the shape `mc replicate add --tags "k1=v1&k2=v2"`
|
||||
// writes, so a single-tag rule passing is not evidence for this.
|
||||
source_client
|
||||
.put_object()
|
||||
.bucket(source_bucket)
|
||||
.key("and-tags/partial.txt")
|
||||
.tagging("env=prod")
|
||||
.body(ByteStream::from_static(b"one of two tags"))
|
||||
.send()
|
||||
.await?;
|
||||
assert_replication_key_absent(&target_client_b, target_bucket_b, "and-tags/partial.txt", Duration::from_secs(3)).await?;
|
||||
source_client
|
||||
.put_object()
|
||||
.bucket(source_bucket)
|
||||
.key("and-tags/full.txt")
|
||||
.tagging("env=prod&tier=gold")
|
||||
.body(ByteStream::from_static(b"both tags"))
|
||||
.send()
|
||||
.await?;
|
||||
wait_for_user_get_object(&target_client_b, target_bucket_b, "and-tags/full.txt").await?;
|
||||
|
||||
source_client
|
||||
.put_object()
|
||||
.bucket(source_bucket)
|
||||
|
||||
@@ -32,10 +32,8 @@ use aws_sdk_s3::types::{
|
||||
VersioningConfiguration,
|
||||
};
|
||||
use http::{Method, StatusCode};
|
||||
use serde_json::Value;
|
||||
use std::io::Write;
|
||||
use std::path::{Path, PathBuf};
|
||||
use std::time::{Duration, SystemTime, UNIX_EPOCH};
|
||||
use std::time::Duration;
|
||||
use tokio::task::JoinSet;
|
||||
use tokio::time::{Instant, sleep};
|
||||
|
||||
@@ -43,7 +41,6 @@ type TestResult = Result<(), Box<dyn std::error::Error + Send + Sync>>;
|
||||
type BoxError = Box<dyn std::error::Error + Send + Sync>;
|
||||
|
||||
const SOURCE_BINARY_ENV: &str = "RUSTFS_UPGRADE_SOURCE_BINARY";
|
||||
const G09_EVIDENCE_DIR_ENV: &str = "RUSTFS_SCANNER_HEAL_G09_EVIDENCE_DIR";
|
||||
const RC5_COMMIT: &str = "40a2470feb567201165a5b809b7598bb4b1f68f5";
|
||||
const SSE_MASTER_KEY_ENV: &str = "RUSTFS_SSE_S3_MASTER_KEY";
|
||||
const SSE_MASTER_KEY: &str = "QkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkI=";
|
||||
@@ -84,14 +81,6 @@ const QUOTA_READINESS_TIMEOUT: Duration = Duration::from_secs(30);
|
||||
// of treating it as an upgrade failure.
|
||||
const QUOTA_ADMISSION_WARMUP_TIMEOUT: Duration = Duration::from_secs(90);
|
||||
|
||||
struct G09EvidenceContext {
|
||||
directory: PathBuf,
|
||||
current_revision: String,
|
||||
previous_revision: String,
|
||||
run_id: String,
|
||||
measurement_window_id: String,
|
||||
}
|
||||
|
||||
fn source_binary() -> Result<PathBuf, Box<dyn std::error::Error + Send + Sync>> {
|
||||
let path = std::env::var_os(SOURCE_BINARY_ENV)
|
||||
.map(PathBuf::from)
|
||||
@@ -102,155 +91,6 @@ fn source_binary() -> Result<PathBuf, Box<dyn std::error::Error + Send + Sync>>
|
||||
Ok(path)
|
||||
}
|
||||
|
||||
fn is_lower_hex_revision(value: &str) -> bool {
|
||||
value.len() == 40
|
||||
&& value
|
||||
.bytes()
|
||||
.all(|byte| byte.is_ascii_hexdigit() && !byte.is_ascii_uppercase())
|
||||
}
|
||||
|
||||
fn current_source_revision() -> Result<String, BoxError> {
|
||||
let revision = env!("RUSTFS_E2E_BUILD_COMMIT");
|
||||
if !is_lower_hex_revision(revision) {
|
||||
return Err(format!("current test binary has invalid source revision {revision}").into());
|
||||
}
|
||||
Ok(revision.to_string())
|
||||
}
|
||||
|
||||
async fn binary_source_revision(binary: &Path) -> Result<String, BoxError> {
|
||||
let output = tokio::process::Command::new(binary).arg("--version").output().await?;
|
||||
if !output.status.success() {
|
||||
return Err(format!("{} --version failed with {}", binary.display(), output.status).into());
|
||||
}
|
||||
let version = String::from_utf8(output.stdout)?;
|
||||
source_revision_from_version_output(&version, binary)
|
||||
}
|
||||
|
||||
fn source_revision_from_version_output(version: &str, binary: &Path) -> Result<String, BoxError> {
|
||||
version
|
||||
.split(|ch: char| !ch.is_ascii_hexdigit())
|
||||
.find(|token| is_lower_hex_revision(token))
|
||||
.map(str::to_string)
|
||||
.ok_or_else(|| format!("{} --version did not expose a 40-byte source revision", binary.display()).into())
|
||||
}
|
||||
|
||||
async fn g09_evidence_context(previous_binary: &Path) -> Result<Option<G09EvidenceContext>, BoxError> {
|
||||
let Some(directory) = std::env::var_os(G09_EVIDENCE_DIR_ENV) else {
|
||||
return Ok(None);
|
||||
};
|
||||
let directory = PathBuf::from(directory);
|
||||
std::fs::create_dir_all(&directory)?;
|
||||
let current_revision = current_source_revision()?;
|
||||
let previous_revision = binary_source_revision(previous_binary).await?;
|
||||
if current_revision == previous_revision {
|
||||
return Err("G09 mixed-version evidence requires distinct current and previous source revisions".into());
|
||||
}
|
||||
let now = SystemTime::now().duration_since(UNIX_EPOCH)?.as_nanos();
|
||||
Ok(Some(G09EvidenceContext {
|
||||
directory,
|
||||
current_revision,
|
||||
previous_revision,
|
||||
run_id: format!("g09-upgrade-{}-{now}", std::process::id()),
|
||||
measurement_window_id: format!("g09-mixed-version-window-{now}"),
|
||||
}))
|
||||
}
|
||||
|
||||
fn write_g09_evidence(
|
||||
context: &G09EvidenceContext,
|
||||
field: &str,
|
||||
role: &str,
|
||||
cases: &[&str],
|
||||
test: &str,
|
||||
details: Value,
|
||||
) -> TestResult {
|
||||
let path = context.directory.join(format!("G09-{field}.json"));
|
||||
let mut evidence = serde_json::json!({
|
||||
"schema": 1,
|
||||
"evidence_type": "measured",
|
||||
"artifact_kind": "upgrade-compatibility-e2e",
|
||||
"source_revision": context.current_revision,
|
||||
"run_id": context.run_id,
|
||||
"measurement_window_id": context.measurement_window_id,
|
||||
"gate": "G09",
|
||||
"field": field,
|
||||
"versions": [context.previous_revision, context.current_revision],
|
||||
"current_revision": context.current_revision,
|
||||
"previous_revision": context.previous_revision,
|
||||
"mixed_version_role": role,
|
||||
"mixed_version_cases": cases,
|
||||
"test": test,
|
||||
"details": details,
|
||||
});
|
||||
if field == "rollback_payload_evidence" {
|
||||
evidence["rollback_payload_replayed"] = Value::Bool(true);
|
||||
}
|
||||
let data = serde_json::to_vec_pretty(&evidence)?;
|
||||
if data.len() > 1024 * 1024 {
|
||||
return Err("G09 mixed-version evidence exceeds the 1 MiB artifact budget".into());
|
||||
}
|
||||
let mut output = std::fs::OpenOptions::new().write(true).create_new(true).open(path)?;
|
||||
output.write_all(&data)?;
|
||||
output.write_all(b"\n")?;
|
||||
output.sync_all()?;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod g09_evidence_tests {
|
||||
use super::*;
|
||||
use tempfile::TempDir;
|
||||
|
||||
#[test]
|
||||
fn source_revision_parser_requires_lowercase_forty_byte_sha() -> TestResult {
|
||||
let binary = Path::new("rustfs");
|
||||
assert_eq!(
|
||||
source_revision_from_version_output("rustfs 1.0.0 abcdef0123456789abcdef0123456789abcdef01 clean", binary)?,
|
||||
"abcdef0123456789abcdef0123456789abcdef01"
|
||||
);
|
||||
assert!(source_revision_from_version_output("rustfs ABCDEF0123456789ABCDEF0123456789ABCDEF01", binary).is_err());
|
||||
assert!(source_revision_from_version_output("rustfs abcdef", binary).is_err());
|
||||
Ok(())
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn g09_evidence_writer_records_measured_role_and_refuses_overwrite() -> TestResult {
|
||||
let directory = TempDir::new()?;
|
||||
let context = G09EvidenceContext {
|
||||
directory: directory.path().to_path_buf(),
|
||||
current_revision: "b".repeat(40),
|
||||
previous_revision: "a".repeat(40),
|
||||
run_id: "g09-upgrade-test-run".to_string(),
|
||||
measurement_window_id: "g09-upgrade-test-window".to_string(),
|
||||
};
|
||||
write_g09_evidence(
|
||||
&context,
|
||||
"mixed_version_reader_evidence",
|
||||
"mixed-version-reader",
|
||||
&["old-writer-new-reader", "new-writer-old-reader"],
|
||||
"unit",
|
||||
serde_json::json!({"assertions": ["reader evidence"]}),
|
||||
)?;
|
||||
let path = directory.path().join("G09-mixed_version_reader_evidence.json");
|
||||
let evidence: Value = serde_json::from_slice(&std::fs::read(path)?)?;
|
||||
assert_eq!(evidence["evidence_type"], "measured");
|
||||
assert_eq!(evidence["gate"], "G09");
|
||||
assert_eq!(evidence["field"], "mixed_version_reader_evidence");
|
||||
assert_eq!(evidence["mixed_version_role"], "mixed-version-reader");
|
||||
assert_eq!(evidence["versions"], serde_json::json!(["a".repeat(40), "b".repeat(40)]));
|
||||
|
||||
let overwrite = write_g09_evidence(
|
||||
&context,
|
||||
"mixed_version_reader_evidence",
|
||||
"mixed-version-reader",
|
||||
&["old-writer-new-reader", "new-writer-old-reader"],
|
||||
"unit",
|
||||
serde_json::json!({}),
|
||||
);
|
||||
assert!(overwrite.is_err(), "G09 evidence must not overwrite an existing artifact");
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
|
||||
async fn enable_versioning(client: &Client, bucket: &str) -> TestResult {
|
||||
let configuration = VersioningConfiguration::builder()
|
||||
.status(BucketVersioningStatus::Enabled)
|
||||
@@ -683,7 +523,6 @@ async fn direct_upgrade_from_rc2_preserves_object_contracts() -> TestResult {
|
||||
async fn rolling_upgrade_from_rc2_preserves_mixed_version_contracts() -> TestResult {
|
||||
init_logging();
|
||||
let previous_binary = source_binary()?;
|
||||
let evidence_context = g09_evidence_context(&previous_binary).await?;
|
||||
let current_binary = rustfs_binary_path();
|
||||
let mut cluster = RustFSTestClusterEnvironment::new(MIXED_NODE_COUNT).await?;
|
||||
cluster.set_env("RUST_LOG", "rustfs=warn,rustfs_notify=warn");
|
||||
@@ -716,45 +555,6 @@ async fn rolling_upgrade_from_rc2_preserves_mixed_version_contracts() -> TestRes
|
||||
}
|
||||
}
|
||||
|
||||
if let Some(context) = evidence_context.as_ref() {
|
||||
let phases = ["one-current-node", "one-previous-node"];
|
||||
let objects_per_phase = MULTIPART_WORKERS * MULTIPART_UPLOADS_PER_WORKER + 2;
|
||||
write_g09_evidence(
|
||||
context,
|
||||
"mixed_version_reader_evidence",
|
||||
"mixed-version-reader",
|
||||
&["old-writer-new-reader", "new-writer-old-reader"],
|
||||
"upgrade_compatibility_test::rolling_upgrade_from_rc2_preserves_mixed_version_contracts",
|
||||
serde_json::json!({
|
||||
"bucket": MIXED_BUCKET,
|
||||
"phases": phases,
|
||||
"objects_per_phase": objects_per_phase,
|
||||
"assertions": [
|
||||
"current node reads objects written through previous-release client",
|
||||
"previous-release node reads objects written through current client",
|
||||
"all nodes list every mixed-version object after homogeneous-current convergence"
|
||||
],
|
||||
}),
|
||||
)?;
|
||||
write_g09_evidence(
|
||||
context,
|
||||
"mixed_version_writer_evidence",
|
||||
"mixed-version-writer",
|
||||
&["old-reader-new-writer", "new-reader-old-writer"],
|
||||
"upgrade_compatibility_test::rolling_upgrade_from_rc2_preserves_mixed_version_contracts",
|
||||
serde_json::json!({
|
||||
"bucket": MIXED_BUCKET,
|
||||
"phases": phases,
|
||||
"objects_per_phase": objects_per_phase,
|
||||
"assertions": [
|
||||
"current writer publishes objects readable by previous-release node",
|
||||
"previous-release writer publishes objects readable by current node",
|
||||
"multipart writers continue under one-current-node and one-previous-node layouts"
|
||||
],
|
||||
}),
|
||||
)?;
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
@@ -1336,7 +1136,6 @@ async fn direct_upgrade_from_previous_release_preserves_bucket_configuration() -
|
||||
async fn rollback_to_previous_release_reads_current_bucket_metadata() -> TestResult {
|
||||
init_logging();
|
||||
let previous_binary = source_binary()?;
|
||||
let evidence_context = g09_evidence_context(&previous_binary).await?;
|
||||
|
||||
let replication_target = FakeS3Target::start().await?;
|
||||
replication_target.create_bucket(ROLLBACK_REPLICA_BUCKET);
|
||||
@@ -1405,54 +1204,6 @@ async fn rollback_to_previous_release_reads_current_bucket_metadata() -> TestRes
|
||||
);
|
||||
assert_eq!(body, post_rollback_bytes);
|
||||
|
||||
env.restart_server_preserving_data(vec![], &server_env).await?;
|
||||
let current_again = env.create_s3_client();
|
||||
assert_versioning_enabled(¤t_again, ROLLBACK_BUCKET, "after rolling forward again").await?;
|
||||
assert_default_sse_s3_encryption(¤t_again, ROLLBACK_BUCKET, "after rolling forward again").await?;
|
||||
assert_bucket_tag(¤t_again, ROLLBACK_BUCKET, "after rolling forward again").await?;
|
||||
assert_remote_target_preserved(&env, ROLLBACK_BUCKET, &target_arn, "after rolling forward again").await?;
|
||||
assert_eq!(
|
||||
read_object(¤t_again, ROLLBACK_BUCKET, single_key, Some(&single_version))
|
||||
.await?
|
||||
.1,
|
||||
single_bytes
|
||||
);
|
||||
assert_eq!(
|
||||
read_object(¤t_again, ROLLBACK_BUCKET, multipart_key, None).await?.1,
|
||||
multipart_bytes
|
||||
);
|
||||
assert_eq!(
|
||||
read_object(¤t_again, ROLLBACK_BUCKET, post_rollback_key, None).await?.1,
|
||||
post_rollback_bytes
|
||||
);
|
||||
|
||||
if let Some(context) = evidence_context.as_ref() {
|
||||
write_g09_evidence(
|
||||
context,
|
||||
"rollback_payload_evidence",
|
||||
"rollback-payload",
|
||||
&["rollback-to-old", "rollback-to-new", "unknown-field-retained"],
|
||||
"upgrade_compatibility_test::rollback_to_previous_release_reads_current_bucket_metadata",
|
||||
serde_json::json!({
|
||||
"bucket": ROLLBACK_BUCKET,
|
||||
"cases": {
|
||||
"rollback-to-old": [
|
||||
"previous-release binary reads current-build versioning, SSE-S3, tags, replication target and objects",
|
||||
"previous-release writer honors the decoded current-build encryption configuration"
|
||||
],
|
||||
"rollback-to-new": [
|
||||
"current build reads the object written by the rolled-back previous release",
|
||||
"current build reads the current-build single-part and multipart objects after rolling forward again"
|
||||
],
|
||||
"unknown-field-retained": [
|
||||
"previous release skips current-build bucket metadata extension fields without dropping known bucket configuration",
|
||||
"current build reads the retained bucket configuration after the previous-release round trip"
|
||||
]
|
||||
},
|
||||
}),
|
||||
)?;
|
||||
}
|
||||
|
||||
replication_target.shutdown().await;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
@@ -4036,10 +4036,6 @@ impl ManualTransitionRunReport {
|
||||
|| self.skipped_queue_timeout > 0
|
||||
}
|
||||
|
||||
fn has_enqueue_backpressure(&self) -> bool {
|
||||
self.skipped_queue_full > 0 || self.skipped_queue_closed > 0 || self.skipped_queue_timeout > 0
|
||||
}
|
||||
|
||||
pub fn was_truncated(&self) -> bool {
|
||||
self.truncated_by_limit || self.truncated_by_duration || self.cancelled
|
||||
}
|
||||
@@ -4255,7 +4251,7 @@ pub async fn enqueue_transition_for_existing_objects_scoped(
|
||||
}
|
||||
report.scanned = report.scanned.saturating_add(1);
|
||||
enqueue_transition_with_lifecycle_report(Some(api.clone()), object, &lc, &src, &options, &mut report).await;
|
||||
if report.has_enqueue_backpressure() {
|
||||
if report.has_partial_enqueue() {
|
||||
report.next_marker.clone_from(&previous_marker);
|
||||
report.next_version_idmarker.clone_from(&previous_version_marker);
|
||||
report.continuation_token =
|
||||
@@ -5165,9 +5161,6 @@ pub async fn put_restore_opts(
|
||||
user_defined: meta,
|
||||
version_id: oi.version_id.map(|e| e.to_string()),
|
||||
mod_time: oi.mod_time,
|
||||
// Restore writes stored (possibly encrypted) bytes, so the writer's
|
||||
// computed MD5 is not the object's public plaintext ETag.
|
||||
preserve_etag: oi.etag.clone(),
|
||||
//expires: oi.expires,
|
||||
..Default::default()
|
||||
})
|
||||
@@ -9957,18 +9950,6 @@ mod tests {
|
||||
assert_eq!(report.skipped_queue_closed, 0);
|
||||
assert_eq!(report.skipped_queue_timeout, 0);
|
||||
assert!(report.has_partial_enqueue());
|
||||
assert!(report.has_enqueue_backpressure());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn manual_transition_in_flight_skip_does_not_stop_the_scan() {
|
||||
let options = ManualTransitionRunOptions::default();
|
||||
let mut report = ManualTransitionRunReport::new("bucket", &options);
|
||||
|
||||
report.record_enqueue_outcome(TransitionEnqueueOutcome::AlreadyInFlight);
|
||||
|
||||
assert!(report.has_partial_enqueue());
|
||||
assert!(!report.has_enqueue_backpressure());
|
||||
}
|
||||
|
||||
#[test]
|
||||
|
||||
@@ -8220,7 +8220,7 @@ mod tests {
|
||||
}
|
||||
mod multipart_transport_tests {
|
||||
use super::super::super::replication_filemeta_boundary::ObjectPartInfo;
|
||||
use super::super::super::replication_storage_boundary::ObjectIO as _;
|
||||
use super::super::super::replication_storage_boundary::{ObjectIO as _, ReadPlan};
|
||||
use super::*;
|
||||
use bytes::Bytes;
|
||||
use http_body_util::{BodyExt, Full};
|
||||
@@ -8229,6 +8229,7 @@ mod tests {
|
||||
#[derive(Debug)]
|
||||
struct Source {
|
||||
body: Bytes,
|
||||
stored: Option<Bytes>,
|
||||
info: ObjectInfo,
|
||||
ranges: StdMutex<Vec<(i64, i64)>>,
|
||||
full_reads: std::sync::atomic::AtomicUsize,
|
||||
@@ -8257,6 +8258,17 @@ mod tests {
|
||||
self.info.version_id.map(|id| id.to_string()),
|
||||
"every read retains the selected source version"
|
||||
);
|
||||
if let Some(stored) = &self.stored {
|
||||
if let Some(range) = &range {
|
||||
self.ranges.lock().expect("range journal lock").push((range.start, range.end));
|
||||
} else {
|
||||
self.full_reads.fetch_add(1, Ordering::Relaxed);
|
||||
}
|
||||
let plan = ReadPlan::build_for_request(range, &self.info, opts, &HeaderMap::new(), None).await?;
|
||||
let start = plan.storage_offset();
|
||||
let end = start + usize::try_from(plan.storage_length()).expect("nonnegative storage length");
|
||||
return plan.into_object_reader(Box::new(std::io::Cursor::new(stored.slice(start..end))), &self.info);
|
||||
}
|
||||
if range.is_none() {
|
||||
self.full_reads.fetch_add(1, Ordering::Relaxed);
|
||||
return Ok(GetObjectReader {
|
||||
@@ -8415,6 +8427,7 @@ mod tests {
|
||||
..Default::default()
|
||||
},
|
||||
body: body.clone(),
|
||||
stored: Some(Bytes::from(stored)),
|
||||
ranges: StdMutex::new(Vec::new()),
|
||||
full_reads: std::sync::atomic::AtomicUsize::new(0),
|
||||
});
|
||||
@@ -8656,6 +8669,7 @@ mod tests {
|
||||
..Default::default()
|
||||
},
|
||||
body: body.clone(),
|
||||
stored: None,
|
||||
ranges: StdMutex::new(Vec::new()),
|
||||
full_reads: std::sync::atomic::AtomicUsize::new(0),
|
||||
});
|
||||
|
||||
@@ -22,7 +22,7 @@ pub(crate) use crate::object_api::{
|
||||
GetObjectReader, ObjectInfo, ObjectOptions, PutObjReader, ReplicationStatusWritebackCondition, ReplicationStatusWritebackMode,
|
||||
};
|
||||
#[cfg(test)]
|
||||
pub(crate) use crate::object_api::{NamespaceLockFence, NamespaceLockSignalTestFence};
|
||||
pub(crate) use crate::object_api::{NamespaceLockFence, NamespaceLockSignalTestFence, ReadPlan};
|
||||
pub(crate) use crate::storage_api_contracts::list::{
|
||||
ListOperations, StorageListObjectVersionsInfo, StorageListObjectsV2Info, StorageObjectInfoOrErr, StorageWalkOptions,
|
||||
};
|
||||
|
||||
@@ -22,152 +22,21 @@ use rustfs_lock::{
|
||||
LockClient, LockError, LockInfo, LockRequest, LockResponse, LockStats, LockStatus, LockType, Result,
|
||||
types::{LockId, LockMetadata, LockPriority},
|
||||
};
|
||||
use rustfs_protos::proto_gen::node_service::{
|
||||
BatchGenerallyLockRequest, BatchGenerallyLockResponse, GenerallyLockRequest, GenerallyLockResponse, GenerallyLockResult,
|
||||
PingRequest,
|
||||
};
|
||||
use rustfs_protos::proto_gen::node_service::{BatchGenerallyLockRequest, GenerallyLockRequest, PingRequest};
|
||||
use rustfs_protos::{
|
||||
ConnectionEvictionLogLevel, evict_failed_connection_with_log_level, models::PingBodyBuilder,
|
||||
proto_gen::node_service::node_service_client::NodeServiceClient,
|
||||
};
|
||||
use std::collections::HashMap;
|
||||
use std::future::Future;
|
||||
use std::pin::Pin;
|
||||
use std::sync::{Mutex, OnceLock};
|
||||
use std::time::Duration;
|
||||
use tokio::task::JoinHandle;
|
||||
use tokio::time::{Instant, timeout};
|
||||
use std::{sync::OnceLock, time::Duration};
|
||||
use tokio::time::timeout;
|
||||
use tonic::Request;
|
||||
use tonic::service::interceptor::InterceptedService;
|
||||
use tonic::{Request, Response};
|
||||
use tracing::{debug, info, warn};
|
||||
|
||||
fn attach_lock_mutation_body_digest<T: rustfs_protos::CanonicalMutationBody>(request: &mut Request<T>) -> std::io::Result<()> {
|
||||
set_tonic_rolling_mutation_body_digest(request)
|
||||
}
|
||||
|
||||
/// Work to run if an RPC that already timed out for its caller completes later.
|
||||
type LateCompletion<T> = Option<Box<dyn FnOnce(T) -> Pin<Box<dyn Future<Output = ()> + Send>> + Send>>;
|
||||
|
||||
/// The liveness window is this many RPC deadlines: a peer that completed a
|
||||
/// lock RPC within it is slow, not gone, and keeps its channel on a timeout.
|
||||
const LOCK_RPC_LIVENESS_WINDOW_DEADLINES: u32 = 2;
|
||||
|
||||
/// Recent history of the shared lock channel to one peer (issue #7363).
|
||||
///
|
||||
/// A single request deadline says nothing about the HTTP/2 connection it ran
|
||||
/// on: a peer whose lock service is merely slow keeps answering other streams.
|
||||
/// Evicting the cached channel on every timeout turned that slowness into a
|
||||
/// `RST_STREAM`/`GOAWAY too_many_resets`/re-dial loop across the cluster, so
|
||||
/// eviction now requires the peer to have gone quiet and is rate limited.
|
||||
#[derive(Debug, Clone, Copy, Default)]
|
||||
struct LockPeerChannelHealth {
|
||||
last_success: Option<Instant>,
|
||||
last_eviction: Option<Instant>,
|
||||
consecutive_timeouts: u32,
|
||||
/// Timed-out RPCs still running in the background for this peer.
|
||||
detached_rpcs: usize,
|
||||
}
|
||||
|
||||
fn lock_peer_channel_health() -> &'static Mutex<HashMap<String, LockPeerChannelHealth>> {
|
||||
static HEALTH: OnceLock<Mutex<HashMap<String, LockPeerChannelHealth>>> = OnceLock::new();
|
||||
HEALTH.get_or_init(Mutex::default)
|
||||
}
|
||||
|
||||
fn with_lock_peer_health<R>(addr: &str, update: impl FnOnce(&mut LockPeerChannelHealth) -> R) -> R {
|
||||
let mut peers = lock_peer_channel_health()
|
||||
.lock()
|
||||
.unwrap_or_else(std::sync::PoisonError::into_inner);
|
||||
update(peers.entry(addr.to_string()).or_default())
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
fn lock_peer_health_for_test(addr: &str) -> LockPeerChannelHealth {
|
||||
lock_peer_channel_health()
|
||||
.lock()
|
||||
.unwrap_or_else(std::sync::PoisonError::into_inner)
|
||||
.get(addr)
|
||||
.copied()
|
||||
.unwrap_or_default()
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
fn reset_lock_peer_health_for_test(addr: &str) {
|
||||
lock_peer_channel_health()
|
||||
.lock()
|
||||
.unwrap_or_else(std::sync::PoisonError::into_inner)
|
||||
.remove(addr);
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
|
||||
enum EvictionTrigger {
|
||||
/// The caller's deadline expired while the stream was still open.
|
||||
Timeout,
|
||||
/// The transport itself reported the failure (refused, reset, GOAWAY, ...).
|
||||
Transport,
|
||||
}
|
||||
|
||||
impl EvictionTrigger {
|
||||
fn as_str(self) -> &'static str {
|
||||
match self {
|
||||
Self::Timeout => "timeout",
|
||||
Self::Transport => "transport",
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
|
||||
enum EvictionVerdict {
|
||||
Evict,
|
||||
/// The peer completed a lock RPC within the liveness window: slow, not gone.
|
||||
PeerRecentlyServed,
|
||||
/// The channel was re-dialed within the cooldown; let it prove itself first.
|
||||
CoolingDown,
|
||||
}
|
||||
|
||||
impl EvictionVerdict {
|
||||
fn as_str(self) -> &'static str {
|
||||
match self {
|
||||
Self::Evict => "evict",
|
||||
Self::PeerRecentlyServed => "peer_recently_served",
|
||||
Self::CoolingDown => "cooling_down",
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Decide whether a failed lock RPC may evict the shared channel to its peer.
|
||||
fn eviction_verdict(
|
||||
health: &LockPeerChannelHealth,
|
||||
now: Instant,
|
||||
trigger: EvictionTrigger,
|
||||
liveness_window: Duration,
|
||||
cooldown: Duration,
|
||||
) -> EvictionVerdict {
|
||||
if trigger == EvictionTrigger::Timeout
|
||||
&& health
|
||||
.last_success
|
||||
.is_some_and(|at| now.saturating_duration_since(at) < liveness_window)
|
||||
{
|
||||
return EvictionVerdict::PeerRecentlyServed;
|
||||
}
|
||||
if health
|
||||
.last_eviction
|
||||
.is_some_and(|at| now.saturating_duration_since(at) < cooldown)
|
||||
{
|
||||
return EvictionVerdict::CoolingDown;
|
||||
}
|
||||
EvictionVerdict::Evict
|
||||
}
|
||||
|
||||
/// Lock ids whose batch entry the server reports as granted.
|
||||
fn acquired_lock_ids(lock_ids: &[LockId], results: &[GenerallyLockResult]) -> Vec<LockId> {
|
||||
results
|
||||
.iter()
|
||||
.zip(lock_ids)
|
||||
.filter(|(result, _)| result.success)
|
||||
.map(|(_, lock_id)| lock_id.clone())
|
||||
.collect()
|
||||
}
|
||||
|
||||
/// Remote lock client implementation
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct RemoteClient {
|
||||
@@ -329,202 +198,14 @@ impl RemoteClient {
|
||||
)
|
||||
}
|
||||
|
||||
fn eviction_cooldown() -> Duration {
|
||||
Duration::from_millis(rustfs_utils::get_env_u64(
|
||||
rustfs_config::ENV_OBJECT_LOCK_RPC_EVICTION_COOLDOWN_MS,
|
||||
rustfs_config::DEFAULT_OBJECT_LOCK_RPC_EVICTION_COOLDOWN_MS,
|
||||
))
|
||||
}
|
||||
|
||||
fn detached_rpc_limit() -> usize {
|
||||
rustfs_utils::get_env_usize(
|
||||
rustfs_config::ENV_OBJECT_LOCK_RPC_DETACHED_LIMIT,
|
||||
rustfs_config::DEFAULT_OBJECT_LOCK_RPC_DETACHED_LIMIT,
|
||||
)
|
||||
}
|
||||
|
||||
fn liveness_window(deadline: Duration) -> Duration {
|
||||
deadline.saturating_mul(LOCK_RPC_LIVENESS_WINDOW_DEADLINES)
|
||||
}
|
||||
|
||||
fn record_rpc_success(&self) {
|
||||
with_lock_peer_health(&self.addr, |health| {
|
||||
health.last_success = Some(Instant::now());
|
||||
health.consecutive_timeouts = 0;
|
||||
});
|
||||
}
|
||||
|
||||
/// Apply the per-peer eviction policy after a failed RPC.
|
||||
async fn maybe_evict_connection(
|
||||
&self,
|
||||
op: &'static str,
|
||||
reason: &str,
|
||||
resource_summary: &str,
|
||||
trigger: EvictionTrigger,
|
||||
deadline: Duration,
|
||||
) {
|
||||
let now = Instant::now();
|
||||
let cooldown = Self::eviction_cooldown();
|
||||
let liveness_window = Self::liveness_window(deadline);
|
||||
let (verdict, consecutive_timeouts) = with_lock_peer_health(&self.addr, |health| {
|
||||
if trigger == EvictionTrigger::Timeout {
|
||||
health.consecutive_timeouts = health.consecutive_timeouts.saturating_add(1);
|
||||
}
|
||||
let verdict = eviction_verdict(health, now, trigger, liveness_window, cooldown);
|
||||
if verdict == EvictionVerdict::Evict {
|
||||
health.last_eviction = Some(now);
|
||||
}
|
||||
(verdict, health.consecutive_timeouts)
|
||||
});
|
||||
if verdict == EvictionVerdict::Evict {
|
||||
rustfs_io_metrics::lock_metrics::record_remote_lock_channel_eviction(&self.addr, trigger.as_str());
|
||||
self.evict_connection(op, reason, resource_summary).await;
|
||||
return;
|
||||
}
|
||||
rustfs_io_metrics::lock_metrics::record_remote_lock_channel_eviction_suppressed(&self.addr, verdict.as_str());
|
||||
debug!(
|
||||
addr = %self.addr,
|
||||
op,
|
||||
resource_summary,
|
||||
trigger = trigger.as_str(),
|
||||
verdict = verdict.as_str(),
|
||||
consecutive_timeouts,
|
||||
"Keeping cached remote lock connection after RPC failure"
|
||||
);
|
||||
}
|
||||
|
||||
/// Keep a timed-out RPC running instead of cancelling its stream.
|
||||
///
|
||||
/// Dropping the future sends `RST_STREAM`; under load those resets pile up
|
||||
/// in the server's pending-accept queue until it answers `GOAWAY
|
||||
/// too_many_resets` and kills every stream on the connection. A detached
|
||||
/// stream ends on its own within the internode RPC timeout, the number per
|
||||
/// peer is bounded, and a lock granted after its caller gave up is released.
|
||||
fn detach_timed_out_rpc<T: Send + 'static>(
|
||||
&self,
|
||||
op: &'static str,
|
||||
resource_summary: &str,
|
||||
handle: JoinHandle<std::result::Result<T, tonic::Status>>,
|
||||
late: LateCompletion<T>,
|
||||
) {
|
||||
let limit = Self::detached_rpc_limit();
|
||||
let admitted = with_lock_peer_health(&self.addr, |health| {
|
||||
if health.detached_rpcs >= limit {
|
||||
false
|
||||
} else {
|
||||
health.detached_rpcs += 1;
|
||||
true
|
||||
}
|
||||
});
|
||||
if !admitted {
|
||||
handle.abort();
|
||||
rustfs_io_metrics::lock_metrics::record_remote_lock_rpc_detached(op, "aborted");
|
||||
debug!(
|
||||
addr = %self.addr,
|
||||
op,
|
||||
resource_summary,
|
||||
limit,
|
||||
"Cancelled timed-out remote lock RPC because the detached stream budget is exhausted"
|
||||
);
|
||||
return;
|
||||
}
|
||||
rustfs_io_metrics::lock_metrics::record_remote_lock_rpc_detached(op, "detached");
|
||||
let addr = self.addr.clone();
|
||||
tokio::spawn(async move {
|
||||
let outcome = handle.await;
|
||||
with_lock_peer_health(&addr, |health| health.detached_rpcs = health.detached_rpcs.saturating_sub(1));
|
||||
match outcome {
|
||||
Ok(Ok(response)) => {
|
||||
with_lock_peer_health(&addr, |health| {
|
||||
health.last_success = Some(Instant::now());
|
||||
health.consecutive_timeouts = 0;
|
||||
});
|
||||
rustfs_io_metrics::lock_metrics::record_remote_lock_rpc_late_completion(op, "success");
|
||||
if let Some(late) = late {
|
||||
late(response).await;
|
||||
}
|
||||
}
|
||||
Ok(Err(status)) => {
|
||||
rustfs_io_metrics::lock_metrics::record_remote_lock_rpc_late_completion(op, "error");
|
||||
debug!(
|
||||
addr = %addr,
|
||||
op,
|
||||
tonic_code = ?status.code(),
|
||||
tonic_message = status.message(),
|
||||
"Detached remote lock RPC failed after its caller timed out"
|
||||
);
|
||||
}
|
||||
Err(join_error) => {
|
||||
rustfs_io_metrics::lock_metrics::record_remote_lock_rpc_late_completion(op, "join_error");
|
||||
debug!(addr = %addr, op, error = %join_error, "Detached remote lock RPC task ended abnormally");
|
||||
}
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
fn late_release_hook(&self, lock_id: LockId) -> LateCompletion<Response<GenerallyLockResponse>> {
|
||||
let client = self.clone();
|
||||
Some(Box::new(move |response: Response<GenerallyLockResponse>| {
|
||||
Box::pin(async move {
|
||||
if response.get_ref().success {
|
||||
client.release_late_acquisitions(vec![lock_id]).await;
|
||||
}
|
||||
})
|
||||
}))
|
||||
}
|
||||
|
||||
fn late_release_batch_hook(&self, lock_ids: Vec<LockId>) -> LateCompletion<Response<BatchGenerallyLockResponse>> {
|
||||
let client = self.clone();
|
||||
Some(Box::new(move |response: Response<BatchGenerallyLockResponse>| {
|
||||
Box::pin(async move {
|
||||
let acquired = acquired_lock_ids(&lock_ids, &response.get_ref().results);
|
||||
if !acquired.is_empty() {
|
||||
client.release_late_acquisitions(acquired).await;
|
||||
}
|
||||
})
|
||||
}))
|
||||
}
|
||||
|
||||
/// A lock granted after its caller stopped waiting is an orphan until its
|
||||
/// lease expires; hand it back right away, best effort.
|
||||
async fn release_late_acquisitions(&self, lock_ids: Vec<LockId>) {
|
||||
let outcome = match self.release_locks_batch(&lock_ids).await {
|
||||
Ok(released) if released.iter().all(|released| *released) => "released",
|
||||
Ok(_) => "partial",
|
||||
Err(_) => "failed",
|
||||
};
|
||||
rustfs_io_metrics::lock_metrics::record_remote_lock_late_release(outcome);
|
||||
if outcome == "released" {
|
||||
debug!(addr = %self.addr, count = lock_ids.len(), "Released remote locks granted after their caller timed out");
|
||||
} else {
|
||||
warn!(
|
||||
addr = %self.addr,
|
||||
count = lock_ids.len(),
|
||||
outcome,
|
||||
"Could not release every remote lock granted after its caller timed out; the server lease will expire it"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
async fn execute_rpc<T, Fut>(
|
||||
&self,
|
||||
op: &'static str,
|
||||
resource_summary: &str,
|
||||
deadline: Duration,
|
||||
future: Fut,
|
||||
late: LateCompletion<T>,
|
||||
) -> std::result::Result<T, LockError>
|
||||
async fn execute_rpc<T, F>(&self, op: &'static str, resource_summary: &str, future: F) -> std::result::Result<T, LockError>
|
||||
where
|
||||
Fut: Future<Output = std::result::Result<T, tonic::Status>> + Send + 'static,
|
||||
T: Send + 'static,
|
||||
F: std::future::Future<Output = std::result::Result<T, tonic::Status>>,
|
||||
{
|
||||
let mut handle = tokio::spawn(future);
|
||||
match timeout(deadline, &mut handle).await {
|
||||
Ok(Ok(Ok(response))) => {
|
||||
self.record_rpc_success();
|
||||
Ok(response)
|
||||
}
|
||||
Ok(Ok(Err(err))) => {
|
||||
let lock_timeout = Self::rpc_timeout();
|
||||
match timeout(lock_timeout, future).await {
|
||||
Ok(Ok(response)) => Ok(response),
|
||||
Ok(Err(err)) => {
|
||||
let reason = err.to_string();
|
||||
// Only evict (and re-dial) the cached channel when the failure is a genuine
|
||||
// transport problem. A server-produced application status (auth denied, peer
|
||||
@@ -536,7 +217,7 @@ impl RemoteClient {
|
||||
debug!(
|
||||
addr = %self.addr,
|
||||
op,
|
||||
timeout_ms = deadline.as_millis(),
|
||||
timeout_ms = lock_timeout.as_millis(),
|
||||
resource_summary,
|
||||
tonic_code = ?err.code(),
|
||||
tonic_message = err.message(),
|
||||
@@ -547,7 +228,7 @@ impl RemoteClient {
|
||||
warn!(
|
||||
addr = %self.addr,
|
||||
op,
|
||||
timeout_ms = deadline.as_millis(),
|
||||
timeout_ms = lock_timeout.as_millis(),
|
||||
resource_summary,
|
||||
tonic_code = ?err.code(),
|
||||
tonic_message = err.message(),
|
||||
@@ -556,29 +237,17 @@ impl RemoteClient {
|
||||
);
|
||||
}
|
||||
if transport_failure {
|
||||
self.maybe_evict_connection(op, &reason, resource_summary, EvictionTrigger::Transport, deadline)
|
||||
.await;
|
||||
self.evict_connection(op, &reason, resource_summary).await;
|
||||
}
|
||||
Err(LockError::internal(format!("{op} RPC failed: {reason}")))
|
||||
}
|
||||
Ok(Err(join_error)) => {
|
||||
warn!(
|
||||
addr = %self.addr,
|
||||
op,
|
||||
resource_summary,
|
||||
error = %join_error,
|
||||
"Remote lock RPC task ended abnormally"
|
||||
);
|
||||
Err(LockError::internal(format!("{op} RPC task failed: {join_error}")))
|
||||
}
|
||||
Err(_) => {
|
||||
let reason = format!("RPC timed out after {deadline:?}");
|
||||
rustfs_io_metrics::lock_metrics::record_remote_lock_rpc_timeout(&self.addr, op);
|
||||
let reason = format!("RPC timed out after {:?}", lock_timeout);
|
||||
if Self::is_scanner_leader_lock(resource_summary) {
|
||||
debug!(
|
||||
addr = %self.addr,
|
||||
op,
|
||||
timeout_ms = deadline.as_millis(),
|
||||
timeout_ms = lock_timeout.as_millis(),
|
||||
resource_summary,
|
||||
"Remote lock RPC timed out for scanner leader lock"
|
||||
);
|
||||
@@ -586,15 +255,13 @@ impl RemoteClient {
|
||||
warn!(
|
||||
addr = %self.addr,
|
||||
op,
|
||||
timeout_ms = deadline.as_millis(),
|
||||
timeout_ms = lock_timeout.as_millis(),
|
||||
resource_summary,
|
||||
"Remote lock RPC timed out"
|
||||
);
|
||||
}
|
||||
self.maybe_evict_connection(op, &reason, resource_summary, EvictionTrigger::Timeout, deadline)
|
||||
.await;
|
||||
self.detach_timed_out_rpc(op, resource_summary, handle, late);
|
||||
Err(LockError::timeout(format!("remote lock RPC {op} on {}", self.addr), deadline))
|
||||
self.evict_connection(op, &reason, resource_summary).await;
|
||||
Err(LockError::timeout(format!("remote lock RPC {op} on {}", self.addr), lock_timeout))
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -687,18 +354,8 @@ impl LockClient for RemoteClient {
|
||||
.map_err(|e| LockError::internal(format!("Failed to serialize request: {e}")))?,
|
||||
});
|
||||
attach_lock_mutation_body_digest(&mut req)?;
|
||||
let late = self.late_release_hook(request.lock_id.clone());
|
||||
|
||||
let resp = match self
|
||||
.execute_rpc(
|
||||
"lock",
|
||||
&resource_summary,
|
||||
Self::rpc_timeout(),
|
||||
async move { client.lock(req).await },
|
||||
late,
|
||||
)
|
||||
.await
|
||||
{
|
||||
let resp = match self.execute_rpc("lock", &resource_summary, client.lock(req)).await {
|
||||
Ok(resp) => resp.into_inner(),
|
||||
Err(err @ LockError::Timeout { .. }) => return Ok(Self::rpc_timeout_failure_response(request, &err)),
|
||||
Err(err) => return Ok(Self::rpc_failure_response(request, &err)),
|
||||
@@ -736,16 +393,9 @@ impl LockClient for RemoteClient {
|
||||
.collect::<Result<Vec<_>>>()?,
|
||||
});
|
||||
attach_lock_mutation_body_digest(&mut req)?;
|
||||
let late = self.late_release_batch_hook(requests.iter().map(|request| request.lock_id.clone()).collect());
|
||||
|
||||
let resp = match self
|
||||
.execute_rpc(
|
||||
"lock_batch",
|
||||
&resource_summary,
|
||||
Self::rpc_timeout(),
|
||||
async move { client.lock_batch(req).await },
|
||||
late,
|
||||
)
|
||||
.execute_rpc("lock_batch", &resource_summary, client.lock_batch(req))
|
||||
.await
|
||||
{
|
||||
Ok(resp) => resp.into_inner(),
|
||||
@@ -786,13 +436,7 @@ impl LockClient for RemoteClient {
|
||||
let mut req = Request::new(GenerallyLockRequest { args: request_string });
|
||||
attach_lock_mutation_body_digest(&mut req)?;
|
||||
let resp = self
|
||||
.execute_rpc(
|
||||
"release",
|
||||
&resource_summary,
|
||||
Self::rpc_timeout(),
|
||||
async move { client.un_lock(req).await },
|
||||
None,
|
||||
)
|
||||
.execute_rpc("release", &resource_summary, client.un_lock(req))
|
||||
.await?
|
||||
.into_inner();
|
||||
if let Some(error_info) = resp.error_info {
|
||||
@@ -820,13 +464,7 @@ impl LockClient for RemoteClient {
|
||||
attach_lock_mutation_body_digest(&mut req)?;
|
||||
|
||||
let resp = self
|
||||
.execute_rpc(
|
||||
"release_batch",
|
||||
&resource_summary,
|
||||
Self::rpc_timeout(),
|
||||
async move { client.un_lock_batch(req).await },
|
||||
None,
|
||||
)
|
||||
.execute_rpc("release_batch", &resource_summary, client.un_lock_batch(req))
|
||||
.await?
|
||||
.into_inner();
|
||||
|
||||
@@ -848,13 +486,7 @@ impl LockClient for RemoteClient {
|
||||
});
|
||||
attach_lock_mutation_body_digest(&mut req)?;
|
||||
let resp = self
|
||||
.execute_rpc(
|
||||
"refresh",
|
||||
&resource_summary,
|
||||
Self::rpc_timeout(),
|
||||
async move { client.refresh(req).await },
|
||||
None,
|
||||
)
|
||||
.execute_rpc("refresh", &resource_summary, client.refresh(req))
|
||||
.await?
|
||||
.into_inner();
|
||||
if let Some(error_info) = resp.error_info {
|
||||
@@ -874,13 +506,7 @@ impl LockClient for RemoteClient {
|
||||
});
|
||||
attach_lock_mutation_body_digest(&mut req)?;
|
||||
let resp = self
|
||||
.execute_rpc(
|
||||
"force_release",
|
||||
&resource_summary,
|
||||
Self::rpc_timeout(),
|
||||
async move { client.force_un_lock(req).await },
|
||||
None,
|
||||
)
|
||||
.execute_rpc("force_release", &resource_summary, client.force_un_lock(req))
|
||||
.await?
|
||||
.into_inner();
|
||||
if let Some(error_info) = resp.error_info {
|
||||
@@ -897,26 +523,16 @@ impl LockClient for RemoteClient {
|
||||
let status_request = Self::create_unlock_request(lock_id);
|
||||
let resource_summary = status_request.resource.to_string();
|
||||
let mut client = self.get_client().await?;
|
||||
let args = serde_json::to_string(&status_request)
|
||||
.map_err(|e| LockError::internal(format!("Failed to serialize request: {e}")))?;
|
||||
|
||||
// Try to acquire a very short-lived lock to test availability
|
||||
let mut req = Request::new(GenerallyLockRequest { args: args.clone() });
|
||||
let mut req = Request::new(GenerallyLockRequest {
|
||||
args: serde_json::to_string(&status_request)
|
||||
.map_err(|e| LockError::internal(format!("Failed to serialize request: {e}")))?,
|
||||
});
|
||||
attach_lock_mutation_body_digest(&mut req)?;
|
||||
// A probe lock granted after the deadline must not linger on the peer.
|
||||
let late = self.late_release_hook(lock_id.clone());
|
||||
|
||||
// Try exclusive lock first with very short timeout
|
||||
let resp = match self
|
||||
.execute_rpc(
|
||||
"check_status",
|
||||
&resource_summary,
|
||||
Self::rpc_timeout(),
|
||||
async move { client.lock(req).await },
|
||||
late,
|
||||
)
|
||||
.await
|
||||
{
|
||||
let resp = match self.execute_rpc("check_status", &resource_summary, client.lock(req)).await {
|
||||
Ok(response) => response.into_inner(),
|
||||
Err(_) => return Ok(Some(Self::unknown_lock_info(lock_id))),
|
||||
};
|
||||
@@ -924,19 +540,14 @@ impl LockClient for RemoteClient {
|
||||
if resp.success {
|
||||
// If we successfully acquired the lock, the resource was free.
|
||||
// Immediately release it on a best-effort basis.
|
||||
let mut release_req = Request::new(GenerallyLockRequest { args });
|
||||
let mut release_req = Request::new(GenerallyLockRequest {
|
||||
args: serde_json::to_string(&status_request)
|
||||
.map_err(|e| LockError::internal(format!("Failed to serialize request: {e}")))?,
|
||||
});
|
||||
attach_lock_mutation_body_digest(&mut release_req)?;
|
||||
if let Ok(mut client) = self.get_client().await {
|
||||
let _ = self
|
||||
.execute_rpc(
|
||||
"check_status_release",
|
||||
&resource_summary,
|
||||
Self::rpc_timeout(),
|
||||
async move { client.un_lock(release_req).await },
|
||||
None,
|
||||
)
|
||||
.await;
|
||||
}
|
||||
let _ = self
|
||||
.execute_rpc("check_status_release", &resource_summary, client.un_lock(release_req))
|
||||
.await;
|
||||
|
||||
Ok(None)
|
||||
} else {
|
||||
@@ -971,8 +582,19 @@ impl LockClient for RemoteClient {
|
||||
|
||||
async fn is_online(&self) -> bool {
|
||||
let online_timeout = Self::online_check_timeout();
|
||||
let mut client = match timeout(online_timeout, self.get_client()).await {
|
||||
Ok(Ok(client)) => client,
|
||||
match timeout(online_timeout, async {
|
||||
let mut client = self.get_client().await?;
|
||||
let ping_req = Request::new(Self::build_ping_request());
|
||||
self.execute_rpc("ping", Self::ONLINE_CHECK_RESOURCE, client.ping(ping_req))
|
||||
.await?;
|
||||
Ok::<(), LockError>(())
|
||||
})
|
||||
.await
|
||||
{
|
||||
Ok(Ok(())) => {
|
||||
debug!(addr = %self.addr, timeout_ms = online_timeout.as_millis(), "remote lock client is online");
|
||||
true
|
||||
}
|
||||
Ok(Err(err)) => {
|
||||
debug!(
|
||||
addr = %self.addr,
|
||||
@@ -980,39 +602,16 @@ impl LockClient for RemoteClient {
|
||||
error = %err,
|
||||
"remote lock client online check failed"
|
||||
);
|
||||
return false;
|
||||
false
|
||||
}
|
||||
Err(_) => {
|
||||
let reason = format!("online check timed out after {:?}", online_timeout);
|
||||
warn!(
|
||||
addr = %self.addr,
|
||||
timeout_ms = online_timeout.as_millis(),
|
||||
"remote lock client online check timed out while dialing"
|
||||
);
|
||||
return false;
|
||||
}
|
||||
};
|
||||
let ping_req = Request::new(Self::build_ping_request());
|
||||
match self
|
||||
.execute_rpc(
|
||||
"ping",
|
||||
Self::ONLINE_CHECK_RESOURCE,
|
||||
online_timeout,
|
||||
async move { client.ping(ping_req).await },
|
||||
None,
|
||||
)
|
||||
.await
|
||||
{
|
||||
Ok(_) => {
|
||||
debug!(addr = %self.addr, timeout_ms = online_timeout.as_millis(), "remote lock client is online");
|
||||
true
|
||||
}
|
||||
Err(err) => {
|
||||
debug!(
|
||||
addr = %self.addr,
|
||||
timeout_ms = online_timeout.as_millis(),
|
||||
error = %err,
|
||||
"remote lock client online check failed"
|
||||
"remote lock client online check timed out"
|
||||
);
|
||||
self.evict_connection("ping", &reason, Self::ONLINE_CHECK_RESOURCE).await;
|
||||
false
|
||||
}
|
||||
}
|
||||
@@ -1074,232 +673,6 @@ mod tests {
|
||||
.with_priority(LockPriority::Normal)
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn eviction_verdict_distinguishes_slow_peers_from_dead_channels() {
|
||||
let now = Instant::now() + Duration::from_secs(3600);
|
||||
let window = Duration::from_secs(6);
|
||||
let cooldown = Duration::from_secs(5);
|
||||
|
||||
let idle = LockPeerChannelHealth::default();
|
||||
assert_eq!(
|
||||
eviction_verdict(&idle, now, EvictionTrigger::Timeout, window, cooldown),
|
||||
EvictionVerdict::Evict
|
||||
);
|
||||
|
||||
let serving = LockPeerChannelHealth {
|
||||
last_success: Some(now - Duration::from_secs(1)),
|
||||
..Default::default()
|
||||
};
|
||||
assert_eq!(
|
||||
eviction_verdict(&serving, now, EvictionTrigger::Timeout, window, cooldown),
|
||||
EvictionVerdict::PeerRecentlyServed,
|
||||
"a timeout on a peer that just answered is load, not a dead channel"
|
||||
);
|
||||
assert_eq!(
|
||||
eviction_verdict(&serving, now, EvictionTrigger::Transport, window, cooldown),
|
||||
EvictionVerdict::Evict,
|
||||
"a transport failure is reported by the channel itself and still evicts"
|
||||
);
|
||||
|
||||
let quiet = LockPeerChannelHealth {
|
||||
last_success: Some(now - Duration::from_secs(30)),
|
||||
..Default::default()
|
||||
};
|
||||
assert_eq!(
|
||||
eviction_verdict(&quiet, now, EvictionTrigger::Timeout, window, cooldown),
|
||||
EvictionVerdict::Evict
|
||||
);
|
||||
|
||||
let just_evicted = LockPeerChannelHealth {
|
||||
last_eviction: Some(now - Duration::from_secs(1)),
|
||||
..Default::default()
|
||||
};
|
||||
assert_eq!(
|
||||
eviction_verdict(&just_evicted, now, EvictionTrigger::Timeout, window, cooldown),
|
||||
EvictionVerdict::CoolingDown
|
||||
);
|
||||
assert_eq!(
|
||||
eviction_verdict(&just_evicted, now, EvictionTrigger::Transport, window, cooldown),
|
||||
EvictionVerdict::CoolingDown
|
||||
);
|
||||
|
||||
let cooled = LockPeerChannelHealth {
|
||||
last_eviction: Some(now - Duration::from_secs(10)),
|
||||
..Default::default()
|
||||
};
|
||||
assert_eq!(
|
||||
eviction_verdict(&cooled, now, EvictionTrigger::Timeout, window, cooldown),
|
||||
EvictionVerdict::Evict
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn acquired_lock_ids_picks_only_granted_batch_entries() {
|
||||
let lock_ids = vec![
|
||||
LockId::new_unique(&ObjectKey::new("bucket", "a")),
|
||||
LockId::new_unique(&ObjectKey::new("bucket", "b")),
|
||||
LockId::new_unique(&ObjectKey::new("bucket", "c")),
|
||||
];
|
||||
let results = vec![
|
||||
GenerallyLockResult {
|
||||
success: true,
|
||||
..Default::default()
|
||||
},
|
||||
GenerallyLockResult {
|
||||
success: false,
|
||||
..Default::default()
|
||||
},
|
||||
];
|
||||
let acquired = acquired_lock_ids(&lock_ids, &results);
|
||||
assert_eq!(
|
||||
acquired,
|
||||
vec![lock_ids[0].clone()],
|
||||
"only granted entries with a matching id are released"
|
||||
);
|
||||
assert!(acquired_lock_ids(&lock_ids, &[]).is_empty());
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
#[serial_test::serial]
|
||||
async fn test_remote_client_timeout_keeps_channel_of_recently_serving_peer() {
|
||||
ensure_test_rpc_secret();
|
||||
let Some((addr, accept_task)) = spawn_hanging_listener().await else {
|
||||
return;
|
||||
};
|
||||
reset_lock_peer_health_for_test(&addr);
|
||||
cache_lazy_channel(&addr).await;
|
||||
with_lock_peer_health(&addr, |health| health.last_success = Some(Instant::now()));
|
||||
|
||||
temp_env::async_with_vars([(rustfs_config::ENV_OBJECT_LOCK_RPC_TIMEOUT_MS, Some("50"))], async {
|
||||
let client = RemoteClient::new(addr.clone());
|
||||
let response = client
|
||||
.acquire_lock(&test_lock_request(Duration::from_millis(5)))
|
||||
.await
|
||||
.unwrap();
|
||||
assert!(!response.success, "timed out lock acquisition should fail");
|
||||
assert!(
|
||||
runtime_sources::test_node_channel_is_cached(&addr).await,
|
||||
"a peer that served a lock RPC within the liveness window is slow, not gone"
|
||||
);
|
||||
assert_eq!(lock_peer_health_for_test(&addr).consecutive_timeouts, 1);
|
||||
})
|
||||
.await;
|
||||
|
||||
accept_task.abort();
|
||||
reset_lock_peer_health_for_test(&addr);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
#[serial_test::serial]
|
||||
async fn test_remote_client_repeated_timeouts_evict_at_most_once_per_cooldown() {
|
||||
ensure_test_rpc_secret();
|
||||
let Some((addr, accept_task)) = spawn_hanging_listener().await else {
|
||||
return;
|
||||
};
|
||||
reset_lock_peer_health_for_test(&addr);
|
||||
cache_lazy_channel(&addr).await;
|
||||
|
||||
temp_env::async_with_vars(
|
||||
[
|
||||
(rustfs_config::ENV_OBJECT_LOCK_RPC_TIMEOUT_MS, Some("50")),
|
||||
(rustfs_config::ENV_OBJECT_LOCK_RPC_EVICTION_COOLDOWN_MS, Some("60000")),
|
||||
],
|
||||
async {
|
||||
let client = RemoteClient::new(addr.clone());
|
||||
let request = test_lock_request(Duration::from_millis(5));
|
||||
|
||||
let _ = client.acquire_lock(&request).await.unwrap();
|
||||
assert!(
|
||||
!runtime_sources::test_node_channel_is_cached(&addr).await,
|
||||
"the first timeout on a quiet peer evicts the cached channel"
|
||||
);
|
||||
|
||||
cache_lazy_channel(&addr).await;
|
||||
let _ = client.acquire_lock(&request).await.unwrap();
|
||||
assert!(
|
||||
runtime_sources::test_node_channel_is_cached(&addr).await,
|
||||
"a second timeout inside the cooldown must not tear the fresh channel down again"
|
||||
);
|
||||
assert_eq!(lock_peer_health_for_test(&addr).consecutive_timeouts, 2);
|
||||
},
|
||||
)
|
||||
.await;
|
||||
|
||||
accept_task.abort();
|
||||
reset_lock_peer_health_for_test(&addr);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
#[serial_test::serial]
|
||||
async fn test_remote_client_detaches_timed_out_rpc_and_reclaims_its_slot() {
|
||||
ensure_test_rpc_secret();
|
||||
let Some((addr, accept_task)) = spawn_hanging_listener().await else {
|
||||
return;
|
||||
};
|
||||
reset_lock_peer_health_for_test(&addr);
|
||||
cache_lazy_channel(&addr).await;
|
||||
|
||||
temp_env::async_with_vars([(rustfs_config::ENV_OBJECT_LOCK_RPC_TIMEOUT_MS, Some("50"))], async {
|
||||
let client = RemoteClient::new(addr.clone());
|
||||
let _ = client
|
||||
.acquire_lock(&test_lock_request(Duration::from_millis(5)))
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(
|
||||
lock_peer_health_for_test(&addr).detached_rpcs,
|
||||
1,
|
||||
"the timed-out stream keeps running instead of being reset"
|
||||
);
|
||||
|
||||
// The hanging listener drops its socket after two seconds; the detached
|
||||
// task then observes the transport failure and frees its slot.
|
||||
let deadline = Instant::now() + Duration::from_secs(10);
|
||||
while lock_peer_health_for_test(&addr).detached_rpcs != 0 {
|
||||
assert!(Instant::now() < deadline, "detached RPC slot must be reclaimed once the stream ends");
|
||||
tokio::time::sleep(Duration::from_millis(50)).await;
|
||||
}
|
||||
})
|
||||
.await;
|
||||
|
||||
accept_task.abort();
|
||||
reset_lock_peer_health_for_test(&addr);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
#[serial_test::serial]
|
||||
async fn test_remote_client_cancels_timed_out_rpc_when_detached_budget_is_exhausted() {
|
||||
ensure_test_rpc_secret();
|
||||
let Some((addr, accept_task)) = spawn_hanging_listener().await else {
|
||||
return;
|
||||
};
|
||||
reset_lock_peer_health_for_test(&addr);
|
||||
cache_lazy_channel(&addr).await;
|
||||
|
||||
temp_env::async_with_vars(
|
||||
[
|
||||
(rustfs_config::ENV_OBJECT_LOCK_RPC_TIMEOUT_MS, Some("50")),
|
||||
(rustfs_config::ENV_OBJECT_LOCK_RPC_DETACHED_LIMIT, Some("0")),
|
||||
],
|
||||
async {
|
||||
let client = RemoteClient::new(addr.clone());
|
||||
let response = client
|
||||
.acquire_lock(&test_lock_request(Duration::from_millis(5)))
|
||||
.await
|
||||
.unwrap();
|
||||
assert!(!response.success);
|
||||
assert_eq!(
|
||||
lock_peer_health_for_test(&addr).detached_rpcs,
|
||||
0,
|
||||
"an exhausted detached budget falls back to cancelling the stream"
|
||||
);
|
||||
},
|
||||
)
|
||||
.await;
|
||||
|
||||
accept_task.abort();
|
||||
reset_lock_peer_health_for_test(&addr);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn lock_mutation_helper_marks_single_and_batch_requests_for_rolling_auth() {
|
||||
let mut single = Request::new(GenerallyLockRequest {
|
||||
@@ -1341,7 +714,6 @@ mod tests {
|
||||
let Some((addr, accept_task)) = spawn_hanging_listener().await else {
|
||||
return;
|
||||
};
|
||||
reset_lock_peer_health_for_test(&addr);
|
||||
cache_lazy_channel(&addr).await;
|
||||
assert!(runtime_sources::test_node_channel_is_cached(&addr).await);
|
||||
|
||||
@@ -1387,7 +759,6 @@ mod tests {
|
||||
let Some((addr, accept_task)) = spawn_hanging_listener().await else {
|
||||
return;
|
||||
};
|
||||
reset_lock_peer_health_for_test(&addr);
|
||||
cache_lazy_channel(&addr).await;
|
||||
assert!(runtime_sources::test_node_channel_is_cached(&addr).await);
|
||||
|
||||
@@ -1434,7 +805,6 @@ mod tests {
|
||||
let Some((addr, accept_task)) = spawn_hanging_listener().await else {
|
||||
return;
|
||||
};
|
||||
reset_lock_peer_health_for_test(&addr);
|
||||
cache_lazy_channel(&addr).await;
|
||||
assert!(runtime_sources::test_node_channel_is_cached(&addr).await);
|
||||
|
||||
@@ -1472,7 +842,6 @@ mod tests {
|
||||
let Some((addr, accept_task)) = spawn_hanging_listener().await else {
|
||||
return;
|
||||
};
|
||||
reset_lock_peer_health_for_test(&addr);
|
||||
cache_lazy_channel(&addr).await;
|
||||
assert!(runtime_sources::test_node_channel_is_cached(&addr).await);
|
||||
|
||||
@@ -1515,7 +884,6 @@ mod tests {
|
||||
let Some(addr) = closed_listener_addr().await else {
|
||||
return;
|
||||
};
|
||||
reset_lock_peer_health_for_test(&addr);
|
||||
cache_lazy_channel(&addr).await;
|
||||
assert!(runtime_sources::test_node_channel_is_cached(&addr).await);
|
||||
|
||||
|
||||
@@ -840,21 +840,15 @@ fn is_decommission_start_active_pool(pool: &PoolStatus) -> bool {
|
||||
decommission_start_pool_state(Some(pool)) == DecommissionStartPoolState::Active
|
||||
}
|
||||
|
||||
fn invalid_decommission_request(reason: impl Into<String>) -> Error {
|
||||
Error::InvalidArgument("decommission".to_string(), "pool-state".to_string(), reason.into())
|
||||
}
|
||||
|
||||
fn ensure_decommission_start_allowed(state: DecommissionStartPoolState) -> Result<()> {
|
||||
match state {
|
||||
DecommissionStartPoolState::Missing => {
|
||||
Err(invalid_decommission_request("failed to start decommission: target pool was not found"))
|
||||
}
|
||||
DecommissionStartPoolState::Missing => Err(Error::other("failed to start decommission: target pool was not found")),
|
||||
DecommissionStartPoolState::Active | DecommissionStartPoolState::Retryable => Ok(()),
|
||||
DecommissionStartPoolState::Decommissioning => Err(StorageError::DecommissionAlreadyRunning),
|
||||
DecommissionStartPoolState::Decommissioned => Err(invalid_decommission_request(
|
||||
"failed to start decommission: target pool is already decommissioned",
|
||||
)),
|
||||
DecommissionStartPoolState::Blocked => Err(invalid_decommission_request(
|
||||
DecommissionStartPoolState::Decommissioned => {
|
||||
Err(Error::other("failed to start decommission: target pool is already decommissioned"))
|
||||
}
|
||||
DecommissionStartPoolState::Blocked => Err(Error::other(
|
||||
"failed to start decommission: target pool decommission is blocked; clear failed or canceled metadata before starting again",
|
||||
)),
|
||||
}
|
||||
@@ -871,7 +865,7 @@ fn ensure_decommission_start_keeps_active_pool(meta: &PoolMeta, indices: &[usize
|
||||
.filter(|idx| meta.pools.get(**idx).is_some_and(is_decommission_start_active_pool))
|
||||
.count();
|
||||
if active_count.saturating_sub(active_target_count) == 0 {
|
||||
return Err(invalid_decommission_request(
|
||||
return Err(Error::other(
|
||||
"failed to start decommission: at least one active pool must remain after decommission start",
|
||||
));
|
||||
}
|
||||
@@ -1757,53 +1751,8 @@ fn ensure_decommission_capacity_reservations_available(
|
||||
Ok(())
|
||||
}
|
||||
|
||||
#[derive(Clone, Copy)]
|
||||
pub(crate) enum DecommissionCapacityAdmission {
|
||||
Mutation,
|
||||
ExistingMultipart,
|
||||
ScannerBacklog,
|
||||
BatchDelete,
|
||||
Heal,
|
||||
}
|
||||
|
||||
impl DecommissionCapacityAdmission {
|
||||
fn phase(self) -> &'static str {
|
||||
match self {
|
||||
Self::Mutation => "mutation",
|
||||
Self::ExistingMultipart => "existing_multipart",
|
||||
Self::ScannerBacklog => "scanner_backlog",
|
||||
Self::BatchDelete => "batch_delete",
|
||||
Self::Heal => "heal",
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn ensure_external_decommission_target_admission(
|
||||
meta: &PoolMeta,
|
||||
target_pool_index: usize,
|
||||
admission: DecommissionCapacityAdmission,
|
||||
) -> Result<()> {
|
||||
let phase = admission.phase();
|
||||
// Pool selection may predate retirement or use a stale node-local snapshot.
|
||||
// Recheck publication against the fenced durable state. Repair and pure
|
||||
// capacity release retain their separate admission contracts.
|
||||
if matches!(admission, DecommissionCapacityAdmission::ScannerBacklog)
|
||||
&& !meta.scanner_pause_backlog_pool_writable(target_pool_index)
|
||||
{
|
||||
return Err(Error::SlowDown);
|
||||
}
|
||||
let active_sources = active_decommission_source_indices(meta);
|
||||
if meta.is_suspended(target_pool_index) {
|
||||
let active_source = active_sources.contains(&target_pool_index);
|
||||
if !matches!(
|
||||
admission,
|
||||
DecommissionCapacityAdmission::Heal | DecommissionCapacityAdmission::ScannerBacklog
|
||||
) && !(matches!(admission, DecommissionCapacityAdmission::ExistingMultipart) && active_source)
|
||||
{
|
||||
return Err(Error::SlowDown);
|
||||
}
|
||||
}
|
||||
if active_sources.into_iter().any(|source_pool_index| {
|
||||
fn ensure_external_decommission_target_admission(meta: &PoolMeta, target_pool_index: usize, phase: &'static str) -> Result<()> {
|
||||
if active_decommission_source_indices(meta).into_iter().any(|source_pool_index| {
|
||||
meta.pools
|
||||
.get(source_pool_index)
|
||||
.and_then(|pool| pool.decommission.as_ref())
|
||||
@@ -1813,13 +1762,6 @@ fn ensure_external_decommission_target_admission(
|
||||
metrics::counter!(METRIC_DECOMMISSION_CAPACITY_CONFLICTS_TOTAL, "phase" => phase).increment(1);
|
||||
return Err(Error::SlowDown);
|
||||
}
|
||||
// Migration reservations budget the mover, not exclusive ownership of a
|
||||
// healthy pool. Foreground publication shares its actual disk capacity;
|
||||
// migration must retain the source if its capacity or target write fails.
|
||||
// Repair keeps its separate, conservative reservation admission contract.
|
||||
if !matches!(admission, DecommissionCapacityAdmission::Heal) {
|
||||
return Ok(());
|
||||
}
|
||||
let reserved = active_decommission_target_reservations(meta)
|
||||
.get(&target_pool_index)
|
||||
.copied()
|
||||
@@ -4326,7 +4268,7 @@ fn should_retry_decommission_cancel_reload(changed: bool, already_canceled: bool
|
||||
|
||||
fn ensure_decommission_cancel_allowed(pool_present: bool, decommission_present: bool, terminal: bool) -> Result<()> {
|
||||
if !pool_present {
|
||||
return Err(invalid_decommission_request("failed to cancel decommission: target pool was not found"));
|
||||
return Err(Error::other("failed to cancel decommission: target pool was not found"));
|
||||
}
|
||||
|
||||
if !decommission_present || terminal {
|
||||
@@ -4345,7 +4287,7 @@ fn ensure_decommission_clear_allowed(
|
||||
unresolved_entries: usize,
|
||||
) -> Result<()> {
|
||||
if !pool_present {
|
||||
return Err(invalid_decommission_request("failed to clear decommission: target pool was not found"));
|
||||
return Err(Error::other("failed to clear decommission: target pool was not found"));
|
||||
}
|
||||
|
||||
if !decommission_present {
|
||||
@@ -4361,7 +4303,7 @@ fn ensure_decommission_clear_allowed(
|
||||
}
|
||||
|
||||
if unresolved_entries > 0 {
|
||||
return Err(invalid_decommission_request(format!(
|
||||
return Err(Error::other(format!(
|
||||
"failed to clear decommission: {unresolved_entries} unresolved listing entries must be reconciled by retrying decommission"
|
||||
)));
|
||||
}
|
||||
@@ -4371,7 +4313,7 @@ fn ensure_decommission_clear_allowed(
|
||||
|
||||
fn ensure_decommission_terminal_operation_supported(single_pool: bool, operation: &str) -> Result<()> {
|
||||
if single_pool {
|
||||
return Err(invalid_decommission_request(format!(
|
||||
return Err(Error::other(format!(
|
||||
"failed to {operation}: single pool deployments do not support decommission"
|
||||
)));
|
||||
}
|
||||
@@ -4381,9 +4323,7 @@ fn ensure_decommission_terminal_operation_supported(single_pool: bool, operation
|
||||
|
||||
fn validate_start_decommission_request(indices: &[usize], single_pool: bool) -> Result<()> {
|
||||
if indices.is_empty() {
|
||||
return Err(invalid_decommission_request(
|
||||
"failed to start decommission: no target pools were provided",
|
||||
));
|
||||
return Err(Error::other("failed to start decommission: no target pools were provided"));
|
||||
}
|
||||
|
||||
ensure_decommission_terminal_operation_supported(single_pool, "start decommission")
|
||||
@@ -4522,41 +4462,9 @@ pub(crate) struct PoolMetaWriteState {
|
||||
cluster_epoch: Option<u64>,
|
||||
pool_meta_absent: bool,
|
||||
bootstrap_authority: PoolMetaBootstrapAuthority,
|
||||
/// First-hand bootstrap authority this process holds for each pool
|
||||
/// (index = pool index): `Fresh` only for pools it formatted itself,
|
||||
/// `LegacyAdoption` only for pools whose migration it verified. Empty when
|
||||
/// the caller tracks deployment-wide authority only.
|
||||
pool_bootstrap_authorities: Vec<PoolMetaBootstrapAuthority>,
|
||||
/// Whether this process hosts the first endpoint of the first pool and is
|
||||
/// therefore the only writer allowed to publish the initial `pool.bin`.
|
||||
/// `None` when the caller did not say; unknown writers are treated as
|
||||
/// elected so every fail-closed rule still applies to them.
|
||||
elected_bootstrap_writer: Option<bool>,
|
||||
identity_initialized: Option<bool>,
|
||||
identity_fresh_bootstrap_nonce: Option<uuid::Uuid>,
|
||||
identity_needs_repair: bool,
|
||||
/// At least one pool has no identity replica at all.
|
||||
identity_replicas_missing: bool,
|
||||
/// At least one pool has a replica that is present but not a valid identity.
|
||||
identity_replicas_invalid: bool,
|
||||
}
|
||||
|
||||
/// Why an all-missing `pool.bin` set may not be initialized right now.
|
||||
enum MissingMetadataRejection {
|
||||
/// Another node still has to act (mint, attest, or publish); retrying the
|
||||
/// startup loop is the remedy, so the write gate stays open.
|
||||
BootstrapPending(Error),
|
||||
/// The durable state contradicts a fresh bootstrap; writes stay blocked
|
||||
/// until an operator recovers the metadata.
|
||||
RecoveryRequired(Error),
|
||||
}
|
||||
|
||||
impl MissingMetadataRejection {
|
||||
fn into_error(self) -> Error {
|
||||
match self {
|
||||
Self::BootstrapPending(err) | Self::RecoveryRequired(err) => err,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
|
||||
@@ -4588,7 +4496,6 @@ impl PoolMetaWriteState {
|
||||
Self::for_startup_with_bootstrap_authority(cluster_id, bootstrap_authority)
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
pub(crate) fn for_startup_with_bootstrap_authority(
|
||||
cluster_id: uuid::Uuid,
|
||||
bootstrap_authority: PoolMetaBootstrapAuthority,
|
||||
@@ -4600,82 +4507,10 @@ impl PoolMetaWriteState {
|
||||
}
|
||||
}
|
||||
|
||||
/// Startup state for a process that loaded every pool format itself and
|
||||
/// remembers, per pool, whether it created (or adopted) that pool
|
||||
/// first-hand. Deployment-wide authority is the conjunction across pools:
|
||||
/// any pool this process merely read yields `None`, exactly as before.
|
||||
pub(crate) fn for_startup_with_pool_bootstrap_authorities(
|
||||
cluster_id: uuid::Uuid,
|
||||
pool_bootstrap_authorities: Vec<PoolMetaBootstrapAuthority>,
|
||||
elected_bootstrap_writer: bool,
|
||||
) -> Self {
|
||||
let bootstrap_authority = pool_bootstrap_authorities
|
||||
.iter()
|
||||
.copied()
|
||||
.reduce(PoolMetaBootstrapAuthority::combine_across_pools)
|
||||
.unwrap_or_default();
|
||||
Self {
|
||||
expected_cluster_id: Some(cluster_id),
|
||||
bootstrap_authority,
|
||||
pool_bootstrap_authorities,
|
||||
elected_bootstrap_writer: Some(elected_bootstrap_writer),
|
||||
..Default::default()
|
||||
}
|
||||
}
|
||||
|
||||
pub(crate) fn bootstrap_identity_proven(&self) -> bool {
|
||||
self.bootstrap_authority.is_proven()
|
||||
}
|
||||
|
||||
fn pool_bootstrap_authority_proven(&self, pool_idx: usize) -> bool {
|
||||
self.pool_bootstrap_authorities
|
||||
.get(pool_idx)
|
||||
.is_some_and(|authority| authority.is_proven())
|
||||
}
|
||||
|
||||
/// Pools this process formatted or adopted first-hand during this startup.
|
||||
pub(crate) fn attested_pool_indices(&self) -> Vec<usize> {
|
||||
self.pool_bootstrap_authorities
|
||||
.iter()
|
||||
.enumerate()
|
||||
.filter(|(_, authority)| authority.is_proven())
|
||||
.map(|(pool_idx, _)| pool_idx)
|
||||
.collect()
|
||||
}
|
||||
|
||||
/// Deployment-level proof assembled from per-pool creators: this process
|
||||
/// created the first pool itself, and every pool replica carries the same
|
||||
/// pending identity. A pending replica is only ever written by the process
|
||||
/// that formatted that pool with first-hand proof (see
|
||||
/// [`PoolMetaIdentityWriteScope::Pools`]), so a complete, agreeing pending
|
||||
/// set proves that every pool joined this bootstrap fresh. A missing,
|
||||
/// corrupt, or disagreeing replica keeps the writer fail-closed, and a
|
||||
/// restart without first-hand proof never reopens bootstrap on its own.
|
||||
fn pending_identity_attested_by_every_pool(&self) -> bool {
|
||||
self.elected_bootstrap_writer == Some(true)
|
||||
&& self.pool_bootstrap_authority_proven(0)
|
||||
&& self.identity_initialized == Some(false)
|
||||
&& !self.identity_needs_repair
|
||||
&& self.identity_fresh_bootstrap_nonce.is_some()
|
||||
}
|
||||
|
||||
/// The elected writer minted (or holds) the nonce and the only thing
|
||||
/// standing between it and a complete attestation is a pool whose creator
|
||||
/// has not written its replica yet. Corrupt replicas are never transient.
|
||||
fn awaiting_creator_attestation(&self) -> bool {
|
||||
self.elected_bootstrap_writer == Some(true)
|
||||
&& self.pool_bootstrap_authority_proven(0)
|
||||
&& self.identity_initialized == Some(false)
|
||||
&& self.identity_fresh_bootstrap_nonce.is_some()
|
||||
&& self.identity_needs_repair
|
||||
&& self.identity_replicas_missing
|
||||
&& !self.identity_replicas_invalid
|
||||
}
|
||||
|
||||
fn is_non_elected_bootstrap_observer(&self) -> bool {
|
||||
self.elected_bootstrap_writer == Some(false)
|
||||
}
|
||||
|
||||
pub(crate) fn identity_is_pending(&self) -> bool {
|
||||
self.identity_initialized == Some(false)
|
||||
}
|
||||
@@ -4795,19 +4630,9 @@ impl PoolMetaWriteState {
|
||||
self.identity_needs_repair = selection.needs_repair;
|
||||
self.identity_initialized = selection.identity.map(|identity| identity.initialized);
|
||||
self.identity_fresh_bootstrap_nonce = selection.identity.and_then(|identity| identity.fresh_bootstrap_nonce);
|
||||
self.identity_replicas_missing = selection
|
||||
.cas_tokens
|
||||
.iter()
|
||||
.any(|token| matches!(token, PoolMetaCasToken::Missing));
|
||||
self.identity_replicas_invalid = selection
|
||||
.valid_replicas
|
||||
.iter()
|
||||
.zip(&selection.cas_tokens)
|
||||
.any(|(valid, token)| !valid && !matches!(token, PoolMetaCasToken::Missing));
|
||||
if let Some(identity) = selection.identity {
|
||||
if identity.initialized {
|
||||
self.bootstrap_authority = PoolMetaBootstrapAuthority::None;
|
||||
self.pool_bootstrap_authorities.clear();
|
||||
}
|
||||
if let Some(metadata_epoch) = self.cluster_epoch
|
||||
&& metadata_epoch != identity.epoch
|
||||
@@ -4830,44 +4655,22 @@ impl PoolMetaWriteState {
|
||||
if !self.pool_meta_absent {
|
||||
return Ok(());
|
||||
}
|
||||
match self.validate_missing_metadata_can_initialize() {
|
||||
Ok(()) => Ok(()),
|
||||
Err(MissingMetadataRejection::BootstrapPending(err)) => Err(err),
|
||||
Err(MissingMetadataRejection::RecoveryRequired(err)) => {
|
||||
Err(block_pool_meta_validation(self, err, "metadata_absence"))
|
||||
}
|
||||
}
|
||||
self.validate_missing_metadata_can_initialize()
|
||||
.map_err(|err| block_pool_meta_validation(self, err, "metadata_absence"))
|
||||
}
|
||||
|
||||
fn validate_missing_metadata_can_initialize(&self) -> std::result::Result<(), MissingMetadataRejection> {
|
||||
use MissingMetadataRejection::{BootstrapPending, RecoveryRequired};
|
||||
fn validate_missing_metadata_can_initialize(&self) -> Result<()> {
|
||||
match self.identity_initialized {
|
||||
Some(false)
|
||||
if self.identity_fresh_bootstrap_nonce.is_some()
|
||||
&& (self.bootstrap_identity_proven() || self.pending_identity_attested_by_every_pool()) =>
|
||||
{
|
||||
Ok(())
|
||||
}
|
||||
Some(false) if self.awaiting_creator_attestation() => Err(BootstrapPending(Error::other(
|
||||
"pool metadata bootstrap pending: waiting for every pool creator to attest the pending cluster identity",
|
||||
))),
|
||||
Some(false) if self.is_non_elected_bootstrap_observer() && self.identity_fresh_bootstrap_nonce.is_some() => {
|
||||
Err(BootstrapPending(Error::other(
|
||||
"pool metadata bootstrap pending: waiting for the elected writer to publish the initial pool.bin",
|
||||
)))
|
||||
}
|
||||
Some(false) => Err(RecoveryRequired(Error::other(
|
||||
"pool metadata recovery required: pending cluster identity exists but this startup has no verified fresh-bootstrap proof, legacy-adoption proof, or complete per-pool creator attestation",
|
||||
))),
|
||||
Some(true) => Err(RecoveryRequired(Error::other(
|
||||
Some(false) if self.bootstrap_identity_proven() && self.identity_fresh_bootstrap_nonce.is_some() => Ok(()),
|
||||
Some(false) => Err(Error::other(
|
||||
"pool metadata recovery required: pending cluster identity exists but this startup has no verified fresh-bootstrap proof or legacy-adoption proof",
|
||||
)),
|
||||
Some(true) => Err(Error::other(
|
||||
"pool metadata recovery required: initialized cluster identity exists but every pool.bin replica is missing",
|
||||
))),
|
||||
None if self.is_non_elected_bootstrap_observer() => Err(BootstrapPending(Error::other(
|
||||
"pool metadata bootstrap pending: waiting for the elected writer to establish the cluster identity",
|
||||
))),
|
||||
None => Err(RecoveryRequired(Error::other(
|
||||
)),
|
||||
None => Err(Error::other(
|
||||
"pool metadata recovery required: no durable bootstrap identity or pool.bin replica is available",
|
||||
))),
|
||||
)),
|
||||
}
|
||||
}
|
||||
|
||||
@@ -5578,9 +5381,7 @@ where
|
||||
write_state.validate_selection(&selection)?;
|
||||
selection.replica_state.ensure_write_safe(operation)?;
|
||||
if selection.absent && (write_state.expected_cluster_id.is_some() || write_state.identity_initialized.is_some()) {
|
||||
write_state
|
||||
.validate_missing_metadata_can_initialize()
|
||||
.map_err(MissingMetadataRejection::into_error)?;
|
||||
write_state.validate_missing_metadata_can_initialize()?;
|
||||
}
|
||||
Ok(selection)
|
||||
}
|
||||
@@ -5682,8 +5483,6 @@ struct PoolMetaIdentitySelection {
|
||||
needs_repair: bool,
|
||||
repair_write_safe: bool,
|
||||
cas_tokens: Vec<PoolMetaCasToken>,
|
||||
/// Per pool: whether the replica decoded as a valid identity.
|
||||
valid_replicas: Vec<bool>,
|
||||
}
|
||||
|
||||
fn encode_pool_meta_identity(identity: PersistedPoolMetaIdentity) -> Result<Vec<u8>> {
|
||||
@@ -5732,17 +5531,6 @@ pub(crate) fn pool_meta_identity_initialized_for_test(data: &[u8]) -> Result<boo
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
pub(crate) fn pending_pool_meta_identity_for_test(cluster_id: uuid::Uuid, epoch: u64, nonce: uuid::Uuid) -> Result<Vec<u8>> {
|
||||
encode_pool_meta_identity(PersistedPoolMetaIdentity {
|
||||
version: POOL_META_IDENTITY_VERSION,
|
||||
cluster_id,
|
||||
epoch,
|
||||
initialized: false,
|
||||
fresh_bootstrap_nonce: Some(nonce),
|
||||
})
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
pub(crate) fn initialized_pool_meta_identity_for_test(cluster_id: uuid::Uuid, epoch: u64) -> Result<Vec<u8>> {
|
||||
encode_pool_meta_identity(PersistedPoolMetaIdentity {
|
||||
@@ -5783,10 +5571,6 @@ fn select_pool_meta_identity(
|
||||
expected_cluster_id: uuid::Uuid,
|
||||
) -> Result<PoolMetaIdentitySelection> {
|
||||
let cas_tokens = reads.iter().map(|read| read.cas.clone()).collect();
|
||||
let valid_replicas = reads
|
||||
.iter()
|
||||
.map(|read| matches!(read.replica, PoolMetaIdentityReplica::Valid(_)))
|
||||
.collect();
|
||||
let mut selected: Option<PersistedPoolMetaIdentity> = None;
|
||||
let mut needs_repair = false;
|
||||
let mut repair_write_safe = true;
|
||||
@@ -5844,7 +5628,6 @@ fn select_pool_meta_identity(
|
||||
needs_repair,
|
||||
repair_write_safe,
|
||||
cas_tokens,
|
||||
valid_replicas,
|
||||
})
|
||||
}
|
||||
|
||||
@@ -6114,43 +5897,10 @@ where
|
||||
result
|
||||
}
|
||||
|
||||
/// Which pool replicas a cluster-identity write may touch.
|
||||
#[derive(Debug, Clone, Copy)]
|
||||
enum PoolMetaIdentityWriteScope<'a> {
|
||||
/// Every pool. Creating a pending identity here requires deployment-wide
|
||||
/// fresh-bootstrap or legacy-adoption proof.
|
||||
All,
|
||||
/// Only the listed pools, each of which this process formatted or adopted
|
||||
/// first-hand. Multi-pool bootstraps whose pools have distinct format
|
||||
/// creators use this scope: the first pool's creator mints the deployment
|
||||
/// nonce and every other creator copies it to its own pool, so the elected
|
||||
/// writer can verify a complete, agreeing pending set instead of trusting
|
||||
/// an in-process flag it cannot observe on another node.
|
||||
Pools(&'a [usize]),
|
||||
}
|
||||
|
||||
fn identity_write_satisfied(
|
||||
selection: &PoolMetaIdentitySelection,
|
||||
identity: PersistedPoolMetaIdentity,
|
||||
scope: PoolMetaIdentityWriteScope<'_>,
|
||||
targets: &[usize],
|
||||
) -> bool {
|
||||
if selection.identity != Some(identity) {
|
||||
return false;
|
||||
}
|
||||
match scope {
|
||||
PoolMetaIdentityWriteScope::All => !selection.needs_repair,
|
||||
PoolMetaIdentityWriteScope::Pools(_) => targets
|
||||
.iter()
|
||||
.all(|pool_idx| selection.valid_replicas.get(*pool_idx).copied().unwrap_or(false)),
|
||||
}
|
||||
}
|
||||
|
||||
async fn persist_pool_meta_identity<S>(
|
||||
pools: Vec<Arc<S>>,
|
||||
write_state: &mut PoolMetaWriteState,
|
||||
initialized: bool,
|
||||
scope: PoolMetaIdentityWriteScope<'_>,
|
||||
fence: &PoolMetaPersistenceFence<'_>,
|
||||
transaction_arm: &mut PoolMetaTransactionArm,
|
||||
) -> Result<()>
|
||||
@@ -6160,23 +5910,6 @@ where
|
||||
let Some(cluster_id) = write_state.expected_cluster_id else {
|
||||
return Ok(());
|
||||
};
|
||||
let targets: Vec<usize> = match scope {
|
||||
PoolMetaIdentityWriteScope::All => (0..pools.len()).collect(),
|
||||
PoolMetaIdentityWriteScope::Pools(indices) => {
|
||||
if initialized {
|
||||
return Err(Error::other("pool metadata identity commit must address every pool"));
|
||||
}
|
||||
if indices
|
||||
.iter()
|
||||
.any(|pool_idx| *pool_idx >= pools.len() || !write_state.pool_bootstrap_authority_proven(*pool_idx))
|
||||
{
|
||||
return Err(Error::other(
|
||||
"pool metadata recovery required: a pending cluster identity can only be attested for pools this startup formatted or adopted first-hand",
|
||||
));
|
||||
}
|
||||
indices.to_vec()
|
||||
}
|
||||
};
|
||||
for attempt in 0..POOL_META_CAS_MAX_ATTEMPTS {
|
||||
let selection = load_pool_meta_identity_selection_observing(pools.clone(), write_state, cluster_id).await?;
|
||||
if !selection.repair_write_safe {
|
||||
@@ -6185,39 +5918,20 @@ where
|
||||
"pool metadata recovery required: cluster identity has an unreadable replica",
|
||||
));
|
||||
}
|
||||
let identity = match (selection.identity, scope) {
|
||||
// An initialized deployment (for example a pool expansion) never
|
||||
// reopens bootstrap: first-hand proof for a new pool is not a
|
||||
// reason to publish a pending identity.
|
||||
(Some(identity), PoolMetaIdentityWriteScope::Pools(_)) if identity.initialized => return Ok(()),
|
||||
(Some(identity), _) if identity.initialized || initialized => PersistedPoolMetaIdentity {
|
||||
let identity = match selection.identity {
|
||||
Some(identity) if identity.initialized || initialized => PersistedPoolMetaIdentity {
|
||||
initialized: true,
|
||||
fresh_bootstrap_nonce: None,
|
||||
..identity
|
||||
},
|
||||
(Some(identity), _) => identity,
|
||||
// Only the first pool's creator mints the deployment nonce; every
|
||||
// other creator waits until it is durable and copies it, so two
|
||||
// concurrent creators can never publish disagreeing replicas.
|
||||
(None, PoolMetaIdentityWriteScope::Pools(indices)) => {
|
||||
if !indices.contains(&0) {
|
||||
return Ok(());
|
||||
}
|
||||
PersistedPoolMetaIdentity {
|
||||
version: POOL_META_IDENTITY_VERSION,
|
||||
cluster_id,
|
||||
epoch: write_state.cluster_epoch.unwrap_or(POOL_META_INITIAL_EPOCH),
|
||||
initialized: false,
|
||||
fresh_bootstrap_nonce: Some(uuid::Uuid::new_v4()),
|
||||
}
|
||||
}
|
||||
(None, PoolMetaIdentityWriteScope::All) if !initialized && !write_state.bootstrap_identity_proven() => {
|
||||
Some(identity) => identity,
|
||||
None if !initialized && !write_state.bootstrap_identity_proven() => {
|
||||
write_state.block_writes();
|
||||
return Err(Error::other(
|
||||
"pool metadata recovery required: cannot create a pending cluster identity without verified fresh-bootstrap proof or legacy-adoption proof",
|
||||
));
|
||||
}
|
||||
(None, PoolMetaIdentityWriteScope::All) => PersistedPoolMetaIdentity {
|
||||
None => PersistedPoolMetaIdentity {
|
||||
version: POOL_META_IDENTITY_VERSION,
|
||||
cluster_id,
|
||||
epoch: write_state.cluster_epoch.unwrap_or(POOL_META_INITIAL_EPOCH),
|
||||
@@ -6225,15 +5939,12 @@ where
|
||||
fresh_bootstrap_nonce: (!initialized).then(uuid::Uuid::new_v4),
|
||||
},
|
||||
};
|
||||
if identity_write_satisfied(&selection, identity, scope, &targets) {
|
||||
if selection.identity == Some(identity) && !selection.needs_repair {
|
||||
return Ok(());
|
||||
}
|
||||
let data = encode_pool_meta_identity(identity)?;
|
||||
let mut conflict = false;
|
||||
for (pool_idx, (pool, token)) in pools.iter().cloned().zip(&selection.cas_tokens).enumerate() {
|
||||
if !targets.contains(&pool_idx) {
|
||||
continue;
|
||||
}
|
||||
for (pool, token) in pools.iter().cloned().zip(&selection.cas_tokens) {
|
||||
match save_pool_meta_object_cas(
|
||||
pool,
|
||||
POOL_META_IDENTITY_NAME,
|
||||
@@ -6260,7 +5971,7 @@ where
|
||||
return Err(Error::PreconditionFailed);
|
||||
}
|
||||
let confirmed = load_pool_meta_identity_selection_observing(pools.clone(), write_state, cluster_id).await?;
|
||||
if identity_write_satisfied(&confirmed, identity, scope, &targets) {
|
||||
if confirmed.identity == Some(identity) && !confirmed.needs_repair {
|
||||
return Ok(());
|
||||
}
|
||||
}
|
||||
@@ -6292,34 +6003,6 @@ where
|
||||
pools,
|
||||
write_state,
|
||||
initialized,
|
||||
PoolMetaIdentityWriteScope::All,
|
||||
&PoolMetaPersistenceFence::Distributed(None),
|
||||
&mut transaction_arm,
|
||||
)
|
||||
.await?;
|
||||
transaction_arm.disarm();
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Attest, during startup, the pending cluster identity for the pools this
|
||||
/// process formatted or adopted first-hand. The first pool's creator mints the
|
||||
/// deployment nonce; every other creator copies it once it is durable. Nothing
|
||||
/// is written while the deployment is already initialized or while the nonce
|
||||
/// is not yet durable, so callers simply retry through the startup loop.
|
||||
pub(crate) async fn persist_pool_meta_identity_for_attested_pools<S>(
|
||||
pools: Vec<Arc<S>>,
|
||||
write_state: &mut PoolMetaWriteState,
|
||||
pool_indices: &[usize],
|
||||
) -> Result<()>
|
||||
where
|
||||
S: EcstoreObjectIO,
|
||||
{
|
||||
let mut transaction_arm = write_state.arm_transaction();
|
||||
persist_pool_meta_identity(
|
||||
pools,
|
||||
write_state,
|
||||
false,
|
||||
PoolMetaIdentityWriteScope::Pools(pool_indices),
|
||||
&PoolMetaPersistenceFence::Distributed(None),
|
||||
&mut transaction_arm,
|
||||
)
|
||||
@@ -6935,15 +6618,7 @@ where
|
||||
.await?;
|
||||
}
|
||||
}
|
||||
persist_pool_meta_identity(
|
||||
pools.clone(),
|
||||
write_state,
|
||||
true,
|
||||
PoolMetaIdentityWriteScope::All,
|
||||
fence,
|
||||
&mut transaction_arm,
|
||||
)
|
||||
.await?;
|
||||
persist_pool_meta_identity(pools.clone(), write_state, true, fence, &mut transaction_arm).await?;
|
||||
let confirmed = load_pool_meta_for_transaction_recovery(pools, write_state).await?;
|
||||
if confirmed.revision != expected_revision
|
||||
|| confirmed.canonical.as_ref() != Some(&expected_canonical)
|
||||
@@ -7076,15 +6751,6 @@ impl PoolMeta {
|
||||
.is_some_and(is_decommission_suspended)
|
||||
}
|
||||
|
||||
pub(crate) fn scanner_pause_backlog_pool_writable(&self, idx: usize) -> bool {
|
||||
self.pools.get(idx).is_some_and(|pool| {
|
||||
!pool
|
||||
.decommission
|
||||
.as_ref()
|
||||
.is_some_and(|info| info.has_decommission_state() && !info.failed && !info.canceled)
|
||||
})
|
||||
}
|
||||
|
||||
fn mark_decommission_progress_saved(&mut self) {
|
||||
for pool in &mut self.pools {
|
||||
if let Some(info) = pool.decommission.as_mut() {
|
||||
@@ -7569,15 +7235,7 @@ impl PoolMeta {
|
||||
}
|
||||
if !selection.absent && write_state.identity_requires_repair() {
|
||||
let initialized = write_state.identity_initialized != Some(false) || selection.revision.is_generation_protocol();
|
||||
persist_pool_meta_identity(
|
||||
pools.clone(),
|
||||
write_state,
|
||||
initialized,
|
||||
PoolMetaIdentityWriteScope::All,
|
||||
fence,
|
||||
transaction_arm,
|
||||
)
|
||||
.await?;
|
||||
persist_pool_meta_identity(pools.clone(), write_state, initialized, fence, transaction_arm).await?;
|
||||
}
|
||||
}
|
||||
// Startup is the only path allowed to create an all-missing metadata
|
||||
@@ -7767,7 +7425,7 @@ impl PoolMeta {
|
||||
confirmed
|
||||
};
|
||||
if confirmed.revision == revision && confirmed.canonical.as_ref() == Some(&durable) {
|
||||
persist_pool_meta_identity(pools, write_state, true, PoolMetaIdentityWriteScope::All, fence, transaction_arm).await?;
|
||||
persist_pool_meta_identity(pools, write_state, true, fence, transaction_arm).await?;
|
||||
#[cfg(feature = "e2e-test-hooks")]
|
||||
startup_cas_test_observe(serde_json::json!({
|
||||
"kind": "confirmed", "object": POOL_META_NAME,
|
||||
@@ -10102,10 +9760,10 @@ impl ECStore {
|
||||
pub(crate) async fn acquire_external_decommission_capacity_fence(
|
||||
&self,
|
||||
target_pool_indices: &[usize],
|
||||
admission: DecommissionCapacityAdmission,
|
||||
phase: &'static str,
|
||||
) -> Result<rustfs_lock::NamespaceLockGuard> {
|
||||
Ok(self
|
||||
.acquire_external_decommission_capacity_fence_with_active_source(target_pool_indices, admission)
|
||||
.acquire_external_decommission_capacity_fence_with_active_source(target_pool_indices, phase)
|
||||
.await?
|
||||
.0)
|
||||
}
|
||||
@@ -10113,14 +9771,14 @@ impl ECStore {
|
||||
pub(crate) async fn acquire_external_decommission_capacity_fence_with_active_source(
|
||||
&self,
|
||||
target_pool_indices: &[usize],
|
||||
admission: DecommissionCapacityAdmission,
|
||||
phase: &'static str,
|
||||
) -> Result<(rustfs_lock::NamespaceLockGuard, bool)> {
|
||||
let save_guard = self.pool_meta_save_gate.lock().await;
|
||||
let (pool_meta_guard, snapshot) = self
|
||||
.acquire_pool_meta_read_guard(&save_guard, "target capacity admission failed")
|
||||
.await?;
|
||||
for target_pool_index in target_pool_indices.iter().copied() {
|
||||
ensure_external_decommission_target_admission(&snapshot, target_pool_index, admission)?;
|
||||
ensure_external_decommission_target_admission(&snapshot, target_pool_index, phase)?;
|
||||
}
|
||||
let has_active_source = pool_meta_has_active_decommission(&snapshot);
|
||||
drop(save_guard);
|
||||
@@ -10142,9 +9800,7 @@ impl ECStore {
|
||||
let admissions = target_pool_indices
|
||||
.iter()
|
||||
.copied()
|
||||
.map(|target_pool_index| {
|
||||
ensure_external_decommission_target_admission(&snapshot, target_pool_index, DecommissionCapacityAdmission::Heal)
|
||||
})
|
||||
.map(|target_pool_index| ensure_external_decommission_target_admission(&snapshot, target_pool_index, "heal"))
|
||||
.collect();
|
||||
drop(save_guard);
|
||||
Ok((pool_meta_guard, admissions))
|
||||
@@ -10818,7 +10474,7 @@ impl ECStore {
|
||||
));
|
||||
}
|
||||
let Some((owner, model_version)) = admitted_owner else {
|
||||
ensure_external_decommission_target_admission(&snapshot, target_pool_index, DecommissionCapacityAdmission::Mutation)?;
|
||||
ensure_external_decommission_target_admission(&snapshot, target_pool_index, "mutation")?;
|
||||
drop(save_guard);
|
||||
let capacity_lease = read_guard.lock_lost_signal();
|
||||
return operation.take().expect("capacity-admitted operation should run once")(capacity_lease).await;
|
||||
@@ -20982,17 +20638,17 @@ mod pools_tests {
|
||||
DecommissionStartPoolState, DecommissionTargetConsumption, DecommissionTerminalState, DecommissionUnresolvedEntry,
|
||||
ListCallback, POOL_META_GENERATION_VERSION, POOL_META_IDENTITY_NAME, POOL_META_NAME, POOL_META_V1_VERSION,
|
||||
POOL_META_VERSION, PoolDecommissionInfo, PoolMeta, PoolMetaCasToken, PoolMetaPersistenceFence, PoolSpaceInfo, PoolStatus,
|
||||
QueuedDecommissionEntry, REBAL_META_NAME, acquire_pool_rebalance_activation_locks, active_decommission_source_indices,
|
||||
apply_decommission_status_space_info, await_decommission_worker, bind_decommission_cancelers,
|
||||
bind_missing_decommission_cancelers, build_decommission_capacity_reservation,
|
||||
build_decommission_capacity_reservation_with_model, cancel_decommission_canceler, clamp_decommission_entry_concurrency,
|
||||
classify_decommission_terminal_state, count_decommission_item, decommission_cancel_signal_result,
|
||||
decommission_durable_ilm_receipt_path, decommission_durable_ilm_receipt_run_prefix,
|
||||
decommission_durable_ilm_receipt_run_token, decommission_entry_queue_capacity, decommission_item_size,
|
||||
decommission_meta_bucket_options, decommission_physical_pool_capacity, decommission_retry_backoff_delay,
|
||||
decommission_start_pool_state, decommission_unresolved_listing_error, dedup_indices,
|
||||
default_decommission_bucket_concurrency, default_decommission_entry_concurrency, drain_decommission_entry_queue,
|
||||
enqueue_decommission_entry, ensure_decommission_cancel_allowed, ensure_decommission_capacity_reservations_available,
|
||||
QueuedDecommissionEntry, REBAL_META_NAME, acquire_pool_rebalance_activation_locks, apply_decommission_status_space_info,
|
||||
await_decommission_worker, bind_decommission_cancelers, bind_missing_decommission_cancelers,
|
||||
build_decommission_capacity_reservation, build_decommission_capacity_reservation_with_model,
|
||||
cancel_decommission_canceler, clamp_decommission_entry_concurrency, classify_decommission_terminal_state,
|
||||
count_decommission_item, decommission_cancel_signal_result, decommission_durable_ilm_receipt_path,
|
||||
decommission_durable_ilm_receipt_run_prefix, decommission_durable_ilm_receipt_run_token,
|
||||
decommission_entry_queue_capacity, decommission_item_size, decommission_meta_bucket_options,
|
||||
decommission_physical_pool_capacity, decommission_retry_backoff_delay, decommission_start_pool_state,
|
||||
decommission_unresolved_listing_error, dedup_indices, default_decommission_bucket_concurrency,
|
||||
default_decommission_entry_concurrency, drain_decommission_entry_queue, enqueue_decommission_entry,
|
||||
ensure_decommission_cancel_allowed, ensure_decommission_capacity_reservations_available,
|
||||
ensure_decommission_clear_allowed, ensure_decommission_generation, ensure_decommission_listing_disks_available,
|
||||
ensure_decommission_not_rebalancing, ensure_decommission_start_allowed, ensure_decommission_start_keeps_active_pool,
|
||||
ensure_decommission_start_local_leader, ensure_decommission_start_pool_states,
|
||||
@@ -21028,13 +20684,12 @@ mod pools_tests {
|
||||
with_decommission_entry_context,
|
||||
};
|
||||
use super::{
|
||||
DecommissionCapacityAdmission, DecommissionCapacityOwner, DecommissionCapacityReleaseProof,
|
||||
DecommissionCapacityReservation, DecommissionCapacityTemporaryMutation, decommission_capacity_mutation_id,
|
||||
ensure_decommission_target_owner_admission, ensure_exact_delete_capacity_namespace_fences,
|
||||
ensure_external_decommission_target_admission, is_decommission_capacity_blocked_error,
|
||||
plan_exact_delete_capacity_reconciliations, record_decommission_target_consumption, release_decommission_target_inflight,
|
||||
reserve_decommission_target_pending, resolve_decommission_target_pending,
|
||||
set_decommission_capacity_info_overrides_for_test,
|
||||
DecommissionCapacityOwner, DecommissionCapacityReleaseProof, DecommissionCapacityReservation,
|
||||
DecommissionCapacityTemporaryMutation, decommission_capacity_mutation_id, ensure_decommission_target_owner_admission,
|
||||
ensure_exact_delete_capacity_namespace_fences, ensure_external_decommission_target_admission,
|
||||
is_decommission_capacity_blocked_error, plan_exact_delete_capacity_reconciliations,
|
||||
record_decommission_target_consumption, release_decommission_target_inflight, reserve_decommission_target_pending,
|
||||
resolve_decommission_target_pending, set_decommission_capacity_info_overrides_for_test,
|
||||
};
|
||||
use crate::bucket::lifecycle::{
|
||||
DurableIlmRecordCheckpoint,
|
||||
@@ -25188,25 +24843,6 @@ mod pools_tests {
|
||||
assert!(!pool_meta_has_active_decommission(&terminal_meta));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_decommission_request_rejections_preserve_invalid_argument_type() {
|
||||
for result in [
|
||||
ensure_decommission_start_allowed(DecommissionStartPoolState::Missing),
|
||||
ensure_decommission_start_allowed(DecommissionStartPoolState::Decommissioned),
|
||||
ensure_decommission_start_allowed(DecommissionStartPoolState::Blocked),
|
||||
ensure_decommission_cancel_allowed(false, false, false),
|
||||
ensure_decommission_clear_allowed(false, false, false, false, false, 0),
|
||||
ensure_decommission_clear_allowed(true, true, false, true, false, 1),
|
||||
ensure_decommission_terminal_operation_supported(true, "cancel decommission"),
|
||||
validate_start_decommission_request(&[], false),
|
||||
validate_start_decommission_request(&[0], true),
|
||||
ensure_decommission_start_keeps_active_pool(&PoolMeta::default(), &[]),
|
||||
] {
|
||||
let err = result.expect_err("invalid lifecycle requests must be rejected before mutation");
|
||||
assert!(matches!(&err, Error::InvalidArgument(_, _, reason) if !reason.is_empty()), "{err:?}");
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_ensure_decommission_start_allowed_rejects_missing_pool() {
|
||||
let err =
|
||||
@@ -25909,7 +25545,7 @@ mod pools_tests {
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn ordinary_write_admission_shares_a_reserved_target_without_becoming_its_owner() {
|
||||
fn ordinary_write_admission_cannot_race_into_a_reserved_target() {
|
||||
let now = OffsetDateTime::UNIX_EPOCH + Duration::minutes(2);
|
||||
let layout = DecommissionErasureLayout { data: 1, parity: 0 };
|
||||
let capacity_infos = vec![
|
||||
@@ -25933,18 +25569,13 @@ mod pools_tests {
|
||||
)
|
||||
.expect("the decommission reservation should fit");
|
||||
|
||||
for admission in [
|
||||
DecommissionCapacityAdmission::Mutation,
|
||||
DecommissionCapacityAdmission::BatchDelete,
|
||||
DecommissionCapacityAdmission::ScannerBacklog,
|
||||
] {
|
||||
ensure_external_decommission_target_admission(&meta, 1, admission)
|
||||
.expect("a healthy target must remain writable while sharing capacity with migration");
|
||||
}
|
||||
assert!(matches!(
|
||||
ensure_external_decommission_target_admission(&meta, 1, DecommissionCapacityAdmission::Heal),
|
||||
Err(Error::SlowDown)
|
||||
));
|
||||
assert!(
|
||||
matches!(
|
||||
ensure_external_decommission_target_admission(&meta, 1, "ordinary_put"),
|
||||
Err(Error::SlowDown)
|
||||
),
|
||||
"an ordinary write must not consume a target reservation"
|
||||
);
|
||||
let rebalance_opts = ObjectOptions {
|
||||
data_movement: true,
|
||||
src_pool_idx: 0,
|
||||
@@ -25971,119 +25602,6 @@ mod pools_tests {
|
||||
let mut decommission_opts = rebalance_opts;
|
||||
expected_owner.apply_to(&mut decommission_opts);
|
||||
assert_eq!(DecommissionCapacityOwner::from_options(&decommission_opts), Some(expected_owner));
|
||||
|
||||
meta.pools[0]
|
||||
.decommission
|
||||
.as_mut()
|
||||
.expect("active source")
|
||||
.capacity_reservation = None;
|
||||
for admission in [
|
||||
DecommissionCapacityAdmission::Mutation,
|
||||
DecommissionCapacityAdmission::BatchDelete,
|
||||
DecommissionCapacityAdmission::ScannerBacklog,
|
||||
] {
|
||||
assert!(
|
||||
matches!(ensure_external_decommission_target_admission(&meta, 1, admission), Err(Error::SlowDown)),
|
||||
"shared capacity must not bypass an active source's missing durable ledger"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn external_decommission_admission_fences_suspended_sources_but_preserves_repair() {
|
||||
let now = OffsetDateTime::UNIX_EPOCH + Duration::minutes(2);
|
||||
let layout = DecommissionErasureLayout { data: 1, parity: 0 };
|
||||
let capacity_infos = vec![
|
||||
DecommissionPoolCapacityInfo::for_test(0, layout, 0, 30, 30),
|
||||
DecommissionPoolCapacityInfo::for_test(1, layout, 100, 100, 0),
|
||||
];
|
||||
let mut active = PoolMeta {
|
||||
version: POOL_META_VERSION,
|
||||
pools: vec![decommission_test_pool_status(0, None), decommission_test_pool_status(1, None)],
|
||||
..Default::default()
|
||||
};
|
||||
active
|
||||
.decommission(0, capacity_infos[0].space)
|
||||
.expect("start the source admission fixture");
|
||||
reserve_decommission_start_target_capacity(
|
||||
&mut active,
|
||||
&[0],
|
||||
&capacity_infos,
|
||||
uuid::Uuid::new_v4(),
|
||||
1,
|
||||
now,
|
||||
DECOMMISSION_CAPACITY_MODEL_VERSION,
|
||||
)
|
||||
.expect("the active source must have a valid reservation to isolate its write fence");
|
||||
|
||||
for (state, queued, failed, canceled, complete) in [
|
||||
("running", false, false, false, false),
|
||||
("queued", true, false, false, false),
|
||||
("failed", false, true, false, false),
|
||||
("canceled", false, false, true, false),
|
||||
("completed", false, false, false, true),
|
||||
] {
|
||||
let mut meta = active.clone();
|
||||
let info = meta.pools[0].decommission.as_mut().expect("the source fixture must exist");
|
||||
info.queued = queued;
|
||||
info.failed = failed;
|
||||
info.canceled = canceled;
|
||||
info.complete = complete;
|
||||
if queued || failed || canceled || complete {
|
||||
info.start_time = None;
|
||||
}
|
||||
for admission in [
|
||||
DecommissionCapacityAdmission::Mutation,
|
||||
DecommissionCapacityAdmission::BatchDelete,
|
||||
] {
|
||||
assert!(
|
||||
matches!(ensure_external_decommission_target_admission(&meta, 0, admission), Err(Error::SlowDown)),
|
||||
"{state} source must reject new publication until its decommission metadata is cleared"
|
||||
);
|
||||
}
|
||||
let existing_multipart =
|
||||
ensure_external_decommission_target_admission(&meta, 0, DecommissionCapacityAdmission::ExistingMultipart);
|
||||
if active_decommission_source_indices(&meta).contains(&0) {
|
||||
existing_multipart
|
||||
.unwrap_or_else(|err| panic!("{state} source must allow an existing multipart upload to drain: {err}"));
|
||||
} else {
|
||||
assert!(
|
||||
matches!(existing_multipart, Err(Error::SlowDown)),
|
||||
"{state} terminal source must reject an existing multipart publication"
|
||||
);
|
||||
}
|
||||
ensure_external_decommission_target_admission(&meta, 0, DecommissionCapacityAdmission::Heal)
|
||||
.unwrap_or_else(|err| panic!("{state} source repair must retain its capacity-only admission: {err}"));
|
||||
let scanner_result =
|
||||
ensure_external_decommission_target_admission(&meta, 0, DecommissionCapacityAdmission::ScannerBacklog);
|
||||
assert_eq!(
|
||||
meta.scanner_pause_backlog_pool_writable(0),
|
||||
failed || canceled,
|
||||
"{state} scanner selection"
|
||||
);
|
||||
if failed || canceled {
|
||||
scanner_result.unwrap_or_else(|err| panic!("{state} scanner membership repair must remain writable: {err}"));
|
||||
} else {
|
||||
assert!(
|
||||
matches!(scanner_result, Err(Error::SlowDown)),
|
||||
"{state} scanner publication must reject its source"
|
||||
);
|
||||
}
|
||||
meta.pools[0].decommission = None;
|
||||
ensure_external_decommission_target_admission(&meta, 0, DecommissionCapacityAdmission::Mutation)
|
||||
.unwrap_or_else(|err| panic!("cleared {state} source must become writable again: {err}"));
|
||||
ensure_external_decommission_target_admission(&meta, 0, DecommissionCapacityAdmission::ScannerBacklog)
|
||||
.unwrap_or_else(|err| panic!("cleared {state} scanner source must rejoin membership: {err}"));
|
||||
}
|
||||
assert!(!active.scanner_pause_backlog_pool_writable(active.pools.len()));
|
||||
assert!(matches!(
|
||||
ensure_external_decommission_target_admission(
|
||||
&active,
|
||||
active.pools.len(),
|
||||
DecommissionCapacityAdmission::ScannerBacklog
|
||||
),
|
||||
Err(Error::SlowDown)
|
||||
));
|
||||
}
|
||||
|
||||
#[test]
|
||||
|
||||
@@ -570,465 +570,6 @@ mod decommission_lock_order_tests {
|
||||
.expect("decommission activation should commit after the probe release");
|
||||
}
|
||||
|
||||
#[test]
|
||||
#[serial_test::serial]
|
||||
fn staged_external_put_rechecks_retiring_source_on_another_node() {
|
||||
run_large_stack_current_thread_async_test("staged-retiring-source", || async {
|
||||
let (_temp_dirs, store, other_store) = test_three_pool_stores_with_isolated_node_contexts(None).await;
|
||||
let bucket = test_bucket("staged-source");
|
||||
let object = "selected-before-retirement.bin";
|
||||
let original = b"original source object";
|
||||
store
|
||||
.make_bucket(&bucket, &MakeBucketOptions::default())
|
||||
.await
|
||||
.expect("create staged source bucket");
|
||||
store.pools[0]
|
||||
.put_object(&bucket, object, &mut PutObjReader::from_vec(original.to_vec()), &ObjectOptions::default())
|
||||
.await
|
||||
.expect("seed the source selected before retirement");
|
||||
|
||||
let layout = DecommissionErasureLayout { data: 1, parity: 0 };
|
||||
set_decommission_capacity_info_overrides_for_test(
|
||||
other_store.id,
|
||||
vec![vec![
|
||||
DecommissionPoolCapacityInfo::for_test(0, layout, 0, 1024, 1024),
|
||||
DecommissionPoolCapacityInfo::for_test(1, layout, 4096, 4096, 0),
|
||||
DecommissionPoolCapacityInfo::for_test(2, layout, 0, 4096, 4096),
|
||||
]],
|
||||
);
|
||||
let barrier = DecommissionCapacityLockOrderBarrier::install(store.id, store.id);
|
||||
barrier.pause_external_object_commit_phase();
|
||||
let put_store = Arc::clone(&store);
|
||||
let put_bucket = bucket.clone();
|
||||
let put = tokio::spawn(async move {
|
||||
put_store
|
||||
.put_object(
|
||||
&put_bucket,
|
||||
object,
|
||||
&mut PutObjReader::from_vec(b"must not replace a retiring source".to_vec()),
|
||||
&ObjectOptions::default(),
|
||||
)
|
||||
.await
|
||||
});
|
||||
tokio::time::timeout(Duration::from_secs(30), barrier.wait_until_external_object_commit_phase_started())
|
||||
.await
|
||||
.expect("public PUT must stage before its decommission commit probe");
|
||||
assert!(!store.pool_meta.read().await.is_suspended(0));
|
||||
other_store
|
||||
.save_current_pool_meta_for_decommission_start(&[0], Vec::new())
|
||||
.await
|
||||
.expect("the other node should activate retirement before the staged PUT commits");
|
||||
assert!(other_store.pool_meta.read().await.is_suspended(0));
|
||||
assert!(
|
||||
!store.pool_meta.read().await.is_suspended(0),
|
||||
"the writer's local snapshot must remain stale to exercise the durable admission probe"
|
||||
);
|
||||
barrier.release_external_object_commit_phase();
|
||||
let result = tokio::time::timeout(Duration::from_secs(30), put)
|
||||
.await
|
||||
.expect("staged PUT must finish after the commit probe is released")
|
||||
.expect("staged PUT must not panic");
|
||||
assert!(
|
||||
matches!(result, Err(crate::error::Error::SlowDown)),
|
||||
"a staged PUT must retry pool selection instead of committing to a newly retiring source: {result:?}"
|
||||
);
|
||||
let mut reader = store.pools[0]
|
||||
.get_object_reader(&bucket, object, None, HeaderMap::new(), &ObjectOptions::default())
|
||||
.await
|
||||
.expect("the original source must remain readable after admission rejects the replacement");
|
||||
let mut body = Vec::new();
|
||||
reader
|
||||
.stream
|
||||
.read_to_end(&mut body)
|
||||
.await
|
||||
.expect("read the full retained source body");
|
||||
assert_eq!(body, original);
|
||||
});
|
||||
}
|
||||
|
||||
#[test]
|
||||
#[serial_test::serial]
|
||||
fn reserved_target_shares_business_io_and_retains_source_after_capacity_loss() {
|
||||
run_large_stack_current_thread_async_test("shared-decommission-capacity", || async {
|
||||
for lose_capacity in [false, true] {
|
||||
let (_temp_dirs, store, other_store) =
|
||||
test_three_pool_stores_with_three_disk_sets_with_isolated_node_contexts(None).await;
|
||||
let bucket = test_bucket("shared-capacity");
|
||||
let object = "migrating-source.bin";
|
||||
let business_object = "business-write.bin";
|
||||
let multipart_object = "business-multipart.bin";
|
||||
let source_body = vec![0x35; 256 * 1024];
|
||||
let business_body = vec![0x57; 64 * 1024];
|
||||
store
|
||||
.make_bucket(&bucket, &MakeBucketOptions::default())
|
||||
.await
|
||||
.expect("create shared-capacity bucket");
|
||||
store.pools[0]
|
||||
.put_object(
|
||||
&bucket,
|
||||
object,
|
||||
&mut PutObjReader::from_vec(source_body.clone()),
|
||||
&ObjectOptions::default(),
|
||||
)
|
||||
.await
|
||||
.expect("seed the retiring source");
|
||||
store.pools[2]
|
||||
.put_object(
|
||||
&bucket,
|
||||
business_object,
|
||||
&mut PutObjReader::from_vec(b"previous business value".to_vec()),
|
||||
&ObjectOptions::default(),
|
||||
)
|
||||
.await
|
||||
.expect("pin the public overwrite to the migration target");
|
||||
let multipart_opts = ObjectOptions {
|
||||
expected_bucket_incarnation_id: Some(
|
||||
store
|
||||
.bucket_incarnation_id(&bucket)
|
||||
.await
|
||||
.expect("load the multipart bucket identity"),
|
||||
),
|
||||
..Default::default()
|
||||
};
|
||||
let routing_upload = new_multipart_upload(&store, 2, &bucket, multipart_object, multipart_opts.clone())
|
||||
.await
|
||||
.expect("pin subsequent public multipart creation to the migration target");
|
||||
let layout = DecommissionErasureLayout { data: 1, parity: 0 };
|
||||
let target_total = source_body.len() * 8;
|
||||
let capacities = vec![
|
||||
DecommissionPoolCapacityInfo::for_test(0, layout, 0, source_body.len() * 2, source_body.len() * 2),
|
||||
DecommissionPoolCapacityInfo::for_test(1, layout, 0, target_total, target_total),
|
||||
DecommissionPoolCapacityInfo::for_test(2, layout, target_total, target_total, 0),
|
||||
];
|
||||
set_decommission_capacity_info_overrides_for_test(store.id, vec![capacities.clone()]);
|
||||
store
|
||||
.save_current_pool_meta_for_decommission_start(&[0], Vec::new())
|
||||
.await
|
||||
.expect("activate source retirement");
|
||||
*other_store.pool_meta.write().await = store.pool_meta.read().await.clone();
|
||||
let before = other_store.pool_meta.read().await.clone();
|
||||
let reservation = before.pools[0]
|
||||
.decommission
|
||||
.as_ref()
|
||||
.expect("active source")
|
||||
.capacity_reservation
|
||||
.as_ref()
|
||||
.expect("durable reservation");
|
||||
assert_eq!(
|
||||
reservation.model_version, 2,
|
||||
"exercise migration I/O outside the global metadata write lock"
|
||||
);
|
||||
assert_eq!(reservation.targets[0].pool_index, 2);
|
||||
|
||||
let barrier =
|
||||
crate::set_disk::rename_fanout_barrier::arm(object, 0, crate::set_disk::rename_fanout_barrier::PHASE_RENAME);
|
||||
let migration_store = Arc::clone(&store);
|
||||
let migration_bucket = bucket.clone();
|
||||
let migration = tokio::spawn(async move {
|
||||
migration_store
|
||||
.decommission_entry_for_test_with_bucket_incarnation(
|
||||
0,
|
||||
MetaCacheEntry {
|
||||
name: object.to_string(),
|
||||
..Default::default()
|
||||
},
|
||||
migration_bucket,
|
||||
migration_store.pools[0].get_disks_by_key(object),
|
||||
)
|
||||
.await
|
||||
});
|
||||
tokio::time::timeout(Duration::from_secs(30), barrier.wait_until_paused())
|
||||
.await
|
||||
.expect("migration must reach target publication");
|
||||
assert!(!migration.is_finished());
|
||||
let mut pending = crate::core::pools::PoolMeta::default();
|
||||
pending
|
||||
.load_no_lock_from_replicas(other_store.pools.clone())
|
||||
.await
|
||||
.expect("read migration intent from the other node");
|
||||
let pending_reservation = pending.pools[0]
|
||||
.decommission
|
||||
.as_ref()
|
||||
.expect("active source")
|
||||
.capacity_reservation
|
||||
.as_ref()
|
||||
.expect("pending reservation")
|
||||
.clone();
|
||||
assert_eq!(pending_reservation.pending_target_physical_bytes, source_body.len());
|
||||
assert_eq!(pending_reservation.consumed_target_physical_bytes, 0);
|
||||
|
||||
tokio::time::timeout(
|
||||
Duration::from_secs(30),
|
||||
other_store.put_object(
|
||||
&bucket,
|
||||
business_object,
|
||||
&mut PutObjReader::from_vec(business_body.clone()),
|
||||
&ObjectOptions::default(),
|
||||
),
|
||||
)
|
||||
.await
|
||||
.expect("business PUT must finish without waiting for the migration target gate")
|
||||
.expect("a reserved healthy pool must accept ordinary PUT");
|
||||
tokio::time::timeout(Duration::from_secs(30), async {
|
||||
let upload = other_store
|
||||
.new_multipart_upload(&bucket, multipart_object, &ObjectOptions::default())
|
||||
.await
|
||||
.expect("the reserved target must accept public multipart creation");
|
||||
assert_ne!(upload.upload_id, routing_upload.upload_id);
|
||||
let lifecycle_guard = other_store
|
||||
.acquire_bucket_lifecycle_read_lock(&bucket)
|
||||
.await
|
||||
.expect("fence the exact-pool multipart placement check");
|
||||
let mut lookup_opts = multipart_opts.clone();
|
||||
lookup_opts.add_bucket_lifecycle_lock_guard(&lifecycle_guard);
|
||||
other_store.pools[2]
|
||||
.get_multipart_info(&bucket, multipart_object, &upload.upload_id, &lookup_opts)
|
||||
.await
|
||||
.expect("public multipart creation must actually select the reserved target");
|
||||
drop(lifecycle_guard);
|
||||
let mut final_part = None;
|
||||
for payload in [vec![0x18; business_body.len()], business_body.clone()] {
|
||||
final_part = Some(
|
||||
other_store
|
||||
.put_object_part(
|
||||
&bucket,
|
||||
multipart_object,
|
||||
&upload.upload_id,
|
||||
1,
|
||||
&mut PutObjReader::from_vec(payload),
|
||||
&ObjectOptions::default(),
|
||||
)
|
||||
.await
|
||||
.expect("the reserved target must accept UploadPart and replacement of the same part"),
|
||||
);
|
||||
}
|
||||
let part = final_part.expect("the replacement part must be present");
|
||||
Arc::clone(&other_store)
|
||||
.complete_multipart_upload(
|
||||
&bucket,
|
||||
multipart_object,
|
||||
&upload.upload_id,
|
||||
vec![crate::storage_api_contracts::multipart::CompletePart {
|
||||
part_num: part.part_num,
|
||||
etag: part.etag,
|
||||
..Default::default()
|
||||
}],
|
||||
&ObjectOptions::default(),
|
||||
)
|
||||
.await
|
||||
.expect("the reserved target must accept multipart completion");
|
||||
other_store
|
||||
.abort_multipart_upload(&bucket, multipart_object, &routing_upload.upload_id, &ObjectOptions::default())
|
||||
.await
|
||||
.expect("ordinary multipart cleanup must not consume the migration's pending intent");
|
||||
})
|
||||
.await
|
||||
.expect("business multipart operations must finish while migration I/O is paused");
|
||||
assert!(!migration.is_finished(), "business publication must overlap paused migration I/O");
|
||||
let mut after_business = crate::core::pools::PoolMeta::default();
|
||||
after_business
|
||||
.load_no_lock_from_replicas(other_store.pools.clone())
|
||||
.await
|
||||
.expect("reload the shared-capacity ledger");
|
||||
assert_eq!(
|
||||
after_business.pools[0]
|
||||
.decommission
|
||||
.as_ref()
|
||||
.expect("active source")
|
||||
.capacity_reservation
|
||||
.as_ref(),
|
||||
Some(&pending_reservation),
|
||||
"ordinary PUT and multipart operations must not settle or consume the migration's pending identity"
|
||||
);
|
||||
|
||||
let mut after_capacity = capacities;
|
||||
// Capacity injection is deterministic; the object I/O and durable metadata use real temporary disks.
|
||||
let free = if lose_capacity {
|
||||
0
|
||||
} else {
|
||||
target_total - source_body.len() - business_body.len() * 2
|
||||
};
|
||||
after_capacity[2] = DecommissionPoolCapacityInfo::for_test(2, layout, free, target_total, target_total - free);
|
||||
set_decommission_capacity_info_overrides_for_test(store.id, vec![after_capacity]);
|
||||
barrier.release();
|
||||
drop(barrier);
|
||||
let migrated = tokio::time::timeout(Duration::from_secs(30), migration)
|
||||
.await
|
||||
.expect("migration must finish after publication resumes")
|
||||
.expect("migration task must not panic");
|
||||
if lose_capacity {
|
||||
let err =
|
||||
migrated.expect_err("capacity loss must prevent source cleanup, even after the target write commits");
|
||||
assert!(err.to_string().contains("capacity"), "unexpected migration error: {err}");
|
||||
} else {
|
||||
migrated.expect("shared-capacity migration should finish when space remains sufficient");
|
||||
}
|
||||
let mut persisted = crate::core::pools::PoolMeta::default();
|
||||
persisted
|
||||
.load_no_lock_from_replicas(other_store.pools.clone())
|
||||
.await
|
||||
.expect("reload finalized migration state");
|
||||
let info = persisted.pools[0].decommission.as_ref().expect("source state");
|
||||
let reservation = info.capacity_reservation.as_ref().expect("migration ledger");
|
||||
assert_eq!(reservation.pending_target_physical_bytes, 0);
|
||||
assert_eq!(
|
||||
reservation.consumed_target_physical_bytes,
|
||||
source_body.len(),
|
||||
"foreign writes must not count as committed source bytes"
|
||||
);
|
||||
assert_eq!(reservation.committed_data_bytes, source_body.len());
|
||||
assert_eq!(info.capacity_blocked_reason.is_some(), lose_capacity);
|
||||
for (pool, key, expected) in [
|
||||
(2, business_object, &business_body),
|
||||
(2, multipart_object, &business_body),
|
||||
(2, object, &source_body),
|
||||
] {
|
||||
let mut reader = other_store.pools[pool]
|
||||
.get_object_reader(&bucket, key, None, HeaderMap::new(), &ObjectOptions::default())
|
||||
.await
|
||||
.expect("all acknowledged target objects must remain readable");
|
||||
let mut actual = Vec::new();
|
||||
reader.read_to_end(&mut actual).await.expect("read the complete target body");
|
||||
assert_eq!(&actual, expected);
|
||||
}
|
||||
if lose_capacity {
|
||||
let mut source = other_store.pools[0]
|
||||
.get_object_reader(&bucket, object, None, HeaderMap::new(), &ObjectOptions::default())
|
||||
.await
|
||||
.expect("capacity-blocked migration must retain its source");
|
||||
let mut actual = Vec::new();
|
||||
source
|
||||
.read_to_end(&mut actual)
|
||||
.await
|
||||
.expect("read the complete retained source");
|
||||
assert_eq!(actual, source_body);
|
||||
other_store
|
||||
.put_object(
|
||||
&bucket,
|
||||
business_object,
|
||||
&mut PutObjReader::from_vec(business_body.clone()),
|
||||
&ObjectOptions::default(),
|
||||
)
|
||||
.await
|
||||
.expect("a capacity-blocked migration must not itself make the healthy target read-only");
|
||||
} else {
|
||||
let err = other_store.pools[0]
|
||||
.get_object_info(&bucket, object, &ObjectOptions::default())
|
||||
.await
|
||||
.expect_err("successful migration must clean the exact source");
|
||||
assert!(crate::error::is_err_object_not_found(&err));
|
||||
}
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
#[test]
|
||||
#[serial_test::serial]
|
||||
fn mixed_batch_delete_admits_only_marker_destinations_during_retirement() {
|
||||
run_large_stack_current_thread_async_test("batch-marker-admission", || async {
|
||||
use crate::storage_api_contracts::object::ObjectToDelete;
|
||||
|
||||
for marker_target in [1, 2] {
|
||||
let (_temp_dirs, store, _other_store) = test_three_pool_stores_with_isolated_node_contexts(None).await;
|
||||
let bucket = test_bucket("batch-marker");
|
||||
store
|
||||
.make_bucket(
|
||||
&bucket,
|
||||
&MakeBucketOptions {
|
||||
versioning_enabled: true,
|
||||
..Default::default()
|
||||
},
|
||||
)
|
||||
.await
|
||||
.expect("create a versioned batch-delete bucket");
|
||||
let source_version = uuid::Uuid::new_v4();
|
||||
for (pool, object, version) in [
|
||||
(0, "purge-source", source_version),
|
||||
(marker_target, "mark-active", uuid::Uuid::new_v4()),
|
||||
] {
|
||||
store.pools[pool]
|
||||
.put_object(
|
||||
&bucket,
|
||||
object,
|
||||
&mut PutObjReader::from_vec(b"version to delete".to_vec()),
|
||||
&ObjectOptions {
|
||||
versioned: true,
|
||||
version_id: Some(version.to_string()),
|
||||
..Default::default()
|
||||
},
|
||||
)
|
||||
.await
|
||||
.expect("seed each exact batch-delete destination");
|
||||
}
|
||||
let layout = DecommissionErasureLayout { data: 1, parity: 0 };
|
||||
set_decommission_capacity_info_overrides_for_test(
|
||||
store.id,
|
||||
vec![vec![
|
||||
DecommissionPoolCapacityInfo::for_test(0, layout, 0, 1024, 1024),
|
||||
DecommissionPoolCapacityInfo::for_test(1, layout, 4096, 4096, 0),
|
||||
DecommissionPoolCapacityInfo::for_test(2, layout, 0, 4096, 4096),
|
||||
]],
|
||||
);
|
||||
store
|
||||
.save_current_pool_meta_for_decommission_start(&[0], Vec::new())
|
||||
.await
|
||||
.expect("reserve pool 1 while pool 0 retires and pool 2 remains unreserved");
|
||||
let (deleted, errors) = store
|
||||
.delete_objects(
|
||||
&bucket,
|
||||
vec![
|
||||
ObjectToDelete {
|
||||
object_name: "mark-active".to_string(),
|
||||
..Default::default()
|
||||
},
|
||||
ObjectToDelete {
|
||||
object_name: "purge-source".to_string(),
|
||||
version_id: Some(source_version),
|
||||
..Default::default()
|
||||
},
|
||||
],
|
||||
ObjectOptions::default(),
|
||||
)
|
||||
.await;
|
||||
assert_eq!(errors.len(), 2);
|
||||
assert!(
|
||||
errors.iter().all(Option::is_none),
|
||||
"the unrelated retiring/reserved pools must not reject marker admission: {errors:?}"
|
||||
);
|
||||
assert_eq!(deleted.len(), 2);
|
||||
assert_eq!(deleted[0].object_name, "mark-active");
|
||||
assert!(deleted[0].delete_marker);
|
||||
assert!(
|
||||
deleted[0].version_id.is_none(),
|
||||
"a latest-version delete does not request an explicit version"
|
||||
);
|
||||
assert!(
|
||||
deleted[0].delete_marker_version_id.is_some(),
|
||||
"the newly created marker must have its own version identity"
|
||||
);
|
||||
assert_eq!(deleted[1].object_name, "purge-source");
|
||||
assert!(!deleted[1].delete_marker);
|
||||
assert_eq!(deleted[1].version_id, Some(source_version));
|
||||
assert!(
|
||||
matches!(
|
||||
store.pools[0]
|
||||
.get_object_info(
|
||||
&bucket,
|
||||
"purge-source",
|
||||
&ObjectOptions {
|
||||
version_id: Some(source_version.to_string()),
|
||||
..Default::default()
|
||||
},
|
||||
)
|
||||
.await,
|
||||
Err(crate::error::Error::ObjectNotFound(..) | crate::error::Error::VersionNotFound(..))
|
||||
),
|
||||
"an exact source deletion must retain its capacity-release path"
|
||||
);
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
#[serial_test::serial]
|
||||
async fn public_upload_part_holds_decommission_capacity_until_rename() {
|
||||
@@ -4958,470 +4499,6 @@ mod decommission_lock_order_tests {
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
#[serial_test::serial]
|
||||
fn scanner_backlog_cas_keeps_fences_after_waiter_cancellation_until_rename_drains() {
|
||||
run_large_stack_current_thread_async_test("scanner-backlog-canceled-waiter", async || {
|
||||
temp_env::async_with_vars([(crate::set_disk::ENV_RUSTFS_PUT_RENAME_EARLY_ACK_ENABLE, Some("true"))], async {
|
||||
let (_temp_dirs, writer, other) =
|
||||
test_three_pool_stores_with_three_disk_sets_with_isolated_node_contexts(None).await;
|
||||
let object = "buckets/.scanner-pause-backlog.json";
|
||||
let set_index = 1;
|
||||
let body = vec![0x37; 1024];
|
||||
assert!(
|
||||
!writer.pools[0].disk_set[0]
|
||||
.shares_namespace_lock_domain(&writer.pools[0].disk_set[set_index])
|
||||
.await
|
||||
);
|
||||
let rename_tasks = crate::set_disk::rename_fanout_barrier::observe_tasks(object);
|
||||
let tail =
|
||||
crate::set_disk::rename_fanout_barrier::arm(object, 0, crate::set_disk::rename_fanout_barrier::PHASE_RENAME);
|
||||
let put_store = Arc::clone(&writer);
|
||||
let put_body = body.clone();
|
||||
let mut put = tokio::spawn(async move {
|
||||
put_store
|
||||
.save_scanner_pause_backlog_replica(0, set_index, put_body, Default::default())
|
||||
.await
|
||||
});
|
||||
tokio::time::timeout(Duration::from_secs(30), tail.wait_until_paused())
|
||||
.await
|
||||
.expect("the native write must reach its held rename");
|
||||
tokio::time::timeout(Duration::from_secs(30), async {
|
||||
while rename_tasks.running() != 1 {
|
||||
tokio::task::yield_now().await;
|
||||
}
|
||||
})
|
||||
.await
|
||||
.expect("the other disks must reach quorum before canceling the waiter");
|
||||
assert!(
|
||||
tokio::time::timeout(Duration::from_millis(100), &mut put).await.is_err(),
|
||||
"native replica publication must await the entire rename tail"
|
||||
);
|
||||
put.abort();
|
||||
assert!(put.await.expect_err("the scanner waiter must be canceled").is_cancelled());
|
||||
|
||||
let capacity_lock = other
|
||||
.new_ns_lock(RUSTFS_META_BUCKET, POOL_META_NAME)
|
||||
.await
|
||||
.expect("capacity lock probe");
|
||||
let object_lock = other
|
||||
.new_ns_lock(RUSTFS_META_BUCKET, object)
|
||||
.await
|
||||
.expect("fixed object lock probe");
|
||||
let mut capacity_probe = tokio::spawn(async move { capacity_lock.get_write_lock(Duration::from_secs(30)).await });
|
||||
let mut object_probe = tokio::spawn(async move { object_lock.get_write_lock(Duration::from_secs(30)).await });
|
||||
for (label, probe) in [("capacity", &mut capacity_probe), ("fixed object", &mut object_probe)] {
|
||||
assert!(
|
||||
tokio::time::timeout(Duration::from_millis(100), probe).await.is_err(),
|
||||
"canceling the scanner waiter must retain its {label} fence while rename is pending"
|
||||
);
|
||||
}
|
||||
tail.release();
|
||||
drop(tail);
|
||||
for probe in [capacity_probe, object_probe] {
|
||||
drop(
|
||||
tokio::time::timeout(Duration::from_secs(30), probe)
|
||||
.await
|
||||
.expect("publication fence must drain after rename")
|
||||
.expect("lock probe must not panic")
|
||||
.expect("publication fence must eventually be released"),
|
||||
);
|
||||
}
|
||||
let mut reader = writer.pools[0].disk_set[set_index]
|
||||
.get_object_reader(RUSTFS_META_BUCKET, object, None, HeaderMap::new(), &ObjectOptions::default())
|
||||
.await
|
||||
.expect("canceled waiter must leave the committed replica readable");
|
||||
let mut actual = Vec::new();
|
||||
reader
|
||||
.read_to_end(&mut actual)
|
||||
.await
|
||||
.expect("read the full native replica after tail drain");
|
||||
assert_eq!(actual, body);
|
||||
})
|
||||
.await;
|
||||
});
|
||||
}
|
||||
|
||||
#[test]
|
||||
#[serial_test::serial]
|
||||
fn scanner_backlog_cas_rejects_lost_capacity_lease_before_publication() {
|
||||
run_large_stack_current_thread_async_test("scanner-backlog-lease-loss", async || {
|
||||
let (_temp_dirs, writer, other) = test_three_pool_stores_with_isolated_node_contexts(None).await;
|
||||
let object = "buckets/.scanner-pause-backlog.json";
|
||||
let body = b"native source before lease loss".to_vec();
|
||||
let original = writer
|
||||
.save_scanner_pause_backlog_replica(2, 1, body.clone(), Default::default())
|
||||
.await
|
||||
.expect("seed the exact native replica set");
|
||||
let (lossy, refresh_calls) = store_with_capacity_lease_loss(&other).await;
|
||||
let barrier = PutObjectCommitBarrier::install(RUSTFS_META_BUCKET, object, PutObjectCommitPause::BeforeQuotaRename);
|
||||
let put = tokio::spawn(async move {
|
||||
lossy
|
||||
.save_scanner_pause_backlog_replica(
|
||||
2,
|
||||
1,
|
||||
b"must not commit after lease loss".to_vec(),
|
||||
crate::storage_api_contracts::object::HTTPPreconditions {
|
||||
if_match: original.etag,
|
||||
..Default::default()
|
||||
},
|
||||
)
|
||||
.await
|
||||
});
|
||||
tokio::time::timeout(Duration::from_secs(30), barrier.wait_until_paused())
|
||||
.await
|
||||
.expect("native CAS must reach its commit barrier");
|
||||
tokio::time::pause();
|
||||
tokio::task::yield_now().await;
|
||||
refresh_calls.arm();
|
||||
tokio::time::advance(Duration::from_secs(11)).await;
|
||||
tokio::task::yield_now().await;
|
||||
assert!(
|
||||
refresh_calls.load(Ordering::Acquire) > 0,
|
||||
"the durable metadata lease must lose refresh quorum"
|
||||
);
|
||||
barrier.release();
|
||||
tokio::time::resume();
|
||||
let err = tokio::time::timeout(Duration::from_secs(30), put)
|
||||
.await
|
||||
.expect("native CAS must finish after the barrier release")
|
||||
.expect("native CAS task must not panic")
|
||||
.expect_err("a lost outer capacity lease must reject native publication");
|
||||
assert!(
|
||||
matches!(err, crate::error::Error::NamespaceLockQuorumUnavailable { .. }),
|
||||
"unexpected lease error: {err}"
|
||||
);
|
||||
drop(barrier);
|
||||
let mut reader = writer.pools[2].disk_set[1]
|
||||
.get_object_reader(RUSTFS_META_BUCKET, object, None, HeaderMap::new(), &ObjectOptions::default())
|
||||
.await
|
||||
.expect("the preexisting replica must survive lease loss");
|
||||
let mut actual = Vec::new();
|
||||
reader.read_to_end(&mut actual).await.expect("read the full retained replica");
|
||||
assert_eq!(actual, body);
|
||||
});
|
||||
}
|
||||
|
||||
#[test]
|
||||
#[serial_test::serial]
|
||||
fn scanner_backlog_cas_rejects_a_retiring_source_on_a_stale_node() {
|
||||
run_large_stack_current_thread_async_test("scanner-backlog-source-fence", async || {
|
||||
let (_temp_dirs, store, writer) = test_three_pool_stores_with_three_disk_sets_with_isolated_node_contexts(None).await;
|
||||
let object = "buckets/.scanner-pause-backlog.json";
|
||||
let body = b"frozen native scanner replica".to_vec();
|
||||
let source_set_index = (writer.pools[0].get_disks_by_key(object).set_index + 1) % writer.pools[0].disk_set.len();
|
||||
assert_ne!(
|
||||
source_set_index,
|
||||
writer.pools[0].get_disks_by_key(object).set_index,
|
||||
"exercise a non-routed native set"
|
||||
);
|
||||
let original = writer
|
||||
.save_scanner_pause_backlog_replica(
|
||||
0,
|
||||
source_set_index,
|
||||
body.clone(),
|
||||
crate::storage_api_contracts::object::HTTPPreconditions {
|
||||
if_none_match: Some("*".to_string()),
|
||||
..Default::default()
|
||||
},
|
||||
)
|
||||
.await
|
||||
.expect("seed a native scanner replica before retirement");
|
||||
assert!(
|
||||
writer
|
||||
.scanner_pause_backlog_writable_set_disks()
|
||||
.await
|
||||
.iter()
|
||||
.any(|set| set.pool_index == 0)
|
||||
);
|
||||
|
||||
let layout = DecommissionErasureLayout { data: 1, parity: 0 };
|
||||
let target_total = body.len() * 8;
|
||||
set_decommission_capacity_info_overrides_for_test(
|
||||
store.id,
|
||||
vec![vec![
|
||||
DecommissionPoolCapacityInfo::for_test(0, layout, 0, body.len() * 2, body.len() * 2),
|
||||
DecommissionPoolCapacityInfo::for_test(1, layout, 0, target_total, target_total),
|
||||
DecommissionPoolCapacityInfo::for_test(2, layout, target_total, target_total, 0),
|
||||
]],
|
||||
);
|
||||
store
|
||||
.save_current_pool_meta_for_decommission_start(&[0], Vec::new())
|
||||
.await
|
||||
.expect("another node durably retires the selected source");
|
||||
assert!(
|
||||
writer.pool_meta.read().await.pools[0].decommission.is_none(),
|
||||
"the writer must retain a stale snapshot"
|
||||
);
|
||||
assert!(
|
||||
writer
|
||||
.scanner_pause_backlog_writable_set_disks()
|
||||
.await
|
||||
.iter()
|
||||
.any(|set| set.pool_index == 0)
|
||||
);
|
||||
|
||||
let result = writer
|
||||
.save_scanner_pause_backlog_replica(
|
||||
0,
|
||||
source_set_index,
|
||||
b"late native scanner update".to_vec(),
|
||||
crate::storage_api_contracts::object::HTTPPreconditions {
|
||||
if_match: original.etag.clone(),
|
||||
..Default::default()
|
||||
},
|
||||
)
|
||||
.await;
|
||||
assert!(
|
||||
matches!(result, Err(crate::error::Error::SlowDown)),
|
||||
"late native source publication must fail: {result:?}"
|
||||
);
|
||||
let mut source = writer.pools[0].disk_set[source_set_index]
|
||||
.get_object_reader(RUSTFS_META_BUCKET, object, None, HeaderMap::new(), &ObjectOptions::default())
|
||||
.await
|
||||
.expect("the original source must remain readable");
|
||||
assert_eq!(source.object_info.etag, original.etag);
|
||||
let mut actual = Vec::new();
|
||||
source
|
||||
.read_to_end(&mut actual)
|
||||
.await
|
||||
.expect("read the entire retained source");
|
||||
assert_eq!(actual, body);
|
||||
|
||||
for set in &writer.pools[2].disk_set {
|
||||
let target_body = format!("surviving native scanner set {}", set.set_index).into_bytes();
|
||||
let committed = writer
|
||||
.save_scanner_pause_backlog_replica(
|
||||
2,
|
||||
set.set_index,
|
||||
target_body.clone(),
|
||||
crate::storage_api_contracts::object::HTTPPreconditions {
|
||||
if_none_match: Some("*".to_string()),
|
||||
..Default::default()
|
||||
},
|
||||
)
|
||||
.await
|
||||
.expect("every reserved healthy target set must still accept scanner replicas");
|
||||
let conflict = writer
|
||||
.save_scanner_pause_backlog_replica(
|
||||
2,
|
||||
set.set_index,
|
||||
b"must not bypass CAS".to_vec(),
|
||||
crate::storage_api_contracts::object::HTTPPreconditions {
|
||||
if_match: Some("stale-native-revision".to_string()),
|
||||
..Default::default()
|
||||
},
|
||||
)
|
||||
.await
|
||||
.expect_err("capacity admission must retain the native writer's CAS");
|
||||
assert!(matches!(conflict, crate::error::Error::PreconditionFailed));
|
||||
let mut target = set
|
||||
.get_object_reader(RUSTFS_META_BUCKET, object, None, HeaderMap::new(), &ObjectOptions::default())
|
||||
.await
|
||||
.expect("read the actual replica set, not the hash-routed set");
|
||||
assert_eq!(target.object_info.etag, committed.etag);
|
||||
let mut actual = Vec::new();
|
||||
target
|
||||
.read_to_end(&mut actual)
|
||||
.await
|
||||
.expect("read the complete native target");
|
||||
assert_eq!(actual, target_body);
|
||||
}
|
||||
for (pool_index, set_index) in [(writer.pools.len(), 0), (0, writer.pools[0].disk_set.len())] {
|
||||
assert!(matches!(
|
||||
writer
|
||||
.save_scanner_pause_backlog_replica(pool_index, set_index, Vec::new(), Default::default())
|
||||
.await,
|
||||
Err(crate::error::Error::InvalidArgument(_, _, _))
|
||||
));
|
||||
}
|
||||
store
|
||||
.decommission_cancel(0)
|
||||
.await
|
||||
.expect("cancel retirement before restoring native membership");
|
||||
writer
|
||||
.save_scanner_pause_backlog_replica(
|
||||
0,
|
||||
source_set_index,
|
||||
b"canceled source membership repair".to_vec(),
|
||||
crate::storage_api_contracts::object::HTTPPreconditions {
|
||||
if_match: original.etag,
|
||||
..Default::default()
|
||||
},
|
||||
)
|
||||
.await
|
||||
.expect("cancel must retain scanner's existing native membership repair contract");
|
||||
});
|
||||
}
|
||||
|
||||
#[test]
|
||||
#[serial_test::serial]
|
||||
fn scanner_backlog_native_replica_reconciles_capacity_and_cleans_source() {
|
||||
run_large_stack_current_thread_async_test("scanner-backlog-reconcile", async || {
|
||||
let (_temp_dirs, store, other_store) =
|
||||
test_three_pool_stores_with_three_disk_sets_with_isolated_node_contexts(None).await;
|
||||
let object = "buckets/.scanner-pause-backlog.json";
|
||||
let body = br#"{"schemaVersion":1,"generation":2}"#.to_vec();
|
||||
let old_body = br#"{"schemaVersion":1,"generation":1}"#.to_vec();
|
||||
let source_time = time::OffsetDateTime::UNIX_EPOCH + time::Duration::seconds(20);
|
||||
let target_time = time::OffsetDateTime::UNIX_EPOCH + time::Duration::seconds(10);
|
||||
for (pool_index, payload, mod_time) in [(0, body.clone(), source_time), (2, old_body, target_time)] {
|
||||
store.pools[pool_index]
|
||||
.put_object(
|
||||
RUSTFS_META_BUCKET,
|
||||
object,
|
||||
&mut PutObjReader::from_vec(payload),
|
||||
&ObjectOptions {
|
||||
max_parity: true,
|
||||
mod_time: Some(mod_time),
|
||||
..Default::default()
|
||||
},
|
||||
)
|
||||
.await
|
||||
.expect("seed native scanner replicas with independent write times");
|
||||
}
|
||||
let layout = DecommissionErasureLayout { data: 1, parity: 0 };
|
||||
let target_total = body.len() * 8;
|
||||
let capacities = vec![
|
||||
DecommissionPoolCapacityInfo::for_test(0, layout, 0, body.len() * 2, body.len() * 2),
|
||||
DecommissionPoolCapacityInfo::for_test(1, layout, 0, target_total, target_total),
|
||||
DecommissionPoolCapacityInfo::for_test(2, layout, target_total, target_total, 0),
|
||||
];
|
||||
set_decommission_capacity_info_overrides_for_test(store.id, vec![capacities.clone()]);
|
||||
store
|
||||
.save_current_pool_meta_for_decommission_start(&[0], Vec::new())
|
||||
.await
|
||||
.expect("activate the source reservation");
|
||||
let owner = decommission_capacity_owner(&*store.pool_meta.read().await);
|
||||
let source_reader = store.pools[0]
|
||||
.get_object_reader(
|
||||
RUSTFS_META_BUCKET,
|
||||
object,
|
||||
None,
|
||||
HeaderMap::new(),
|
||||
&ObjectOptions {
|
||||
no_lock: true,
|
||||
data_movement: true,
|
||||
raw_data_movement_read: true,
|
||||
..Default::default()
|
||||
},
|
||||
)
|
||||
.await
|
||||
.expect("read the frozen source replica");
|
||||
let conflict = data_movement::migrate_decommission_object(
|
||||
Arc::clone(&store),
|
||||
0,
|
||||
RUSTFS_META_BUCKET.to_string(),
|
||||
source_reader,
|
||||
None,
|
||||
"scanner_backlog_conflict",
|
||||
Some(owner),
|
||||
)
|
||||
.await
|
||||
.expect_err("a different older native ledger must retain its source and capacity intent");
|
||||
assert!(conflict.to_string().contains("Precondition failed"), "unexpected conflict: {conflict}");
|
||||
let mut persisted = crate::core::pools::PoolMeta::default();
|
||||
persisted
|
||||
.load_no_lock_from_replicas(store.pools.clone())
|
||||
.await
|
||||
.expect("reload the unresolved intent");
|
||||
assert_eq!(
|
||||
persisted.pools[0]
|
||||
.decommission
|
||||
.as_ref()
|
||||
.expect("source state")
|
||||
.capacity_reservation
|
||||
.as_ref()
|
||||
.expect("durable capacity")
|
||||
.pending_target_physical_bytes,
|
||||
body.len()
|
||||
);
|
||||
let previous = store.pools[2]
|
||||
.get_object_info(RUSTFS_META_BUCKET, object, &ObjectOptions::default())
|
||||
.await
|
||||
.expect("read the native writer's CAS revision");
|
||||
let replacement = store.pools[2]
|
||||
.put_object(
|
||||
RUSTFS_META_BUCKET,
|
||||
object,
|
||||
&mut PutObjReader::from_vec(body.clone()),
|
||||
&ObjectOptions {
|
||||
max_parity: true,
|
||||
mod_time: Some(target_time),
|
||||
http_preconditions: Some(crate::storage_api_contracts::object::HTTPPreconditions {
|
||||
if_match: previous.etag,
|
||||
..Default::default()
|
||||
}),
|
||||
..Default::default()
|
||||
},
|
||||
)
|
||||
.await
|
||||
.expect("native scanner CAS converges the payload without a migration marker");
|
||||
assert!(!data_movement::is_owned_data_movement_target(&replacement));
|
||||
*other_store.pool_meta.write().await = persisted;
|
||||
set_decommission_capacity_info_overrides_for_test(other_store.id, vec![capacities]);
|
||||
tokio::time::timeout(
|
||||
Duration::from_secs(30),
|
||||
other_store.decommission_entry_for_test(
|
||||
0,
|
||||
MetaCacheEntry {
|
||||
name: object.to_string(),
|
||||
..Default::default()
|
||||
},
|
||||
RUSTFS_META_BUCKET.to_string(),
|
||||
other_store.pools[0].get_disks_by_key(object),
|
||||
),
|
||||
)
|
||||
.await
|
||||
.expect("replica conflict recovery must be bounded")
|
||||
.expect("identical native replica should finish migration on the reloaded node");
|
||||
let mut reconciled = crate::core::pools::PoolMeta::default();
|
||||
reconciled
|
||||
.load_no_lock_from_replicas(other_store.pools.clone())
|
||||
.await
|
||||
.expect("reload reconciled capacity");
|
||||
let reservation = reconciled.pools[0]
|
||||
.decommission
|
||||
.as_ref()
|
||||
.expect("source state")
|
||||
.capacity_reservation
|
||||
.as_ref()
|
||||
.expect("reconciled capacity");
|
||||
assert_eq!(reservation.pending_target_physical_bytes, 0);
|
||||
assert_eq!(reservation.committed_data_bytes, body.len());
|
||||
assert_eq!(reservation.consumed_target_physical_bytes, body.len());
|
||||
assert!(reservation.targets.iter().all(|target| target.pending_mutation_id.is_none()));
|
||||
assert_eq!(
|
||||
other_store.pool_meta.read().await.pools[0]
|
||||
.decommission
|
||||
.as_ref()
|
||||
.expect("worker progress")
|
||||
.items_decommission_failed,
|
||||
0
|
||||
);
|
||||
let missing = other_store.pools[0]
|
||||
.get_object_info(RUSTFS_META_BUCKET, object, &ObjectOptions::default())
|
||||
.await
|
||||
.expect_err("the source should be cleaned only after equivalent-target capacity reconciliation");
|
||||
assert!(crate::error::is_err_object_not_found(&missing));
|
||||
let mut target_reader = other_store.pools[2]
|
||||
.get_object_reader(RUSTFS_META_BUCKET, object, None, HeaderMap::new(), &ObjectOptions::default())
|
||||
.await
|
||||
.expect("the surviving replica should remain readable");
|
||||
assert_eq!(
|
||||
target_reader.object_info.mod_time,
|
||||
Some(target_time),
|
||||
"recovery must not overwrite the native target"
|
||||
);
|
||||
let mut actual = Vec::new();
|
||||
target_reader
|
||||
.read_to_end(&mut actual)
|
||||
.await
|
||||
.expect("read surviving ledger bytes");
|
||||
assert_eq!(actual, body);
|
||||
});
|
||||
}
|
||||
|
||||
#[test]
|
||||
#[serial_test::serial]
|
||||
fn data_movement_equivalent_target_reconciles_published_capacity_after_restart() {
|
||||
|
||||
@@ -984,24 +984,6 @@ fn is_superseding_unversioned_data_movement_object(source: &ObjectInfo, target:
|
||||
.is_some_and(|(source_time, target_time)| target_time > source_time)
|
||||
}
|
||||
|
||||
fn is_equivalent_scanner_backlog_replica(source: &ObjectInfo, target: &ObjectInfo, compare_part_checksums: bool) -> bool {
|
||||
// Scanner publishes this exact payload to surviving sets with CAS. Each
|
||||
// set assigns its own write time; that timestamp is not a ledger generation.
|
||||
// Accept only an identical, known unversioned identity, never a different
|
||||
// record based on timestamp ordering or a similarly named user object.
|
||||
source.bucket == crate::disk::RUSTFS_META_BUCKET
|
||||
&& target.bucket == source.bucket
|
||||
&& source.name == "buckets/.scanner-pause-backlog.json"
|
||||
&& target.name == source.name
|
||||
&& is_unversioned_data_movement_object(source)
|
||||
&& is_unversioned_data_movement_object(target)
|
||||
&& !source.delete_marker
|
||||
&& source.mod_time.is_some()
|
||||
&& target.mod_time.is_some()
|
||||
&& source.etag.as_ref().is_some_and(|etag| !etag.is_empty())
|
||||
&& is_equivalent_data_movement_object_identity(source, target, false, compare_part_checksums)
|
||||
}
|
||||
|
||||
fn is_data_movement_upload_takeover_target(source: &ObjectInfo, target: &ObjectInfo, compare_part_checksums: bool) -> bool {
|
||||
let identity = data_movement_upload_identity(source);
|
||||
source.mod_time.is_some()
|
||||
@@ -1471,9 +1453,7 @@ fn resolve_data_movement_overwrite_resume_result_for(
|
||||
return Ok(true);
|
||||
}
|
||||
|
||||
Ok(matches!(err, Error::PreconditionFailed)
|
||||
&& (is_equivalent_scanner_backlog_replica(source, &target, compare_part_checksums)
|
||||
|| is_superseding_unversioned_data_movement_object(source, &target)))
|
||||
Ok(matches!(err, Error::PreconditionFailed) && is_superseding_unversioned_data_movement_object(source, &target))
|
||||
}
|
||||
|
||||
#[derive(Clone, Copy)]
|
||||
@@ -3308,132 +3288,6 @@ mod tests {
|
||||
assert!(overwrite_resume_for_target(&source, source.clone()));
|
||||
}
|
||||
|
||||
fn scanner_backlog_replica_pair() -> (ObjectInfo, ObjectInfo) {
|
||||
let source = ObjectInfo {
|
||||
bucket: crate::disk::RUSTFS_META_BUCKET.to_string(),
|
||||
name: "buckets/.scanner-pause-backlog.json".to_string(),
|
||||
version_id: None,
|
||||
mod_time: Some(OffsetDateTime::UNIX_EPOCH + time::Duration::SECOND),
|
||||
..overwrite_equivalence_source()
|
||||
};
|
||||
let target = ObjectInfo {
|
||||
mod_time: Some(OffsetDateTime::UNIX_EPOCH),
|
||||
..source.clone()
|
||||
};
|
||||
(source, target)
|
||||
}
|
||||
|
||||
fn scanner_backlog_precondition_resumes(source: &ObjectInfo, target: ObjectInfo) -> bool {
|
||||
resolve_data_movement_overwrite_resume_result_for(&Error::PreconditionFailed, Ok(Some(target)), source, 0, 1, true)
|
||||
.expect("scanner replica conflict should be adjudicated")
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_scanner_backlog_resume_accepts_identical_native_replica_with_older_write_time() {
|
||||
let (source, target) = scanner_backlog_replica_pair();
|
||||
assert!(!is_owned_data_movement_target(&target), "native scanner writes are not migration copies");
|
||||
assert!(!is_equivalent_data_movement_object(&source, &target));
|
||||
assert!(
|
||||
scanner_backlog_precondition_resumes(&source, target),
|
||||
"identical ledger payloads have replica-local write times, not distinct committed generations"
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_scanner_backlog_resume_rejects_changed_payload_or_metadata() {
|
||||
let (source, target) = scanner_backlog_replica_pair();
|
||||
let mut different_etag = target.clone();
|
||||
different_etag.etag = Some("different-ledger-generation".to_string());
|
||||
let mut different_size = target.clone();
|
||||
different_size.size += 1;
|
||||
let mut different_checksum = target.clone();
|
||||
different_checksum.checksum = Some(Bytes::from_static(b"different-checksum"));
|
||||
let mut different_metadata = target.clone();
|
||||
Arc::make_mut(&mut different_metadata.user_defined).insert("x-amz-meta-key".to_string(), "different".to_string());
|
||||
let mut different_tags = target.clone();
|
||||
different_tags.user_tags = Arc::new("tag=changed".to_string());
|
||||
let mut different_parts = target.clone();
|
||||
Arc::make_mut(&mut different_parts.parts)[0].etag = "different-part".to_string();
|
||||
let mut different_tier = target;
|
||||
different_tier.transitioned_object.tier = "different-tier".to_string();
|
||||
for (label, different) in [
|
||||
("etag", different_etag),
|
||||
("size", different_size),
|
||||
("checksum", different_checksum),
|
||||
("metadata", different_metadata),
|
||||
("tags", different_tags),
|
||||
("parts", different_parts),
|
||||
("tier", different_tier),
|
||||
] {
|
||||
assert!(
|
||||
!scanner_backlog_precondition_resumes(&source, different),
|
||||
"replica-local timestamps do not authorize a changed {label}"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_scanner_backlog_resume_rejects_other_namespaces_and_incomplete_identity() {
|
||||
let (source, target) = scanner_backlog_replica_pair();
|
||||
for (bucket, name) in [
|
||||
("user-bucket", "buckets/.scanner-pause-backlog.json"),
|
||||
(crate::disk::RUSTFS_META_BUCKET, "buckets/.scanner-pause-backlog.json.bkp"),
|
||||
(crate::disk::RUSTFS_META_BUCKET, "buckets/.usage-cache.bin"),
|
||||
] {
|
||||
let mut source = source.clone();
|
||||
let mut target = target.clone();
|
||||
for replica in [&mut source, &mut target] {
|
||||
replica.bucket = bucket.to_string();
|
||||
replica.name = name.to_string();
|
||||
}
|
||||
assert!(!scanner_backlog_precondition_resumes(&source, target), "out-of-scope key {bucket}/{name}");
|
||||
}
|
||||
for missing in ["etag", "empty-etag", "source-time", "target-time", "version", "delete-marker"] {
|
||||
let mut source = source.clone();
|
||||
let mut target = target.clone();
|
||||
match missing {
|
||||
"etag" => {
|
||||
source.etag = None;
|
||||
target.etag = None;
|
||||
}
|
||||
"empty-etag" => {
|
||||
source.etag = Some(String::new());
|
||||
target.etag = Some(String::new());
|
||||
}
|
||||
"source-time" => source.mod_time = None,
|
||||
"target-time" => target.mod_time = None,
|
||||
"version" => {
|
||||
source.version_id = Some(Uuid::from_u128(1));
|
||||
target.version_id = source.version_id;
|
||||
}
|
||||
"delete-marker" => {
|
||||
source.delete_marker = true;
|
||||
target.delete_marker = true;
|
||||
}
|
||||
_ => unreachable!("all identity variants are enumerated above"),
|
||||
}
|
||||
assert!(!scanner_backlog_precondition_resumes(&source, target), "unsupported identity: {missing}");
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_scanner_backlog_resume_requires_a_cross_pool_precondition_conflict() {
|
||||
let (source, target) = scanner_backlog_replica_pair();
|
||||
for (err, target_pool) in [
|
||||
(Error::PreconditionFailed, 0),
|
||||
(Error::SlowDown, 1),
|
||||
(
|
||||
Error::InvalidUploadID(source.bucket.clone(), source.name.clone(), "upload".to_string()),
|
||||
1,
|
||||
),
|
||||
] {
|
||||
assert!(
|
||||
!resolve_data_movement_overwrite_resume_result_for(&err, Ok(Some(target.clone())), &source, 0, target_pool, true)
|
||||
.expect("non-resumable conflict should return false")
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_data_movement_overwrite_resume_accepts_part_mod_time_drift() {
|
||||
let source = overwrite_equivalence_source();
|
||||
|
||||
@@ -22543,112 +22543,6 @@ mod test {
|
||||
);
|
||||
}
|
||||
|
||||
#[cfg(unix)]
|
||||
#[tokio::test]
|
||||
async fn conditional_mrf_manifest_storage_full_keeps_recovery_anchors() {
|
||||
use tempfile::tempdir;
|
||||
|
||||
const MRF_COMMIT_MANIFEST_SLOT_0: &str = ".heal-mrf-commit.0.bin";
|
||||
const MRF_SCOPED_JOURNAL_PATH: &str = "buckets/.heal/mrf/journal-scoped.bin";
|
||||
|
||||
let _mode = durability_mode_override::set(DurabilityMode::Relaxed);
|
||||
let dir = tempdir().expect("temp dir should be created");
|
||||
let endpoint = Endpoint::try_from(dir.path().to_str().expect("temp dir should be utf8")).expect("endpoint should parse");
|
||||
let disk = LocalDisk::new(&endpoint, false).await.expect("local disk should be created");
|
||||
let previous_manifest = Bytes::from_static(b"mrf-committed-manifest-v1");
|
||||
let successor_manifest = Bytes::from_static(b"mrf-committed-manifest-v2");
|
||||
let legacy_journal = Bytes::from_static(b"legacy-mrf-journal-records");
|
||||
|
||||
assert_eq!(
|
||||
disk.compare_and_update_file(RUSTFS_META_BUCKET, MRF_COMMIT_MANIFEST_SLOT_0, None, Some(previous_manifest.clone()),)
|
||||
.await
|
||||
.expect("previous MRF manifest should commit"),
|
||||
ConditionalFileUpdate::Updated
|
||||
);
|
||||
disk.write_all(RUSTFS_META_BUCKET, MRF_SCOPED_JOURNAL_PATH, legacy_journal.clone())
|
||||
.await
|
||||
.expect("legacy MRF journal should be retained");
|
||||
|
||||
let manifest_path = disk
|
||||
.get_object_path(RUSTFS_META_BUCKET, MRF_COMMIT_MANIFEST_SLOT_0)
|
||||
.expect("MRF manifest path should resolve");
|
||||
let parent = manifest_path.parent().expect("MRF manifest path should have a parent");
|
||||
os::fsync_dir_recorder::set_failure(parent, ErrorKind::StorageFull);
|
||||
|
||||
let err = disk
|
||||
.compare_and_update_file(
|
||||
RUSTFS_META_BUCKET,
|
||||
MRF_COMMIT_MANIFEST_SLOT_0,
|
||||
Some(previous_manifest.clone()),
|
||||
Some(successor_manifest),
|
||||
)
|
||||
.await
|
||||
.expect_err("storage-full fsync failure must fail the MRF manifest successor commit");
|
||||
assert!(matches!(err, DiskError::Io(ref err) if err.kind() == ErrorKind::StorageFull));
|
||||
assert_eq!(
|
||||
disk.read_all(RUSTFS_META_BUCKET, MRF_COMMIT_MANIFEST_SLOT_0)
|
||||
.await
|
||||
.expect("previous committed MRF manifest should remain readable after storage-full rollback"),
|
||||
previous_manifest
|
||||
);
|
||||
assert_eq!(
|
||||
disk.read_all(RUSTFS_META_BUCKET, MRF_SCOPED_JOURNAL_PATH)
|
||||
.await
|
||||
.expect("legacy MRF journal should remain readable after storage-full manifest publication failure"),
|
||||
legacy_journal
|
||||
);
|
||||
}
|
||||
|
||||
#[cfg(unix)]
|
||||
#[tokio::test]
|
||||
async fn conditional_mrf_manifest_storage_full_delete_keeps_recovery_anchors() {
|
||||
use tempfile::tempdir;
|
||||
|
||||
const MRF_COMMIT_MANIFEST_SLOT_0: &str = ".heal-mrf-commit.0.bin";
|
||||
const MRF_SCOPED_JOURNAL_PATH: &str = "buckets/.heal/mrf/journal-scoped.bin";
|
||||
|
||||
let _mode = durability_mode_override::set(DurabilityMode::Relaxed);
|
||||
let dir = tempdir().expect("temp dir should be created");
|
||||
let endpoint = Endpoint::try_from(dir.path().to_str().expect("temp dir should be utf8")).expect("endpoint should parse");
|
||||
let disk = LocalDisk::new(&endpoint, false).await.expect("local disk should be created");
|
||||
let committed_manifest = Bytes::from_static(b"mrf-committed-manifest-v1");
|
||||
let legacy_journal = Bytes::from_static(b"legacy-mrf-journal-records");
|
||||
|
||||
assert_eq!(
|
||||
disk.compare_and_update_file(RUSTFS_META_BUCKET, MRF_COMMIT_MANIFEST_SLOT_0, None, Some(committed_manifest.clone()),)
|
||||
.await
|
||||
.expect("committed MRF manifest should publish"),
|
||||
ConditionalFileUpdate::Updated
|
||||
);
|
||||
disk.write_all(RUSTFS_META_BUCKET, MRF_SCOPED_JOURNAL_PATH, legacy_journal.clone())
|
||||
.await
|
||||
.expect("legacy MRF journal should be retained");
|
||||
|
||||
let manifest_path = disk
|
||||
.get_object_path(RUSTFS_META_BUCKET, MRF_COMMIT_MANIFEST_SLOT_0)
|
||||
.expect("MRF manifest path should resolve");
|
||||
let parent = manifest_path.parent().expect("MRF manifest path should have a parent");
|
||||
os::fsync_dir_recorder::set_failure(parent, ErrorKind::StorageFull);
|
||||
|
||||
let err = disk
|
||||
.compare_and_update_file(RUSTFS_META_BUCKET, MRF_COMMIT_MANIFEST_SLOT_0, Some(committed_manifest.clone()), None)
|
||||
.await
|
||||
.expect_err("storage-full fsync failure must fail the MRF manifest cleanup delete");
|
||||
assert!(matches!(err, DiskError::Io(ref err) if err.kind() == ErrorKind::StorageFull));
|
||||
assert_eq!(
|
||||
disk.read_all(RUSTFS_META_BUCKET, MRF_COMMIT_MANIFEST_SLOT_0)
|
||||
.await
|
||||
.expect("committed MRF manifest should be restored after failed cleanup delete"),
|
||||
committed_manifest
|
||||
);
|
||||
assert_eq!(
|
||||
disk.read_all(RUSTFS_META_BUCKET, MRF_SCOPED_JOURNAL_PATH)
|
||||
.await
|
||||
.expect("legacy MRF journal should remain readable after failed cleanup delete"),
|
||||
legacy_journal
|
||||
);
|
||||
}
|
||||
|
||||
#[cfg(unix)]
|
||||
#[tokio::test]
|
||||
async fn conditional_file_update_dir_fsync_failure_removes_new_file_without_anchor() {
|
||||
|
||||
@@ -431,7 +431,7 @@ impl<'a> MultiWriter<'a> {
|
||||
errs = ?self.errs,
|
||||
"Erasure encode write quorum unavailable: {summary_text}"
|
||||
);
|
||||
Err(write_err.into())
|
||||
Err(std::io::Error::other(format!("Failed to write data: {summary_text}")))
|
||||
}
|
||||
|
||||
async fn shutdown_writer(writer_opt: &mut Option<BitrotWriterWrapper>, err: &mut Option<Error>) {
|
||||
@@ -503,7 +503,7 @@ impl<'a> MultiWriter<'a> {
|
||||
errs = ?self.errs,
|
||||
"Erasure encode shutdown quorum unavailable: {summary_text}"
|
||||
);
|
||||
Err(write_err.into())
|
||||
Err(std::io::Error::other(format!("Failed to shutdown writers: {summary_text}")))
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1002,7 +1002,6 @@ impl Erasure {
|
||||
mod tests {
|
||||
use super::*;
|
||||
use crate::erasure::coding::{BitrotWriterWrapper, CustomWriter};
|
||||
use crate::error::StorageError;
|
||||
use rustfs_rio::HardLimitReader;
|
||||
use rustfs_utils::HashAlgorithm;
|
||||
use std::future::Future;
|
||||
@@ -1452,14 +1451,7 @@ mod tests {
|
||||
Ok(_) => panic!("writer quorum failure should fail the encode pipeline"),
|
||||
Err(err) => err,
|
||||
};
|
||||
let err = StorageError::from(err);
|
||||
assert!(matches!(
|
||||
&err,
|
||||
StorageError::Io(source)
|
||||
if source.kind() == std::io::ErrorKind::Other
|
||||
&& source.to_string() == "injected write failure after producer blocks"
|
||||
));
|
||||
assert!(!err.is_quorum_error());
|
||||
assert!(err.to_string().contains("Failed to write data"));
|
||||
tokio::time::timeout(Duration::from_secs(1), reader_dropped)
|
||||
.await
|
||||
.expect("writer failure should abort the blocked producer")
|
||||
@@ -1652,7 +1644,7 @@ mod tests {
|
||||
|
||||
#[tokio::test]
|
||||
async fn multi_writer_short_write_fails_before_shutdown() {
|
||||
let mut writers = vec![Some(bitrot_writer(ShortWriteWriter, 32))];
|
||||
let mut writers = vec![Some(bitrot_writer(ShortWriteWriter, 16))];
|
||||
let err = {
|
||||
let mut writer = MultiWriter::new(&mut writers, 1);
|
||||
writer
|
||||
@@ -1661,93 +1653,63 @@ mod tests {
|
||||
.expect_err("short writes must fail the shard writer")
|
||||
};
|
||||
|
||||
let err = StorageError::from(err);
|
||||
assert!(matches!(&err, StorageError::Io(source) if source.kind() == std::io::ErrorKind::WriteZero));
|
||||
assert!(!err.is_quorum_error());
|
||||
assert!(err.to_string().contains("Failed to write data"));
|
||||
assert!(writers[0].is_none(), "short-write shard must be removed before commit");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn multi_writer_reports_fallback_summary_when_only_offline_writers_remain() {
|
||||
let mut writers = vec![None, None];
|
||||
let (err, summary) = {
|
||||
let err = {
|
||||
let mut writer = MultiWriter::new(&mut writers, 1);
|
||||
let err = writer
|
||||
writer
|
||||
.write(vec![Bytes::from_static(b"offline-a"), Bytes::from_static(b"offline-b")])
|
||||
.await
|
||||
.expect_err("offline writers cannot satisfy write quorum");
|
||||
let summary = build_write_quorum_failure_summary(&writer.errs, OBJECT_OP_IGNORED_ERRS, writer.write_quorum);
|
||||
(err, format_write_quorum_failure(&summary))
|
||||
.expect_err("offline writers cannot satisfy write quorum")
|
||||
};
|
||||
|
||||
assert_eq!(
|
||||
err.get_ref().and_then(|source| source.downcast_ref::<Error>()),
|
||||
Some(&Error::ErasureWriteQuorum),
|
||||
);
|
||||
let err = StorageError::from(err);
|
||||
assert_eq!(err, StorageError::ErasureWriteQuorum);
|
||||
assert!(err.is_quorum_error());
|
||||
assert!(summary.contains("offline-disks=2/2"));
|
||||
assert!(summary.contains("required=1"));
|
||||
let err = err.to_string();
|
||||
assert!(err.contains("Failed to write data"));
|
||||
assert!(err.contains("offline-disks=2/2"));
|
||||
assert!(err.contains("required=1"));
|
||||
|
||||
let (shutdown_err, summary) = {
|
||||
let shutdown_err = {
|
||||
let mut writer = MultiWriter::new(&mut writers, 1);
|
||||
let err = writer
|
||||
writer
|
||||
.shutdown()
|
||||
.await
|
||||
.expect_err("offline writers cannot satisfy shutdown quorum");
|
||||
let summary = build_write_quorum_failure_summary(&writer.errs, OBJECT_OP_IGNORED_ERRS, writer.write_quorum);
|
||||
(err, format_write_quorum_failure(&summary))
|
||||
.expect_err("offline writers cannot satisfy shutdown quorum")
|
||||
};
|
||||
|
||||
assert_eq!(
|
||||
shutdown_err.get_ref().and_then(|source| source.downcast_ref::<Error>()),
|
||||
Some(&Error::ErasureWriteQuorum),
|
||||
);
|
||||
let shutdown_err = StorageError::from(shutdown_err);
|
||||
assert_eq!(shutdown_err, StorageError::ErasureWriteQuorum);
|
||||
assert!(shutdown_err.is_quorum_error());
|
||||
assert!(summary.contains("offline-disks=2/2"));
|
||||
assert!(summary.contains("required=1"));
|
||||
let shutdown_err = shutdown_err.to_string();
|
||||
assert!(shutdown_err.contains("Failed to shutdown writers"));
|
||||
assert!(shutdown_err.contains("offline-disks=2/2"));
|
||||
assert!(shutdown_err.contains("required=1"));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn multi_writer_reports_quorum_failure_when_quorum_exceeds_writer_count() {
|
||||
let committed = Arc::new(Mutex::new(Vec::new()));
|
||||
let mut writers = vec![Some(bitrot_writer(DeferredCommitWriter::new(committed), 32))];
|
||||
let mut writers = vec![Some(bitrot_writer(DeferredCommitWriter::new(committed), 16))];
|
||||
let mut writer = MultiWriter::new(&mut writers, 2);
|
||||
|
||||
let err = writer
|
||||
.write(vec![Bytes::from_static(b"quorum impossible")])
|
||||
.await
|
||||
.expect_err("write quorum above writer count must fail");
|
||||
assert_eq!(
|
||||
err.get_ref().and_then(|source| source.downcast_ref::<Error>()),
|
||||
Some(&Error::ErasureWriteQuorum),
|
||||
);
|
||||
let err = StorageError::from(err);
|
||||
assert_eq!(err, StorageError::ErasureWriteQuorum);
|
||||
assert!(err.is_quorum_error());
|
||||
let summary = build_write_quorum_failure_summary(&writer.errs, OBJECT_OP_IGNORED_ERRS, writer.write_quorum);
|
||||
let summary = format_write_quorum_failure(&summary);
|
||||
assert!(summary.contains("required=2"));
|
||||
assert!(summary.contains("erasure write quorum"));
|
||||
let err = err.to_string();
|
||||
assert!(err.contains("Failed to write data"));
|
||||
assert!(err.contains("required=2"));
|
||||
assert!(err.contains("erasure write quorum"));
|
||||
|
||||
let shutdown_err = writer
|
||||
.shutdown()
|
||||
.await
|
||||
.expect_err("shutdown quorum above writer count must fail");
|
||||
assert_eq!(
|
||||
shutdown_err.get_ref().and_then(|source| source.downcast_ref::<Error>()),
|
||||
Some(&Error::ErasureWriteQuorum),
|
||||
);
|
||||
let shutdown_err = StorageError::from(shutdown_err);
|
||||
assert_eq!(shutdown_err, StorageError::ErasureWriteQuorum);
|
||||
assert!(shutdown_err.is_quorum_error());
|
||||
let summary = build_write_quorum_failure_summary(&writer.errs, OBJECT_OP_IGNORED_ERRS, writer.write_quorum);
|
||||
let summary = format_write_quorum_failure(&summary);
|
||||
assert!(summary.contains("required=2"));
|
||||
assert!(summary.contains("erasure write quorum"));
|
||||
let shutdown_err = shutdown_err.to_string();
|
||||
assert!(shutdown_err.contains("Failed to shutdown writers"));
|
||||
assert!(shutdown_err.contains("required=2"));
|
||||
assert!(shutdown_err.contains("erasure write quorum"));
|
||||
}
|
||||
|
||||
// The production wiring (`MultiWriter::new`) must arm a real deadline by
|
||||
@@ -1832,13 +1794,7 @@ mod tests {
|
||||
.write(four_shards())
|
||||
.await
|
||||
.expect_err("two stalled writers must fail the write quorum instead of hanging");
|
||||
assert_eq!(
|
||||
err.get_ref().and_then(|source| source.downcast_ref::<Error>()),
|
||||
Some(&Error::ErasureWriteQuorum),
|
||||
);
|
||||
let err = StorageError::from(err);
|
||||
assert_eq!(err, StorageError::ErasureWriteQuorum);
|
||||
assert!(err.is_quorum_error());
|
||||
assert!(err.to_string().contains("Failed to write data"));
|
||||
}
|
||||
|
||||
// A small object whose bytes were fully buffered leaves `write` succeeding
|
||||
@@ -1883,13 +1839,7 @@ mod tests {
|
||||
.shutdown()
|
||||
.await
|
||||
.expect_err("two shutdown stalls must fail the shutdown quorum instead of hanging");
|
||||
assert_eq!(
|
||||
err.get_ref().and_then(|source| source.downcast_ref::<Error>()),
|
||||
Some(&Error::ErasureWriteQuorum),
|
||||
);
|
||||
let err = StorageError::from(err);
|
||||
assert_eq!(err, StorageError::ErasureWriteQuorum);
|
||||
assert!(err.is_quorum_error());
|
||||
assert!(err.to_string().contains("Failed to shutdown writers"));
|
||||
}
|
||||
|
||||
// A slow-but-honest writer that keeps completing shards (delay < stall
|
||||
@@ -2171,13 +2121,7 @@ mod tests {
|
||||
.await
|
||||
.expect_err("streaming encode must fail when write quorum is unavailable");
|
||||
|
||||
assert_eq!(
|
||||
err.get_ref().and_then(|source| source.downcast_ref::<Error>()),
|
||||
Some(&Error::ErasureWriteQuorum),
|
||||
);
|
||||
let err = StorageError::from(err);
|
||||
assert_eq!(err, StorageError::ErasureWriteQuorum);
|
||||
assert!(err.is_quorum_error());
|
||||
assert!(err.to_string().contains("Failed to write data"));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -2201,13 +2145,7 @@ mod tests {
|
||||
.await
|
||||
.expect_err("write quorum failure must fail the inline encode");
|
||||
|
||||
assert_eq!(
|
||||
err.get_ref().and_then(|source| source.downcast_ref::<Error>()),
|
||||
Some(&Error::ErasureWriteQuorum),
|
||||
);
|
||||
let err = StorageError::from(err);
|
||||
assert_eq!(err, StorageError::ErasureWriteQuorum);
|
||||
assert!(err.is_quorum_error());
|
||||
assert!(err.to_string().contains("Failed to write data"));
|
||||
assert!(
|
||||
committed.lock().expect("committed buffer should be lockable").is_empty(),
|
||||
"successful writer must not be committed when write quorum fails before shutdown"
|
||||
@@ -2235,13 +2173,7 @@ mod tests {
|
||||
.await
|
||||
.expect_err("shutdown quorum failure must fail the inline encode");
|
||||
|
||||
let err = StorageError::from(err);
|
||||
assert!(matches!(
|
||||
&err,
|
||||
StorageError::Io(source)
|
||||
if source.kind() == std::io::ErrorKind::Other && source.to_string() == "injected shutdown failure"
|
||||
));
|
||||
assert!(!err.is_quorum_error());
|
||||
assert!(err.to_string().contains("Failed to shutdown writers"));
|
||||
assert!(
|
||||
!committed.lock().expect("committed buffer should be lockable").is_empty(),
|
||||
"the successful writer should have committed before shutdown quorum failure was reported"
|
||||
@@ -2463,13 +2395,7 @@ mod tests {
|
||||
.await
|
||||
.expect_err("batched encode must fail when write quorum is unavailable");
|
||||
|
||||
assert_eq!(
|
||||
err.get_ref().and_then(|source| source.downcast_ref::<Error>()),
|
||||
Some(&Error::ErasureWriteQuorum),
|
||||
);
|
||||
let err = StorageError::from(err);
|
||||
assert_eq!(err, StorageError::ErasureWriteQuorum);
|
||||
assert!(err.is_quorum_error());
|
||||
assert!(err.to_string().contains("Failed to write data"));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
|
||||
@@ -20,8 +20,6 @@
|
||||
//! contract stays implemented `for SetDisks`, so its associated-type bounds are
|
||||
//! unchanged; method bodies are moved verbatim and runtime behavior is the same.
|
||||
|
||||
use crate::core::pools::DecommissionCapacityAdmission;
|
||||
|
||||
#[cfg(test)]
|
||||
use super::super::GetObjectMetadataCacheKey;
|
||||
#[cfg(test)]
|
||||
@@ -1811,10 +1809,7 @@ impl crate::storage_api_contracts::multipart::MultipartOperations for SetDisks {
|
||||
let decommission_capacity_guard = if let Some(store) = opts.decommission_capacity_admission.as_ref() {
|
||||
Some(
|
||||
store
|
||||
.acquire_external_decommission_capacity_fence(
|
||||
&[self.pool_index],
|
||||
DecommissionCapacityAdmission::ExistingMultipart,
|
||||
)
|
||||
.acquire_external_decommission_capacity_fence(&[self.pool_index], "mutation")
|
||||
.await?,
|
||||
)
|
||||
} else {
|
||||
@@ -2350,7 +2345,6 @@ impl crate::storage_api_contracts::multipart::MultipartOperations for SetDisks {
|
||||
bucket,
|
||||
object,
|
||||
opts.no_lock || object_lock_guard.is_some(),
|
||||
DecommissionCapacityAdmission::ExistingMultipart,
|
||||
)
|
||||
.await?;
|
||||
decommission_object_lock_guard = object_guard;
|
||||
@@ -3116,10 +3110,7 @@ impl crate::storage_api_contracts::multipart::MultipartOperations for SetDisks {
|
||||
{
|
||||
decommission_capacity_guard = Some(
|
||||
store
|
||||
.acquire_external_decommission_capacity_fence(
|
||||
&[self.pool_index],
|
||||
DecommissionCapacityAdmission::ExistingMultipart,
|
||||
)
|
||||
.acquire_external_decommission_capacity_fence(&[self.pool_index], "mutation")
|
||||
.await?,
|
||||
);
|
||||
}
|
||||
|
||||
@@ -19,8 +19,6 @@
|
||||
//! bounds are unchanged, and the impls reach shared primitives through the
|
||||
//! SetDisks core (io_primitives) via inherent calls.
|
||||
|
||||
use crate::core::pools::DecommissionCapacityAdmission;
|
||||
|
||||
#[cfg(test)]
|
||||
use super::super::MetadataCacheInvalidationProbe;
|
||||
use super::super::{
|
||||
@@ -3907,7 +3905,6 @@ impl SetDisks {
|
||||
bucket,
|
||||
object,
|
||||
opts.no_lock || object_lock_guard.is_some(),
|
||||
DecommissionCapacityAdmission::Mutation,
|
||||
)
|
||||
.await?;
|
||||
decommission_object_lock_guard = object_guard;
|
||||
@@ -4105,7 +4102,7 @@ impl SetDisks {
|
||||
{
|
||||
decommission_capacity_guard = Some(
|
||||
store
|
||||
.acquire_external_decommission_capacity_fence(&[self.pool_index], DecommissionCapacityAdmission::Mutation)
|
||||
.acquire_external_decommission_capacity_fence(&[self.pool_index], "mutation")
|
||||
.await?,
|
||||
);
|
||||
}
|
||||
@@ -9209,11 +9206,6 @@ impl crate::storage_api_contracts::object::ObjectOperations for SetDisks {
|
||||
let dest_obj = transaction.remote_object.clone();
|
||||
let mut transition_meta = (*oi.user_defined).clone();
|
||||
rustfs_utils::http::remove_str(&mut transition_meta, rustfs_utils::http::SUFFIX_PART_CHECKSUMS);
|
||||
// The tier holds opaque stored bytes. Its metadata must not be treated
|
||||
// as a second object header set: forwarding SSE intent or wrapped DEKs
|
||||
// would request a second encryption pass and disclose local envelope
|
||||
// material to the remote provider.
|
||||
transition_meta.retain(|key, _| !rustfs_utils::http::is_replication_stripped_encryption_key(key));
|
||||
transition_meta.insert("name".to_string(), object.to_string());
|
||||
rustfs_utils::http::metadata_compat::insert_str(
|
||||
&mut transition_meta,
|
||||
@@ -9770,16 +9762,13 @@ impl crate::storage_api_contracts::object::ObjectOperations for SetDisks {
|
||||
part_opts.part_number = Some(part_info.number);
|
||||
#[cfg(test)]
|
||||
fail_restore_multipart_at(RestoreMultipartFailurePoint::InvalidPartSize)?;
|
||||
if part_info.size == 0 {
|
||||
return Err(Error::other(format!("invalid multipart restore stored part size {}", part_info.size)));
|
||||
if part_info.actual_size <= 0 {
|
||||
return Err(Error::other(format!("invalid multipart restore part size {}", part_info.actual_size)));
|
||||
}
|
||||
let stored_part_size = i64::try_from(part_info.size).map_err(|_| {
|
||||
Error::other(format!("multipart restore stored part size exceeds i64: {}", part_info.size))
|
||||
})?;
|
||||
#[cfg(test)]
|
||||
fail_restore_multipart_at(RestoreMultipartFailurePoint::RangeOverflow)?;
|
||||
let part_end = part_offset
|
||||
.checked_add(stored_part_size - 1)
|
||||
.checked_add(part_info.actual_size - 1)
|
||||
.ok_or_else(|| Error::other("multipart restore part range overflow".to_string()))?;
|
||||
let rs = Some(HTTPRangeSpec {
|
||||
is_suffix_length: false,
|
||||
@@ -9807,19 +9796,13 @@ impl crate::storage_api_contracts::object::ObjectOperations for SetDisks {
|
||||
#[cfg(test)]
|
||||
fail_restore_multipart_at(RestoreMultipartFailurePoint::HashReader)?;
|
||||
let hash_reader =
|
||||
HashReader::from_stream(reader, stored_part_size, part_info.actual_size, None, None, false)?;
|
||||
HashReader::from_stream(reader, part_info.actual_size, part_info.actual_size, None, None, false)?;
|
||||
let mut p_reader = PutObjReader::new(hash_reader);
|
||||
#[cfg(test)]
|
||||
fail_restore_multipart_at(RestoreMultipartFailurePoint::PutPart)?;
|
||||
// `ropts` carries the object's ETag so the single-part copy-back
|
||||
// keeps it (the writer only ever sees stored bytes). A part write
|
||||
// must not inherit that object-level value, or every restored part
|
||||
// would be recorded under the same ETag; each part keeps its own.
|
||||
let mut part_write_opts = ropts.clone();
|
||||
part_write_opts.preserve_etag = Some(part_info.etag.clone()).filter(|etag| !etag.is_empty());
|
||||
let p_info = self_
|
||||
.clone()
|
||||
.put_object_part(bucket, object, &res.upload_id, part_info.number, &mut p_reader, &part_write_opts)
|
||||
.put_object_part(bucket, object, &res.upload_id, part_info.number, &mut p_reader, &ropts)
|
||||
.await?;
|
||||
#[cfg(test)]
|
||||
let p_info = if restore_multipart_failure_is(RestoreMultipartFailurePoint::SizeMismatch) {
|
||||
@@ -9829,7 +9812,7 @@ impl crate::storage_api_contracts::object::ObjectOperations for SetDisks {
|
||||
} else {
|
||||
p_info
|
||||
};
|
||||
if p_info.size as i64 != stored_part_size {
|
||||
if p_info.size as i64 != part_info.actual_size {
|
||||
return Err(Error::other(ObjectApiError::InvalidObjectState(GenericError {
|
||||
bucket: bucket.to_string(),
|
||||
object: object.to_string(),
|
||||
@@ -9861,11 +9844,6 @@ impl crate::storage_api_contracts::object::ObjectOperations for SetDisks {
|
||||
user_defined: restore_commit_metadata,
|
||||
no_lock: false,
|
||||
decommission_capacity_admission: opts.decommission_capacity_admission.clone(),
|
||||
// The composite ETag would otherwise be recomputed from the
|
||||
// parts as they were written back, which for an encrypted or
|
||||
// compressed object digests stored bytes rather than the
|
||||
// object's public ETag.
|
||||
preserve_etag: oi.etag.clone(),
|
||||
..Default::default()
|
||||
};
|
||||
self_
|
||||
@@ -13507,303 +13485,6 @@ mod transition_commit_failure_tests {
|
||||
);
|
||||
}
|
||||
|
||||
/// backlog#2368 B5: the tier stores opaque bytes, so the archive request
|
||||
/// must not carry the object's encryption headers. Forwarding them made
|
||||
/// every S3 target reject an SSE-C archive outright, asked the target to
|
||||
/// encrypt an SSE-KMS object a second time under a key id it does not own,
|
||||
/// and handed the wrapped DEK to a third-party provider.
|
||||
#[tokio::test]
|
||||
#[serial_test::serial]
|
||||
async fn transition_does_not_forward_encryption_metadata_to_the_tier() {
|
||||
let (_temp_dirs, disk_stores, set_disks) = hermetic_set_disks(4).await;
|
||||
let bucket = "transition-encryption-metadata-bucket";
|
||||
let object = "object.bin";
|
||||
for disk in &disk_stores {
|
||||
disk.make_volume(bucket).await.expect("bucket volume should be created");
|
||||
}
|
||||
|
||||
let encryption_metadata = [
|
||||
("x-amz-server-side-encryption", "aws:kms"),
|
||||
("x-amz-server-side-encryption-aws-kms-key-id", "arn:aws:kms:us-east-1:123:key/abc"),
|
||||
("x-amz-server-side-encryption-customer-algorithm", "AES256"),
|
||||
(rustfs_utils::http::INTERNAL_ENCRYPTION_KEY_HEADER, "d3JhcHBlZC1kZWs="),
|
||||
(rustfs_utils::http::INTERNAL_ENCRYPTION_IV_HEADER, "AAAAAAAAAAAAAAAA"),
|
||||
(rustfs_utils::http::INTERNAL_ENCRYPTION_ALGORITHM_HEADER, "AES256"),
|
||||
];
|
||||
let mut user_defined: HashMap<String, String> = encryption_metadata
|
||||
.iter()
|
||||
.map(|(key, value)| ((*key).to_string(), (*value).to_string()))
|
||||
.collect();
|
||||
user_defined.insert("x-amz-meta-owner".to_string(), "finance".to_string());
|
||||
|
||||
let mut reader = PutObjReader::from_vec(b"stored bytes the tier keeps opaque ".repeat(64));
|
||||
set_disks
|
||||
.put_object(
|
||||
bucket,
|
||||
object,
|
||||
&mut reader,
|
||||
&ObjectOptions {
|
||||
user_defined,
|
||||
..Default::default()
|
||||
},
|
||||
)
|
||||
.await
|
||||
.expect("the encrypted source object should be written");
|
||||
let original = set_disks
|
||||
.get_object_info(bucket, object, &ObjectOptions::default())
|
||||
.await
|
||||
.expect("the source object should be readable");
|
||||
|
||||
let tier_name = format!("COLDTIER{}", &Uuid::new_v4().simple().to_string()[..8]).to_uppercase();
|
||||
let backend = register_mock_tier(&runtime_sources::global_tier_config_mgr(), &tier_name).await;
|
||||
set_disks
|
||||
.transition_object(
|
||||
bucket,
|
||||
object,
|
||||
&ObjectOptions {
|
||||
no_lock: true,
|
||||
transition: TransitionOptions {
|
||||
status: TRANSITION_PENDING.to_string(),
|
||||
tier: tier_name,
|
||||
etag: original.etag.clone().unwrap_or_default(),
|
||||
..Default::default()
|
||||
},
|
||||
version_id: original.version_id.map(|version| version.to_string()),
|
||||
mod_time: original.mod_time,
|
||||
..Default::default()
|
||||
},
|
||||
)
|
||||
.await
|
||||
.expect("the encrypted object should transition");
|
||||
|
||||
let transitioned = set_disks
|
||||
.get_object_info(bucket, object, &ObjectOptions::default())
|
||||
.await
|
||||
.expect("the transitioned object should be readable");
|
||||
let remote_metadata = backend
|
||||
.metadata(&transitioned.transitioned_object.name)
|
||||
.await
|
||||
.expect("the tier must have received the object");
|
||||
|
||||
for (key, _) in encryption_metadata {
|
||||
assert!(
|
||||
!remote_metadata.keys().any(|stored| stored.eq_ignore_ascii_case(key)),
|
||||
"transition must not forward {key} to the tier: {remote_metadata:?}"
|
||||
);
|
||||
}
|
||||
assert!(
|
||||
remote_metadata
|
||||
.iter()
|
||||
.any(|(key, value)| key.eq_ignore_ascii_case("x-amz-meta-owner") && value == "finance"),
|
||||
"ordinary user metadata must still travel to the tier: {remote_metadata:?}"
|
||||
);
|
||||
|
||||
// Read-through and restore both resolve encryption locally, so the
|
||||
// stripped keys must survive untouched in the local metadata.
|
||||
for (key, value) in encryption_metadata {
|
||||
assert_eq!(
|
||||
transitioned.user_defined.get(key).map(String::as_str),
|
||||
Some(value),
|
||||
"the local copy must keep {key}"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
/// Deterministic bytes that do not repeat with a short period, so a slice
|
||||
/// taken at the wrong offset cannot coincidentally compare equal.
|
||||
fn stored_representation_bytes(seed: u32, len: usize) -> Vec<u8> {
|
||||
(0..len)
|
||||
.map(|index| {
|
||||
let mixed = (index as u32).wrapping_add(seed).wrapping_mul(2_654_435_761);
|
||||
(mixed >> 13) as u8
|
||||
})
|
||||
.collect()
|
||||
}
|
||||
|
||||
/// Compares two stored representations without dumping megabytes of bytes
|
||||
/// into the failure output.
|
||||
fn assert_stored_representation_eq(actual: &[u8], expected: &[u8], what: &str) {
|
||||
assert_eq!(actual.len(), expected.len(), "{what}: stored length differs");
|
||||
if let Some(offset) = actual.iter().zip(expected).position(|(left, right)| left != right) {
|
||||
panic!(
|
||||
"{what}: stored bytes differ at offset {offset} (found {:#04x}, expected {:#04x})",
|
||||
actual[offset], expected[offset]
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
async fn read_stored_representation(set_disks: &Arc<SetDisks>, bucket: &str, object: &str) -> Vec<u8> {
|
||||
let mut reader = set_disks
|
||||
.get_object_reader(
|
||||
bucket,
|
||||
object,
|
||||
None,
|
||||
HeaderMap::new(),
|
||||
&ObjectOptions {
|
||||
no_lock: true,
|
||||
raw_data_movement_read: true,
|
||||
..Default::default()
|
||||
},
|
||||
)
|
||||
.await
|
||||
.expect("stored-representation reader should open");
|
||||
let mut body = Vec::new();
|
||||
reader.stream.read_to_end(&mut body).await.expect("stored body should drain");
|
||||
body
|
||||
}
|
||||
|
||||
/// backlog#2368 B3: the multipart restore loop addresses the tier in STORED
|
||||
/// coordinates. Accumulating each part's PLAINTEXT length instead handed
|
||||
/// every part a misaligned slice of the remote object whose length still
|
||||
/// satisfied the range, the `HashReader` and the completion size check, so
|
||||
/// the copy-back reported success while silently replacing the bytes.
|
||||
///
|
||||
/// The fixture reproduces the encrypted geometry — a stored form LONGER
|
||||
/// than the plaintext it encodes — because that is what keeps a
|
||||
/// plaintext-coordinate range inside the tier object and makes the
|
||||
/// corruption silent rather than a short read.
|
||||
#[tokio::test]
|
||||
#[serial_test::serial]
|
||||
async fn multipart_restore_copies_the_stored_representation_back_verbatim() {
|
||||
let (_temp_dirs, disk_stores, set_disks) = hermetic_set_disks(4).await;
|
||||
let bucket = "restore-multipart-stored-coordinates-bucket";
|
||||
let object = "object.bin";
|
||||
for disk in &disk_stores {
|
||||
disk.make_volume(bucket).await.expect("bucket volume should be created");
|
||||
}
|
||||
|
||||
// The minimum-part-size gate reads the PLAINTEXT length, so part one
|
||||
// clears 5 MiB there while its stored form carries encoding overhead.
|
||||
let part_shapes = [(6 * 1024 * 1024_usize, 9_216_usize), (256 * 1024_usize, 512_usize)];
|
||||
let mut user_defined = HashMap::new();
|
||||
user_defined.insert(rustfs_utils::http::INTERNAL_ENCRYPTION_ALGORITHM_HEADER.to_string(), "AES256".to_string());
|
||||
user_defined.insert(
|
||||
rustfs_utils::http::INTERNAL_ENCRYPTION_IV_HEADER.to_string(),
|
||||
"AAAAAAAAAAAAAAAA".to_string(),
|
||||
);
|
||||
|
||||
let upload = set_disks
|
||||
.new_multipart_upload(
|
||||
bucket,
|
||||
object,
|
||||
&ObjectOptions {
|
||||
user_defined: user_defined.clone(),
|
||||
..Default::default()
|
||||
},
|
||||
)
|
||||
.await
|
||||
.expect("multipart upload should be created");
|
||||
|
||||
let mut uploaded_parts = Vec::new();
|
||||
let mut expected_stored = Vec::new();
|
||||
for (index, (plaintext_len, overhead)) in part_shapes.iter().enumerate() {
|
||||
let stored = stored_representation_bytes(index as u32 * 7 + 1, plaintext_len + overhead);
|
||||
expected_stored.extend_from_slice(&stored);
|
||||
let stored_len = stored.len() as i64;
|
||||
let hash_reader =
|
||||
HashReader::from_stream(std::io::Cursor::new(stored), stored_len, *plaintext_len as i64, None, None, false)
|
||||
.expect("hash reader over the stored representation");
|
||||
let mut reader = PutObjReader::new(hash_reader);
|
||||
let info = set_disks
|
||||
.put_object_part(bucket, object, &upload.upload_id, index + 1, &mut reader, &ObjectOptions::default())
|
||||
.await
|
||||
.expect("stored part should be staged");
|
||||
assert_eq!(info.size as i64, stored_len, "a part is stored in its encoded length");
|
||||
uploaded_parts.push(CompletePart {
|
||||
part_num: info.part_num,
|
||||
etag: info.etag,
|
||||
..Default::default()
|
||||
});
|
||||
}
|
||||
|
||||
let original = set_disks
|
||||
.clone()
|
||||
.complete_multipart_upload(bucket, object, &upload.upload_id, uploaded_parts, &ObjectOptions::default())
|
||||
.await
|
||||
.expect("source multipart upload should complete");
|
||||
let original_parts: Vec<(usize, usize, i64, String)> = original
|
||||
.parts
|
||||
.iter()
|
||||
.map(|part| (part.number, part.size, part.actual_size, part.etag.clone()))
|
||||
.collect();
|
||||
for (_, size, actual_size, _) in &original_parts {
|
||||
assert!(
|
||||
*size as i64 > *actual_size,
|
||||
"the fixture must keep the two coordinate systems apart: stored {size} vs plaintext {actual_size}"
|
||||
);
|
||||
}
|
||||
let stored_before = read_stored_representation(&set_disks, bucket, object).await;
|
||||
assert_stored_representation_eq(&stored_before, &expected_stored, "the fixture must store its encoded bytes verbatim");
|
||||
|
||||
let tier_name = format!("COLDTIER{}", &Uuid::new_v4().simple().to_string()[..8]).to_uppercase();
|
||||
register_mock_tier(&runtime_sources::global_tier_config_mgr(), &tier_name).await;
|
||||
set_disks
|
||||
.transition_object(
|
||||
bucket,
|
||||
object,
|
||||
&ObjectOptions {
|
||||
no_lock: true,
|
||||
transition: TransitionOptions {
|
||||
status: TRANSITION_PENDING.to_string(),
|
||||
tier: tier_name,
|
||||
etag: original.etag.clone().unwrap_or_default(),
|
||||
..Default::default()
|
||||
},
|
||||
version_id: original.version_id.map(|version| version.to_string()),
|
||||
mod_time: original.mod_time,
|
||||
..Default::default()
|
||||
},
|
||||
)
|
||||
.await
|
||||
.expect("multipart source should transition before restore");
|
||||
|
||||
let operation_id = Uuid::new_v4();
|
||||
set_disks
|
||||
.put_object_metadata(
|
||||
bucket,
|
||||
object,
|
||||
&ObjectOptions {
|
||||
eval_metadata: Some(restore_metadata(operation_id, true)),
|
||||
..Default::default()
|
||||
},
|
||||
)
|
||||
.await
|
||||
.expect("the restore generation should be installed");
|
||||
let mut restore_opts = ObjectOptions::default();
|
||||
restore_opts.transition.restore_request.days = Some(1);
|
||||
restore_opts.user_defined = restore_operation_id_metadata(operation_id);
|
||||
set_disks
|
||||
.clone()
|
||||
.restore_transitioned_object(bucket, object, &restore_opts)
|
||||
.await
|
||||
.expect("multipart restore should complete");
|
||||
|
||||
let stored_after = read_stored_representation(&set_disks, bucket, object).await;
|
||||
assert_stored_representation_eq(
|
||||
&stored_after,
|
||||
&expected_stored,
|
||||
"a multipart restore must copy the stored representation back verbatim",
|
||||
);
|
||||
|
||||
let restored = set_disks
|
||||
.get_object_info(bucket, object, &ObjectOptions::default())
|
||||
.await
|
||||
.expect("the restored object should be readable");
|
||||
let restored_parts: Vec<(usize, usize, i64, String)> = restored
|
||||
.parts
|
||||
.iter()
|
||||
.map(|part| (part.number, part.size, part.actual_size, part.etag.clone()))
|
||||
.collect();
|
||||
assert_eq!(
|
||||
restored_parts, original_parts,
|
||||
"restore must rebuild the same part layout, sizes and part ETags"
|
||||
);
|
||||
assert_eq!(restored.size, original.size, "restore must keep the stored object size");
|
||||
// backlog#2369 P7.1: the copy-back digests stored bytes, so the object's
|
||||
// public ETag has to be carried over rather than recomputed.
|
||||
assert_eq!(restored.etag, original.etag, "restore must preserve the object ETag");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
#[serial_test::serial]
|
||||
async fn restore_failure_after_snapshot_cleans_exact_generation_and_returns_primary_error() {
|
||||
|
||||
@@ -17,7 +17,6 @@ use super::{
|
||||
UpdateMetadataOpts, Uuid, X_AMZ_RESTORE, get_raw_etag, restore_operation_id_from_metadata,
|
||||
};
|
||||
use crate::bucket::lifecycle::lifecycle;
|
||||
use crate::core::pools::DecommissionCapacityAdmission;
|
||||
use rustfs_filemeta::RestoreStatusOps;
|
||||
use rustfs_utils::http::headers::{AMZ_RESTORE_EXPIRY_DAYS, AMZ_RESTORE_REQUEST_DATE};
|
||||
use s3s::dto::{RestoreStatus, Timestamp};
|
||||
@@ -161,13 +160,7 @@ impl SetDisks {
|
||||
let (decommission_object_lock_guard, decommission_target_lock_covered, mut decommission_capacity_guard) =
|
||||
if let Some(store) = opts.decommission_capacity_admission.as_ref() {
|
||||
store
|
||||
.acquire_external_decommission_commit_guards(
|
||||
self.pool_index,
|
||||
bucket,
|
||||
object,
|
||||
opts.no_lock,
|
||||
DecommissionCapacityAdmission::Mutation,
|
||||
)
|
||||
.acquire_external_decommission_commit_guards(self.pool_index, bucket, object, opts.no_lock)
|
||||
.await?
|
||||
} else {
|
||||
(None, false, None)
|
||||
@@ -185,7 +178,7 @@ impl SetDisks {
|
||||
{
|
||||
decommission_capacity_guard = Some(
|
||||
store
|
||||
.acquire_external_decommission_capacity_fence(&[self.pool_index], DecommissionCapacityAdmission::Mutation)
|
||||
.acquire_external_decommission_capacity_fence(&[self.pool_index], "mutation")
|
||||
.await?,
|
||||
);
|
||||
}
|
||||
@@ -271,13 +264,7 @@ impl SetDisks {
|
||||
let (decommission_object_lock_guard, decommission_target_lock_covered, mut decommission_capacity_guard) =
|
||||
if let Some(store) = opts.decommission_capacity_admission.as_ref() {
|
||||
store
|
||||
.acquire_external_decommission_commit_guards(
|
||||
self.pool_index,
|
||||
bucket,
|
||||
object,
|
||||
opts.no_lock,
|
||||
DecommissionCapacityAdmission::Mutation,
|
||||
)
|
||||
.acquire_external_decommission_commit_guards(self.pool_index, bucket, object, opts.no_lock)
|
||||
.await?
|
||||
} else {
|
||||
(None, false, None)
|
||||
@@ -295,7 +282,7 @@ impl SetDisks {
|
||||
{
|
||||
decommission_capacity_guard = Some(
|
||||
store
|
||||
.acquire_external_decommission_capacity_fence(&[self.pool_index], DecommissionCapacityAdmission::Mutation)
|
||||
.acquire_external_decommission_capacity_fence(&[self.pool_index], "mutation")
|
||||
.await?,
|
||||
);
|
||||
}
|
||||
|
||||
@@ -671,9 +671,9 @@ mod tests {
|
||||
use crate::cluster::rpc::PeerS3Client;
|
||||
use crate::config::com::{delete_config, read_config_no_lock_preserve_empty_with_metadata, save_config};
|
||||
use crate::core::pools::{
|
||||
DecommissionCapacityAdmission, DecommissionCapacityLockOrderBarrier, DecommissionErasureLayout,
|
||||
DecommissionPoolCapacityInfo, POOL_META_IDENTITY_NAME, PoolDecommissionInfo, PoolMetaReplicaState, PoolStatus,
|
||||
initialized_pool_meta_identity_for_test, set_decommission_capacity_info_overrides_for_test,
|
||||
DecommissionCapacityLockOrderBarrier, DecommissionErasureLayout, DecommissionPoolCapacityInfo, POOL_META_IDENTITY_NAME,
|
||||
PoolDecommissionInfo, PoolMetaReplicaState, PoolStatus, initialized_pool_meta_identity_for_test,
|
||||
set_decommission_capacity_info_overrides_for_test,
|
||||
};
|
||||
use crate::core::sets::HealFormatAfterSaveBarrier;
|
||||
use crate::disk::error::Result as DiskResult;
|
||||
@@ -1149,7 +1149,7 @@ mod tests {
|
||||
let (temp_dir, store, shutdown) = multi_pool_heal_store().await;
|
||||
let target = remove_heal_test_format(&temp_dir, &store, 0, 3).await;
|
||||
let capacity_guard = store
|
||||
.acquire_external_decommission_capacity_fence(&[0], DecommissionCapacityAdmission::Heal)
|
||||
.acquire_external_decommission_capacity_fence(&[0], "heal")
|
||||
.await
|
||||
.expect("ordinary heal capacity fence should be acquired");
|
||||
|
||||
|
||||
@@ -14,7 +14,7 @@
|
||||
|
||||
use super::*;
|
||||
use crate::core::pools::{
|
||||
PoolMetaReplicaState, PoolMetaWriteState, local_decommission_queue_prefix, persist_pool_meta_identity_for_attested_pools,
|
||||
PoolMetaBootstrapAuthority, PoolMetaReplicaState, PoolMetaWriteState, local_decommission_queue_prefix,
|
||||
persist_pool_meta_identity_for_startup, pool_meta_has_active_decommission,
|
||||
};
|
||||
use crate::runtime::instance::InstanceContext;
|
||||
@@ -174,20 +174,9 @@ where
|
||||
S: EcstoreObjectIO,
|
||||
{
|
||||
if elected_writer && write_state.bootstrap_identity_proven() {
|
||||
return persist_pool_meta_identity_for_startup(pools, write_state, false).await;
|
||||
persist_pool_meta_identity_for_startup(pools, write_state, false).await?;
|
||||
}
|
||||
if write_state.bootstrap_identity_proven() {
|
||||
return Ok(());
|
||||
}
|
||||
// Multi-pool bootstrap whose pools were formatted by different nodes: no
|
||||
// single process can prove the whole deployment fresh in memory, so each
|
||||
// creator attests the pools it formatted first-hand with the shared nonce
|
||||
// and the elected writer waits for a complete, agreeing pending set.
|
||||
let attested = write_state.attested_pool_indices();
|
||||
if attested.is_empty() {
|
||||
return Ok(());
|
||||
}
|
||||
persist_pool_meta_identity_for_attested_pools(pools, write_state, &attested).await
|
||||
Ok(())
|
||||
}
|
||||
|
||||
async fn save_validated_pool_meta_for_startup<S>(
|
||||
@@ -418,7 +407,7 @@ impl ECStore {
|
||||
preflight_startup_rpc_secret(&endpoint_pools)?;
|
||||
|
||||
let mut deployment_id = None;
|
||||
let mut pool_meta_bootstrap_authorities = Vec::new();
|
||||
let mut pool_meta_bootstrap_authority = None;
|
||||
|
||||
// let (endpoint_pools, _) = EndpointServerPools::create_server_endpoints(address.as_str(), &layouts)?;
|
||||
|
||||
@@ -534,10 +523,12 @@ impl ECStore {
|
||||
}
|
||||
}
|
||||
}?;
|
||||
// First-hand authority for this pool only: `Fresh` when this process
|
||||
// formatted it, `LegacyAdoption` when it verified the migration, and
|
||||
// `None` when it merely read a format another node created.
|
||||
pool_meta_bootstrap_authorities.push(loaded_format.pool_meta_bootstrap_authority);
|
||||
pool_meta_bootstrap_authority = Some(pool_meta_bootstrap_authority.map_or(
|
||||
loaded_format.pool_meta_bootstrap_authority,
|
||||
|authority: PoolMetaBootstrapAuthority| {
|
||||
authority.combine_across_pools(loaded_format.pool_meta_bootstrap_authority)
|
||||
},
|
||||
));
|
||||
let fm = loaded_format.format;
|
||||
|
||||
// Format loading succeeded, enable health monitoring on all disks
|
||||
@@ -578,13 +569,9 @@ impl ECStore {
|
||||
let peer_sys = S3PeerSys::new_with_instance_ctx(&endpoint_pools, instance_ctx.clone());
|
||||
let mut pool_meta = PoolMeta::new(&pools, &PoolMeta::default());
|
||||
pool_meta.dont_save = true;
|
||||
let elected_bootstrap_writer = pools
|
||||
.first()
|
||||
.is_some_and(|pool| pool_first_endpoint_is_local(&pool.endpoints));
|
||||
let pool_meta_write_state = PoolMetaWriteState::for_startup_with_pool_bootstrap_authorities(
|
||||
let pool_meta_write_state = PoolMetaWriteState::for_startup_with_bootstrap_authority(
|
||||
deployment_id,
|
||||
pool_meta_bootstrap_authorities,
|
||||
elected_bootstrap_writer,
|
||||
pool_meta_bootstrap_authority.unwrap_or_default(),
|
||||
);
|
||||
|
||||
let decommission_cancelers = RwLock::new(vec![None; pools.len()]);
|
||||
@@ -974,9 +961,8 @@ mod tests {
|
||||
bucket::replication::{ReplicationState, ReplicationStatusType, replication_statuses_map},
|
||||
core::pools::{
|
||||
DecommissionErasureLayout, DecommissionPoolCapacityInfo, POOL_META_IDENTITY_NAME, POOL_META_NAME, POOL_META_VERSION,
|
||||
PoolDecommissionInfo, PoolMeta, PoolStatus, pending_pool_meta_identity_for_test,
|
||||
pool_meta_identity_initialized_for_test, pool_meta_v3_commit_state_for_test,
|
||||
set_decommission_capacity_info_overrides_for_test,
|
||||
PoolDecommissionInfo, PoolMeta, PoolStatus, pool_meta_identity_initialized_for_test,
|
||||
pool_meta_v3_commit_state_for_test, set_decommission_capacity_info_overrides_for_test,
|
||||
},
|
||||
disk::endpoint::Endpoint,
|
||||
error::{Error, Result, StorageError},
|
||||
@@ -1479,331 +1465,6 @@ mod tests {
|
||||
.await;
|
||||
}
|
||||
|
||||
fn startup_object(storage: &StartupPoolMetaStorage, object: &str) -> Option<Vec<u8>> {
|
||||
storage
|
||||
.objects
|
||||
.lock()
|
||||
.unwrap_or_else(std::sync::PoisonError::into_inner)
|
||||
.get(object)
|
||||
.map(|(payload, _)| payload.clone())
|
||||
}
|
||||
|
||||
/// Startup errors wrap their cause in context whose `Display` hides the
|
||||
/// source, so assertions walk the chain the same way
|
||||
/// `Error::pool_metadata_failure` does.
|
||||
fn error_chain_text(err: &Error) -> String {
|
||||
let mut parts = vec![err.to_string()];
|
||||
let mut current: Option<&(dyn std::error::Error + 'static)> = Some(err);
|
||||
while let Some(error) = current {
|
||||
current = if let Some(io) = error.downcast_ref::<std::io::Error>() {
|
||||
io.get_ref().map(|inner| inner as &(dyn std::error::Error + 'static))
|
||||
} else {
|
||||
error.source()
|
||||
};
|
||||
if let Some(next) = current {
|
||||
parts.push(next.to_string());
|
||||
}
|
||||
}
|
||||
parts.join(" <- ")
|
||||
}
|
||||
|
||||
fn inject_startup_object(storage: &StartupPoolMetaStorage, object: &str, payload: Vec<u8>) {
|
||||
storage
|
||||
.objects
|
||||
.lock()
|
||||
.unwrap_or_else(std::sync::PoisonError::into_inner)
|
||||
.insert(object.to_string(), (payload, format!("injected-{object}")));
|
||||
}
|
||||
|
||||
fn init_test_pool_meta_with_pools(pool_count: usize) -> PoolMeta {
|
||||
PoolMeta {
|
||||
version: POOL_META_VERSION,
|
||||
pools: (0..pool_count)
|
||||
.map(|id| PoolStatus {
|
||||
id,
|
||||
cmd_line: format!("pool-{id}"),
|
||||
last_update: OffsetDateTime::UNIX_EPOCH,
|
||||
decommission: None,
|
||||
})
|
||||
.collect(),
|
||||
dont_save: false,
|
||||
}
|
||||
}
|
||||
|
||||
/// Two single-node pools whose formats were created by different nodes:
|
||||
/// node0 formatted pool0 and only read pool1's format, node1 the reverse.
|
||||
fn two_pool_creator_states(deployment_id: Uuid) -> (PoolMetaWriteState, PoolMetaWriteState) {
|
||||
let node0 = PoolMetaWriteState::for_startup_with_pool_bootstrap_authorities(
|
||||
deployment_id,
|
||||
vec![PoolMetaBootstrapAuthority::Fresh, PoolMetaBootstrapAuthority::None],
|
||||
true,
|
||||
);
|
||||
let node1 = PoolMetaWriteState::for_startup_with_pool_bootstrap_authorities(
|
||||
deployment_id,
|
||||
vec![PoolMetaBootstrapAuthority::None, PoolMetaBootstrapAuthority::Fresh],
|
||||
false,
|
||||
);
|
||||
(node0, node1)
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn test_two_pool_bootstrap_with_distinct_format_creators_converges_through_creator_attestation() {
|
||||
let deployment_id = Uuid::new_v4();
|
||||
let pool0 = Arc::new(StartupPoolMetaStorage::new(Vec::new()));
|
||||
let pool1 = Arc::new(StartupPoolMetaStorage::new(Vec::new()));
|
||||
let pools = vec![pool0.clone(), pool1.clone()];
|
||||
let (mut node0, mut node1) = two_pool_creator_states(deployment_id);
|
||||
assert!(!node0.bootstrap_identity_proven(), "reading pool1's format is not deployment-wide proof");
|
||||
assert!(!node1.bootstrap_identity_proven());
|
||||
|
||||
// node1 (pool1 creator, non-elected) starts first: no durable nonce exists
|
||||
// yet, so it must neither mint one nor latch its write gate while waiting.
|
||||
establish_pool_meta_bootstrap_identity_if_proven(pools.clone(), &mut node1, false)
|
||||
.await
|
||||
.expect("a non-first creator without a durable nonce writes nothing");
|
||||
assert!(startup_object(&pool0, POOL_META_IDENTITY_NAME).is_none());
|
||||
assert!(startup_object(&pool1, POOL_META_IDENTITY_NAME).is_none());
|
||||
let err = load_pool_meta_for_startup(pools.clone(), &mut node1)
|
||||
.await
|
||||
.expect_err("nothing durable authorizes a non-elected node");
|
||||
assert!(err.to_string().contains("bootstrap pending"), "{err}");
|
||||
node1
|
||||
.ensure_write_safe("waiting non-elected creator")
|
||||
.expect("waiting for the elected writer must not latch the write gate");
|
||||
|
||||
// node0 (pool0 creator, elected) mints the nonce on the pool it created;
|
||||
// pool1 is still unattested, so it cannot publish pool.bin and must not latch.
|
||||
establish_pool_meta_bootstrap_identity_if_proven(pools.clone(), &mut node0, true)
|
||||
.await
|
||||
.expect("the first pool's creator mints the pending identity");
|
||||
let minted = startup_object(&pool0, POOL_META_IDENTITY_NAME).expect("pool0 pending identity");
|
||||
assert!(!pool_meta_identity_initialized_for_test(&minted).expect("decode pending identity"));
|
||||
assert!(
|
||||
startup_object(&pool1, POOL_META_IDENTITY_NAME).is_none(),
|
||||
"node0 holds no first-hand proof for pool1 and must not attest it"
|
||||
);
|
||||
let err = load_pool_meta_for_startup(pools.clone(), &mut node0)
|
||||
.await
|
||||
.expect_err("an unattested pool keeps the elected writer from publishing");
|
||||
assert!(err.to_string().contains("waiting for every pool creator"), "{err}");
|
||||
node0
|
||||
.ensure_write_safe("waiting elected writer")
|
||||
.expect("waiting for creators must not latch the write gate");
|
||||
assert!(startup_object(&pool0, POOL_META_NAME).is_none());
|
||||
|
||||
// node1 retries: it copies pool0's pending identity (same nonce) onto the
|
||||
// pool it created, then keeps waiting for the elected writer's pool.bin.
|
||||
establish_pool_meta_bootstrap_identity_if_proven(pools.clone(), &mut node1, false)
|
||||
.await
|
||||
.expect("the pool1 creator attests with the durable nonce");
|
||||
assert_eq!(startup_object(&pool1, POOL_META_IDENTITY_NAME).as_deref(), Some(minted.as_slice()));
|
||||
let err = load_pool_meta_for_startup(pools.clone(), &mut node1)
|
||||
.await
|
||||
.expect_err("a complete pending set never unlocks a non-elected node");
|
||||
assert!(err.to_string().contains("waiting for the elected writer to publish"), "{err}");
|
||||
node1
|
||||
.ensure_write_safe("attested non-elected creator")
|
||||
.expect("waiting for pool.bin must not latch the write gate");
|
||||
assert!(startup_object(&pool0, POOL_META_NAME).is_none());
|
||||
|
||||
// node0 retries: every pool is attested under one nonce, so it publishes
|
||||
// pool.bin and commits the identity on both pools.
|
||||
establish_pool_meta_bootstrap_identity_if_proven(pools.clone(), &mut node0, true)
|
||||
.await
|
||||
.expect("re-establishing an already minted identity is idempotent");
|
||||
let (_, replica_state) = load_pool_meta_for_startup(pools.clone(), &mut node0)
|
||||
.await
|
||||
.expect("complete creator attestation authorizes the initial pool metadata write");
|
||||
persist_pool_meta_for_startup_if_safe(
|
||||
&init_test_pool_meta_with_pools(2),
|
||||
pools.clone(),
|
||||
replica_state,
|
||||
&mut node0,
|
||||
true,
|
||||
true,
|
||||
)
|
||||
.await
|
||||
.expect("the elected writer publishes pool.bin and commits the identity");
|
||||
for pool in [&pool0, &pool1] {
|
||||
assert!(startup_object(pool, POOL_META_NAME).is_some());
|
||||
let identity = startup_object(pool, POOL_META_IDENTITY_NAME).expect("committed identity");
|
||||
assert!(pool_meta_identity_initialized_for_test(&identity).expect("decode committed identity"));
|
||||
}
|
||||
|
||||
// node1 retries once more: pool.bin exists and nothing is rewritten.
|
||||
let before = startup_object(&pool1, POOL_META_IDENTITY_NAME);
|
||||
establish_pool_meta_bootstrap_identity_if_proven(pools.clone(), &mut node1, false)
|
||||
.await
|
||||
.expect("an initialized deployment never reopens bootstrap");
|
||||
assert_eq!(startup_object(&pool1, POOL_META_IDENTITY_NAME), before);
|
||||
load_pool_meta_for_startup(pools, &mut node1)
|
||||
.await
|
||||
.expect("published pool metadata admits the non-elected node");
|
||||
node1
|
||||
.ensure_write_safe("converged non-elected creator")
|
||||
.expect("no latch remains after convergence");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn test_two_pool_bootstrap_rejects_pending_replicas_from_different_bootstraps() {
|
||||
let deployment_id = Uuid::new_v4();
|
||||
let pool0 = Arc::new(StartupPoolMetaStorage::new(Vec::new()));
|
||||
let pool1 = Arc::new(StartupPoolMetaStorage::new(Vec::new()));
|
||||
let pools = vec![pool0.clone(), pool1.clone()];
|
||||
let (mut node0, _) = two_pool_creator_states(deployment_id);
|
||||
establish_pool_meta_bootstrap_identity_if_proven(pools.clone(), &mut node0, true)
|
||||
.await
|
||||
.expect("the first pool's creator mints the pending identity");
|
||||
inject_startup_object(
|
||||
&pool1,
|
||||
POOL_META_IDENTITY_NAME,
|
||||
pending_pool_meta_identity_for_test(deployment_id, 1, Uuid::new_v4()).expect("encode foreign pending identity"),
|
||||
);
|
||||
|
||||
let err = load_pool_meta_for_startup(pools.clone(), &mut node0)
|
||||
.await
|
||||
.expect_err("a pending replica bound to another bootstrap nonce must fail closed");
|
||||
let chain = error_chain_text(&err);
|
||||
assert!(chain.contains("disagree on fresh-bootstrap proof"), "{chain}");
|
||||
node0
|
||||
.ensure_write_safe("split bootstrap")
|
||||
.expect_err("a split bootstrap latches the write gate");
|
||||
assert!(startup_object(&pool0, POOL_META_NAME).is_none());
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn test_two_pool_bootstrap_treats_corrupt_creator_replica_as_recovery_not_waiting() {
|
||||
let deployment_id = Uuid::new_v4();
|
||||
let pool0 = Arc::new(StartupPoolMetaStorage::new(Vec::new()));
|
||||
let pool1 = Arc::new(StartupPoolMetaStorage::new(Vec::new()));
|
||||
let pools = vec![pool0.clone(), pool1.clone()];
|
||||
let (mut node0, _) = two_pool_creator_states(deployment_id);
|
||||
establish_pool_meta_bootstrap_identity_if_proven(pools.clone(), &mut node0, true)
|
||||
.await
|
||||
.expect("the first pool's creator mints the pending identity");
|
||||
// Keep the on-disk format/version header so the replica classifies as
|
||||
// corrupt (undecodable payload) rather than as an incompatible format.
|
||||
let mut corrupt = pending_pool_meta_identity_for_test(deployment_id, 1, Uuid::new_v4()).expect("encode identity");
|
||||
corrupt.truncate(4);
|
||||
corrupt.extend_from_slice(b"not a cluster identity");
|
||||
inject_startup_object(&pool1, POOL_META_IDENTITY_NAME, corrupt);
|
||||
|
||||
let err = load_pool_meta_for_startup(pools.clone(), &mut node0)
|
||||
.await
|
||||
.expect_err("a corrupt replica is not a creator that is still catching up");
|
||||
let chain = error_chain_text(&err);
|
||||
assert!(chain.contains("no verified fresh-bootstrap proof"), "{chain}");
|
||||
node0
|
||||
.ensure_write_safe("corrupt attestation")
|
||||
.expect_err("a corrupt attestation latches the write gate");
|
||||
assert!(startup_object(&pool0, POOL_META_NAME).is_none());
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn test_elected_restart_without_first_hand_proof_cannot_reuse_a_complete_pending_set() {
|
||||
let deployment_id = Uuid::new_v4();
|
||||
let pool0 = Arc::new(StartupPoolMetaStorage::new(Vec::new()));
|
||||
let pool1 = Arc::new(StartupPoolMetaStorage::new(Vec::new()));
|
||||
let pools = vec![pool0.clone(), pool1.clone()];
|
||||
let (mut node0, mut node1) = two_pool_creator_states(deployment_id);
|
||||
establish_pool_meta_bootstrap_identity_if_proven(pools.clone(), &mut node0, true)
|
||||
.await
|
||||
.expect("mint");
|
||||
establish_pool_meta_bootstrap_identity_if_proven(pools.clone(), &mut node1, false)
|
||||
.await
|
||||
.expect("attest");
|
||||
assert_eq!(
|
||||
startup_object(&pool0, POOL_META_IDENTITY_NAME),
|
||||
startup_object(&pool1, POOL_META_IDENTITY_NAME),
|
||||
"both creators attested the same pending identity"
|
||||
);
|
||||
|
||||
// The elected node restarts before publishing: it now merely reads both
|
||||
// formats, so the complete pending set alone must not reopen bootstrap.
|
||||
let mut restarted = PoolMetaWriteState::for_startup_with_pool_bootstrap_authorities(
|
||||
deployment_id,
|
||||
vec![PoolMetaBootstrapAuthority::None, PoolMetaBootstrapAuthority::None],
|
||||
true,
|
||||
);
|
||||
establish_pool_meta_bootstrap_identity_if_proven(pools.clone(), &mut restarted, true)
|
||||
.await
|
||||
.expect("a restart without first-hand proof writes nothing");
|
||||
let err = load_pool_meta_for_startup(pools.clone(), &mut restarted)
|
||||
.await
|
||||
.expect_err("a pending set alone never authorizes a writer without first-hand proof");
|
||||
assert!(err.to_string().contains("no verified fresh-bootstrap proof"), "{err}");
|
||||
restarted
|
||||
.ensure_write_safe("unproven restart")
|
||||
.expect_err("the rejected restart latches the write gate");
|
||||
assert!(startup_object(&pool0, POOL_META_NAME).is_none());
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn test_fresh_pool_joining_an_initialized_deployment_never_reopens_bootstrap() {
|
||||
let deployment_id = Uuid::new_v4();
|
||||
let pool0 = Arc::new(StartupPoolMetaStorage::new(Vec::new()));
|
||||
let mut founder = PoolMetaWriteState::for_startup(deployment_id, true);
|
||||
establish_pool_meta_bootstrap_identity_if_proven(vec![pool0.clone()], &mut founder, true)
|
||||
.await
|
||||
.expect("the founder mints");
|
||||
let (_, replica_state) = load_pool_meta_for_startup(vec![pool0.clone()], &mut founder)
|
||||
.await
|
||||
.expect("the founder may initialize");
|
||||
persist_pool_meta_for_startup_if_safe(
|
||||
&init_test_pool_meta(None),
|
||||
vec![pool0.clone()],
|
||||
replica_state,
|
||||
&mut founder,
|
||||
true,
|
||||
true,
|
||||
)
|
||||
.await
|
||||
.expect("the founder commits");
|
||||
let founded = startup_object(&pool0, POOL_META_IDENTITY_NAME).expect("committed identity");
|
||||
assert!(pool_meta_identity_initialized_for_test(&founded).expect("decode committed identity"));
|
||||
|
||||
// Expansion: pool1 is fresh and was formatted first-hand by the node
|
||||
// hosting its first endpoint, whether or not that node is elected.
|
||||
let pool1 = Arc::new(StartupPoolMetaStorage::new(Vec::new()));
|
||||
let pools = vec![pool0.clone(), pool1.clone()];
|
||||
for elected in [false, true] {
|
||||
let mut joiner = PoolMetaWriteState::for_startup_with_pool_bootstrap_authorities(
|
||||
deployment_id,
|
||||
vec![PoolMetaBootstrapAuthority::None, PoolMetaBootstrapAuthority::Fresh],
|
||||
elected,
|
||||
);
|
||||
establish_pool_meta_bootstrap_identity_if_proven(pools.clone(), &mut joiner, elected)
|
||||
.await
|
||||
.expect("an initialized deployment ignores first-hand proof for a new pool");
|
||||
assert!(
|
||||
startup_object(&pool1, POOL_META_IDENTITY_NAME).is_none(),
|
||||
"no pending identity may be written to an expansion pool"
|
||||
);
|
||||
assert_eq!(startup_object(&pool0, POOL_META_IDENTITY_NAME).as_deref(), Some(founded.as_slice()));
|
||||
let (_, replica_state) = load_pool_meta_for_startup(pools.clone(), &mut joiner)
|
||||
.await
|
||||
.expect("published pool metadata admits the joiner");
|
||||
joiner
|
||||
.ensure_write_safe("expansion joiner")
|
||||
.expect("joining never latches the write gate");
|
||||
if elected {
|
||||
persist_pool_meta_for_startup_if_safe(
|
||||
&init_test_pool_meta_with_pools(2),
|
||||
pools.clone(),
|
||||
replica_state,
|
||||
&mut joiner,
|
||||
true,
|
||||
true,
|
||||
)
|
||||
.await
|
||||
.expect("the topology update repairs the new pool's replicas");
|
||||
let identity = startup_object(&pool1, POOL_META_IDENTITY_NAME).expect("expansion pool identity");
|
||||
assert!(pool_meta_identity_initialized_for_test(&identity).expect("decode repaired identity"));
|
||||
assert!(startup_object(&pool1, POOL_META_NAME).is_some());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn test_store_init_distinguishes_fresh_deployment_from_wiped_lagging_node() {
|
||||
let deployment_id = Uuid::new_v4();
|
||||
@@ -4198,60 +3859,13 @@ mod tests {
|
||||
.await
|
||||
.expect("suspended source versions should be readable")
|
||||
.expect("suspended source must exist before worker convergence");
|
||||
assert_eq!(versions.versions.len(), 1, "DELETE must not add a marker to the retiring source");
|
||||
let source = &versions.versions[0];
|
||||
assert!(
|
||||
!source.deleted && source.version_id.is_none_or(|version_id| version_id.is_nil()),
|
||||
"the source pool must retain its null data version until worker convergence"
|
||||
versions
|
||||
.versions
|
||||
.iter()
|
||||
.any(|version| !version.deleted && version.version_id.is_none_or(|version_id| version_id.is_nil())),
|
||||
"the source pool must retain its null data version while DELETE owns the fixed fence"
|
||||
);
|
||||
assert_eq!(source.mod_time, Some(OffsetDateTime::UNIX_EPOCH + time::Duration::SECOND));
|
||||
|
||||
let mut reader = store.pools[0]
|
||||
.get_object_reader(bucket, object, None, HeaderMap::new(), &ObjectOptions::default())
|
||||
.await
|
||||
.expect("the retiring source must remain directly readable before worker convergence");
|
||||
let mut body = Vec::new();
|
||||
reader
|
||||
.stream
|
||||
.read_to_end(&mut body)
|
||||
.await
|
||||
.expect("read retained source bytes");
|
||||
assert_eq!(body, b"suspended source generation");
|
||||
}
|
||||
|
||||
async fn assert_suspended_null_delete_marker_visible(
|
||||
store: &Arc<crate::store::ECStore>,
|
||||
bucket: &str,
|
||||
object: &str,
|
||||
marker_mod_time: OffsetDateTime,
|
||||
) {
|
||||
let versions = store.pools[1]
|
||||
.get_disks_by_key(object)
|
||||
.load_file_info_versions_exact(bucket, object)
|
||||
.await
|
||||
.expect("healthy target versions should be readable")
|
||||
.expect("the healthy target must retain the DELETE marker");
|
||||
assert_eq!(versions.versions.len(), 1, "the target must contain only the null delete marker");
|
||||
let marker = &versions.versions[0];
|
||||
assert!(marker.deleted, "migration must not replace the DELETE marker with source data");
|
||||
assert!(marker.version_id.is_none_or(|version_id| version_id.is_nil()));
|
||||
assert_eq!(marker.size, 0);
|
||||
assert_eq!(marker.mod_time, Some(marker_mod_time), "migration must preserve the marker generation");
|
||||
assert!(marker_mod_time > OffsetDateTime::UNIX_EPOCH + time::Duration::SECOND);
|
||||
|
||||
let head_err = store
|
||||
.get_object_info(bucket, object, &ObjectOptions::default())
|
||||
.await
|
||||
.expect_err("HEAD must observe the DELETE marker instead of the old null source");
|
||||
assert!(matches!(head_err, Error::ObjectNotFound(_, _)), "unexpected HEAD result: {head_err:?}");
|
||||
let get_err = match store
|
||||
.get_object_reader(bucket, object, None, HeaderMap::new(), &ObjectOptions::default())
|
||||
.await
|
||||
{
|
||||
Ok(_) => panic!("GET must not resurrect the deleted null source"),
|
||||
Err(err) => err,
|
||||
};
|
||||
assert!(matches!(get_err, Error::ObjectNotFound(_, _)), "unexpected GET result: {get_err:?}");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -8089,7 +7703,7 @@ mod tests {
|
||||
write_suspended_decommission_source(&store, &bucket, object).await;
|
||||
mark_test_pool_decommissioning(&store, 0).await;
|
||||
|
||||
let deleted = store
|
||||
let delete_err = store
|
||||
.delete_object(
|
||||
&bucket,
|
||||
object,
|
||||
@@ -8099,12 +7713,12 @@ mod tests {
|
||||
},
|
||||
)
|
||||
.await
|
||||
.expect("a healthy reserved target must accept suspended DELETE");
|
||||
assert!(deleted.delete_marker);
|
||||
assert_eq!(deleted.version_id, Some(uuid::Uuid::nil()));
|
||||
let marker_mod_time = deleted.mod_time.expect("DELETE must return the marker generation");
|
||||
.expect_err("capacity-reserved target must reject a concurrent suspended DELETE");
|
||||
assert!(
|
||||
matches!(delete_err, Error::SlowDown),
|
||||
"unexpected suspended DELETE result: {delete_err:?}"
|
||||
);
|
||||
assert_suspended_null_source_present(&store, &bucket, object).await;
|
||||
assert_suspended_null_delete_marker_visible(&store, &bucket, object, marker_mod_time).await;
|
||||
|
||||
let source_set = store.pools[0].get_disks_by_key(object);
|
||||
let worker_store = Arc::clone(&store);
|
||||
@@ -8124,7 +7738,7 @@ mod tests {
|
||||
})
|
||||
.await
|
||||
.expect("suspended decommission worker should join")
|
||||
.expect("worker must converge the old null source behind the newer DELETE marker");
|
||||
.expect("worker must migrate the fenced suspended source");
|
||||
|
||||
assert_decommission_source_absent(
|
||||
&store,
|
||||
@@ -8136,7 +7750,10 @@ mod tests {
|
||||
},
|
||||
)
|
||||
.await;
|
||||
assert_suspended_null_delete_marker_visible(&store, &bucket, object, marker_mod_time).await;
|
||||
assert_eq!(
|
||||
read_decommission_target_body(&store, &bucket, object, &ObjectOptions::default()).await,
|
||||
b"suspended source generation"
|
||||
);
|
||||
shutdown.cancel();
|
||||
}
|
||||
|
||||
@@ -8169,7 +7786,7 @@ mod tests {
|
||||
},
|
||||
None,
|
||||
));
|
||||
let (deleted, errors) = store
|
||||
let (_deleted, errors) = store
|
||||
.delete_objects(
|
||||
&bucket,
|
||||
vec![ObjectToDelete {
|
||||
@@ -8183,23 +7800,10 @@ mod tests {
|
||||
)
|
||||
.await;
|
||||
assert!(
|
||||
matches!(errors.as_slice(), [None]),
|
||||
matches!(errors.as_slice(), [Some(Error::SlowDown)]),
|
||||
"unexpected suspended batch DELETE result: {errors:?}"
|
||||
);
|
||||
assert_eq!(deleted.len(), 1);
|
||||
assert!(deleted[0].delete_marker);
|
||||
assert_eq!(deleted[0].object_name, object);
|
||||
assert!(
|
||||
deleted[0]
|
||||
.delete_marker_version_id
|
||||
.is_none_or(|version_id| version_id.is_nil()),
|
||||
"batch DELETE must retain the native null version identity"
|
||||
);
|
||||
let marker_mod_time = deleted[0]
|
||||
.delete_marker_mtime
|
||||
.expect("batch DELETE must return the marker generation");
|
||||
assert_suspended_null_source_present(&store, &bucket, object).await;
|
||||
assert_suspended_null_delete_marker_visible(&store, &bucket, object, marker_mod_time).await;
|
||||
|
||||
let source_set = store.pools[0].get_disks_by_key(object);
|
||||
let worker_store = Arc::clone(&store);
|
||||
@@ -8219,7 +7823,7 @@ mod tests {
|
||||
})
|
||||
.await
|
||||
.expect("suspended batch decommission worker should join")
|
||||
.expect("worker must converge the old null source behind the newer batch DELETE marker");
|
||||
.expect("worker must migrate the batch-fenced suspended source");
|
||||
|
||||
assert_decommission_source_absent(
|
||||
&store,
|
||||
@@ -8231,7 +7835,10 @@ mod tests {
|
||||
},
|
||||
)
|
||||
.await;
|
||||
assert_suspended_null_delete_marker_visible(&store, &bucket, object, marker_mod_time).await;
|
||||
assert_eq!(
|
||||
read_decommission_target_body(&store, &bucket, object, &ObjectOptions::default()).await,
|
||||
b"suspended source generation"
|
||||
);
|
||||
shutdown.cancel();
|
||||
}
|
||||
|
||||
|
||||
@@ -762,7 +762,13 @@ impl ECStore {
|
||||
self.pools
|
||||
.iter()
|
||||
.enumerate()
|
||||
.filter(|(pool_index, _)| pool_meta.scanner_pause_backlog_pool_writable(*pool_index))
|
||||
.filter(|(pool_index, _)| {
|
||||
!pool_meta.pools.get(*pool_index).is_some_and(|pool| {
|
||||
pool.decommission
|
||||
.as_ref()
|
||||
.is_some_and(|info| info.has_decommission_state() && !info.failed && !info.canceled)
|
||||
})
|
||||
})
|
||||
.flat_map(|(_, pool)| pool.disk_set.iter().cloned())
|
||||
.collect()
|
||||
}
|
||||
|
||||
@@ -37,7 +37,7 @@ use crate::bucket::object_lock::objectlock_sys::{
|
||||
};
|
||||
use crate::bucket::replication::{DeleteReplicationConfigSnapshot, ReplicationObjectBridge};
|
||||
use crate::bucket::versioning::VersioningApi;
|
||||
use crate::core::pools::{DecommissionCapacityAdmission, DecommissionCapacityOwner, ensure_decommission_capacity_mutation_id};
|
||||
use crate::core::pools::{DecommissionCapacityOwner, ensure_decommission_capacity_mutation_id};
|
||||
use crate::disk::OldCurrentSize;
|
||||
use crate::object_api::{
|
||||
NamespaceLockFence, ObjectLockConfigSnapshot, ScannerPublicationCommitScopeGuard, ScannerPublicationCommitState,
|
||||
@@ -3060,68 +3060,6 @@ impl ECStore {
|
||||
)))
|
||||
}
|
||||
|
||||
/// Publish a native scanner replica without allowing stale pool selection
|
||||
/// to race retirement. Failed/canceled membership repair remains permitted.
|
||||
/// A canceled waiter cannot release publication fences from an in-flight write.
|
||||
pub async fn save_scanner_pause_backlog_replica(
|
||||
self: &Arc<Self>,
|
||||
pool_index: usize,
|
||||
set_index: usize,
|
||||
data: Vec<u8>,
|
||||
preconditions: crate::storage_api_contracts::object::HTTPPreconditions,
|
||||
) -> Result<ObjectInfo> {
|
||||
let set = self
|
||||
.pools
|
||||
.get(pool_index)
|
||||
.and_then(|pool| pool.disk_set.get(set_index))
|
||||
.ok_or_else(|| Error::InvalidArgument("scanner-backlog".into(), "replica".into(), "unknown pool or set".into()))?;
|
||||
let set = Arc::clone(set);
|
||||
let store = Arc::clone(self);
|
||||
let write = async move {
|
||||
let object = "buckets/.scanner-pause-backlog.json";
|
||||
let mut opts = ObjectOptions {
|
||||
max_parity: true,
|
||||
http_preconditions: Some(preconditions),
|
||||
write_completion: crate::object_api::WriteCompletion::TailDrained,
|
||||
..Default::default()
|
||||
};
|
||||
// Match migration: fixed object namespace -> durable pool metadata ->
|
||||
// actual replica namespace. The replica need not be the hash-routed set.
|
||||
let object_guard = if store.single_pool() {
|
||||
None
|
||||
} else {
|
||||
Some(
|
||||
store
|
||||
.acquire_object_write_lock("scanner_backlog_replica", RUSTFS_META_BUCKET, object)
|
||||
.await?,
|
||||
)
|
||||
};
|
||||
let capacity_guard = if let Some(guard) = object_guard.as_ref() {
|
||||
guard.add_namespace_lock_fence(&mut opts);
|
||||
opts.no_lock = match store.pools.first().and_then(|pool| pool.disk_set.first()) {
|
||||
Some(fixed) => fixed.shares_namespace_lock_domain(&set).await,
|
||||
None => false,
|
||||
};
|
||||
let capacity_guard = store
|
||||
.acquire_external_decommission_capacity_fence(&[pool_index], DecommissionCapacityAdmission::ScannerBacklog)
|
||||
.await?;
|
||||
opts.add_namespace_lock_guard(&capacity_guard);
|
||||
Some(capacity_guard)
|
||||
} else {
|
||||
None
|
||||
};
|
||||
let result = set
|
||||
.put_object(RUSTFS_META_BUCKET, object, &mut PutObjReader::from_vec(data), &opts)
|
||||
.await;
|
||||
drop(capacity_guard);
|
||||
drop(object_guard);
|
||||
result
|
||||
};
|
||||
// The set layer may detach its rename owner, even for full-tail writes.
|
||||
// Keep these outer guards alive until that owner finishes if scanner exits.
|
||||
tokio::spawn(write).await.map_err(Error::from)?
|
||||
}
|
||||
|
||||
pub(super) async fn run_external_decommission_capacity_object_mutation<T, F, Fut>(
|
||||
&self,
|
||||
target_pool_idx: usize,
|
||||
@@ -3191,11 +3129,8 @@ impl ECStore {
|
||||
let (capacity_guard, has_active_decommission) = if capacity_releasing {
|
||||
self.acquire_decommission_capacity_release_fence_with_active_source().await?
|
||||
} else {
|
||||
self.acquire_external_decommission_capacity_fence_with_active_source(
|
||||
&[target_pool_idx],
|
||||
DecommissionCapacityAdmission::Mutation,
|
||||
)
|
||||
.await?
|
||||
self.acquire_external_decommission_capacity_fence_with_active_source(&[target_pool_idx], "mutation")
|
||||
.await?
|
||||
};
|
||||
let (capacity_guard, object_guard) = if has_active_decommission && !opts.no_lock {
|
||||
// Active migration acquires the object namespace before its capacity
|
||||
@@ -3211,7 +3146,7 @@ impl ECStore {
|
||||
let capacity_guard = if capacity_releasing {
|
||||
self.acquire_decommission_capacity_release_fence_with_active_source().await?.0
|
||||
} else {
|
||||
self.acquire_external_decommission_capacity_fence(&[target_pool_idx], DecommissionCapacityAdmission::Mutation)
|
||||
self.acquire_external_decommission_capacity_fence(&[target_pool_idx], "mutation")
|
||||
.await?
|
||||
};
|
||||
(capacity_guard, Some(guard))
|
||||
@@ -3241,10 +3176,9 @@ impl ECStore {
|
||||
bucket: &str,
|
||||
object: &str,
|
||||
no_lock: bool,
|
||||
admission: DecommissionCapacityAdmission,
|
||||
) -> Result<(Option<ObjectLockDiagGuard>, bool, Option<rustfs_lock::NamespaceLockGuard>)> {
|
||||
let (capacity_guard, has_active_decommission) = self
|
||||
.acquire_external_decommission_capacity_fence_with_active_source(&[target_pool_idx], admission)
|
||||
.acquire_external_decommission_capacity_fence_with_active_source(&[target_pool_idx], "mutation")
|
||||
.await?;
|
||||
if !has_active_decommission {
|
||||
// Keep the read probe through the staged commit. This closes the
|
||||
@@ -3293,10 +3227,7 @@ impl ECStore {
|
||||
return operation(opts).await;
|
||||
}
|
||||
let (capacity_guard, has_active_decommission) = self
|
||||
.acquire_external_decommission_capacity_fence_with_active_source(
|
||||
&[target_pool_idx],
|
||||
DecommissionCapacityAdmission::Heal,
|
||||
)
|
||||
.acquire_external_decommission_capacity_fence_with_active_source(&[target_pool_idx], "heal")
|
||||
.await?;
|
||||
let (capacity_guard, object_guard) = if has_active_decommission && !opts.no_lock {
|
||||
// Active migration acquires the object namespace before its capacity
|
||||
@@ -3317,7 +3248,7 @@ impl ECStore {
|
||||
None => false,
|
||||
};
|
||||
let capacity_guard = self
|
||||
.acquire_external_decommission_capacity_fence(&[target_pool_idx], DecommissionCapacityAdmission::Heal)
|
||||
.acquire_external_decommission_capacity_fence(&[target_pool_idx], "heal")
|
||||
.await?;
|
||||
opts.no_lock = target_lock_covered;
|
||||
(capacity_guard, Some(guard))
|
||||
@@ -5162,14 +5093,9 @@ impl ECStore {
|
||||
}
|
||||
|
||||
let _capacity_fence = if !self.single_pool() && latest_marker_objects.iter().any(|creates_marker| *creates_marker) {
|
||||
// Only marker destinations can grow. Other pools participate in
|
||||
// exact deletion under the same metadata read fence and must not
|
||||
// be treated as publication targets merely because they retire.
|
||||
let mut target_pool_indices = marker_target_pool_indices.iter().flatten().copied().collect::<Vec<_>>();
|
||||
target_pool_indices.sort_unstable();
|
||||
target_pool_indices.dedup();
|
||||
let target_pool_indices = (0..self.pools.len()).collect::<Vec<_>>();
|
||||
match self
|
||||
.acquire_external_decommission_capacity_fence(&target_pool_indices, DecommissionCapacityAdmission::BatchDelete)
|
||||
.acquire_external_decommission_capacity_fence(&target_pool_indices, "batch_delete")
|
||||
.await
|
||||
{
|
||||
Ok(fence) => Some(fence),
|
||||
|
||||
@@ -521,8 +521,6 @@ async fn submit_mrf_heal_request(manager: &HealManager, intent: &MrfIntent) -> c
|
||||
struct MrfRuntime {
|
||||
queue: MrfQueue,
|
||||
config: MrfConsumerConfig,
|
||||
checkpoint_owner: Uuid,
|
||||
next_checkpoint_sequence: u64,
|
||||
new_since_flush: usize,
|
||||
/// True while the in-memory pending set has changed since the last
|
||||
/// journal flush (push, pop, or an attempts bump that alters the encoded
|
||||
@@ -539,12 +537,6 @@ struct MrfRuntime {
|
||||
/// Partial-write responsibilities accepted from replay and waiting for an
|
||||
/// exact storage-owned proof before the startup journal can be deleted.
|
||||
durable_replay_anchors: Vec<MrfDurableRepairAnchor>,
|
||||
/// Startup replay source to remove after the retained replay
|
||||
/// responsibilities are discharged. `None` means the runtime only needs
|
||||
/// the legacy journal cleanup path for snapshots it wrote itself.
|
||||
replay_cleanup: Option<ReplayCleanup>,
|
||||
/// Last committed checkpoint published by this runtime flush path.
|
||||
runtime_checkpoint: Option<(Uuid, u64)>,
|
||||
/// Earliest instant a full-admission retry may proceed.
|
||||
backoff_until: Option<tokio::time::Instant>,
|
||||
}
|
||||
@@ -568,34 +560,6 @@ impl MrfRuntime {
|
||||
|
||||
async fn flush(&mut self) {
|
||||
let (authoritative, legacy) = self.snapshot();
|
||||
let (committed_persisted, committed_on_disk) = if authoritative.is_empty() {
|
||||
(true, false)
|
||||
} else {
|
||||
match snapshot::publish_committed_snapshot(
|
||||
&journal_disks().await,
|
||||
self.checkpoint_owner,
|
||||
self.next_checkpoint_sequence,
|
||||
&authoritative,
|
||||
self.config.journal_max_bytes,
|
||||
)
|
||||
.await
|
||||
{
|
||||
Ok(publication) => {
|
||||
self.runtime_checkpoint = Some((publication.owner, publication.sequence));
|
||||
self.next_checkpoint_sequence = publication.sequence.saturating_add(1);
|
||||
(true, true)
|
||||
}
|
||||
Err(err) => {
|
||||
tracing::warn!(
|
||||
target: "rustfs::heal::mrf",
|
||||
error = %err,
|
||||
sequence = self.next_checkpoint_sequence,
|
||||
"MRF committed checkpoint publish failed; retaining previous replay anchor"
|
||||
);
|
||||
(false, false)
|
||||
}
|
||||
}
|
||||
};
|
||||
let authoritative_persisted = write_journal(MRF_SCOPED_JOURNAL_PATH, &authoritative).await;
|
||||
if !authoritative.is_empty() {
|
||||
counter!("rustfs_heal_mrf_journal_fsync_total").increment(1);
|
||||
@@ -606,10 +570,10 @@ impl MrfRuntime {
|
||||
// old reader from observing a newer epoch that a new reader cannot
|
||||
// see when the canonical write is unavailable.
|
||||
let legacy_persisted = authoritative_persisted && write_journal(MRF_JOURNAL_PATH, &legacy).await;
|
||||
// Keep dirty until the committed checkpoint, authoritative snapshot,
|
||||
// and compatibility mirror have all been accepted; otherwise a
|
||||
// one-sided failure would never retry the missing recovery anchor.
|
||||
let persisted = committed_persisted && authoritative_persisted && legacy_persisted;
|
||||
// Keep dirty until both the authoritative snapshot and its
|
||||
// compatibility mirror have been accepted; otherwise a one-sided
|
||||
// failure would never retry the missing file.
|
||||
let persisted = authoritative_persisted && legacy_persisted;
|
||||
self.new_since_flush = 0;
|
||||
// Keep the dirty flag when every disk write failed: a clean backlog
|
||||
// would otherwise never rewrite, losing the periodic persist retry a
|
||||
@@ -617,7 +581,7 @@ impl MrfRuntime {
|
||||
if persisted {
|
||||
self.dirty = false;
|
||||
}
|
||||
self.journal_on_disk |= committed_on_disk || authoritative_persisted || legacy_persisted;
|
||||
self.journal_on_disk |= authoritative_persisted || legacy_persisted;
|
||||
}
|
||||
|
||||
/// Drain pending intents into the heal manager until it is full, the
|
||||
@@ -675,45 +639,6 @@ impl MrfRuntime {
|
||||
self.retain_replay_journal || !self.durable_replay_anchors.is_empty()
|
||||
}
|
||||
|
||||
fn replay_cleanup_to_delete(&self) -> Option<ReplayCleanup> {
|
||||
if self.journal_on_disk && !self.retained_replay_journal() {
|
||||
Some(self.replay_cleanup.unwrap_or(ReplayCleanup::Legacy))
|
||||
} else {
|
||||
None
|
||||
}
|
||||
}
|
||||
|
||||
async fn delete_idle_recovery_anchors(&mut self) -> bool {
|
||||
let runtime_deleted = match self.runtime_checkpoint {
|
||||
Some((owner, sequence)) => {
|
||||
match snapshot::delete_committed_snapshots_through(owner, sequence, self.config.journal_max_bytes).await {
|
||||
Ok(deleted) => deleted,
|
||||
Err(err) => {
|
||||
tracing::warn!(
|
||||
target: "rustfs::heal::mrf",
|
||||
error = %err,
|
||||
sequence,
|
||||
"MRF runtime checkpoint cleanup failed"
|
||||
);
|
||||
false
|
||||
}
|
||||
}
|
||||
}
|
||||
None => true,
|
||||
};
|
||||
let replay_deleted = match self.replay_cleanup_to_delete() {
|
||||
Some(cleanup) => delete_replay_source(cleanup, self.config.journal_max_bytes).await,
|
||||
None => true,
|
||||
};
|
||||
if runtime_deleted && replay_deleted {
|
||||
self.runtime_checkpoint = None;
|
||||
self.replay_cleanup = None;
|
||||
true
|
||||
} else {
|
||||
false
|
||||
}
|
||||
}
|
||||
|
||||
fn discharge_durable_replay_anchors(&mut self) {
|
||||
if self.durable_replay_anchors.is_empty() {
|
||||
return;
|
||||
@@ -783,8 +708,6 @@ struct ReplayOutcome {
|
||||
journal_on_disk: bool,
|
||||
retain_journal_for_replay: bool,
|
||||
durable_replay_anchors: Vec<MrfDurableRepairAnchor>,
|
||||
cleanup: Option<ReplayCleanup>,
|
||||
next_checkpoint_sequence: u64,
|
||||
}
|
||||
|
||||
fn replay_must_retain_journal(
|
||||
@@ -796,7 +719,7 @@ fn replay_must_retain_journal(
|
||||
rearm_incomplete || pending_depth > 0 || accepted_without_durable_anchor || durable_replay_anchors > 0
|
||||
}
|
||||
|
||||
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
|
||||
#[derive(Clone, Copy)]
|
||||
enum ReplayCleanup {
|
||||
Legacy,
|
||||
Committed { owner: Uuid, sequence: u64 },
|
||||
@@ -870,8 +793,6 @@ async fn replay_into(
|
||||
journal_on_disk: false,
|
||||
retain_journal_for_replay: false,
|
||||
durable_replay_anchors: Vec::new(),
|
||||
cleanup: None,
|
||||
next_checkpoint_sequence: 1,
|
||||
};
|
||||
}
|
||||
Err(err) => {
|
||||
@@ -885,16 +806,10 @@ async fn replay_into(
|
||||
journal_on_disk: true,
|
||||
retain_journal_for_replay: true,
|
||||
durable_replay_anchors: Vec::new(),
|
||||
cleanup: None,
|
||||
next_checkpoint_sequence: 1,
|
||||
};
|
||||
}
|
||||
};
|
||||
let cleanup = source.cleanup;
|
||||
let next_checkpoint_sequence = match cleanup {
|
||||
ReplayCleanup::Legacy => 1,
|
||||
ReplayCleanup::Committed { sequence, .. } => sequence.saturating_add(1),
|
||||
};
|
||||
let data = source.data;
|
||||
let (decoded, truncated) = decode_journal(&data);
|
||||
let replayed = decoded.len();
|
||||
@@ -998,8 +913,6 @@ async fn replay_into(
|
||||
journal_on_disk,
|
||||
retain_journal_for_replay,
|
||||
durable_replay_anchors,
|
||||
cleanup: journal_on_disk.then_some(cleanup),
|
||||
next_checkpoint_sequence,
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1010,15 +923,11 @@ async fn run_mrf_consumer(manager: Arc<HealManager>, mut receiver: mpsc::Receive
|
||||
let mut runtime = MrfRuntime {
|
||||
queue: MrfQueue::new(config.queue_capacity, config.journal_max_bytes),
|
||||
config: config.clone(),
|
||||
checkpoint_owner: Uuid::new_v4(),
|
||||
next_checkpoint_sequence: 1,
|
||||
new_since_flush: 0,
|
||||
dirty: false,
|
||||
journal_on_disk: false,
|
||||
retain_replay_journal: false,
|
||||
durable_replay_anchors: Vec::new(),
|
||||
replay_cleanup: None,
|
||||
runtime_checkpoint: None,
|
||||
backoff_until: None,
|
||||
};
|
||||
|
||||
@@ -1028,8 +937,6 @@ async fn run_mrf_consumer(manager: Arc<HealManager>, mut receiver: mpsc::Receive
|
||||
runtime.journal_on_disk = replay.journal_on_disk;
|
||||
runtime.retain_replay_journal = replay.retain_journal_for_replay;
|
||||
runtime.durable_replay_anchors = replay.durable_replay_anchors;
|
||||
runtime.replay_cleanup = replay.cleanup;
|
||||
runtime.next_checkpoint_sequence = replay.next_checkpoint_sequence;
|
||||
// Anything still pending (e.g. the manager was full and backoff armed)
|
||||
// must be re-persisted by the next flush before replay can delete the
|
||||
// startup anchor.
|
||||
@@ -1094,7 +1001,7 @@ async fn run_mrf_consumer(manager: Arc<HealManager>, mut receiver: mpsc::Receive
|
||||
TickAction::DeleteJournal => {
|
||||
// All replayed intents have either been accepted,
|
||||
// merged, or replaced by a pending successor snapshot.
|
||||
if runtime.delete_idle_recovery_anchors().await {
|
||||
if delete_journals().await {
|
||||
runtime.journal_on_disk = false;
|
||||
gauge!("rustfs_heal_mrf_journal_bytes").set(0.0);
|
||||
}
|
||||
@@ -1137,10 +1044,7 @@ fn tick_action(dirty: bool, depth: usize, journal_on_disk: bool, retain_replay_j
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use crate::heal::manager::HealConfig;
|
||||
use crate::heal::storage::{ECStoreHealStorage, HealStorageAPI};
|
||||
use rustfs_common::mrf_channel::{MrfIntent, MrfKind, MrfVerifiedRepairDisposition, MrfVerifiedRepairEvent};
|
||||
use serial_test::serial;
|
||||
use std::sync::Arc as StdArc;
|
||||
|
||||
fn intent(bucket: &str, object: &str, attempts: u8) -> MrfIntent {
|
||||
@@ -1156,12 +1060,6 @@ mod tests {
|
||||
}
|
||||
}
|
||||
|
||||
fn encoded_payload(intent: &MrfIntent) -> Vec<u8> {
|
||||
let mut payload = Vec::new();
|
||||
assert!(encode_intent(intent, &mut payload), "fixture intent must encode");
|
||||
payload
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn tick_action_table() {
|
||||
use TickAction::*;
|
||||
@@ -1219,23 +1117,14 @@ mod tests {
|
||||
let bucket_incarnation_id = uuid::Uuid::new_v4();
|
||||
let anchor = rustfs_common::mrf_channel::MrfDurableRepairAnchor::from_intent(&intent, bucket_incarnation_id)
|
||||
.expect("fresh replay lease and bucket incarnation build a durable anchor");
|
||||
let cleanup_owner = uuid::Uuid::new_v4();
|
||||
let cleanup = ReplayCleanup::Committed {
|
||||
owner: cleanup_owner,
|
||||
sequence: 17,
|
||||
};
|
||||
let mut runtime = MrfRuntime {
|
||||
queue: MrfQueue::new(2, usize::MAX),
|
||||
config: MrfConsumerConfig::default(),
|
||||
checkpoint_owner: Uuid::new_v4(),
|
||||
next_checkpoint_sequence: 1,
|
||||
new_since_flush: 0,
|
||||
dirty: false,
|
||||
journal_on_disk: true,
|
||||
retain_replay_journal: false,
|
||||
durable_replay_anchors: vec![anchor],
|
||||
replay_cleanup: Some(cleanup),
|
||||
runtime_checkpoint: None,
|
||||
backoff_until: None,
|
||||
};
|
||||
rustfs_common::mrf_channel::note_mrf_verified_repair(MrfVerifiedRepairEvent {
|
||||
@@ -1253,249 +1142,14 @@ mod tests {
|
||||
runtime.retained_replay_journal(),
|
||||
"anchor must retain the startup journal before proof is consumed"
|
||||
);
|
||||
assert_eq!(
|
||||
runtime.replay_cleanup_to_delete(),
|
||||
None,
|
||||
"the committed replay source must not be reclaimed before the exact proof"
|
||||
);
|
||||
runtime.discharge_durable_replay_anchors();
|
||||
assert!(
|
||||
!runtime.retained_replay_journal(),
|
||||
"matching verified proof discharges the durable replay anchor"
|
||||
);
|
||||
assert_eq!(
|
||||
runtime.replay_cleanup_to_delete(),
|
||||
Some(cleanup),
|
||||
"proof discharge must preserve the committed owner/sequence cleanup target"
|
||||
);
|
||||
rustfs_common::mrf_channel::release_mrf_intent(&intent);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn runtime_cleanup_defaults_to_legacy_for_runtime_written_journals() {
|
||||
let runtime = MrfRuntime {
|
||||
queue: MrfQueue::new(2, usize::MAX),
|
||||
config: MrfConsumerConfig::default(),
|
||||
checkpoint_owner: Uuid::new_v4(),
|
||||
next_checkpoint_sequence: 1,
|
||||
new_since_flush: 0,
|
||||
dirty: false,
|
||||
journal_on_disk: true,
|
||||
retain_replay_journal: false,
|
||||
durable_replay_anchors: Vec::new(),
|
||||
replay_cleanup: None,
|
||||
runtime_checkpoint: None,
|
||||
backoff_until: None,
|
||||
};
|
||||
|
||||
assert_eq!(
|
||||
runtime.replay_cleanup_to_delete(),
|
||||
Some(ReplayCleanup::Legacy),
|
||||
"journals written by the runtime still use the legacy cleanup path"
|
||||
);
|
||||
}
|
||||
|
||||
#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
|
||||
#[serial]
|
||||
async fn runtime_idle_cleanup_deletes_runtime_and_replay_recovery_anchors() {
|
||||
let _env = rustfs_test_utils::TestECStoreEnv::builder()
|
||||
.prefix("rustfs_mrf_runtime_idle_cleanup")
|
||||
.build()
|
||||
.await;
|
||||
let disks = journal_disks().await;
|
||||
assert!(!disks.is_empty(), "test environment must register local disks");
|
||||
|
||||
let replay_owner = Uuid::new_v4();
|
||||
let runtime_owner = Uuid::new_v4();
|
||||
let config = MrfConsumerConfig::default();
|
||||
let journal_max_bytes = config.journal_max_bytes;
|
||||
let replay_payload = encoded_payload(&intent("cleanup-bucket", "replay-object", 0));
|
||||
let runtime_payload = encoded_payload(&intent("cleanup-bucket", "runtime-object", 0));
|
||||
snapshot::publish_committed_snapshot(&disks, replay_owner, 7, &replay_payload, journal_max_bytes)
|
||||
.await
|
||||
.expect("publish retained replay checkpoint");
|
||||
snapshot::publish_committed_snapshot(&disks, runtime_owner, 8, &runtime_payload, journal_max_bytes)
|
||||
.await
|
||||
.expect("publish runtime checkpoint");
|
||||
assert!(write_journal(MRF_SCOPED_JOURNAL_PATH, &runtime_payload).await);
|
||||
assert!(write_journal(MRF_JOURNAL_PATH, &runtime_payload).await);
|
||||
|
||||
let mut runtime = MrfRuntime {
|
||||
queue: MrfQueue::new(2, usize::MAX),
|
||||
config,
|
||||
checkpoint_owner: Uuid::new_v4(),
|
||||
next_checkpoint_sequence: 9,
|
||||
new_since_flush: 0,
|
||||
dirty: false,
|
||||
journal_on_disk: true,
|
||||
retain_replay_journal: false,
|
||||
durable_replay_anchors: Vec::new(),
|
||||
replay_cleanup: Some(ReplayCleanup::Committed {
|
||||
owner: replay_owner,
|
||||
sequence: 7,
|
||||
}),
|
||||
runtime_checkpoint: Some((runtime_owner, 8)),
|
||||
backoff_until: None,
|
||||
};
|
||||
|
||||
assert!(
|
||||
runtime.delete_idle_recovery_anchors().await,
|
||||
"idle cleanup should remove both runtime and replay recovery anchors"
|
||||
);
|
||||
assert_eq!(runtime.replay_cleanup, None);
|
||||
assert_eq!(runtime.runtime_checkpoint, None);
|
||||
assert!(
|
||||
snapshot::inspect_local_committed_snapshot(journal_max_bytes)
|
||||
.await
|
||||
.expect("inspect committed checkpoints after cleanup")
|
||||
.is_none(),
|
||||
"both committed checkpoint generations must be gone after idle cleanup"
|
||||
);
|
||||
assert_eq!(read_journal(MRF_SCOPED_JOURNAL_PATH).await, None);
|
||||
assert_eq!(read_journal(MRF_JOURNAL_PATH).await, None);
|
||||
}
|
||||
|
||||
#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
|
||||
#[serial]
|
||||
async fn committed_replay_anchor_waits_for_verified_proof_before_idle_cleanup() {
|
||||
let env = rustfs_test_utils::TestECStoreEnv::builder()
|
||||
.prefix("rustfs_mrf_replay_proof_cleanup")
|
||||
.build()
|
||||
.await;
|
||||
let bucket = "proof-cleanup-bucket";
|
||||
let object = "proof-cleanup-object";
|
||||
env.make_bucket(bucket, false).await;
|
||||
let storage: Arc<dyn HealStorageAPI> = Arc::new(ECStoreHealStorage::new(env.ecstore.clone()));
|
||||
let manager = Arc::new(HealManager::new(
|
||||
storage.clone(),
|
||||
Some(HealConfig {
|
||||
queue_size: 2,
|
||||
heal_interval: Duration::from_secs(3600),
|
||||
enable_auto_heal: false,
|
||||
..Default::default()
|
||||
}),
|
||||
));
|
||||
let disks = journal_disks().await;
|
||||
assert!(!disks.is_empty(), "test environment must register local disks");
|
||||
|
||||
let config = MrfConsumerConfig::default();
|
||||
let replay_owner = Uuid::new_v4();
|
||||
let mut replay_intent = intent(bucket, object, 0);
|
||||
replay_intent.kind = MrfKind::PartialWrite;
|
||||
replay_intent.version_id = None;
|
||||
let replay_payload = encoded_payload(&replay_intent);
|
||||
snapshot::publish_committed_snapshot(&disks, replay_owner, 11, &replay_payload, config.journal_max_bytes)
|
||||
.await
|
||||
.expect("publish committed replay checkpoint");
|
||||
|
||||
let mut queue = MrfQueue::new(config.queue_capacity, config.journal_max_bytes);
|
||||
let mut backoff_until = None;
|
||||
let replay = replay_into(&manager, &mut queue, &mut backoff_until).await;
|
||||
assert_eq!(replay.replayed, 1, "the committed replay checkpoint must decode one record");
|
||||
assert_eq!(queue.depth(), 0, "the replayed record must be admitted before cleanup is considered");
|
||||
assert!(backoff_until.is_none(), "the accepted replay must not arm admission backoff");
|
||||
assert_eq!(
|
||||
manager.operations_snapshot().await.queued_by_source.mrf,
|
||||
1,
|
||||
"the replayed record must be visible as an MRF manager request"
|
||||
);
|
||||
assert!(
|
||||
replay.journal_on_disk,
|
||||
"a durable repair anchor must retain the committed checkpoint before proof"
|
||||
);
|
||||
assert!(
|
||||
!replay.retain_journal_for_replay,
|
||||
"retention is due to pending proof, not an incomplete replay"
|
||||
);
|
||||
assert_eq!(
|
||||
replay.durable_replay_anchors.len(),
|
||||
1,
|
||||
"the real bucket incarnation must create a proof anchor"
|
||||
);
|
||||
assert_eq!(
|
||||
replay.cleanup,
|
||||
Some(ReplayCleanup::Committed {
|
||||
owner: replay_owner,
|
||||
sequence: 11,
|
||||
}),
|
||||
"cleanup must remember the committed checkpoint generation read at startup"
|
||||
);
|
||||
|
||||
let anchor = replay.durable_replay_anchors[0].clone();
|
||||
let mut runtime = MrfRuntime {
|
||||
queue,
|
||||
config,
|
||||
checkpoint_owner: Uuid::new_v4(),
|
||||
next_checkpoint_sequence: replay.next_checkpoint_sequence,
|
||||
new_since_flush: 0,
|
||||
dirty: false,
|
||||
journal_on_disk: replay.journal_on_disk,
|
||||
retain_replay_journal: replay.retain_journal_for_replay,
|
||||
durable_replay_anchors: replay.durable_replay_anchors,
|
||||
replay_cleanup: replay.cleanup,
|
||||
runtime_checkpoint: None,
|
||||
backoff_until,
|
||||
};
|
||||
assert!(runtime.retained_replay_journal(), "proof-bearing replay anchors must block idle cleanup");
|
||||
assert!(
|
||||
snapshot::inspect_local_committed_snapshot(runtime.config.journal_max_bytes)
|
||||
.await
|
||||
.expect("inspect retained committed checkpoint")
|
||||
.is_some(),
|
||||
"the committed replay checkpoint must still be present before proof"
|
||||
);
|
||||
|
||||
rustfs_common::mrf_channel::note_mrf_verified_repair(MrfVerifiedRepairEvent {
|
||||
kind: anchor.kind,
|
||||
bucket: anchor.bucket.clone(),
|
||||
object: anchor.object.clone(),
|
||||
version_id: anchor.version_id,
|
||||
scope: anchor.scope,
|
||||
lease: Some(anchor.lease),
|
||||
bucket_incarnation_id: anchor.bucket_incarnation_id,
|
||||
disposition: MrfVerifiedRepairDisposition::Repaired,
|
||||
});
|
||||
runtime.discharge_durable_replay_anchors();
|
||||
assert!(
|
||||
!runtime.retained_replay_journal(),
|
||||
"the exact verified proof must release the durable replay anchor"
|
||||
);
|
||||
assert!(
|
||||
runtime.delete_idle_recovery_anchors().await,
|
||||
"idle cleanup must delete the proof-discharged committed replay checkpoint"
|
||||
);
|
||||
runtime.journal_on_disk = false;
|
||||
assert!(
|
||||
snapshot::inspect_local_committed_snapshot(runtime.config.journal_max_bytes)
|
||||
.await
|
||||
.expect("inspect committed checkpoints after proof cleanup")
|
||||
.is_none(),
|
||||
"the committed replay checkpoint must be gone after proof-driven cleanup"
|
||||
);
|
||||
|
||||
let restart_manager = Arc::new(HealManager::new(
|
||||
storage,
|
||||
Some(HealConfig {
|
||||
queue_size: 2,
|
||||
heal_interval: Duration::from_secs(3600),
|
||||
enable_auto_heal: false,
|
||||
..Default::default()
|
||||
}),
|
||||
));
|
||||
assert_eq!(
|
||||
replay_journal_once(&restart_manager).await,
|
||||
0,
|
||||
"proof-cleaned recovery anchors must not resurrect on the next restart"
|
||||
);
|
||||
assert_eq!(
|
||||
restart_manager.operations_snapshot().await.queued_by_source.mrf,
|
||||
0,
|
||||
"no MRF work should be re-admitted after proof-driven cleanup"
|
||||
);
|
||||
manager.stop().await.expect("stop proof cleanup manager");
|
||||
restart_manager.stop().await.expect("stop restart-check manager");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn durable_replay_acquires_a_fresh_lease_before_manager_admission() {
|
||||
let unique = uuid::Uuid::new_v4();
|
||||
@@ -1616,62 +1270,6 @@ mod tests {
|
||||
assert!(!snapshot.is_empty(), "the resident intent remains journalable after rejection");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn rollback_legacy_payload_omits_scoped_only_responsibilities() {
|
||||
let mut scoped = intent("rollback-bucket", "scoped-only-object", 0);
|
||||
scoped.kind = MrfKind::PartialWrite;
|
||||
scoped.scope = Some(rustfs_common::mrf_channel::MrfScope {
|
||||
pool_index: 3,
|
||||
set_index: 7,
|
||||
});
|
||||
let compat = intent("rollback-bucket", "v1-compatible-object", 0);
|
||||
|
||||
let mut runtime = MrfRuntime {
|
||||
queue: MrfQueue::new(4, usize::MAX),
|
||||
config: MrfConsumerConfig::default(),
|
||||
checkpoint_owner: Uuid::new_v4(),
|
||||
next_checkpoint_sequence: 1,
|
||||
new_since_flush: 0,
|
||||
dirty: true,
|
||||
journal_on_disk: false,
|
||||
retain_replay_journal: false,
|
||||
durable_replay_anchors: Vec::new(),
|
||||
replay_cleanup: None,
|
||||
runtime_checkpoint: None,
|
||||
backoff_until: None,
|
||||
};
|
||||
assert_eq!(runtime.queue.try_push_typed(scoped.clone()), MrfQueuePushResult::Enqueued);
|
||||
assert_eq!(runtime.queue.try_push_typed(compat.clone()), MrfQueuePushResult::Enqueued);
|
||||
|
||||
let (authoritative, legacy) = runtime.snapshot();
|
||||
let (authoritative_decoded, authoritative_truncated) = decode_journal(&authoritative);
|
||||
assert_eq!(authoritative_truncated, 0);
|
||||
assert_eq!(authoritative_decoded.len(), 2);
|
||||
assert!(
|
||||
authoritative_decoded
|
||||
.iter()
|
||||
.any(|intent| intent.object.as_ref() == "scoped-only-object" && intent.scope == scoped.scope),
|
||||
"new readers must retain the scoped partial-write responsibility"
|
||||
);
|
||||
|
||||
let (legacy_decoded, legacy_truncated) = decode_journal(&legacy);
|
||||
assert_eq!(legacy_truncated, 0);
|
||||
assert_eq!(legacy_decoded.len(), 1, "rollback payload must contain one v1-compatible record");
|
||||
let legacy_record = legacy_decoded.first().expect("one rollback-compatible record");
|
||||
assert_eq!(legacy_record.bucket, compat.bucket);
|
||||
assert_eq!(legacy_record.object, compat.object);
|
||||
assert_eq!(legacy_record.version_id, compat.version_id);
|
||||
assert_eq!(legacy_record.kind, compat.kind);
|
||||
assert_eq!(legacy_record.scope, None);
|
||||
assert_eq!(legacy_record.attempts, compat.attempts);
|
||||
assert!(
|
||||
!legacy
|
||||
.windows(b"scoped-only-object".len())
|
||||
.any(|window| window == b"scoped-only-object"),
|
||||
"legacy rollback bytes must not disguise a scoped-only responsibility as an unscoped record"
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn mrf_dedupe_failure_releases_key_for_retry() {
|
||||
let mut queue = MrfQueue::new(1, usize::MAX);
|
||||
|
||||
@@ -22,9 +22,8 @@
|
||||
//! responsibility through a newer durable snapshot or a verified repair proof.
|
||||
//! An unreadable commit path cannot prove that only legacy data exists. This
|
||||
//! explicit inspection API fails closed and never mutates recovery anchors.
|
||||
//! The live consumer writes committed checkpoints alongside the scoped and
|
||||
//! legacy journal mirrors; cleanup remains gated by replay ownership and exact
|
||||
//! verified repair proof handoff.
|
||||
//! It is wired into the replay reader before writer activation, but the writer
|
||||
//! remains gated on ownership-aware handoff.
|
||||
//! One surviving committed replica supports process restart recovery only;
|
||||
//! this reader does not establish a replication quorum or a power-loss policy.
|
||||
|
||||
@@ -357,8 +356,8 @@ fn validate_reusable_manifest_slot(existing: Option<&[u8]>, sequence: u64, paylo
|
||||
/// The writer is a narrow production primitive for the ownership-aware MRF
|
||||
/// handoff: it validates the whole journal payload, preserves the previous
|
||||
/// committed slot, and publishes the manifest only after the successor payload
|
||||
/// reaches the same disk. It does not delete legacy journals or tombstone older
|
||||
/// anchors by itself; the consumer decides cleanup after replay handoff.
|
||||
/// reaches the same disk. It does not delete legacy journals, tombstone older
|
||||
/// anchors, or activate the live consumer.
|
||||
pub async fn publish_committed_snapshot(
|
||||
disks: &[EcstoreDiskStore],
|
||||
owner: Uuid,
|
||||
@@ -372,10 +371,7 @@ pub async fn publish_committed_snapshot(
|
||||
if owner.is_nil() || sequence == 0 || sequence == u64::MAX {
|
||||
return Err(SnapshotError::Corrupt);
|
||||
}
|
||||
if payload.len() > limit {
|
||||
return Err(SnapshotError::TooLarge);
|
||||
}
|
||||
if decode_journal(payload).1 != 0 {
|
||||
if payload.len() > limit || decode_journal(payload).1 != 0 {
|
||||
return Err(SnapshotError::Corrupt);
|
||||
}
|
||||
let current = read_committed(disks, limit).await?;
|
||||
@@ -559,13 +555,13 @@ pub async fn inspect_local_committed_snapshot(max_bytes: usize) -> Result<Option
|
||||
read_committed(&super::journal_disks().await, max_bytes).await
|
||||
}
|
||||
|
||||
/// Remove committed checkpoints from `owner` whose sequence is no newer than
|
||||
/// Remove committed manifests from `owner` whose sequence is no newer than
|
||||
/// `committed_through`.
|
||||
///
|
||||
/// Cleanup is manifest-first so readers cannot rediscover an older payload
|
||||
/// after the newest replay has been fully discharged. The payload is removed
|
||||
/// only after the manifest and body were revalidated as one complete committed
|
||||
/// checkpoint; damaged, future, mismatched, or foreign-owner slots are retained.
|
||||
/// Payload files are intentionally left as orphans after their manifest is
|
||||
/// removed. Readers cannot discover a payload without its matching manifest,
|
||||
/// and deleting manifests first prevents an older retained slot from becoming
|
||||
/// visible again after the newest replay has been fully discharged.
|
||||
pub async fn delete_committed_snapshots_through(
|
||||
owner: Uuid,
|
||||
committed_through: u64,
|
||||
@@ -584,10 +580,11 @@ async fn delete_committed_snapshots_through_on(
|
||||
if disks.is_empty() {
|
||||
return Err(SnapshotError::NoWritableReplica);
|
||||
}
|
||||
let mut any_changed = false;
|
||||
let mut first_error = None;
|
||||
for disk in disks {
|
||||
for (manifest_path, payload_path) in MANIFEST_PATHS.into_iter().zip(PAYLOAD_PATHS) {
|
||||
let manifest_bytes = match read_bounded(disk, manifest_path, MANIFEST_LEN).await {
|
||||
for path in MANIFEST_PATHS {
|
||||
let existing = match read_bounded(disk, path, MANIFEST_LEN).await {
|
||||
Ok(Some(existing)) => existing,
|
||||
Ok(None) => continue,
|
||||
Err(error) => {
|
||||
@@ -597,7 +594,7 @@ async fn delete_committed_snapshots_through_on(
|
||||
continue;
|
||||
}
|
||||
};
|
||||
let manifest = match Manifest::decode(&manifest_bytes, max_bytes) {
|
||||
let manifest = match Manifest::decode(&existing, max_bytes) {
|
||||
Ok(manifest) => manifest,
|
||||
Err(error) => {
|
||||
if first_error.is_none() {
|
||||
@@ -609,58 +606,16 @@ async fn delete_committed_snapshots_through_on(
|
||||
if manifest.owner != owner || manifest.sequence > committed_through {
|
||||
continue;
|
||||
}
|
||||
let payload_bytes = match read_bounded(disk, payload_path, manifest.payload_len).await {
|
||||
Ok(Some(payload)) => payload,
|
||||
Ok(None) => {
|
||||
if first_error.is_none() {
|
||||
first_error = Some(SnapshotError::Corrupt);
|
||||
}
|
||||
continue;
|
||||
}
|
||||
Err(error) => {
|
||||
if first_error.is_none() {
|
||||
first_error = Some(error);
|
||||
}
|
||||
continue;
|
||||
}
|
||||
};
|
||||
if let Err(error) = CommittedSnapshot::decode(0, &manifest_bytes, payload_bytes.clone(), max_bytes) {
|
||||
if first_error.is_none() {
|
||||
first_error = Some(error);
|
||||
}
|
||||
continue;
|
||||
}
|
||||
match EcstoreDiskAPI::compare_and_update_file(
|
||||
disk.as_ref(),
|
||||
RUSTFS_META_BUCKET,
|
||||
manifest_path,
|
||||
Some(EcstoreDiskBytes::copy_from_slice(&manifest_bytes)),
|
||||
path,
|
||||
Some(EcstoreDiskBytes::from(existing)),
|
||||
None,
|
||||
)
|
||||
.await
|
||||
{
|
||||
Ok(EcstoreConditionalFileUpdate::Updated) => {
|
||||
match EcstoreDiskAPI::compare_and_update_file(
|
||||
disk.as_ref(),
|
||||
RUSTFS_META_BUCKET,
|
||||
payload_path,
|
||||
Some(EcstoreDiskBytes::copy_from_slice(&payload_bytes)),
|
||||
None,
|
||||
)
|
||||
.await
|
||||
{
|
||||
Ok(
|
||||
EcstoreConditionalFileUpdate::Updated
|
||||
| EcstoreConditionalFileUpdate::Missing
|
||||
| EcstoreConditionalFileUpdate::Mismatch,
|
||||
) => {}
|
||||
Err(error) => {
|
||||
if first_error.is_none() {
|
||||
first_error = Some(SnapshotError::Disk(error));
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
Ok(EcstoreConditionalFileUpdate::Updated) => any_changed = true,
|
||||
Ok(EcstoreConditionalFileUpdate::Missing | EcstoreConditionalFileUpdate::Mismatch) => {}
|
||||
Err(error) => {
|
||||
if first_error.is_none() {
|
||||
@@ -670,7 +625,13 @@ async fn delete_committed_snapshots_through_on(
|
||||
}
|
||||
}
|
||||
}
|
||||
if let Some(error) = first_error { Err(error) } else { Ok(true) }
|
||||
if any_changed {
|
||||
Ok(true)
|
||||
} else if let Some(error) = first_error {
|
||||
Err(error)
|
||||
} else {
|
||||
Ok(true)
|
||||
}
|
||||
}
|
||||
|
||||
async fn read_recovery_snapshot(disks: &[EcstoreDiskStore], limit: usize) -> Result<Option<RecoverySnapshot>, SnapshotError> {
|
||||
@@ -1140,93 +1101,6 @@ mod tests {
|
||||
);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn committed_snapshot_writer_payload_failure_does_not_publish_manifest() {
|
||||
let root = TempDir::new().expect("test directory");
|
||||
let store = disk(&root, "disk").await;
|
||||
let owner = Uuid::new_v4();
|
||||
let old = payload("old");
|
||||
let next = payload("next");
|
||||
commit(&store, 0, owner, 1, &old).await;
|
||||
std::fs::create_dir(root.path().join("disk").join(RUSTFS_META_BUCKET).join(PAYLOAD_PATHS[1]))
|
||||
.expect("payload path blocks successor staging");
|
||||
|
||||
let result = publish_committed_snapshot(std::slice::from_ref(&store), owner, 2, &next, 4096).await;
|
||||
|
||||
assert!(
|
||||
matches!(result, Err(SnapshotError::Disk(_) | SnapshotError::Read(_))),
|
||||
"payload failure must be visible before manifest publication: {result:?}"
|
||||
);
|
||||
let reopened = disk(&root, "disk").await;
|
||||
let recovered = read_committed(std::slice::from_ref(&reopened), 4096)
|
||||
.await
|
||||
.expect("read previous committed snapshot")
|
||||
.expect("old anchor remains committed");
|
||||
assert_eq!(recovered.sequence(), 1);
|
||||
assert_eq!(recovered.slot(), 0);
|
||||
assert_eq!(recovered.payload(), old.as_slice());
|
||||
assert_eq!(
|
||||
EcstoreDiskAPI::read_all(reopened.as_ref(), RUSTFS_META_BUCKET, PAYLOAD_PATHS[0])
|
||||
.await
|
||||
.expect("old payload retained")
|
||||
.as_ref(),
|
||||
old.as_slice()
|
||||
);
|
||||
assert_eq!(
|
||||
EcstoreDiskAPI::read_all(reopened.as_ref(), RUSTFS_META_BUCKET, MANIFEST_PATHS[0])
|
||||
.await
|
||||
.expect("old manifest retained")
|
||||
.as_ref(),
|
||||
manifest(owner, 1, &old).as_slice()
|
||||
);
|
||||
assert!(
|
||||
matches!(
|
||||
EcstoreDiskAPI::read_all(reopened.as_ref(), RUSTFS_META_BUCKET, MANIFEST_PATHS[1]).await,
|
||||
Err(EcstoreDiskError::FileNotFound | EcstoreDiskError::VolumeNotFound)
|
||||
),
|
||||
"successor manifest must not be published when payload staging fails"
|
||||
);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn committed_snapshot_writer_capacity_failure_preserves_previous_anchor() {
|
||||
let root = TempDir::new().expect("test directory");
|
||||
let store = disk(&root, "disk").await;
|
||||
let owner = Uuid::new_v4();
|
||||
let old = payload("old");
|
||||
let next = payload("next");
|
||||
commit(&store, 0, owner, 1, &old).await;
|
||||
|
||||
let result = publish_committed_snapshot(std::slice::from_ref(&store), owner, 2, &next, next.len() - 1).await;
|
||||
|
||||
assert!(
|
||||
matches!(result, Err(SnapshotError::TooLarge)),
|
||||
"capacity failure must be reported separately from corruption: {result:?}"
|
||||
);
|
||||
let reopened = disk(&root, "disk").await;
|
||||
let recovered = read_committed(std::slice::from_ref(&reopened), 4096)
|
||||
.await
|
||||
.expect("read previous committed snapshot")
|
||||
.expect("old anchor remains committed");
|
||||
assert_eq!(recovered.sequence(), 1);
|
||||
assert_eq!(recovered.slot(), 0);
|
||||
assert_eq!(recovered.payload(), old.as_slice());
|
||||
assert_eq!(
|
||||
EcstoreDiskAPI::read_all(reopened.as_ref(), RUSTFS_META_BUCKET, MANIFEST_PATHS[0])
|
||||
.await
|
||||
.expect("old manifest retained")
|
||||
.as_ref(),
|
||||
manifest(owner, 1, &old).as_slice()
|
||||
);
|
||||
assert!(
|
||||
matches!(
|
||||
EcstoreDiskAPI::read_all(reopened.as_ref(), RUSTFS_META_BUCKET, PAYLOAD_PATHS[1]).await,
|
||||
Err(EcstoreDiskError::FileNotFound | EcstoreDiskError::VolumeNotFound)
|
||||
),
|
||||
"oversized successor payload must not be staged"
|
||||
);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn committed_snapshot_writer_does_not_overwrite_damaged_inactive_manifest() {
|
||||
let root = TempDir::new().expect("test directory");
|
||||
@@ -1481,7 +1355,7 @@ mod tests {
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn committed_cleanup_removes_complete_checkpoint_at_or_below_sequence() {
|
||||
async fn committed_cleanup_removes_only_manifests_at_or_below_sequence() {
|
||||
let root = TempDir::new().expect("test directory");
|
||||
let disk = disk(&root, "disk").await;
|
||||
let owner = Uuid::new_v4();
|
||||
@@ -1503,19 +1377,12 @@ mod tests {
|
||||
),
|
||||
"old manifest is gone, so the old payload cannot become visible again"
|
||||
);
|
||||
assert!(
|
||||
matches!(
|
||||
EcstoreDiskAPI::read_all(disk.as_ref(), RUSTFS_META_BUCKET, PAYLOAD_PATHS[0]).await,
|
||||
Err(EcstoreDiskError::FileNotFound | EcstoreDiskError::VolumeNotFound)
|
||||
),
|
||||
"old payload should be reclaimed after its manifest is removed"
|
||||
);
|
||||
assert_eq!(
|
||||
EcstoreDiskAPI::read_all(disk.as_ref(), RUSTFS_META_BUCKET, PAYLOAD_PATHS[1])
|
||||
EcstoreDiskAPI::read_all(disk.as_ref(), RUSTFS_META_BUCKET, PAYLOAD_PATHS[0])
|
||||
.await
|
||||
.expect("newer payload retained")
|
||||
.expect("old payload orphan may remain")
|
||||
.as_ref(),
|
||||
newer
|
||||
older
|
||||
);
|
||||
let recovered = read_committed(std::slice::from_ref(&disk), 4096)
|
||||
.await
|
||||
@@ -1525,40 +1392,6 @@ mod tests {
|
||||
assert_eq!(recovered.payload(), newer);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn committed_cleanup_retains_manifest_when_payload_identity_mismatches() {
|
||||
let root = TempDir::new().expect("test directory");
|
||||
let disk = disk(&root, "disk").await;
|
||||
let owner = Uuid::new_v4();
|
||||
let declared = payload("declared");
|
||||
let actual = payload("actual");
|
||||
install(&disk, MANIFEST_PATHS[0], &manifest(owner, 3, &declared)).await;
|
||||
install(&disk, PAYLOAD_PATHS[0], &actual).await;
|
||||
|
||||
assert!(
|
||||
matches!(
|
||||
delete_committed_snapshots_through_on(std::slice::from_ref(&disk), owner, 3, 4096).await,
|
||||
Err(SnapshotError::Corrupt)
|
||||
),
|
||||
"cleanup must fail closed when the committed body no longer matches its manifest"
|
||||
);
|
||||
|
||||
assert_eq!(
|
||||
EcstoreDiskAPI::read_all(disk.as_ref(), RUSTFS_META_BUCKET, MANIFEST_PATHS[0])
|
||||
.await
|
||||
.expect("mismatched manifest retained")
|
||||
.as_ref(),
|
||||
manifest(owner, 3, &declared)
|
||||
);
|
||||
assert_eq!(
|
||||
EcstoreDiskAPI::read_all(disk.as_ref(), RUSTFS_META_BUCKET, PAYLOAD_PATHS[0])
|
||||
.await
|
||||
.expect("mismatched payload retained")
|
||||
.as_ref(),
|
||||
actual
|
||||
);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn committed_cleanup_preserves_other_owner_manifests_within_sequence_window() {
|
||||
let root = TempDir::new().expect("test directory");
|
||||
@@ -1584,13 +1417,6 @@ mod tests {
|
||||
),
|
||||
"the replay owner's manifest is reclaimed"
|
||||
);
|
||||
assert!(
|
||||
matches!(
|
||||
EcstoreDiskAPI::read_all(disk.as_ref(), RUSTFS_META_BUCKET, PAYLOAD_PATHS[0]).await,
|
||||
Err(EcstoreDiskError::FileNotFound | EcstoreDiskError::VolumeNotFound)
|
||||
),
|
||||
"the replay owner's payload is reclaimed"
|
||||
);
|
||||
assert_eq!(
|
||||
EcstoreDiskAPI::read_all(disk.as_ref(), RUSTFS_META_BUCKET, MANIFEST_PATHS[1])
|
||||
.await
|
||||
|
||||
@@ -22,7 +22,7 @@
|
||||
//! Under `cargo nextest` each test runs in its own process, which keeps the
|
||||
//! process-global MRF channel singleton safe.
|
||||
|
||||
use rustfs_common::mrf_channel::{self, MrfIngressResult, MrfKind, MrfScope};
|
||||
use rustfs_common::mrf_channel::{self, MrfKind};
|
||||
use rustfs_heal::heal::{
|
||||
manager::{HealConfig, HealManager},
|
||||
mrf_queue,
|
||||
@@ -51,8 +51,6 @@ const JOURNAL_REL: &str = "buckets/.heal/mrf/journal.bin";
|
||||
const SCOPED_JOURNAL_REL: &str = "buckets/.heal/mrf/journal-scoped.bin";
|
||||
const COMMITTED_PAYLOAD_REL: &str = ".heal-mrf-snapshot.0.bin";
|
||||
const COMMITTED_MANIFEST_REL: &str = ".heal-mrf-commit.0.bin";
|
||||
const COMMITTED_PAYLOAD_RELS: [&str; 2] = [".heal-mrf-snapshot.0.bin", ".heal-mrf-snapshot.1.bin"];
|
||||
const COMMITTED_MANIFEST_RELS: [&str; 2] = [".heal-mrf-commit.0.bin", ".heal-mrf-commit.1.bin"];
|
||||
const COMMITTED_MAGIC: &[u8; 8] = b"RFMRFC01";
|
||||
const COMMITTED_MANIFEST_LEN: usize = 8 + 1 + 16 + 8 + 8 + 32 + 32;
|
||||
|
||||
@@ -237,71 +235,6 @@ fn journal_matches_on_all_disks(disk_paths: &[PathBuf], relative_path: &str, exp
|
||||
.all(|path| std::fs::read(path.join(META_BUCKET).join(relative_path)).is_ok_and(|actual| actual == expected))
|
||||
}
|
||||
|
||||
fn journal_contains_on_all_disks(disk_paths: &[PathBuf], relative_path: &str, needle: &[u8]) -> bool {
|
||||
disk_paths.iter().all(|path| {
|
||||
std::fs::read(path.join(META_BUCKET).join(relative_path))
|
||||
.is_ok_and(|actual| actual.windows(needle.len()).any(|window| window == needle))
|
||||
})
|
||||
}
|
||||
|
||||
fn journal_contains_on_any_disk(disk_paths: &[PathBuf], relative_path: &str, needle: &[u8]) -> bool {
|
||||
disk_paths.iter().any(|path| {
|
||||
std::fs::read(path.join(META_BUCKET).join(relative_path))
|
||||
.is_ok_and(|actual| actual.windows(needle.len()).any(|window| window == needle))
|
||||
})
|
||||
}
|
||||
|
||||
fn committed_payload_contains_on_all_disks(disk_paths: &[PathBuf], needles: &[&[u8]]) -> bool {
|
||||
disk_paths.iter().all(|path| {
|
||||
let root = path.join(META_BUCKET);
|
||||
COMMITTED_PAYLOAD_RELS.into_iter().any(|payload_rel| {
|
||||
std::fs::read(root.join(payload_rel)).is_ok_and(|payload| {
|
||||
needles
|
||||
.iter()
|
||||
.all(|needle| payload.windows(needle.len()).any(|window| window == *needle))
|
||||
})
|
||||
})
|
||||
})
|
||||
}
|
||||
|
||||
fn committed_checkpoint_matches_on_all_disks(disk_paths: &[PathBuf], sequence: u64, expected_payload: &[u8]) -> bool {
|
||||
disk_paths.iter().all(|path| {
|
||||
let root = path.join(META_BUCKET);
|
||||
COMMITTED_PAYLOAD_RELS
|
||||
.into_iter()
|
||||
.zip(COMMITTED_MANIFEST_RELS)
|
||||
.any(|(payload_rel, manifest_rel)| {
|
||||
let Ok(payload) = std::fs::read(root.join(payload_rel)) else {
|
||||
return false;
|
||||
};
|
||||
if payload != expected_payload {
|
||||
return false;
|
||||
}
|
||||
let Ok(manifest) = std::fs::read(root.join(manifest_rel)) else {
|
||||
return false;
|
||||
};
|
||||
if manifest.len() != COMMITTED_MANIFEST_LEN || &manifest[..8] != COMMITTED_MAGIC || manifest[8] != 1 {
|
||||
return false;
|
||||
}
|
||||
let Ok(recorded_sequence) = <[u8; 8]>::try_from(&manifest[25..33]).map(u64::from_le_bytes) else {
|
||||
return false;
|
||||
};
|
||||
let Ok(recorded_len) = <[u8; 8]>::try_from(&manifest[33..41]).map(u64::from_le_bytes) else {
|
||||
return false;
|
||||
};
|
||||
let Ok(expected_len) = u64::try_from(expected_payload.len()) else {
|
||||
return false;
|
||||
};
|
||||
if recorded_sequence != sequence || recorded_len != expected_len {
|
||||
return false;
|
||||
}
|
||||
let payload_digest: [u8; 32] = Sha256::digest(expected_payload).into();
|
||||
let manifest_digest: [u8; 32] = Sha256::digest(&manifest[..COMMITTED_MANIFEST_LEN - 32]).into();
|
||||
payload_digest.as_slice() == &manifest[41..73] && manifest_digest.as_slice() == &manifest[73..]
|
||||
})
|
||||
})
|
||||
}
|
||||
|
||||
async fn wait_until<F, Fut>(deadline: Duration, mut probe: F) -> bool
|
||||
where
|
||||
F: FnMut() -> Fut,
|
||||
@@ -642,73 +575,6 @@ async fn journal_replay_retains_file_when_manager_is_full() {
|
||||
);
|
||||
}
|
||||
|
||||
/// Rollback mirrors are for v1 readers only: the committed and scoped
|
||||
/// snapshots remain authoritative, while the legacy journal omits scoped-only
|
||||
/// records that an older binary cannot represent safely.
|
||||
#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
|
||||
#[serial]
|
||||
async fn rollback_legacy_mirror_persists_only_v1_compatible_records() {
|
||||
let (disk_paths, storage) = heal_env().await;
|
||||
register_local_disks(&disk_paths, "mrf-rollback-mirror-test").await;
|
||||
|
||||
let manager = Arc::new(HealManager::new(
|
||||
storage,
|
||||
Some(HealConfig {
|
||||
queue_size: 0,
|
||||
heal_interval: Duration::from_secs(3600),
|
||||
enable_auto_heal: false,
|
||||
..Default::default()
|
||||
}),
|
||||
));
|
||||
mrf_queue::spawn_mrf_consumer(manager.clone());
|
||||
|
||||
let scoped_only = b"rollback-scoped-only-object";
|
||||
let v1_compatible = b"rollback-v1-compatible-object";
|
||||
assert_eq!(
|
||||
mrf_channel::try_send_mrf_intent_typed(
|
||||
MrfKind::PartialWrite,
|
||||
"rollback-bucket",
|
||||
std::str::from_utf8(scoped_only).expect("fixture object is UTF-8"),
|
||||
None,
|
||||
Some(MrfScope {
|
||||
pool_index: 3,
|
||||
set_index: 7,
|
||||
}),
|
||||
),
|
||||
MrfIngressResult::Enqueued,
|
||||
"scoped-only intent should be accepted by the live consumer"
|
||||
);
|
||||
assert_eq!(
|
||||
mrf_channel::try_send_mrf_intent_typed(
|
||||
MrfKind::PartialWrite,
|
||||
"rollback-bucket",
|
||||
std::str::from_utf8(v1_compatible).expect("fixture object is UTF-8"),
|
||||
None,
|
||||
None,
|
||||
),
|
||||
MrfIngressResult::Enqueued,
|
||||
"v1-compatible intent should be accepted by the live consumer"
|
||||
);
|
||||
|
||||
let flushed = wait_until(Duration::from_secs(10), || async {
|
||||
committed_payload_contains_on_all_disks(&disk_paths, &[scoped_only, v1_compatible])
|
||||
&& journal_contains_on_all_disks(&disk_paths, SCOPED_JOURNAL_REL, scoped_only)
|
||||
&& journal_contains_on_all_disks(&disk_paths, SCOPED_JOURNAL_REL, v1_compatible)
|
||||
&& journal_contains_on_all_disks(&disk_paths, JOURNAL_REL, v1_compatible)
|
||||
&& !journal_contains_on_any_disk(&disk_paths, JOURNAL_REL, scoped_only)
|
||||
})
|
||||
.await;
|
||||
assert!(
|
||||
flushed,
|
||||
"runtime flush must persist rollback-safe mirrors without leaking scoped-only records into the legacy journal"
|
||||
);
|
||||
assert_eq!(
|
||||
manager.operations_snapshot().await.queued_by_source.mrf,
|
||||
0,
|
||||
"zero-capacity manager keeps both intents in the MRF runtime so the persisted snapshot is observable"
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn mrf_journal_child_process_fixture() {
|
||||
let Ok(root) = std::env::var("RUSTFS_MRF_REPLAY_CHILD_ROOT") else {
|
||||
@@ -763,14 +629,13 @@ fn mrf_successor_flush_child_process_fixture() {
|
||||
let expected_successor = journal_record(1, "successor-bucket", "second-object", None, 2);
|
||||
let flushed = wait_until(Duration::from_secs(10), || async {
|
||||
manager.operations_snapshot().await.queued_by_source.mrf == 1
|
||||
&& committed_checkpoint_matches_on_all_disks(&disk_paths, 2, &expected_successor)
|
||||
&& journal_matches_on_all_disks(&disk_paths, SCOPED_JOURNAL_REL, &expected_successor)
|
||||
&& journal_matches_on_all_disks(&disk_paths, JOURNAL_REL, &expected_successor)
|
||||
})
|
||||
.await;
|
||||
assert!(
|
||||
flushed,
|
||||
"child process must publish the committed pending successor before the delete phase"
|
||||
"child process must publish the pending successor snapshot before the delete phase"
|
||||
);
|
||||
});
|
||||
std::process::exit(78);
|
||||
@@ -811,14 +676,13 @@ fn mrf_successor_flush_waiting_child_process_fixture() {
|
||||
let expected_successor = journal_record(1, "service-kill-bucket", "second-object", None, 2);
|
||||
let flushed = wait_until(Duration::from_secs(10), || async {
|
||||
manager.operations_snapshot().await.queued_by_source.mrf == 1
|
||||
&& committed_checkpoint_matches_on_all_disks(&disk_paths, 2, &expected_successor)
|
||||
&& journal_matches_on_all_disks(&disk_paths, SCOPED_JOURNAL_REL, &expected_successor)
|
||||
&& journal_matches_on_all_disks(&disk_paths, JOURNAL_REL, &expected_successor)
|
||||
})
|
||||
.await;
|
||||
assert!(
|
||||
flushed,
|
||||
"child process must publish the committed pending successor before it can be killed"
|
||||
"child process must publish the pending successor snapshot before it can be killed"
|
||||
);
|
||||
std::fs::write(&ready_path, b"ready").expect("write ready marker");
|
||||
loop {
|
||||
|
||||
@@ -62,51 +62,6 @@ pub fn record_contention_event() {
|
||||
counter!("rustfs_lock_contentions").increment(1);
|
||||
}
|
||||
|
||||
/// Record a remote lock RPC that exceeded its caller's deadline.
|
||||
#[inline(always)]
|
||||
pub fn record_remote_lock_rpc_timeout(peer: &str, op: &'static str) {
|
||||
use metrics::counter;
|
||||
counter!("rustfs_remote_lock_rpc_timeouts_total", "peer" => peer.to_string(), "op" => op).increment(1);
|
||||
}
|
||||
|
||||
/// Record the cached lock channel to `peer` being evicted after an RPC failure.
|
||||
#[inline(always)]
|
||||
pub fn record_remote_lock_channel_eviction(peer: &str, trigger: &'static str) {
|
||||
use metrics::counter;
|
||||
counter!("rustfs_remote_lock_channel_evictions_total", "peer" => peer.to_string(), "trigger" => trigger).increment(1);
|
||||
}
|
||||
|
||||
/// Record an RPC failure that did not evict the cached lock channel to `peer`
|
||||
/// because the peer recently served a request or was re-dialed too recently.
|
||||
#[inline(always)]
|
||||
pub fn record_remote_lock_channel_eviction_suppressed(peer: &str, verdict: &'static str) {
|
||||
use metrics::counter;
|
||||
counter!("rustfs_remote_lock_channel_evictions_suppressed_total", "peer" => peer.to_string(), "verdict" => verdict)
|
||||
.increment(1);
|
||||
}
|
||||
|
||||
/// Record a timed-out lock RPC that was left running (`detached`) or cancelled
|
||||
/// because the per-peer detached budget was exhausted (`aborted`).
|
||||
#[inline(always)]
|
||||
pub fn record_remote_lock_rpc_detached(op: &'static str, outcome: &'static str) {
|
||||
use metrics::counter;
|
||||
counter!("rustfs_remote_lock_rpc_detached_total", "op" => op, "outcome" => outcome).increment(1);
|
||||
}
|
||||
|
||||
/// Record how a detached lock RPC eventually ended.
|
||||
#[inline(always)]
|
||||
pub fn record_remote_lock_rpc_late_completion(op: &'static str, outcome: &'static str) {
|
||||
use metrics::counter;
|
||||
counter!("rustfs_remote_lock_rpc_late_completions_total", "op" => op, "outcome" => outcome).increment(1);
|
||||
}
|
||||
|
||||
/// Record the release of a lock that was granted after its caller timed out.
|
||||
#[inline(always)]
|
||||
pub fn record_remote_lock_late_release(outcome: &'static str) {
|
||||
use metrics::counter;
|
||||
counter!("rustfs_remote_lock_late_releases_total", "outcome" => outcome).increment(1);
|
||||
}
|
||||
|
||||
/// Record object namespace lock diagnostics being enabled.
|
||||
#[inline(always)]
|
||||
pub fn record_object_lock_diag_enabled(enabled: bool) {
|
||||
@@ -228,12 +183,6 @@ mod tests {
|
||||
record_lock_hold_time(Duration::from_millis(100));
|
||||
record_early_release();
|
||||
record_contention_event();
|
||||
record_remote_lock_rpc_timeout("http://peer:9000", "lock");
|
||||
record_remote_lock_channel_eviction("http://peer:9000", "timeout");
|
||||
record_remote_lock_channel_eviction_suppressed("http://peer:9000", "peer_recently_served");
|
||||
record_remote_lock_rpc_detached("lock", "detached");
|
||||
record_remote_lock_rpc_late_completion("lock", "success");
|
||||
record_remote_lock_late_release("released");
|
||||
});
|
||||
|
||||
let emitted: std::collections::HashSet<String> = snapshotter
|
||||
@@ -250,12 +199,6 @@ mod tests {
|
||||
"rustfs_lock_hold_time_secs",
|
||||
"rustfs_lock_early_releases",
|
||||
"rustfs_lock_contentions",
|
||||
"rustfs_remote_lock_rpc_timeouts_total",
|
||||
"rustfs_remote_lock_channel_evictions_total",
|
||||
"rustfs_remote_lock_channel_evictions_suppressed_total",
|
||||
"rustfs_remote_lock_rpc_detached_total",
|
||||
"rustfs_remote_lock_rpc_late_completions_total",
|
||||
"rustfs_remote_lock_late_releases_total",
|
||||
] {
|
||||
assert!(emitted.contains(expected), "{expected} must be emitted by its record helper");
|
||||
}
|
||||
|
||||
@@ -819,9 +819,7 @@ impl KmsBackend for AwsKmsBackend {
|
||||
.with_rotate(true)
|
||||
.with_enable_disable(true)
|
||||
.with_schedule_deletion(true)
|
||||
// AWS KMS exposes rotation state but does not enumerate key
|
||||
// versions through this backend's API contract.
|
||||
.with_versioning(false)
|
||||
.with_versioning(true)
|
||||
.with_physical_delete(false)
|
||||
.with_production_supported(true)
|
||||
}
|
||||
|
||||
@@ -1233,9 +1233,6 @@ impl LocalKmsClient {
|
||||
async fn decode_stored_key(&self, key_id: &str) -> Result<(StoredMasterKey, Vec<u8>)> {
|
||||
let key_path = self.master_key_path(key_id)?;
|
||||
if !fs::try_exists(&key_path).await? {
|
||||
// Only an accessible key store can establish that a single key is
|
||||
// missing; a directory outage must retain its filesystem error.
|
||||
let _ = fs::read_dir(&self.config.key_dir).await?;
|
||||
return Err(KmsError::key_not_found(key_id));
|
||||
}
|
||||
|
||||
@@ -2390,76 +2387,6 @@ mod tests {
|
||||
(client, temp_dir)
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn local_key_directory_outage_is_io_error_and_recovers_original_key() {
|
||||
let root = TempDir::new().expect("create isolated key store");
|
||||
let key_dir = root.path().join("keys");
|
||||
let unavailable_dir = root.path().join("keys-unavailable");
|
||||
let config = KmsConfig::local(key_dir.clone()).with_insecure_development_defaults();
|
||||
let backend = LocalKmsBackend::new(config).await.expect("start Local KMS");
|
||||
let key_id = "directory-outage-key";
|
||||
backend
|
||||
.create_key(CreateKeyRequest {
|
||||
key_name: Some(key_id.to_string()),
|
||||
..Default::default()
|
||||
})
|
||||
.await
|
||||
.expect("create the original key");
|
||||
let request = |key_id: &str| GenerateDataKeyRequest {
|
||||
key_id: key_id.to_string(),
|
||||
key_spec: KeySpec::Aes256,
|
||||
encryption_context: HashMap::new(),
|
||||
};
|
||||
let before = backend
|
||||
.generate_data_key(request(key_id))
|
||||
.await
|
||||
.expect("generate a data key before the outage");
|
||||
let missing_key = backend.generate_data_key(request("no-such-key")).await;
|
||||
let key_path = key_dir.join(format!("{key_id}.key"));
|
||||
let original_record = fs::read(&key_path).await.expect("read the original key record");
|
||||
|
||||
fs::rename(&key_dir, &unavailable_dir)
|
||||
.await
|
||||
.expect("make the key directory unavailable");
|
||||
let unavailable = backend.generate_data_key(request(key_id)).await;
|
||||
// Restore before checking the error so the failing regression leaves no
|
||||
// orphaned key store; both paths also belong to the same temporary root.
|
||||
fs::rename(&unavailable_dir, &key_dir)
|
||||
.await
|
||||
.expect("restore the original key directory");
|
||||
|
||||
let after = backend
|
||||
.generate_data_key(request(key_id))
|
||||
.await
|
||||
.expect("generate a data key after directory restoration");
|
||||
for data_key in [&before, &after] {
|
||||
let decrypted = backend
|
||||
.decrypt(DecryptRequest {
|
||||
ciphertext: data_key.ciphertext_blob.clone(),
|
||||
encryption_context: HashMap::new(),
|
||||
grant_tokens: Vec::new(),
|
||||
})
|
||||
.await
|
||||
.expect("the original master key must decrypt both data keys");
|
||||
assert!(
|
||||
decrypted.plaintext == data_key.plaintext_key,
|
||||
"directory restoration must preserve the original key material"
|
||||
);
|
||||
}
|
||||
assert!(
|
||||
fs::read(&key_path).await.expect("read the restored key record") == original_record,
|
||||
"reads and recovery must not rewrite the key record"
|
||||
);
|
||||
assert!(
|
||||
matches!(missing_key, Err(KmsError::KeyNotFound { key_id }) if key_id == "no-such-key"),
|
||||
"a missing key in a readable directory must remain KeyNotFound"
|
||||
);
|
||||
assert!(
|
||||
matches!(unavailable, Err(KmsError::IoError { .. })),
|
||||
"an unavailable key directory must remain an I/O error, not KeyNotFound"
|
||||
);
|
||||
}
|
||||
|
||||
/// With the AAD write switch on, the Local backend seals the stored
|
||||
/// encryption context into the wrap exactly like KV2: the bound envelope
|
||||
/// round-trips, a rewritten stored context fails authentication even with
|
||||
|
||||
@@ -74,39 +74,6 @@ impl ScriptedResponse {
|
||||
}
|
||||
}
|
||||
|
||||
/// The `auth/token/lookup-self` answer every scripted Vault serves for free.
|
||||
///
|
||||
/// A Vault client now probes its token's remaining lifetime at login
|
||||
/// (backlog#2369 P3), which is credential plumbing rather than the protocol any
|
||||
/// of these tests is scripting. Answering it out of band keeps every existing
|
||||
/// script meaningful: `ttl` 0 is Vault's "this token does not expire", so the
|
||||
/// probe changes nothing about how a scripted test behaves.
|
||||
pub(crate) fn token_lookup_self_response() -> String {
|
||||
serde_json::json!({
|
||||
"data": {
|
||||
"accessor": "scripted-accessor",
|
||||
"creation_time": 1_700_000_000u64,
|
||||
"creation_ttl": 0,
|
||||
"display_name": "token",
|
||||
"entity_id": "",
|
||||
"explicit_max_ttl": 0,
|
||||
"id": "scripted-token",
|
||||
"num_uses": 0,
|
||||
"orphan": true,
|
||||
"path": "auth/token/create",
|
||||
"policies": ["default"],
|
||||
"renewable": false,
|
||||
"ttl": 0
|
||||
}
|
||||
})
|
||||
.to_string()
|
||||
}
|
||||
|
||||
/// Whether a recorded request line addresses the token self-lookup.
|
||||
pub(crate) fn is_token_lookup_self(request_line: &str) -> bool {
|
||||
request_line.contains("/v1/auth/token/lookup-self")
|
||||
}
|
||||
|
||||
/// A scripted stand-in Vault listening on a loopback port.
|
||||
pub(crate) struct ScriptedVault {
|
||||
/// Base address (`http://127.0.0.1:port`) to point a Vault client at.
|
||||
@@ -135,19 +102,6 @@ impl ScriptedVault {
|
||||
let Some((request_line, body, mut stream)) = read_request(stream).await else {
|
||||
continue;
|
||||
};
|
||||
if is_token_lookup_self(&request_line) {
|
||||
// Served out of band so the credential probe does not
|
||||
// consume a scripted response meant for the protocol under
|
||||
// test, and is not recorded as one of its requests.
|
||||
let body = token_lookup_self_response();
|
||||
let payload = format!(
|
||||
"HTTP/1.1 200 Scripted\r\ncontent-type: application/json\r\ncontent-length: {}\r\nconnection: close\r\n\r\n{body}",
|
||||
body.len(),
|
||||
);
|
||||
let _ = stream.write_all(payload.as_bytes()).await;
|
||||
let _ = stream.shutdown().await;
|
||||
continue;
|
||||
}
|
||||
recorded
|
||||
.lock()
|
||||
.expect("scripted vault request log poisoned")
|
||||
@@ -201,19 +155,6 @@ impl ScriptedVault {
|
||||
let Some((request_line, body, stream)) = read_request(stream).await else {
|
||||
return;
|
||||
};
|
||||
if is_token_lookup_self(&request_line) {
|
||||
// Credential plumbing, not part of the KV2 protocol
|
||||
// this responder models; see token_lookup_self_response.
|
||||
write_response(
|
||||
stream,
|
||||
ScriptedResponse::Http {
|
||||
status: 200,
|
||||
body: token_lookup_self_response(),
|
||||
},
|
||||
)
|
||||
.await;
|
||||
return;
|
||||
}
|
||||
recorded
|
||||
.lock()
|
||||
.expect("scripted vault request log poisoned")
|
||||
|
||||
+1
-1
@@ -13,5 +13,5 @@ expression: capabilities_snapshot(backend.capabilities())
|
||||
"rotate": true,
|
||||
"schedule_deletion": true,
|
||||
"update_key_metadata": false,
|
||||
"versioning": false
|
||||
"versioning": true
|
||||
}
|
||||
|
||||
@@ -114,7 +114,7 @@ impl fmt::Debug for SecretString {
|
||||
}
|
||||
|
||||
/// Expiry attributes of a lease-bound token.
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
|
||||
#[derive(Debug, Clone, Copy)]
|
||||
pub(crate) struct LeaseInfo {
|
||||
/// Time-to-live granted at issue or renewal.
|
||||
pub(crate) ttl: Duration,
|
||||
@@ -207,102 +207,31 @@ pub(crate) trait TokenSource: fmt::Debug + Send + Sync {
|
||||
}
|
||||
|
||||
/// Token source for [`VaultAuthMethod::Token`]: always yields the token fixed
|
||||
/// at configuration time.
|
||||
///
|
||||
/// The token itself is never re-issued, but it usually still expires:
|
||||
/// `vault token create` defaults to a 768-hour TTL. Hard-coding "no lease"
|
||||
/// here left the renewal task unstarted and published no remaining-TTL gauge,
|
||||
/// so a healthy-looking cluster turned every KMS call into a 403 a month later
|
||||
/// and could only be recovered by a restart or a reconfigure (backlog#2369 P3).
|
||||
/// The source therefore asks Vault what it is holding, once per client
|
||||
/// generation, and lets the existing renewal loop take over whenever the answer
|
||||
/// carries a TTL.
|
||||
/// Map a `lookup-self` answer onto a lease.
|
||||
///
|
||||
/// A zero TTL is Vault's answer for a token that never expires (root and
|
||||
/// periodic-root tokens), which keeps the pre-probe behaviour exactly: no
|
||||
/// lease, no renewal task, no expiry gate. A response that omits `renewable`
|
||||
/// is treated as not renewable, so the renewal loop falls back to re-reading
|
||||
/// the remaining TTL instead of assuming it can extend it.
|
||||
fn static_token_lease(ttl_secs: u64, renewable: Option<bool>) -> Option<LeaseInfo> {
|
||||
(ttl_secs > 0).then_some(LeaseInfo {
|
||||
ttl: Duration::from_secs(ttl_secs),
|
||||
renewable: renewable.unwrap_or(false),
|
||||
})
|
||||
}
|
||||
|
||||
/// at configuration time. The token carries no lease, so it is never renewed
|
||||
/// and never expires from the provider's point of view.
|
||||
pub(crate) struct StaticToken {
|
||||
token: TokenLease,
|
||||
/// Client authenticated with the configured token, used only for
|
||||
/// `lookup-self`. Per-generation renewals use the generation's own client.
|
||||
lookup_client: VaultClient,
|
||||
}
|
||||
|
||||
impl StaticToken {
|
||||
pub(crate) fn new(settings: &VaultConnectionSettings, token: String) -> Result<Self> {
|
||||
let lookup_client = settings.build_client(&token)?;
|
||||
Ok(Self {
|
||||
pub(crate) fn new(token: String) -> Self {
|
||||
Self {
|
||||
token: TokenLease::new(token, None),
|
||||
lookup_client,
|
||||
})
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[async_trait]
|
||||
impl TokenSource for StaticToken {
|
||||
async fn acquire(&self) -> AttemptResult<TokenLease> {
|
||||
// A lookup failure must not fail the login. The token itself may well
|
||||
// be valid: a policy can omit `lookup-self`, and Vault may simply be
|
||||
// unreachable for the moment. Failing here would take down deployments
|
||||
// that work today, so the probe degrades to the pre-probe behaviour —
|
||||
// no lease, no renewal — and says so loudly instead.
|
||||
let lease = match vaultrs::token::lookup_self(&self.lookup_client).await {
|
||||
Ok(lookup) => static_token_lease(lookup.ttl, lookup.renewable),
|
||||
Err(error) => {
|
||||
warn!(
|
||||
event = "vault_static_token_lookup_failed",
|
||||
error = %error,
|
||||
"Could not read the configured Vault token's remaining lifetime, so it will not be \
|
||||
renewed and its expiry will not be tracked. Grant the token `lookup-self` (Vault's \
|
||||
default policy does) or switch to AppRole, Kubernetes or an agent-managed token file"
|
||||
);
|
||||
None
|
||||
}
|
||||
};
|
||||
|
||||
if let Some(lease) = lease
|
||||
&& !lease.renewable
|
||||
{
|
||||
warn!(
|
||||
event = "vault_static_token_not_renewable",
|
||||
ttl_secs = lease.ttl.as_secs(),
|
||||
"The configured Vault token expires and cannot be renewed; RustFS will fail closed as it \
|
||||
approaches expiry. Switch to AppRole, Kubernetes or an agent-managed token file, or \
|
||||
reconfigure with a fresh token before it lapses"
|
||||
);
|
||||
}
|
||||
|
||||
Ok(TokenLease::new(self.token.expose().to_string(), lease))
|
||||
}
|
||||
|
||||
async fn renew(&self, client: &VaultClient) -> AttemptResult<TokenLease> {
|
||||
// Vault refuses renew-self on a non-renewable token; the renewal loop
|
||||
// then falls back to `acquire`, which re-reads the remaining TTL and
|
||||
// keeps the gauge honest until the fail-closed window is reached.
|
||||
let auth = vaultrs::token::renew_self(client, None)
|
||||
.await
|
||||
.map_err(|error| attempt_error("token renewal", error))?;
|
||||
Ok(TokenLease::from_auth(auth))
|
||||
Ok(self.token.clone())
|
||||
}
|
||||
}
|
||||
|
||||
impl fmt::Debug for StaticToken {
|
||||
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
|
||||
// TokenLease::fmt already redacts the token value; VaultClient embeds
|
||||
// its settings, including the token, so it must stay out of Debug.
|
||||
f.debug_struct("StaticToken")
|
||||
.field("token", &self.token)
|
||||
.finish_non_exhaustive()
|
||||
// TokenLease::fmt already redacts the token value.
|
||||
f.debug_struct("StaticToken").field("token", &self.token).finish()
|
||||
}
|
||||
}
|
||||
|
||||
@@ -612,7 +541,7 @@ pub(crate) fn token_source_for(
|
||||
settings: &VaultConnectionSettings,
|
||||
) -> Result<Box<dyn TokenSource>> {
|
||||
match auth_method {
|
||||
VaultAuthMethod::Token { token } => Ok(Box::new(StaticToken::new(settings, token.clone())?)),
|
||||
VaultAuthMethod::Token { token } => Ok(Box::new(StaticToken::new(token.clone()))),
|
||||
VaultAuthMethod::AppRole {
|
||||
role_id,
|
||||
secret_id,
|
||||
@@ -1272,22 +1201,14 @@ mod tests {
|
||||
(Arc::new(provider), state)
|
||||
}
|
||||
|
||||
/// A provider whose token reports no expiry, which is what `lookup-self`
|
||||
/// answers for a root or periodic-root token. Scripted rather than backed
|
||||
/// by [`StaticToken`] because the real source now asks Vault what it holds.
|
||||
async fn static_provider() -> VaultCredentialProvider {
|
||||
VaultCredentialProvider::new(
|
||||
test_settings(),
|
||||
Box::new(ScriptedSource {
|
||||
state: Arc::new(ScriptedState::default()),
|
||||
ttl: Duration::ZERO,
|
||||
renewable: false,
|
||||
login_delay: Duration::ZERO,
|
||||
}),
|
||||
Box::new(StaticToken::new(TEST_TOKEN.to_string())),
|
||||
test_policy(Duration::from_secs(10), Duration::from_secs(5)),
|
||||
)
|
||||
.await
|
||||
.expect("a token without an expiry must build without a live Vault")
|
||||
.expect("static provider must build without a live Vault")
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -1310,57 +1231,20 @@ mod tests {
|
||||
assert!(provider.spawn_renewal_task().is_none(), "a token without a lease has nothing to renew");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_static_token_source_builds_without_contacting_vault() {
|
||||
token_source_for(
|
||||
#[tokio::test]
|
||||
async fn test_static_token_source_yields_configured_token() {
|
||||
let settings = test_settings();
|
||||
let source = token_source_for(
|
||||
&VaultAuthMethod::Token {
|
||||
token: TEST_TOKEN.to_string(),
|
||||
},
|
||||
&test_settings(),
|
||||
&settings,
|
||||
)
|
||||
.expect("token auth must map to a source");
|
||||
}
|
||||
|
||||
/// backlog#2369 P3: `vault token create` defaults to a 768-hour TTL, so
|
||||
/// hard-coding "no lease" for token auth left the renewal task unstarted
|
||||
/// and turned a healthy cluster into one that answers 403 a month later.
|
||||
/// The lease now comes from what Vault reports.
|
||||
#[test]
|
||||
fn static_token_lease_follows_what_vault_reports() {
|
||||
assert_eq!(
|
||||
static_token_lease(0, Some(true)),
|
||||
None,
|
||||
"a token Vault reports as non-expiring must keep behaving as one"
|
||||
);
|
||||
assert_eq!(
|
||||
static_token_lease(0, None),
|
||||
None,
|
||||
"a non-expiring token stays non-expiring whatever renewable says"
|
||||
);
|
||||
assert_eq!(
|
||||
static_token_lease(2_764_800, Some(true)),
|
||||
Some(LeaseInfo {
|
||||
ttl: Duration::from_secs(2_764_800),
|
||||
renewable: true,
|
||||
}),
|
||||
"the default 768-hour token must be tracked and renewed"
|
||||
);
|
||||
assert_eq!(
|
||||
static_token_lease(3_600, Some(false)),
|
||||
Some(LeaseInfo {
|
||||
ttl: Duration::from_secs(3_600),
|
||||
renewable: false,
|
||||
}),
|
||||
"an expiring token that cannot be renewed still needs its expiry tracked"
|
||||
);
|
||||
assert_eq!(
|
||||
static_token_lease(3_600, None),
|
||||
Some(LeaseInfo {
|
||||
ttl: Duration::from_secs(3_600),
|
||||
renewable: false,
|
||||
}),
|
||||
"an omitted renewable flag must not be read as renewable"
|
||||
);
|
||||
let lease = source.acquire().await.expect("static acquire cannot fail");
|
||||
assert_eq!(lease.expose(), TEST_TOKEN);
|
||||
assert!(lease.lease_info().is_none(), "static tokens must not carry a lease");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -1875,7 +1759,7 @@ mod tests {
|
||||
renewable: true,
|
||||
}),
|
||||
);
|
||||
let static_source = StaticToken::new(&test_settings(), TEST_TOKEN.to_string()).expect("static source");
|
||||
let static_source = StaticToken::new(TEST_TOKEN.to_string());
|
||||
let approle_source = AppRoleLogin::new(
|
||||
&test_settings(),
|
||||
"approle".to_string(),
|
||||
|
||||
@@ -38,16 +38,6 @@ use uuid::Uuid;
|
||||
|
||||
const UNLOCK_RETRY_ATTEMPTS: usize = 3;
|
||||
const UNLOCK_RETRY_BACKOFF: Duration = Duration::from_millis(100);
|
||||
/// Slow retry schedule for unlocks that survive the fast retry loop. Lock RPC
|
||||
/// timeouts under load are transient (issue #7363); giving up after three
|
||||
/// quick attempts left orphaned entries for the server lease to expire.
|
||||
const DEFERRED_UNLOCK_BACKOFF: [Duration; 5] = [
|
||||
Duration::from_secs(1),
|
||||
Duration::from_secs(2),
|
||||
Duration::from_secs(4),
|
||||
Duration::from_secs(8),
|
||||
Duration::from_secs(16),
|
||||
];
|
||||
const LOCK_ACQUIRE_RETRY_INITIAL_BACKOFF: Duration = Duration::from_millis(250);
|
||||
const LOCK_ACQUIRE_ATTEMPT_TIMEOUT: Duration = Duration::from_secs(1);
|
||||
const LOCK_ACQUIRE_SPARE_HEDGES: usize = 1;
|
||||
@@ -729,7 +719,22 @@ impl DistributedLock {
|
||||
let mut pending = entries;
|
||||
|
||||
for attempt in 1..=UNLOCK_RETRY_ATTEMPTS {
|
||||
pending = Self::release_pending_once(pending, attempt, context).await;
|
||||
let release_results = join_all(pending.into_iter().map(|(lock_id, client)| async move {
|
||||
match client.release(&lock_id).await {
|
||||
Ok(true) => None,
|
||||
Ok(false) => {
|
||||
warn!(%lock_id, attempt, context, "distributed unlock did not find lock on client");
|
||||
Some((lock_id, client))
|
||||
}
|
||||
Err(err) => {
|
||||
warn!(%lock_id, attempt, context, "distributed unlock failed on client: {}", err);
|
||||
Some((lock_id, client))
|
||||
}
|
||||
}
|
||||
}))
|
||||
.await;
|
||||
|
||||
pending = release_results.into_iter().flatten().collect();
|
||||
if pending.is_empty() {
|
||||
debug!(attempt, context, "distributed unlock completed");
|
||||
return;
|
||||
@@ -744,54 +749,7 @@ impl DistributedLock {
|
||||
remaining = pending.len(),
|
||||
attempts = UNLOCK_RETRY_ATTEMPTS,
|
||||
context,
|
||||
"distributed unlock left unreleased entries after retry; continuing with deferred retries"
|
||||
);
|
||||
Self::release_entries_deferred(pending, context).await;
|
||||
}
|
||||
|
||||
async fn release_pending_once(
|
||||
pending: Vec<(LockId, Arc<dyn LockClient>)>,
|
||||
attempt: usize,
|
||||
context: &'static str,
|
||||
) -> Vec<(LockId, Arc<dyn LockClient>)> {
|
||||
let release_results = join_all(pending.into_iter().map(|(lock_id, client)| async move {
|
||||
match client.release(&lock_id).await {
|
||||
Ok(true) => None,
|
||||
Ok(false) => {
|
||||
warn!(%lock_id, attempt, context, "distributed unlock did not find lock on client");
|
||||
Some((lock_id, client))
|
||||
}
|
||||
Err(err) => {
|
||||
warn!(%lock_id, attempt, context, "distributed unlock failed on client: {}", err);
|
||||
Some((lock_id, client))
|
||||
}
|
||||
}
|
||||
}))
|
||||
.await;
|
||||
|
||||
release_results.into_iter().flatten().collect()
|
||||
}
|
||||
|
||||
/// Bounded slow retries for entries the fast loop could not release. Every
|
||||
/// caller runs on a background task, so waiting here blocks nobody; after
|
||||
/// the schedule is exhausted the server lease reclaims the entry.
|
||||
async fn release_entries_deferred(mut pending: Vec<(LockId, Arc<dyn LockClient>)>, context: &'static str) {
|
||||
let mut attempt = UNLOCK_RETRY_ATTEMPTS;
|
||||
for delay in DEFERRED_UNLOCK_BACKOFF {
|
||||
tokio::time::sleep(delay).await;
|
||||
attempt += 1;
|
||||
pending = Self::release_pending_once(pending, attempt, context).await;
|
||||
if pending.is_empty() {
|
||||
debug!(attempt, context, "deferred distributed unlock converged");
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
warn!(
|
||||
remaining = pending.len(),
|
||||
attempts = attempt,
|
||||
context,
|
||||
"distributed unlock abandoned entries after deferred retry; the server lease will expire them"
|
||||
"distributed unlock left unreleased entries after retry"
|
||||
);
|
||||
}
|
||||
|
||||
@@ -837,9 +795,7 @@ impl DistributedLock {
|
||||
continue;
|
||||
};
|
||||
|
||||
// Deferred retries may wait tens of seconds; never hold up the
|
||||
// next late completion behind them.
|
||||
drop(tokio::spawn(Self::release_entries(vec![(lock_id, client.clone())], context)));
|
||||
Self::release_entries(vec![(lock_id, client.clone())], context).await;
|
||||
}
|
||||
Ok((idx, Ok(resp))) => {
|
||||
tracing::debug!(
|
||||
@@ -1242,8 +1198,8 @@ fn record_lock_held_release(lock_type: LockType) {
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::{
|
||||
DEFERRED_UNLOCK_BACKOFF, DistributedLock, LOCK_ACQUIRE_ATTEMPT_TIMEOUT, LOCK_ACQUIRE_RETRY_INITIAL_BACKOFF,
|
||||
LockAcquireFailureKind, LockLostSignal, UNLOCK_RETRY_ATTEMPTS, is_remote_lock_rpc_failure, should_warn_lock_failure,
|
||||
DistributedLock, LOCK_ACQUIRE_ATTEMPT_TIMEOUT, LOCK_ACQUIRE_RETRY_INITIAL_BACKOFF, LockAcquireFailureKind,
|
||||
LockLostSignal, is_remote_lock_rpc_failure, should_warn_lock_failure,
|
||||
};
|
||||
use crate::{LockError, LockId, LockInfo, LockRequest, LockResponse, LockStats, LockType, ObjectKey, client::LockClient};
|
||||
use rand::{SeedableRng as _, TryRng, rngs::StdRng};
|
||||
@@ -1736,94 +1692,6 @@ mod tests {
|
||||
drop(guard);
|
||||
}
|
||||
|
||||
/// Fails `release` a fixed number of times before succeeding, mimicking a
|
||||
/// peer whose lock RPCs time out under load and then recover.
|
||||
#[derive(Debug)]
|
||||
struct FlakyReleaseClient {
|
||||
failures_left: AtomicUsize,
|
||||
release_calls: Arc<AtomicUsize>,
|
||||
}
|
||||
|
||||
#[async_trait::async_trait]
|
||||
impl LockClient for FlakyReleaseClient {
|
||||
async fn acquire_lock(&self, _request: &LockRequest) -> crate::Result<LockResponse> {
|
||||
Ok(LockResponse::failure("unused", Duration::ZERO))
|
||||
}
|
||||
|
||||
async fn release(&self, _lock_id: &LockId) -> crate::Result<bool> {
|
||||
self.release_calls.fetch_add(1, Ordering::SeqCst);
|
||||
if self.failures_left.load(Ordering::SeqCst) > 0 {
|
||||
self.failures_left.fetch_sub(1, Ordering::SeqCst);
|
||||
return Err(LockError::internal("remote lock rpc timed out: release"));
|
||||
}
|
||||
Ok(true)
|
||||
}
|
||||
|
||||
async fn refresh(&self, _lock_id: &LockId) -> crate::Result<bool> {
|
||||
Ok(false)
|
||||
}
|
||||
|
||||
async fn force_release(&self, _lock_id: &LockId) -> crate::Result<bool> {
|
||||
Ok(false)
|
||||
}
|
||||
|
||||
async fn check_status(&self, _lock_id: &LockId) -> crate::Result<Option<LockInfo>> {
|
||||
Ok(None)
|
||||
}
|
||||
|
||||
async fn get_stats(&self) -> crate::Result<LockStats> {
|
||||
Ok(LockStats::default())
|
||||
}
|
||||
|
||||
async fn close(&self) -> crate::Result<()> {
|
||||
Ok(())
|
||||
}
|
||||
|
||||
async fn is_online(&self) -> bool {
|
||||
true
|
||||
}
|
||||
|
||||
async fn is_local(&self) -> bool {
|
||||
false
|
||||
}
|
||||
}
|
||||
|
||||
#[tokio::test(start_paused = true)]
|
||||
async fn release_entries_keeps_retrying_transient_failures_after_the_fast_loop() {
|
||||
let release_calls = Arc::new(AtomicUsize::new(0));
|
||||
let client: Arc<dyn LockClient> = Arc::new(FlakyReleaseClient {
|
||||
failures_left: AtomicUsize::new(UNLOCK_RETRY_ATTEMPTS + 2),
|
||||
release_calls: release_calls.clone(),
|
||||
});
|
||||
let lock_id = LockId::new_unique(&ObjectKey::new("bucket", "object"));
|
||||
|
||||
DistributedLock::release_entries(vec![(lock_id, client)], "test_deferred_unlock").await;
|
||||
|
||||
assert_eq!(
|
||||
release_calls.load(Ordering::SeqCst),
|
||||
UNLOCK_RETRY_ATTEMPTS + 3,
|
||||
"two deferred attempts fail, the third releases the entry"
|
||||
);
|
||||
}
|
||||
|
||||
#[tokio::test(start_paused = true)]
|
||||
async fn release_entries_gives_up_after_the_deferred_schedule() {
|
||||
let release_calls = Arc::new(AtomicUsize::new(0));
|
||||
let client: Arc<dyn LockClient> = Arc::new(FlakyReleaseClient {
|
||||
failures_left: AtomicUsize::new(usize::MAX),
|
||||
release_calls: release_calls.clone(),
|
||||
});
|
||||
let lock_id = LockId::new_unique(&ObjectKey::new("bucket", "object"));
|
||||
|
||||
DistributedLock::release_entries(vec![(lock_id, client)], "test_deferred_unlock_abandoned").await;
|
||||
|
||||
assert_eq!(
|
||||
release_calls.load(Ordering::SeqCst),
|
||||
UNLOCK_RETRY_ATTEMPTS + DEFERRED_UNLOCK_BACKOFF.len(),
|
||||
"the retry budget is bounded; the server lease reclaims what remains"
|
||||
);
|
||||
}
|
||||
|
||||
#[derive(Debug)]
|
||||
struct ResponseClient {
|
||||
response: LockResponse,
|
||||
|
||||
@@ -166,24 +166,6 @@ fn rule_replicates(rule: &ReplicationRule, obj: &ObjectOpts) -> bool {
|
||||
}
|
||||
}
|
||||
|
||||
fn replication_filter_tags_match(filter: &s3s::dto::ReplicationRuleFilter, object_tags: &HashMap<String, String>) -> bool {
|
||||
let tag_matches = |tag: &s3s::dto::Tag| match (&tag.key, &tag.value) {
|
||||
(None, None) => true,
|
||||
(Some(key), _) if key.is_empty() => true,
|
||||
(Some(key), Some(value)) => object_tags.get(key) == Some(value),
|
||||
_ => false,
|
||||
};
|
||||
|
||||
filter
|
||||
.and
|
||||
.as_ref()
|
||||
.and_then(|and| and.tags.as_deref())
|
||||
.into_iter()
|
||||
.flatten()
|
||||
.chain(filter.tag.iter())
|
||||
.all(tag_matches)
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
|
||||
pub enum ReplicationTargetValidationError {
|
||||
RoleWithMultipleDestinations,
|
||||
@@ -722,7 +704,7 @@ impl ReplicationConfigurationExt for ReplicationConfiguration {
|
||||
|
||||
if let Some(filter) = &rule.filter {
|
||||
let object_tags = ReplicationTagFilter::decode_tags_to_map(&obj.user_tags);
|
||||
if replication_filter_tags_match(filter, &object_tags) {
|
||||
if filter.test_tags(&object_tags) {
|
||||
rules.push(rule.clone());
|
||||
}
|
||||
} else {
|
||||
@@ -1157,47 +1139,6 @@ mod tests {
|
||||
assert_eq!(validate_replication_config_structure(&structure_config(vec![rule])), Ok(()));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn actionable_rules_require_every_and_tag_to_match() {
|
||||
let mut rule = replication_rule("rule-1", "arn:target:a");
|
||||
rule.filter = Some(s3s::dto::ReplicationRuleFilter {
|
||||
and: Some(s3s::dto::ReplicationRuleAndOperator {
|
||||
prefix: None,
|
||||
tags: Some(vec![
|
||||
s3s::dto::Tag {
|
||||
key: Some("env".to_string()),
|
||||
value: Some("prod".to_string()),
|
||||
},
|
||||
s3s::dto::Tag {
|
||||
key: Some("tier".to_string()),
|
||||
value: Some("gold".to_string()),
|
||||
},
|
||||
]),
|
||||
}),
|
||||
..Default::default()
|
||||
});
|
||||
let config = structure_config(vec![rule]);
|
||||
let object = |user_tags: &str| ObjectOpts {
|
||||
name: "object".to_string(),
|
||||
user_tags: user_tags.to_string(),
|
||||
..Default::default()
|
||||
};
|
||||
|
||||
assert!(config.filter_target_arns(&object("env=prod")).is_empty());
|
||||
assert_eq!(config.filter_target_arns(&object("env=prod&tier=gold")), vec!["arn:target:a"]);
|
||||
assert!(config.filter_target_arns(&object("")).is_empty());
|
||||
|
||||
let mut malformed = config;
|
||||
malformed.rules[0].filter.as_mut().unwrap().and.as_mut().unwrap().tags = Some(vec![s3s::dto::Tag {
|
||||
key: Some("env".to_string()),
|
||||
value: None,
|
||||
}]);
|
||||
assert!(
|
||||
malformed.filter_target_arns(&object("env=prod")).is_empty(),
|
||||
"a malformed tag filter must fail closed"
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn structure_validation_allows_tag_filter_when_delete_marker_replication_disabled() {
|
||||
let mut rule = replication_rule("rule-1", "arn:target:a");
|
||||
|
||||
@@ -580,30 +580,6 @@ impl FailStats {
|
||||
FailedMetric { count, size }
|
||||
}
|
||||
|
||||
/// Both rolling windows from one walk of the samples. `short` must be the
|
||||
/// narrower window; the walk stops at `long`. Callers that need both (the
|
||||
/// per-node site snapshot) would otherwise scan the deque twice while
|
||||
/// holding the bucket-stats read lock, and the deque is only bounded by
|
||||
/// the one-hour window - an unreachable target under load fills it.
|
||||
pub fn recent_windows(&self, short: Duration, long: Duration) -> (FailedMetric, FailedMetric) {
|
||||
let now = Instant::now();
|
||||
let mut short_metric = FailedMetric::default();
|
||||
let mut long_metric = FailedMetric::default();
|
||||
for sample in self.recent.iter().rev() {
|
||||
let age = now.duration_since(sample.observed_at);
|
||||
if age > long {
|
||||
break;
|
||||
}
|
||||
if age <= short {
|
||||
short_metric.count += 1;
|
||||
short_metric.size += sample.size;
|
||||
}
|
||||
long_metric.count += 1;
|
||||
long_metric.size += sample.size;
|
||||
}
|
||||
(short_metric, long_metric)
|
||||
}
|
||||
|
||||
pub fn merge(&self, other: &FailStats) -> Self {
|
||||
Self {
|
||||
count: self.count.saturating_add(other.count),
|
||||
@@ -936,26 +912,6 @@ mod tests {
|
||||
assert_eq!(last_hour.size, 96);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn fail_stats_recent_windows_matches_two_separate_scans() {
|
||||
let mut stats = FailStats::default();
|
||||
stats.add_size(64, None::<&()>);
|
||||
stats.add_size(32, None::<&()>);
|
||||
|
||||
let (minute, hour) = stats.recent_windows(Duration::from_secs(60), Duration::from_secs(60 * 60));
|
||||
let expected_minute = stats.recent_since(Duration::from_secs(60));
|
||||
let expected_hour = stats.recent_since(Duration::from_secs(60 * 60));
|
||||
|
||||
assert_eq!((minute.count, minute.size), (expected_minute.count, expected_minute.size));
|
||||
assert_eq!((hour.count, hour.size), (expected_hour.count, expected_hour.size));
|
||||
assert_eq!(minute.count, 2);
|
||||
assert_eq!(hour.size, 96);
|
||||
|
||||
let empty = FailStats::default();
|
||||
let (minute, hour) = empty.recent_windows(Duration::from_secs(60), Duration::from_secs(60 * 60));
|
||||
assert_eq!((minute.count, minute.size, hour.count, hour.size), (0, 0, 0, 0));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn fail_stats_saturate_instead_of_wrapping() {
|
||||
let mut stats = FailStats {
|
||||
|
||||
@@ -90,7 +90,6 @@ s3s = { workspace = true, features = ["minio"] }
|
||||
hex-simd.workspace = true
|
||||
|
||||
[dev-dependencies]
|
||||
temp-env = { workspace = true, features = ["async_closure"] }
|
||||
tokio = { workspace = true, features = ["test-util"] }
|
||||
tokio-test = { workspace = true }
|
||||
criterion = { workspace = true, features = ["html_reports"] }
|
||||
|
||||
@@ -327,55 +327,6 @@ where
|
||||
}
|
||||
}
|
||||
|
||||
/// Read-side switch for the pre-`1.0.0-alpha.91` nonce layout, in which a whole
|
||||
/// v1 segment reused the part nonce for every block.
|
||||
///
|
||||
/// On by default, because turning it off refuses to decrypt objects written
|
||||
/// before that release. Block zero's derived nonce equals that base nonce, so
|
||||
/// the layout also lets a frame encrypted at index zero authenticate anywhere
|
||||
/// in its segment; the in-segment layout lock catches that as soon as a later
|
||||
/// frame disagrees, but a stream that is nothing but repeats of frame zero has
|
||||
/// no such later frame. A deployment with no pre-alpha.91 objects should set
|
||||
/// this to `false` to remove that surface outright (backlog#2369 P2).
|
||||
///
|
||||
// RUSTFS_COMPAT_TODO(backlog-2369-legacy-nonce-fallback): Remove after the
|
||||
// minimum supported direct-upgrade release and after migration tooling has
|
||||
// rewritten every pre-alpha.91 encrypted object.
|
||||
pub const ENV_RUSTFS_ENCRYPTION_LEGACY_NONCE_FALLBACK: &str = "RUSTFS_ENCRYPTION_LEGACY_NONCE_FALLBACK";
|
||||
const DEFAULT_RUSTFS_ENCRYPTION_LEGACY_NONCE_FALLBACK: bool = true;
|
||||
|
||||
fn legacy_nonce_fallback_enabled() -> bool {
|
||||
#[cfg(test)]
|
||||
{
|
||||
rustfs_utils::get_env_bool(
|
||||
ENV_RUSTFS_ENCRYPTION_LEGACY_NONCE_FALLBACK,
|
||||
DEFAULT_RUSTFS_ENCRYPTION_LEGACY_NONCE_FALLBACK,
|
||||
)
|
||||
}
|
||||
#[cfg(not(test))]
|
||||
{
|
||||
static CACHED: std::sync::OnceLock<bool> = std::sync::OnceLock::new();
|
||||
*CACHED.get_or_init(|| {
|
||||
rustfs_utils::get_env_bool(
|
||||
ENV_RUSTFS_ENCRYPTION_LEGACY_NONCE_FALLBACK,
|
||||
DEFAULT_RUSTFS_ENCRYPTION_LEGACY_NONCE_FALLBACK,
|
||||
)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
/// The nonce layout selected while decoding a legacy v1 segment.
|
||||
///
|
||||
/// A historical writer used one of these layouts consistently for every
|
||||
/// block in a segment. Once a non-zero block identifies that layout, accepting
|
||||
/// another layout would let an attacker replay a block encrypted at index zero.
|
||||
#[derive(Clone, Copy, PartialEq, Eq)]
|
||||
enum V1NonceLayout {
|
||||
Current,
|
||||
LegacyBlock,
|
||||
ReusedPart,
|
||||
}
|
||||
|
||||
pin_project! {
|
||||
/// A reader wrapper that decrypts data on the fly using AES-256-GCM.
|
||||
/// This is a demonstration. For production, use a secure and audited crypto library.
|
||||
@@ -407,8 +358,6 @@ pin_project! {
|
||||
segment_frames: usize,
|
||||
stream_saw_v2: bool,
|
||||
segments_completed: usize,
|
||||
v1_nonce_layout: Option<V1NonceLayout>,
|
||||
legacy_nonce_fallback: bool,
|
||||
}
|
||||
}
|
||||
|
||||
@@ -442,8 +391,6 @@ where
|
||||
segment_frames: 0,
|
||||
stream_saw_v2: false,
|
||||
segments_completed: 0,
|
||||
v1_nonce_layout: None,
|
||||
legacy_nonce_fallback: legacy_nonce_fallback_enabled(),
|
||||
}
|
||||
}
|
||||
|
||||
@@ -494,8 +441,6 @@ where
|
||||
segment_frames: 0,
|
||||
stream_saw_v2: false,
|
||||
segments_completed: 0,
|
||||
v1_nonce_layout: None,
|
||||
legacy_nonce_fallback: legacy_nonce_fallback_enabled(),
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -602,7 +547,6 @@ where
|
||||
*this.segment_frame_version = None;
|
||||
*this.saw_final_frame = false;
|
||||
*this.segment_frames = 0;
|
||||
*this.v1_nonce_layout = None;
|
||||
|
||||
if *this.multipart_mode {
|
||||
let next_part = if *this.current_part_index + 1 < this.multipart_parts.len() {
|
||||
@@ -752,46 +696,26 @@ where
|
||||
*this.base_nonce
|
||||
};
|
||||
let legacy_block_nonce = derive_block_nonce(&legacy_part_nonce, *this.block_index);
|
||||
let legacy_part_nonce =
|
||||
Nonce::try_from(legacy_part_nonce.as_slice()).map_err(|_| Error::other("invalid nonce length"))?;
|
||||
let legacy_block_nonce =
|
||||
Nonce::try_from(legacy_block_nonce.as_slice()).map_err(|_| Error::other("invalid nonce length"))?;
|
||||
let layouts = [
|
||||
(V1NonceLayout::Current, &nonce),
|
||||
(V1NonceLayout::LegacyBlock, &legacy_block_nonce),
|
||||
(V1NonceLayout::ReusedPart, &legacy_part_nonce),
|
||||
];
|
||||
let selected = if *this.block_index == 0 { None } else { *this.v1_nonce_layout };
|
||||
let mut plaintext = None;
|
||||
let mut last_error = None;
|
||||
for (layout, candidate_nonce) in layouts {
|
||||
if selected.is_some_and(|expected| expected != layout) {
|
||||
continue;
|
||||
}
|
||||
if layout == V1NonceLayout::ReusedPart && !*this.legacy_nonce_fallback {
|
||||
continue;
|
||||
}
|
||||
match this.cipher.decrypt(candidate_nonce, ciphertext) {
|
||||
Ok(value) => {
|
||||
plaintext = Some((value, layout));
|
||||
break;
|
||||
match this.cipher.decrypt(&nonce, ciphertext) {
|
||||
Ok(plaintext) => plaintext,
|
||||
Err(primary_err) => {
|
||||
let legacy_nonce =
|
||||
Nonce::try_from(legacy_block_nonce.as_slice()).map_err(|_| Error::other("invalid nonce length"))?;
|
||||
|
||||
match this.cipher.decrypt(&legacy_nonce, ciphertext) {
|
||||
Ok(plaintext) => plaintext,
|
||||
Err(_) => {
|
||||
// Accept previously written streams that reused the part nonce
|
||||
// for every block inside a segment.
|
||||
let legacy_part_nonce = Nonce::try_from(legacy_part_nonce.as_slice())
|
||||
.map_err(|_| Error::other("invalid nonce length"))?;
|
||||
this.cipher
|
||||
.decrypt(&legacy_part_nonce, ciphertext)
|
||||
.map_err(|_| Error::other(format!("decrypt error: {primary_err}")))?
|
||||
}
|
||||
}
|
||||
Err(error) => last_error = Some(error),
|
||||
}
|
||||
}
|
||||
let (plaintext, layout) = plaintext.ok_or_else(|| {
|
||||
Error::new(
|
||||
std::io::ErrorKind::InvalidData,
|
||||
format!(
|
||||
"decrypt error: {}",
|
||||
last_error.map_or_else(|| "nonce layout rejected".to_string(), |error| error.to_string())
|
||||
),
|
||||
)
|
||||
})?;
|
||||
if *this.block_index > 0 && this.v1_nonce_layout.is_none() {
|
||||
*this.v1_nonce_layout = Some(layout);
|
||||
}
|
||||
plaintext
|
||||
};
|
||||
if *this.current_frame_type == FRAME_TYPE_V2_FINAL {
|
||||
*this.saw_final_frame = true;
|
||||
@@ -1079,154 +1003,6 @@ mod tests {
|
||||
assert_eq!(&decrypted, data);
|
||||
}
|
||||
|
||||
/// Encrypts `block_count` full v1 blocks, then overwrites frame one with a
|
||||
/// verbatim copy of frame zero. Every frame is the same length, so the
|
||||
/// stream keeps its original size and the forgery is invisible to any
|
||||
/// length check.
|
||||
async fn v1_stream_with_frame_zero_replayed_at_index_one(key: [u8; 32], nonce: [u8; 12], block_count: usize) -> Vec<u8> {
|
||||
assert!(block_count >= 2, "a replay needs at least two frames");
|
||||
let mut data = Vec::with_capacity(ENCRYPTION_BLOCK_SIZE * block_count);
|
||||
for index in 0..block_count {
|
||||
data.extend(std::iter::repeat_n(0xA1u8.wrapping_add(index as u8 * 17), ENCRYPTION_BLOCK_SIZE));
|
||||
}
|
||||
|
||||
let mut encrypt_reader = EncryptReader::new(Cursor::new(data), key, nonce);
|
||||
let mut encrypted = Vec::new();
|
||||
encrypt_reader.read_to_end(&mut encrypted).await.expect("encrypt v1 frames");
|
||||
|
||||
// Header layout: [type][len:24][crc:32]; `len` counts the payload plus
|
||||
// its own 4-byte CRC field, so the frame occupies 8 + (len - 4) bytes.
|
||||
let declared_len = (encrypted[1] as usize) | ((encrypted[2] as usize) << 8) | ((encrypted[3] as usize) << 16);
|
||||
let frame_len = 8 + declared_len - 4;
|
||||
let replayed_first = encrypted[..frame_len].to_vec();
|
||||
encrypted[frame_len..frame_len * 2].copy_from_slice(&replayed_first);
|
||||
encrypted
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn decrypt_reader_rejects_a_replayed_first_v1_frame() {
|
||||
let key = [0x11; 32];
|
||||
let nonce = [0x22; 12];
|
||||
let encrypted = v1_stream_with_frame_zero_replayed_at_index_one(key, nonce, 3).await;
|
||||
|
||||
let mut decrypt_reader = DecryptReader::new(Cursor::new(encrypted), key, nonce);
|
||||
let error = decrypt_reader
|
||||
.read_to_end(&mut Vec::new())
|
||||
.await
|
||||
.expect_err("a repeated index-zero frame must not authenticate at index one");
|
||||
assert_eq!(error.kind(), std::io::ErrorKind::InvalidData);
|
||||
}
|
||||
|
||||
/// The in-segment layout lock must not cost compatibility: every legacy v1
|
||||
/// shape the fallback chain exists for still decrypts under the default.
|
||||
#[tokio::test]
|
||||
async fn legacy_v1_streams_still_decrypt_under_the_default_fallback() {
|
||||
temp_env::async_with_vars([(ENV_RUSTFS_ENCRYPTION_LEGACY_NONCE_FALLBACK, None::<&str>)], async {
|
||||
assert!(legacy_nonce_fallback_enabled(), "the legacy nonce fallback must stay on by default");
|
||||
|
||||
let mut key = [0u8; 32];
|
||||
let mut nonce = [0u8; 12];
|
||||
rand::rng().fill_bytes(&mut key);
|
||||
rand::rng().fill_bytes(&mut nonce);
|
||||
let mut data = vec![0u8; ENCRYPTION_BLOCK_SIZE * 3 + 17];
|
||||
rand::rng().fill(&mut data[..]);
|
||||
|
||||
// Modern single-part stream.
|
||||
let mut encrypted = Vec::new();
|
||||
EncryptReader::new(Cursor::new(data.clone()), key, nonce)
|
||||
.read_to_end(&mut encrypted)
|
||||
.await
|
||||
.expect("modern v1 stream should encrypt");
|
||||
let mut decrypted = Vec::new();
|
||||
DecryptReader::new(Cursor::new(encrypted), key, nonce)
|
||||
.read_to_end(&mut decrypted)
|
||||
.await
|
||||
.expect("modern v1 stream should decrypt");
|
||||
assert_eq!(decrypted, data);
|
||||
|
||||
// Pre-alpha.91 stream that reused the part nonce for every block.
|
||||
let legacy = encrypt_with_legacy_nonce_reuse(&data, key, nonce);
|
||||
let mut decrypted = Vec::new();
|
||||
DecryptReader::new(Cursor::new(legacy), key, nonce)
|
||||
.read_to_end(&mut decrypted)
|
||||
.await
|
||||
.expect("a reused-nonce legacy stream should still decrypt");
|
||||
assert_eq!(decrypted, data);
|
||||
})
|
||||
.await;
|
||||
}
|
||||
|
||||
/// The residual after the layout lock: a stream that is nothing but repeats
|
||||
/// of frame zero has no later frame to disagree with the reused-part
|
||||
/// layout, so only turning the fallback off rejects it.
|
||||
#[tokio::test]
|
||||
async fn a_two_frame_replay_is_closed_only_by_disabling_the_legacy_fallback() {
|
||||
let key = [0x33; 32];
|
||||
let nonce = [0x44; 12];
|
||||
let encrypted = v1_stream_with_frame_zero_replayed_at_index_one(key, nonce, 2).await;
|
||||
|
||||
temp_env::async_with_vars([(ENV_RUSTFS_ENCRYPTION_LEGACY_NONCE_FALLBACK, None::<&str>)], async {
|
||||
let mut forged = Vec::new();
|
||||
DecryptReader::new(Cursor::new(encrypted.clone()), key, nonce)
|
||||
.read_to_end(&mut forged)
|
||||
.await
|
||||
.expect("with the fallback on this forgery is still accepted");
|
||||
assert_eq!(forged.len(), ENCRYPTION_BLOCK_SIZE * 2);
|
||||
assert_eq!(
|
||||
&forged[..ENCRYPTION_BLOCK_SIZE],
|
||||
&forged[ENCRYPTION_BLOCK_SIZE..],
|
||||
"the accepted forgery is frame zero's plaintext twice over"
|
||||
);
|
||||
})
|
||||
.await;
|
||||
|
||||
temp_env::async_with_vars([(ENV_RUSTFS_ENCRYPTION_LEGACY_NONCE_FALLBACK, Some("false"))], async {
|
||||
let error = DecryptReader::new(Cursor::new(encrypted.clone()), key, nonce)
|
||||
.read_to_end(&mut Vec::new())
|
||||
.await
|
||||
.expect_err("with the fallback off the replayed frame must not authenticate");
|
||||
assert_eq!(error.kind(), std::io::ErrorKind::InvalidData);
|
||||
})
|
||||
.await;
|
||||
}
|
||||
|
||||
/// Turning the fallback off removes exactly the third layout: modern v1
|
||||
/// streams keep decrypting, pre-alpha.91 reused-nonce streams stop.
|
||||
#[tokio::test]
|
||||
async fn disabling_the_legacy_nonce_fallback_refuses_only_reused_part_nonces() {
|
||||
let mut key = [0u8; 32];
|
||||
let mut nonce = [0u8; 12];
|
||||
rand::rng().fill_bytes(&mut key);
|
||||
rand::rng().fill_bytes(&mut nonce);
|
||||
let mut data = vec![0u8; ENCRYPTION_BLOCK_SIZE * 3 + 17];
|
||||
rand::rng().fill(&mut data[..]);
|
||||
|
||||
let mut modern = Vec::new();
|
||||
EncryptReader::new(Cursor::new(data.clone()), key, nonce)
|
||||
.read_to_end(&mut modern)
|
||||
.await
|
||||
.expect("modern v1 stream should encrypt");
|
||||
let legacy = encrypt_with_legacy_nonce_reuse(&data, key, nonce);
|
||||
|
||||
temp_env::async_with_vars([(ENV_RUSTFS_ENCRYPTION_LEGACY_NONCE_FALLBACK, Some("false"))], async {
|
||||
assert!(!legacy_nonce_fallback_enabled(), "the switch must be observed");
|
||||
|
||||
let mut decrypted = Vec::new();
|
||||
DecryptReader::new(Cursor::new(modern), key, nonce)
|
||||
.read_to_end(&mut decrypted)
|
||||
.await
|
||||
.expect("modern v1 streams must keep decrypting with the fallback off");
|
||||
assert_eq!(decrypted, data);
|
||||
|
||||
let error = DecryptReader::new(Cursor::new(legacy), key, nonce)
|
||||
.read_to_end(&mut Vec::new())
|
||||
.await
|
||||
.expect_err("the third layout must be gone when the fallback is off");
|
||||
assert_eq!(error.kind(), std::io::ErrorKind::InvalidData);
|
||||
})
|
||||
.await;
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn test_decrypt_reader_only() {
|
||||
// Encrypt some data first
|
||||
|
||||
@@ -564,18 +564,6 @@ impl DataUsageCacheSource {
|
||||
#[serde(transparent)]
|
||||
pub struct DataUsageScanPlanDigest(pub [u8; 32]);
|
||||
|
||||
#[derive(Clone, Debug, Default, Serialize, Deserialize, PartialEq, Eq)]
|
||||
pub struct DataUsageSegmentInvalidationProof {
|
||||
#[serde(default)]
|
||||
pub process_epoch: String,
|
||||
#[serde(default)]
|
||||
pub generation_start: u64,
|
||||
#[serde(default)]
|
||||
pub generation_end: u64,
|
||||
#[serde(default)]
|
||||
pub producer_identity_coverage_complete: bool,
|
||||
}
|
||||
|
||||
#[derive(Clone, Copy, Debug, Serialize, Deserialize, PartialEq, Eq)]
|
||||
#[serde(rename_all = "snake_case")]
|
||||
pub enum PendingScannerHealKind {
|
||||
@@ -669,11 +657,6 @@ pub struct DataUsageCacheInfo {
|
||||
/// structural plan remains reusable across ordinary bucket writes.
|
||||
#[serde(default)]
|
||||
pub scan_execution_digest: Option<DataUsageScanPlanDigest>,
|
||||
/// Process-epoch and generation window that produced a complete set cache
|
||||
/// with all known segment invalidation producers wired. This proof is
|
||||
/// additive compatibility metadata; absence keeps segment reuse disabled.
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub segment_invalidation_proof: Option<DataUsageSegmentInvalidationProof>,
|
||||
/// Durable bucket incarnations captured for a complete set aggregate.
|
||||
/// Missing or nil entries are legacy/unproven and cannot authorize
|
||||
/// skipping an unselected bucket in a later scoped set scan.
|
||||
@@ -703,7 +686,6 @@ impl Serialize for DataUsageCacheInfo {
|
||||
+ usize::from(self.lkg_leader_epoch.is_some())
|
||||
+ usize::from(self.lkg_scan_plan_digest.is_some())
|
||||
+ usize::from(self.scan_execution_digest.is_some())
|
||||
+ usize::from(self.segment_invalidation_proof.is_some())
|
||||
+ usize::from(!self.scan_bucket_incarnations.is_empty());
|
||||
let mut state = serializer.serialize_map(Some(field_count))?;
|
||||
state.serialize_entry("name", &self.name)?;
|
||||
@@ -764,9 +746,6 @@ impl Serialize for DataUsageCacheInfo {
|
||||
if let Some(scan_execution_digest) = self.scan_execution_digest {
|
||||
state.serialize_entry("scan_execution_digest", &scan_execution_digest)?;
|
||||
}
|
||||
if let Some(proof) = &self.segment_invalidation_proof {
|
||||
state.serialize_entry("segment_invalidation_proof", proof)?;
|
||||
}
|
||||
if !self.scan_bucket_incarnations.is_empty() {
|
||||
state.serialize_entry("scan_bucket_incarnations", &self.scan_bucket_incarnations)?;
|
||||
}
|
||||
|
||||
@@ -1095,7 +1095,6 @@ fn test_data_usage_cache_info_deserialize_defaults_scan_resume_after() {
|
||||
assert!(!decoded.snapshot_complete);
|
||||
assert!(decoded.scan_plan_digest.is_none());
|
||||
assert!(decoded.scan_execution_digest.is_none());
|
||||
assert!(decoded.segment_invalidation_proof.is_none());
|
||||
assert_eq!(decoded.cache_key_format, 0);
|
||||
}
|
||||
|
||||
@@ -1184,12 +1183,6 @@ fn test_new_data_usage_cache_msgpack_round_trips_and_supports_old_reader() {
|
||||
snapshot_complete: true,
|
||||
scan_plan_digest: Some(TEST_PLAN_DIGEST),
|
||||
scan_execution_digest: Some(DataUsageScanPlanDigest([42; 32])),
|
||||
segment_invalidation_proof: Some(DataUsageSegmentInvalidationProof {
|
||||
process_epoch: "scanner-process".to_string(),
|
||||
generation_start: 7,
|
||||
generation_end: 9,
|
||||
producer_identity_coverage_complete: true,
|
||||
}),
|
||||
cache_key_format: DATA_USAGE_CACHE_KEY_FORMAT,
|
||||
..Default::default()
|
||||
},
|
||||
@@ -1219,15 +1212,6 @@ fn test_new_data_usage_cache_msgpack_round_trips_and_supports_old_reader() {
|
||||
assert!(current.info.snapshot_complete);
|
||||
assert_eq!(current.info.scan_plan_digest, Some(TEST_PLAN_DIGEST));
|
||||
assert_eq!(current.info.scan_execution_digest, Some(DataUsageScanPlanDigest([42; 32])));
|
||||
assert_eq!(
|
||||
current.info.segment_invalidation_proof,
|
||||
Some(DataUsageSegmentInvalidationProof {
|
||||
process_epoch: "scanner-process".to_string(),
|
||||
generation_start: 7,
|
||||
generation_end: 9,
|
||||
producer_identity_coverage_complete: true,
|
||||
})
|
||||
);
|
||||
assert_eq!(current.info.cache_key_format, DATA_USAGE_CACHE_KEY_FORMAT);
|
||||
assert_eq!(current.find("bucket").map(|entry| entry.objects), Some(3));
|
||||
|
||||
|
||||
@@ -97,9 +97,9 @@ pub use scanner::{
|
||||
pub use scanner_io::{
|
||||
ScannerDirtyUsageAckError, ScannerDirtyUsageBucket, ScannerDirtyUsageSnapshot, ScannerDirtyUsageState,
|
||||
acknowledge_dirty_usage_generation, acknowledge_scoped_dirty_usage, clear_dirty_usage_bucket, record_dirty_usage_bucket,
|
||||
record_dirty_usage_bucket_from_producer, record_dirty_usage_bucket_from_producers, record_dirty_usage_object,
|
||||
record_dirty_usage_object_from_producer, record_scanner_maintenance_change, scanner_activity_epoch,
|
||||
scanner_dirty_usage_snapshot, scanner_dirty_usage_state, scanner_maintenance_generation,
|
||||
record_dirty_usage_bucket_from_producer, record_dirty_usage_object, record_dirty_usage_object_from_producer,
|
||||
record_scanner_maintenance_change, scanner_activity_epoch, scanner_dirty_usage_snapshot, scanner_dirty_usage_state,
|
||||
scanner_maintenance_generation,
|
||||
};
|
||||
pub use segment_invalidation::SegmentInvalidationProducerIdentity;
|
||||
pub use sleeper::{DynamicSleeper, SCANNER_IDLE_MODE, SCANNER_SLEEPER};
|
||||
|
||||
@@ -964,10 +964,9 @@ async fn run_scanner_usage_recovery_intents_for_startup(
|
||||
Ok(attempted)
|
||||
}
|
||||
|
||||
/// Start normal scanning when enabled, or one bounded recovery attempt.
|
||||
/// Start normal scanning when enabled, or one resume-only cleanup attempt.
|
||||
/// The disabled branch returns a finite task for the startup owner to join;
|
||||
/// it never enables ordinary namespace scanning while it replays durable reset
|
||||
/// intents and cleanup markers.
|
||||
/// it never enables ordinary namespace scanning or accepts a new reset intent.
|
||||
pub async fn init_scanner_with_recovery(
|
||||
ctx: CancellationToken,
|
||||
storeapi: Arc<ECStore>,
|
||||
@@ -989,17 +988,6 @@ pub async fn init_scanner_with_recovery(
|
||||
return None;
|
||||
}
|
||||
Some(tokio::spawn(async move {
|
||||
if let Err(error) = run_scanner_usage_recovery_intents_for_startup(ctx.clone(), storeapi.clone()).await {
|
||||
warn!(
|
||||
target: "rustfs::scanner",
|
||||
event = EVENT_SCANNER_PERSIST_STATE,
|
||||
component = LOG_COMPONENT_SCANNER,
|
||||
subsystem = LOG_SUBSYSTEM_RUNTIME,
|
||||
state = "recovery_intent_startup_discovery_failed",
|
||||
error = %error,
|
||||
"Scanner recovery intent startup discovery failed"
|
||||
);
|
||||
}
|
||||
if let Err(error) = resume_scanner_cycle_cleanup(ctx, storeapi).await {
|
||||
warn!(
|
||||
target: "rustfs::scanner",
|
||||
|
||||
@@ -23,7 +23,9 @@ use super::ScannerCycleOutcome;
|
||||
use crate::data_usage_define::DataUsageCacheRevision;
|
||||
use crate::storage_api::ScannerStorage;
|
||||
use crate::storage_api::owner::ObjectIO as _;
|
||||
use crate::{BUCKET_META_PREFIX, ECStore, EcstoreError, RUSTFS_META_BUCKET, ScannerObjectOptions, SetDisks};
|
||||
use crate::{
|
||||
BUCKET_META_PREFIX, ECStore, EcstoreError, RUSTFS_META_BUCKET, ScannerObjectOptions, SetDisks, save_config_with_preconditions,
|
||||
};
|
||||
use futures::future::join_all;
|
||||
use http::HeaderMap;
|
||||
use serde::{Deserialize, Serialize};
|
||||
@@ -1193,14 +1195,13 @@ where
|
||||
};
|
||||
let revision = revisions.get(&id).cloned();
|
||||
let data = data.clone();
|
||||
let storeapi = storeapi.clone();
|
||||
async move {
|
||||
let Some(revision) = revision else {
|
||||
return (id, Err("replica revision is unavailable".to_string()));
|
||||
};
|
||||
let result = storeapi
|
||||
.save_scanner_pause_backlog_replica(id.pool_index, id.set_index, data, revision.preconditions())
|
||||
let result = save_config_with_preconditions(set, SCANNER_PAUSE_BACKLOG_PATH.as_str(), data, revision.preconditions())
|
||||
.await
|
||||
.map(|_| ())
|
||||
.map_err(|err| err.to_string());
|
||||
(id, result)
|
||||
}
|
||||
|
||||
@@ -128,79 +128,6 @@ pub(super) mod cleanup_io_fault {
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
pub(super) mod recovery_intent_accept_fault {
|
||||
use super::*;
|
||||
|
||||
enum Fault {
|
||||
Corrupt,
|
||||
Running,
|
||||
}
|
||||
|
||||
static NEXT_ACCEPT_READBACK_FAULT: StdMutex<Option<Fault>> = StdMutex::new(None);
|
||||
|
||||
pub(in crate::scanner) struct Guard;
|
||||
|
||||
impl Drop for Guard {
|
||||
fn drop(&mut self) {
|
||||
*NEXT_ACCEPT_READBACK_FAULT
|
||||
.lock()
|
||||
.unwrap_or_else(|poisoned| poisoned.into_inner()) = None;
|
||||
}
|
||||
}
|
||||
|
||||
pub(in crate::scanner) fn corrupt_next_accept_readback() -> Guard {
|
||||
install(Fault::Corrupt)
|
||||
}
|
||||
|
||||
pub(in crate::scanner) fn advance_next_accept_readback_to_running() -> Guard {
|
||||
install(Fault::Running)
|
||||
}
|
||||
|
||||
fn install(fault: Fault) -> Guard {
|
||||
let mut slot = NEXT_ACCEPT_READBACK_FAULT
|
||||
.lock()
|
||||
.unwrap_or_else(|poisoned| poisoned.into_inner());
|
||||
assert!(slot.is_none(), "only one recovery intent accept readback fault may be installed");
|
||||
*slot = Some(fault);
|
||||
Guard
|
||||
}
|
||||
|
||||
pub(super) async fn maybe_apply<S>(storeapi: Arc<S>, path: &str) -> Result<(), ScannerError>
|
||||
where
|
||||
S: ScannerObjectIO,
|
||||
{
|
||||
let Some(fault) = NEXT_ACCEPT_READBACK_FAULT
|
||||
.lock()
|
||||
.unwrap_or_else(|poisoned| poisoned.into_inner())
|
||||
.take()
|
||||
else {
|
||||
return Ok(());
|
||||
};
|
||||
match fault {
|
||||
Fault::Corrupt => save_config(storeapi, path, b"{corrupt".to_vec()).await.map_err(|err| {
|
||||
ScannerError::Other(format!("failed to inject scanner recovery intent accept readback fault: {err}"))
|
||||
}),
|
||||
Fault::Running => {
|
||||
let mut record = read_recovery_intent_record(storeapi.clone(), path).await?.ok_or_else(|| {
|
||||
ScannerError::Other("scanner recovery intent disappeared before fault injection".to_string())
|
||||
})?;
|
||||
record.state = SCANNER_RECOVERY_INTENT_STATE_RUNNING.to_string();
|
||||
save_config(
|
||||
storeapi,
|
||||
path,
|
||||
serde_json::to_vec(&record)
|
||||
.map_err(|err| ScannerError::Other(format!("failed to encode scanner recovery intent fault: {err}")))?,
|
||||
)
|
||||
.await
|
||||
.map_err(|err| {
|
||||
ScannerError::Other(format!("failed to inject scanner recovery intent accept readback fault: {err}"))
|
||||
})
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Clone, Debug, Default, Serialize)]
|
||||
pub struct ScannerCycleRecoveryStatus {
|
||||
/// The immutable primary object whose revision is being guarded.
|
||||
@@ -637,17 +564,6 @@ fn compare_recovery_intent(
|
||||
}
|
||||
}
|
||||
|
||||
fn confirm_recovery_intent_acceptance(
|
||||
expected: ScannerRecoveryIntentRecord,
|
||||
persisted: ScannerRecoveryIntentRecord,
|
||||
) -> ScannerRecoveryIntentAcceptResult {
|
||||
if persisted == expected {
|
||||
ScannerRecoveryIntentAcceptResult::Accepted { record: persisted }
|
||||
} else {
|
||||
compare_recovery_intent(&expected, persisted)
|
||||
}
|
||||
}
|
||||
|
||||
async fn read_recovery_intent_record(
|
||||
storeapi: Arc<impl ScannerObjectIO>,
|
||||
path: &str,
|
||||
@@ -841,20 +757,7 @@ pub async fn accept_scanner_usage_recovery_intent(
|
||||
.map_err(|err| ScannerError::Other(format!("failed to encode scanner recovery intent: {err}")))?;
|
||||
match save_config_with_preconditions(storeapi.clone(), &path, encoded, DataUsageCacheRevision::Missing.preconditions()).await
|
||||
{
|
||||
Ok(_) => {
|
||||
#[cfg(test)]
|
||||
recovery_intent_accept_fault::maybe_apply(storeapi.clone(), &path).await?;
|
||||
let persisted = match read_recovery_intent_record(storeapi.clone(), &path).await {
|
||||
Ok(Some(record)) => record,
|
||||
Ok(None) => {
|
||||
return Err(ScannerError::Other(
|
||||
"scanner recovery intent disappeared before acceptance confirmation".to_string(),
|
||||
));
|
||||
}
|
||||
Err(error) => return Err(error),
|
||||
};
|
||||
Ok(confirm_recovery_intent_acceptance(candidate, persisted))
|
||||
}
|
||||
Ok(_) => Ok(ScannerRecoveryIntentAcceptResult::Accepted { record: candidate }),
|
||||
Err(EcstoreError::PreconditionFailed) => {
|
||||
let existing = read_recovery_intent_record(storeapi, &path).await?;
|
||||
let Some(existing) = existing else {
|
||||
|
||||
@@ -152,49 +152,6 @@ fn run_data_scanner_keeps_its_two_argument_api() {
|
||||
assert_run_data_scanner_signature(run_data_scanner);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
#[serial]
|
||||
async fn native_backlog_replica_writes_preserve_cas_across_writer_restart() {
|
||||
let (_temp_dir, store) = setup_scanner_cycle_store_with_pool_count(false, 2).await;
|
||||
let now = scanner_pause_backlog_now();
|
||||
let mut stale = ScannerPauseBacklogController::claim(store.clone(), now)
|
||||
.await
|
||||
.expect("the original scanner writer must publish to both pools");
|
||||
let original = scanner_pause_backlog_status(store.clone()).await;
|
||||
assert!(original.durable);
|
||||
assert_eq!(original.healthy_replicas, 2);
|
||||
let restarted = restart_scanner_cycle_store_from(&store).await;
|
||||
let _replacement = ScannerPauseBacklogController::claim(restarted.clone(), now.saturating_add(1))
|
||||
.await
|
||||
.expect("the restarted scanner must claim the surviving native replicas");
|
||||
let claimed = scanner_pause_backlog_status(restarted.clone()).await;
|
||||
assert!(claimed.writer_epoch > original.writer_epoch);
|
||||
assert_eq!(claimed.healthy_replicas, 2);
|
||||
|
||||
stale
|
||||
.observe(ScannerPauseBacklogObservation {
|
||||
now_unix_secs: now.saturating_add(2),
|
||||
paused: true,
|
||||
movement_generation: store.scanner_data_movement_generation().saturating_add(1),
|
||||
movement_work_items: 1,
|
||||
pause_started_at_unix_secs: now.saturating_add(2),
|
||||
dirty_usage_buckets: 0,
|
||||
discovered_expiry_items: 0,
|
||||
discovered_transition_items: 0,
|
||||
})
|
||||
.await;
|
||||
let retained = scanner_pause_backlog_status(restarted.clone()).await;
|
||||
assert_eq!(retained.writer_epoch, claimed.writer_epoch);
|
||||
assert_eq!(retained.generation, claimed.generation);
|
||||
assert_eq!(retained.phase, ScannerPauseBacklogPhase::Idle);
|
||||
assert_eq!(retained.healthy_replicas, 2);
|
||||
assert_eq!(retained.stale_or_unavailable_replicas, 0);
|
||||
let _recovered = ScannerPauseBacklogController::claim(restarted.clone(), now.saturating_add(3))
|
||||
.await
|
||||
.expect("a fresh writer must still recover after the stale CAS failure");
|
||||
assert!(scanner_pause_backlog_status(restarted).await.error.is_none());
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn restarted_main_loop_completes_durable_pause_backlog_catch_up() {
|
||||
crate::scanner_io::clear_dirty_usage_buckets_for_tests();
|
||||
|
||||
@@ -12,7 +12,7 @@
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
use super::super::cycle_state::{cleanup_io_fault, recovery_intent_accept_fault};
|
||||
use super::super::cycle_state::cleanup_io_fault;
|
||||
use super::*;
|
||||
use crate::storage_api::owner::{EcstoreRebalStatus, EcstoreRebalanceInfo, EcstoreRebalanceMeta, EcstoreRebalanceStats};
|
||||
|
||||
@@ -256,100 +256,6 @@ async fn scanner_recovery_intent_accept_is_durable_and_idempotent() {
|
||||
assert_eq!(replay, ScannerRecoveryIntentAcceptResult::Replayed { record });
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
#[serial]
|
||||
async fn scanner_recovery_intent_accept_requires_confirmed_readback() {
|
||||
let (_dir, store) = setup_scanner_cycle_store().await;
|
||||
let _fault = recovery_intent_accept_fault::corrupt_next_accept_readback();
|
||||
let error =
|
||||
accept_scanner_usage_recovery_intent(store.clone(), recovery_intent_request("intent-key-0001-readback", "operator-a"))
|
||||
.await
|
||||
.expect_err("accept must fail when the just-written intent cannot be confirmed");
|
||||
assert!(error.to_string().contains("scanner recovery intent is invalid"), "{error}");
|
||||
|
||||
let restarted = restart_scanner_cycle_store_from(&store).await;
|
||||
let error = scanner_usage_recovery_intents_for_startup(&CancellationToken::new(), restarted)
|
||||
.await
|
||||
.expect_err("unconfirmed corrupt intent must remain a fail-closed startup error");
|
||||
assert!(error.to_string().contains("scanner recovery intent is invalid"), "{error}");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
#[serial]
|
||||
async fn scanner_recovery_intent_accept_replays_if_execution_advances_before_readback() {
|
||||
let (_dir, store) = setup_scanner_cycle_store().await;
|
||||
let request = recovery_intent_request("intent-key-0001-running", "operator-a");
|
||||
let _fault = recovery_intent_accept_fault::advance_next_accept_readback_to_running();
|
||||
let replay = accept_scanner_usage_recovery_intent(store.clone(), request.clone())
|
||||
.await
|
||||
.expect("same request advanced by execution remains idempotent");
|
||||
let record = match replay {
|
||||
ScannerRecoveryIntentAcceptResult::Replayed { record } => record,
|
||||
other => panic!("advanced same-request record must replay instead of conflict: {other:?}"),
|
||||
};
|
||||
assert_eq!(record.state, "running");
|
||||
|
||||
let retry = accept_scanner_usage_recovery_intent(store, request)
|
||||
.await
|
||||
.expect("lost response retry observes the running durable record");
|
||||
assert_eq!(retry, ScannerRecoveryIntentAcceptResult::Replayed { record });
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
#[serial]
|
||||
async fn concurrent_scanner_recovery_intent_acceptance_uses_one_durable_record() {
|
||||
let (_dir, store) = setup_scanner_cycle_store().await;
|
||||
let request = recovery_intent_request("intent-key-0001-concurrent", "operator-a");
|
||||
let mut tasks = Vec::new();
|
||||
for _ in 0..12 {
|
||||
let store = store.clone();
|
||||
let request = request.clone();
|
||||
tasks.push(tokio::spawn(async move {
|
||||
accept_scanner_usage_recovery_intent(store, request)
|
||||
.await
|
||||
.expect("concurrent same-key accept should converge")
|
||||
}));
|
||||
}
|
||||
|
||||
let mut accepted = 0usize;
|
||||
let mut replayed = 0usize;
|
||||
let mut records = Vec::new();
|
||||
for task in tasks {
|
||||
match task.await.expect("accept task should not panic") {
|
||||
ScannerRecoveryIntentAcceptResult::Accepted { record } => {
|
||||
accepted += 1;
|
||||
records.push(record);
|
||||
}
|
||||
ScannerRecoveryIntentAcceptResult::Replayed { record } => {
|
||||
replayed += 1;
|
||||
records.push(record);
|
||||
}
|
||||
other => panic!("same-key accepts must not conflict: {other:?}"),
|
||||
}
|
||||
}
|
||||
assert_eq!(accepted, 1, "exactly one request may win the missing-record CAS");
|
||||
assert_eq!(replayed, 11, "all other same-key requests must replay the durable winner");
|
||||
assert!(
|
||||
records.windows(2).all(|pair| pair[0] == pair[1]),
|
||||
"all accepts must return the same durable identity"
|
||||
);
|
||||
|
||||
let restarted = restart_scanner_cycle_store_from(&store).await;
|
||||
let replayable = scanner_usage_recovery_intents_for_startup(&CancellationToken::new(), restarted.clone())
|
||||
.await
|
||||
.expect("startup should rediscover the single indexed intent");
|
||||
assert_eq!(replayable, vec![records[0].intent_id.clone()]);
|
||||
let replay = accept_scanner_usage_recovery_intent(restarted, request)
|
||||
.await
|
||||
.expect("lost response after restart should replay the same record");
|
||||
assert_eq!(
|
||||
replay,
|
||||
ScannerRecoveryIntentAcceptResult::Replayed {
|
||||
record: records[0].clone()
|
||||
}
|
||||
);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
#[serial]
|
||||
async fn scanner_recovery_intent_executor_persists_completed_progress() {
|
||||
@@ -551,7 +457,7 @@ async fn scanner_recovery_intent_startup_rejects_corrupt_pending_record() {
|
||||
|
||||
#[tokio::test]
|
||||
#[serial]
|
||||
async fn scanner_recovery_intent_disabled_startup_replays_non_terminal_intent() {
|
||||
async fn scanner_recovery_intent_disabled_startup_preserves_non_terminal_intent() {
|
||||
let (_dir, store) = setup_scanner_cycle_store().await;
|
||||
let record = match accept_scanner_usage_recovery_intent(
|
||||
store.clone(),
|
||||
@@ -567,12 +473,12 @@ async fn scanner_recovery_intent_disabled_startup_replays_non_terminal_intent()
|
||||
let restarted = restart_scanner_cycle_store_from(&store).await;
|
||||
run_disabled_startup(CancellationToken::new(), restarted.clone()).await;
|
||||
|
||||
let completed = get_scanner_usage_recovery_intent(restarted, &record.intent_id)
|
||||
let preserved = get_scanner_usage_recovery_intent(restarted, &record.intent_id)
|
||||
.await
|
||||
.expect("startup-replayed intent should read")
|
||||
.expect("startup-replayed intent should remain durable");
|
||||
assert_eq!(completed.state, "completed");
|
||||
assert_eq!(completed.intent_id, record.intent_id);
|
||||
.expect("startup-skipped intent should read")
|
||||
.expect("startup-skipped intent should remain durable");
|
||||
assert_eq!(preserved.state, "accepted");
|
||||
assert_eq!(preserved.intent_id, record.intent_id);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -641,17 +547,6 @@ async fn scanner_recovery_intent_query_rejects_corrupt_or_unknown_records() {
|
||||
.await
|
||||
.expect_err("corrupt intent must not decode as absent");
|
||||
assert!(error.to_string().contains("scanner recovery intent is invalid"));
|
||||
|
||||
let mut future = serde_json::to_value(&record).expect("record value");
|
||||
future["future_writer_capability"] = serde_json::json!("durable-accept-v2");
|
||||
save_config(store.clone(), &path, serde_json::to_vec(&future).expect("future record should encode"))
|
||||
.await
|
||||
.expect("future durable record");
|
||||
let error = get_scanner_usage_recovery_intent(store.clone(), &record.intent_id)
|
||||
.await
|
||||
.expect_err("future writer payload must not decode as a known terminal state");
|
||||
assert!(error.to_string().contains("scanner recovery intent is invalid"));
|
||||
|
||||
let unknown = get_scanner_usage_recovery_intent(store, &scanner_recovery_actor_sha256("missing"))
|
||||
.await
|
||||
.expect("missing intent should read as absent");
|
||||
|
||||
@@ -39,7 +39,7 @@ use s3s::dto::{
|
||||
BucketLifecycleConfiguration, ObjectLockConfiguration, ObjectLockEnabled, ReplicationConfiguration, VersioningConfiguration,
|
||||
};
|
||||
use sha2::{Digest as _, Sha256};
|
||||
use std::collections::{BTreeMap, BTreeSet, HashMap, HashSet};
|
||||
use std::collections::{BTreeSet, HashMap, HashSet};
|
||||
use std::future::Future;
|
||||
use std::path::Path;
|
||||
use std::pin::Pin;
|
||||
@@ -98,24 +98,6 @@ const METRIC_SCANNER_SET_SCANS_QUEUED: &str = "rustfs_scanner_set_scans_queued";
|
||||
const METRIC_SCANNER_DISK_BUCKET_SCANS_ACTIVE: &str = "rustfs_scanner_disk_bucket_scans_active";
|
||||
const METRIC_SCANNER_DISK_BUCKET_SCANS_QUEUED: &str = "rustfs_scanner_disk_bucket_scans_queued";
|
||||
|
||||
pub(crate) const SCANNER_SEGMENT_ACTIVATION_PROOF_INPUTS: [&str; 7] = [
|
||||
"source",
|
||||
"bucket_incarnation",
|
||||
"key_format",
|
||||
"baseline_scan_plan_digest",
|
||||
"process_epoch",
|
||||
"generation_window",
|
||||
"producer_identities",
|
||||
];
|
||||
pub(crate) const SCANNER_SEGMENT_ACTIVATION_FAIL_CLOSED_CHECKS: [&str; 6] = [
|
||||
"missing_producer_identity",
|
||||
"restart_gap",
|
||||
"generation_gap",
|
||||
"overflow",
|
||||
"missing_cold_zero_walk_oracle",
|
||||
"distributed_without_peer_invalidation",
|
||||
];
|
||||
|
||||
pub type DirtyUsageBuckets = HashMap<String, u64>;
|
||||
|
||||
#[derive(Clone, Debug)]
|
||||
@@ -181,52 +163,11 @@ struct ScannerPeerDirtyUsageExpectation {
|
||||
struct VerifiedRemoteDirtyUsage {
|
||||
dirty_buckets: HashSet<String>,
|
||||
acknowledgements: Vec<crate::scanner::ScannerDirtyUsageAcknowledgement>,
|
||||
peer_count: usize,
|
||||
dirty_peer_count: usize,
|
||||
}
|
||||
|
||||
struct ScannerBucketScopeResolutionResult {
|
||||
scope: ScannerBucketScanScope,
|
||||
remote_dirty_usage_acknowledgements: Vec<crate::scanner::ScannerDirtyUsageAcknowledgement>,
|
||||
distributed_segment_invalidation_evidence: Option<DistributedSegmentInvalidationEvidence>,
|
||||
}
|
||||
|
||||
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
|
||||
pub(crate) struct DistributedSegmentInvalidationEvidence {
|
||||
pub(crate) invalidation_domain: crate::segment_invalidation::SegmentInvalidationDomain,
|
||||
pub(crate) distributed_ec_invalidation: bool,
|
||||
pub(crate) peer_count: usize,
|
||||
pub(crate) dirty_peer_count: usize,
|
||||
pub(crate) same_window_remote_proof: bool,
|
||||
pub(crate) all_peers_bound_to_generation_window: bool,
|
||||
}
|
||||
|
||||
#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
|
||||
pub(crate) struct ScannerSegmentReuseActivationProof {
|
||||
pub(crate) production_activation: bool,
|
||||
pub(crate) producer_identity_coverage_complete: bool,
|
||||
pub(crate) durable_producer_identity: bool,
|
||||
pub(crate) restart_gap_absent: bool,
|
||||
pub(crate) generation_window_bound: bool,
|
||||
pub(crate) overflow_absent: bool,
|
||||
pub(crate) cold_zero_walk_oracle: bool,
|
||||
pub(crate) distributed_peer_invalidation: bool,
|
||||
}
|
||||
|
||||
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
|
||||
pub(crate) struct ScannerSegmentReuseActivationPreflight {
|
||||
pub(crate) production_activation: bool,
|
||||
pub(crate) scanner_segment_reuse_activated: bool,
|
||||
pub(crate) proof_inputs: &'static [&'static str],
|
||||
pub(crate) fail_closed_checks: &'static [&'static str],
|
||||
pub(crate) fail_closed_blockers: [Option<&'static str>; 6],
|
||||
}
|
||||
|
||||
impl ScannerSegmentReuseActivationPreflight {
|
||||
#[cfg(test)]
|
||||
pub(crate) fn fail_closed_blockers(&self) -> impl Iterator<Item = &'static str> + '_ {
|
||||
self.fail_closed_blockers.iter().filter_map(|blocker| *blocker)
|
||||
}
|
||||
}
|
||||
|
||||
fn verified_remote_dirty_usage(
|
||||
@@ -250,7 +191,6 @@ fn verified_remote_dirty_usage(
|
||||
|| !snapshot.complete
|
||||
|| snapshot.pending_bucket_count != u64::try_from(snapshot.buckets.len()).unwrap_or(u64::MAX)
|
||||
|| (expected.pending && snapshot.pending_bucket_count == 0)
|
||||
|| (!expected.pending && snapshot.pending_bucket_count != 0)
|
||||
{
|
||||
return None;
|
||||
}
|
||||
@@ -276,13 +216,9 @@ fn verified_remote_dirty_usage(
|
||||
}
|
||||
}
|
||||
|
||||
let peer_count = received_peers.len();
|
||||
let dirty_peer_count = acknowledgements.len();
|
||||
(received_peers.len() == expected_peers.len()).then_some(VerifiedRemoteDirtyUsage {
|
||||
dirty_buckets,
|
||||
acknowledgements,
|
||||
peer_count,
|
||||
dirty_peer_count,
|
||||
})
|
||||
}
|
||||
|
||||
@@ -308,11 +244,8 @@ fn resolve_remote_dirty_usage_scope(
|
||||
let default_result = |scope: ScannerBucketScanScope| ScannerBucketScopeResolutionResult {
|
||||
scope,
|
||||
remote_dirty_usage_acknowledgements: Vec::new(),
|
||||
distributed_segment_invalidation_evidence: None,
|
||||
};
|
||||
|
||||
let peer_count = remote_dirty_usage.peer_count;
|
||||
let dirty_peer_count = remote_dirty_usage.dirty_peer_count;
|
||||
dirty_buckets.extend(remote_dirty_usage.dirty_buckets);
|
||||
// Peer snapshots contribute bucket names only; the local prefix scopes
|
||||
// would narrow a bucket a peer dirtied elsewhere, so the merged scope
|
||||
@@ -350,21 +283,10 @@ fn resolve_remote_dirty_usage_scope(
|
||||
if scanner_scoped_dirty_usage_ack_exceeds_cost_threshold(&scoped_acknowledgements) {
|
||||
return default_result(ScannerBucketScanScope::default());
|
||||
}
|
||||
let has_scoped_acknowledgements = !scoped_acknowledgements.is_empty();
|
||||
|
||||
ScannerBucketScopeResolutionResult {
|
||||
scope,
|
||||
remote_dirty_usage_acknowledgements: scoped_acknowledgements,
|
||||
distributed_segment_invalidation_evidence: (dirty_peer_count > 0 && has_scoped_acknowledgements).then_some(
|
||||
DistributedSegmentInvalidationEvidence {
|
||||
invalidation_domain: crate::segment_invalidation::SegmentInvalidationDomain::DistributedEc,
|
||||
distributed_ec_invalidation: true,
|
||||
peer_count,
|
||||
dirty_peer_count,
|
||||
same_window_remote_proof: true,
|
||||
all_peers_bound_to_generation_window: true,
|
||||
},
|
||||
),
|
||||
}
|
||||
}
|
||||
|
||||
@@ -484,63 +406,10 @@ fn scoped_scan_scope_from_dirty_buckets(
|
||||
ScannerBucketScanScope::from_dirty_buckets(selected_buckets, selected_bucket_prefixes, baseline_scan_plan_digest)
|
||||
}
|
||||
|
||||
fn scanner_segment_reuse_activation_preflight() -> ScannerSegmentReuseActivationPreflight {
|
||||
fn scanner_segment_reuse_activated() -> bool {
|
||||
// Production segment reuse stays disabled until a durable mutation-stream
|
||||
// proof satisfies the segment invalidation contract.
|
||||
scanner_segment_reuse_activation_preflight_from_proof(ScannerSegmentReuseActivationProof::default())
|
||||
}
|
||||
|
||||
fn scanner_segment_reuse_activation_preflight_from_proof(
|
||||
proof: ScannerSegmentReuseActivationProof,
|
||||
) -> ScannerSegmentReuseActivationPreflight {
|
||||
ScannerSegmentReuseActivationPreflight {
|
||||
production_activation: proof.production_activation,
|
||||
scanner_segment_reuse_activated: proof.production_activation
|
||||
&& proof.producer_identity_coverage_complete
|
||||
&& proof.durable_producer_identity
|
||||
&& proof.restart_gap_absent
|
||||
&& proof.generation_window_bound
|
||||
&& proof.overflow_absent
|
||||
&& proof.cold_zero_walk_oracle
|
||||
&& proof.distributed_peer_invalidation,
|
||||
proof_inputs: &SCANNER_SEGMENT_ACTIVATION_PROOF_INPUTS,
|
||||
fail_closed_checks: &SCANNER_SEGMENT_ACTIVATION_FAIL_CLOSED_CHECKS,
|
||||
fail_closed_blockers: [
|
||||
(!proof.producer_identity_coverage_complete || !proof.durable_producer_identity)
|
||||
.then_some("missing_producer_identity"),
|
||||
(!proof.restart_gap_absent).then_some("restart_gap"),
|
||||
(!proof.generation_window_bound).then_some("generation_gap"),
|
||||
(!proof.overflow_absent).then_some("overflow"),
|
||||
(!proof.cold_zero_walk_oracle).then_some("missing_cold_zero_walk_oracle"),
|
||||
(!proof.distributed_peer_invalidation).then_some("distributed_without_peer_invalidation"),
|
||||
],
|
||||
}
|
||||
}
|
||||
|
||||
fn scanner_segment_reuse_activation_preflight_for_cycle(
|
||||
dirty_usage_snapshot: &DirtyUsageSnapshot,
|
||||
dirty_usage_producer_evidence: DirtyUsageProducerEvidence,
|
||||
distributed: bool,
|
||||
distributed_segment_invalidation_evidence: Option<DistributedSegmentInvalidationEvidence>,
|
||||
cold_zero_walk_oracle: bool,
|
||||
) -> ScannerSegmentReuseActivationPreflight {
|
||||
scanner_segment_reuse_activation_preflight_from_proof(ScannerSegmentReuseActivationProof {
|
||||
production_activation: false,
|
||||
producer_identity_coverage_complete: dirty_usage_producer_evidence.producer_identity_coverage_complete,
|
||||
durable_producer_identity: dirty_usage_producer_evidence.durable_producer_identity,
|
||||
restart_gap_absent: dirty_usage_producer_evidence.restart_gap_absent,
|
||||
generation_window_bound: dirty_usage_snapshot.covers_all_pending
|
||||
&& dirty_usage_snapshot.generation != 0
|
||||
&& dirty_usage_snapshot.generation != u64::MAX
|
||||
&& dirty_usage_producer_evidence.generation_window_bound,
|
||||
overflow_absent: dirty_usage_snapshot.covers_all_pending,
|
||||
cold_zero_walk_oracle,
|
||||
distributed_peer_invalidation: !distributed || distributed_segment_invalidation_evidence.is_some(),
|
||||
})
|
||||
}
|
||||
|
||||
fn scanner_segment_reuse_activated() -> bool {
|
||||
scanner_segment_reuse_activation_preflight().scanner_segment_reuse_activated
|
||||
false
|
||||
}
|
||||
|
||||
pub(crate) fn is_scanner_metadata_corrupt_error(err: &StorageError) -> bool {
|
||||
@@ -602,8 +471,6 @@ pub struct ScannerBucketScanPlan {
|
||||
bucket_failures: ScannerBucketFailureState,
|
||||
pending_maintenance_work: Arc<AtomicBool>,
|
||||
cache_cycle_floor: Arc<AtomicU64>,
|
||||
cold_zero_walk_reuse_observed: Arc<AtomicBool>,
|
||||
segment_invalidation_proof: Option<crate::DataUsageSegmentInvalidationProof>,
|
||||
}
|
||||
|
||||
#[derive(Clone, Default)]
|
||||
@@ -736,25 +603,6 @@ fn scanner_bucket_scan_status(has_failed: bool, has_partial: bool, has_namespace
|
||||
}
|
||||
}
|
||||
|
||||
fn scanner_cycle_cold_zero_walk_oracle(
|
||||
scan_scope: &ScannerBucketScanScope,
|
||||
all_buckets: &[BucketInfo],
|
||||
completed_all_sets: bool,
|
||||
scan_scope_matches: bool,
|
||||
bucket_scan_status: ScannerBucketScanStatus,
|
||||
cold_zero_walk_reuse_observed: bool,
|
||||
) -> bool {
|
||||
let Some(selected_buckets) = scan_scope.selected_buckets.as_deref() else {
|
||||
return false;
|
||||
};
|
||||
cold_zero_walk_reuse_observed
|
||||
&& !selected_buckets.is_empty()
|
||||
&& completed_all_sets
|
||||
&& scan_scope_matches
|
||||
&& bucket_scan_status == ScannerBucketScanStatus::Complete
|
||||
&& all_buckets.iter().any(|bucket| !selected_buckets.contains(&bucket.name))
|
||||
}
|
||||
|
||||
fn classify_nsscanner_cycle(
|
||||
completed_all_sets: bool,
|
||||
budget_elapsed: bool,
|
||||
@@ -1208,8 +1056,6 @@ pub(crate) struct ScannerCycleResult {
|
||||
observational_snapshot_published: bool,
|
||||
dirty_usage_clear: Option<DirtyUsageBuckets>,
|
||||
remote_dirty_usage_acknowledgements: Vec<crate::scanner::ScannerDirtyUsageAcknowledgement>,
|
||||
distributed_segment_invalidation_evidence: Option<DistributedSegmentInvalidationEvidence>,
|
||||
segment_reuse_activation_preflight: ScannerSegmentReuseActivationPreflight,
|
||||
remote_publication_lease_targets: Vec<(String, String, u64)>,
|
||||
failed_dirty_usage: bool,
|
||||
pending_maintenance_work: bool,
|
||||
@@ -1226,8 +1072,6 @@ impl ScannerCycleResult {
|
||||
observational_snapshot_published: false,
|
||||
dirty_usage_clear,
|
||||
remote_dirty_usage_acknowledgements: Vec::new(),
|
||||
distributed_segment_invalidation_evidence: None,
|
||||
segment_reuse_activation_preflight: scanner_segment_reuse_activation_preflight(),
|
||||
remote_publication_lease_targets: Vec::new(),
|
||||
failed_dirty_usage: false,
|
||||
pending_maintenance_work: false,
|
||||
@@ -1293,21 +1137,6 @@ impl ScannerCycleResult {
|
||||
self
|
||||
}
|
||||
|
||||
fn with_distributed_segment_invalidation_evidence(
|
||||
mut self,
|
||||
evidence: Option<DistributedSegmentInvalidationEvidence>,
|
||||
) -> Self {
|
||||
self.publication_expectation = None;
|
||||
self.distributed_segment_invalidation_evidence = evidence;
|
||||
self
|
||||
}
|
||||
|
||||
fn with_segment_reuse_activation_preflight(mut self, preflight: ScannerSegmentReuseActivationPreflight) -> Self {
|
||||
self.publication_expectation = None;
|
||||
self.segment_reuse_activation_preflight = preflight;
|
||||
self
|
||||
}
|
||||
|
||||
pub(crate) fn with_remote_publication_lease_targets(mut self, targets: Vec<(String, String, u64)>) -> Self {
|
||||
self.publication_expectation = None;
|
||||
self.remote_publication_lease_targets = targets;
|
||||
@@ -1395,9 +1224,9 @@ pub(crate) use cache::{
|
||||
pub use dirty_usage::{
|
||||
ScannerDirtyUsageAckError, ScannerDirtyUsageBucket, ScannerDirtyUsageSnapshot, ScannerDirtyUsageState,
|
||||
acknowledge_dirty_usage_generation, acknowledge_scoped_dirty_usage, clear_dirty_usage_bucket, record_dirty_usage_bucket,
|
||||
record_dirty_usage_bucket_from_producer, record_dirty_usage_bucket_from_producers, record_dirty_usage_object,
|
||||
record_dirty_usage_object_from_producer, record_scanner_maintenance_change, scanner_activity_epoch,
|
||||
scanner_dirty_usage_snapshot, scanner_dirty_usage_state, scanner_maintenance_generation,
|
||||
record_dirty_usage_bucket_from_producer, record_dirty_usage_object, record_dirty_usage_object_from_producer,
|
||||
record_scanner_maintenance_change, scanner_activity_epoch, scanner_dirty_usage_snapshot, scanner_dirty_usage_state,
|
||||
scanner_maintenance_generation,
|
||||
};
|
||||
#[cfg(test)]
|
||||
pub(crate) use dirty_usage::{clear_dirty_usage_buckets_for_tests, dirty_usage_buckets_for_tests};
|
||||
|
||||
@@ -16,16 +16,17 @@ use super::*;
|
||||
|
||||
pub(super) static DIRTY_USAGE_BUCKET_GENERATION: AtomicU64 = AtomicU64::new(0);
|
||||
pub(super) static DIRTY_USAGE_BUCKETS: LazyLock<StdMutex<DirtyUsageBuckets>> = LazyLock::new(|| StdMutex::new(HashMap::new()));
|
||||
// Lock order when dirty usage state is updated is `DIRTY_USAGE_BUCKETS`,
|
||||
// `DIRTY_USAGE_BUCKET_SCOPES`, then `DIRTY_USAGE_PRODUCER_IDENTITIES`. All
|
||||
// guards are held only for synchronous map updates, so no scanner task can
|
||||
// observe a bucket generation without its matching scope and producer evidence.
|
||||
// Lock order when both dirty maps are needed is `DIRTY_USAGE_BUCKETS` followed
|
||||
// by `DIRTY_USAGE_BUCKET_SCOPES`. Both are held only for synchronous map
|
||||
// updates, so no scanner task can observe a bucket generation without its
|
||||
// matching scope.
|
||||
pub(super) static DIRTY_USAGE_BUCKET_SCOPES: LazyLock<StdMutex<DirtyUsageBucketScopes>> =
|
||||
LazyLock::new(|| StdMutex::new(HashMap::new()));
|
||||
// Non-authoritative process-local producer coverage. Any future segment reuse
|
||||
// activation must bind this to the exact generation window and durable proof.
|
||||
pub(super) static DIRTY_USAGE_PRODUCER_IDENTITIES: LazyLock<StdMutex<DirtyUsageProducerIdentities>> =
|
||||
LazyLock::new(|| StdMutex::new(BTreeMap::new()));
|
||||
pub(super) static DIRTY_USAGE_PRODUCER_IDENTITIES: LazyLock<
|
||||
StdMutex<BTreeSet<crate::segment_invalidation::SegmentInvalidationProducerIdentity>>,
|
||||
> = LazyLock::new(|| StdMutex::new(BTreeSet::new()));
|
||||
pub(super) static DIRTY_USAGE_BUCKET_NOTIFY: LazyLock<Notify> = LazyLock::new(Notify::new);
|
||||
pub(super) static SCANNER_ACTIVITY_EPOCH: LazyLock<String> = LazyLock::new(|| format!("{:032x}", rand::random::<u128>()));
|
||||
pub(super) static SCANNER_MAINTENANCE_GENERATION: AtomicU64 = AtomicU64::new(0);
|
||||
@@ -58,38 +59,6 @@ pub(super) type DirtyUsageBucketScopes = HashMap<String, DirtyUsageBucketScope>;
|
||||
|
||||
const MAX_DIRTY_USAGE_TOP_LEVEL_ENTRIES_PER_BUCKET: usize = 128;
|
||||
|
||||
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
|
||||
pub(super) struct DirtyUsageProducerIdentityState {
|
||||
first_generation: u64,
|
||||
last_generation: u64,
|
||||
}
|
||||
|
||||
pub(super) type DirtyUsageProducerIdentities =
|
||||
BTreeMap<crate::segment_invalidation::SegmentInvalidationProducerIdentity, DirtyUsageProducerIdentityState>;
|
||||
|
||||
#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
|
||||
pub(super) struct DirtyUsageProducerEvidence {
|
||||
pub(super) producer_identity_coverage_complete: bool,
|
||||
pub(super) durable_producer_identity: bool,
|
||||
pub(super) restart_gap_absent: bool,
|
||||
pub(super) generation_window_bound: bool,
|
||||
pub(super) generation_start: u64,
|
||||
pub(super) generation_end: u64,
|
||||
}
|
||||
|
||||
impl DirtyUsageProducerEvidence {
|
||||
pub(super) fn segment_invalidation_proof(self) -> Option<crate::DataUsageSegmentInvalidationProof> {
|
||||
(self.generation_window_bound && self.producer_identity_coverage_complete).then(|| {
|
||||
crate::DataUsageSegmentInvalidationProof {
|
||||
process_epoch: scanner_activity_epoch().to_string(),
|
||||
generation_start: self.generation_start,
|
||||
generation_end: self.generation_end,
|
||||
producer_identity_coverage_complete: true,
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
/// A point-in-time view of the local dirty bucket generations.
|
||||
///
|
||||
/// `complete == false` is an all-or-nothing overflow signal: `buckets` is
|
||||
@@ -257,21 +226,12 @@ mod scoped_dirty_usage_tests {
|
||||
record_dirty_usage_object_from_producer("photos", "hot/object", SegmentInvalidationProducerIdentity::PutObject);
|
||||
record_dirty_usage_object_from_producer("photos", "archive/object", SegmentInvalidationProducerIdentity::DeleteObject);
|
||||
record_dirty_usage_bucket_from_producer("photos", SegmentInvalidationProducerIdentity::Unknown);
|
||||
record_dirty_usage_bucket_from_producers(
|
||||
"photos",
|
||||
[
|
||||
SegmentInvalidationProducerIdentity::DeleteMarker,
|
||||
SegmentInvalidationProducerIdentity::AbortMultipartUpload,
|
||||
],
|
||||
);
|
||||
|
||||
assert_eq!(
|
||||
dirty_usage_producer_identities_for_tests(),
|
||||
BTreeSet::from([
|
||||
SegmentInvalidationProducerIdentity::PutObject,
|
||||
SegmentInvalidationProducerIdentity::DeleteObject,
|
||||
SegmentInvalidationProducerIdentity::DeleteMarker,
|
||||
SegmentInvalidationProducerIdentity::AbortMultipartUpload
|
||||
SegmentInvalidationProducerIdentity::DeleteObject
|
||||
])
|
||||
);
|
||||
assert_eq!(
|
||||
@@ -295,7 +255,8 @@ fn dirty_usage_bucket_scopes() -> MutexGuard<'static, DirtyUsageBucketScopes> {
|
||||
.unwrap_or_else(|poisoned| poisoned.into_inner())
|
||||
}
|
||||
|
||||
fn dirty_usage_producer_identities() -> MutexGuard<'static, DirtyUsageProducerIdentities> {
|
||||
fn dirty_usage_producer_identities()
|
||||
-> MutexGuard<'static, BTreeSet<crate::segment_invalidation::SegmentInvalidationProducerIdentity>> {
|
||||
DIRTY_USAGE_PRODUCER_IDENTITIES
|
||||
.lock()
|
||||
.unwrap_or_else(|poisoned| poisoned.into_inner())
|
||||
@@ -316,7 +277,7 @@ pub fn record_dirty_usage_bucket(bucket: &str) {
|
||||
return;
|
||||
}
|
||||
|
||||
record_dirty_usage_bucket_inner(bucket, std::iter::empty());
|
||||
record_dirty_usage_bucket_inner(bucket);
|
||||
}
|
||||
|
||||
pub fn record_dirty_usage_bucket_from_producer(
|
||||
@@ -327,32 +288,17 @@ pub fn record_dirty_usage_bucket_from_producer(
|
||||
return;
|
||||
}
|
||||
|
||||
record_dirty_usage_bucket_inner(bucket, [producer]);
|
||||
record_segment_invalidation_producer_identity(producer);
|
||||
record_dirty_usage_bucket_inner(bucket);
|
||||
}
|
||||
|
||||
pub fn record_dirty_usage_bucket_from_producers<I>(bucket: &str, producers: I)
|
||||
where
|
||||
I: IntoIterator<Item = crate::segment_invalidation::SegmentInvalidationProducerIdentity>,
|
||||
{
|
||||
if bucket.is_empty() {
|
||||
return;
|
||||
}
|
||||
|
||||
record_dirty_usage_bucket_inner(bucket, producers);
|
||||
}
|
||||
|
||||
fn record_dirty_usage_bucket_inner<I>(bucket: &str, producers: I)
|
||||
where
|
||||
I: IntoIterator<Item = crate::segment_invalidation::SegmentInvalidationProducerIdentity>,
|
||||
{
|
||||
fn record_dirty_usage_bucket_inner(bucket: &str) {
|
||||
let pending_buckets = {
|
||||
let mut dirty_buckets = dirty_usage_buckets();
|
||||
let mut dirty_scopes = dirty_usage_bucket_scopes();
|
||||
let mut producer_identities = dirty_usage_producer_identities();
|
||||
let generation = advance_generation(&DIRTY_USAGE_BUCKET_GENERATION);
|
||||
dirty_buckets.insert(bucket.to_string(), generation);
|
||||
dirty_scopes.insert(bucket.to_string(), DirtyUsageBucketScope::WholeBucket);
|
||||
record_segment_invalidation_producer_identities_for_generation(&mut producer_identities, generation, producers);
|
||||
dirty_buckets.len()
|
||||
};
|
||||
global_metrics().record_scanner_dirty_usage_pending(usize_to_u64_saturated(pending_buckets));
|
||||
@@ -370,7 +316,7 @@ where
|
||||
/// local: after restart or any unverified distributed path the scanner falls
|
||||
/// back to its ordinary bucket scan.
|
||||
pub fn record_dirty_usage_object(bucket: &str, object: &str) {
|
||||
record_dirty_usage_object_inner(bucket, object, std::iter::empty());
|
||||
record_dirty_usage_object_inner(bucket, object);
|
||||
}
|
||||
|
||||
pub fn record_dirty_usage_object_from_producer(
|
||||
@@ -382,16 +328,13 @@ pub fn record_dirty_usage_object_from_producer(
|
||||
return;
|
||||
}
|
||||
|
||||
record_dirty_usage_object_inner(bucket, object, [producer]);
|
||||
record_segment_invalidation_producer_identity(producer);
|
||||
record_dirty_usage_object_inner(bucket, object);
|
||||
}
|
||||
|
||||
fn record_dirty_usage_object_inner<I>(bucket: &str, object: &str, producers: I)
|
||||
where
|
||||
I: IntoIterator<Item = crate::segment_invalidation::SegmentInvalidationProducerIdentity>,
|
||||
{
|
||||
let producers = producers.into_iter().collect::<Vec<_>>();
|
||||
fn record_dirty_usage_object_inner(bucket: &str, object: &str) {
|
||||
let Some(top_level_entry) = dirty_usage_top_level_entry(object) else {
|
||||
record_dirty_usage_bucket_inner(bucket, producers);
|
||||
record_dirty_usage_bucket(bucket);
|
||||
return;
|
||||
};
|
||||
if bucket.is_empty() {
|
||||
@@ -401,7 +344,6 @@ where
|
||||
let pending_buckets = {
|
||||
let mut dirty_buckets = dirty_usage_buckets();
|
||||
let mut dirty_scopes = dirty_usage_bucket_scopes();
|
||||
let mut producer_identities = dirty_usage_producer_identities();
|
||||
let generation = advance_generation(&DIRTY_USAGE_BUCKET_GENERATION);
|
||||
dirty_buckets.insert(bucket.to_string(), generation);
|
||||
let scope = dirty_scopes
|
||||
@@ -417,7 +359,6 @@ where
|
||||
if overflowed {
|
||||
*scope = DirtyUsageBucketScope::WholeBucket;
|
||||
}
|
||||
record_segment_invalidation_producer_identities_for_generation(&mut producer_identities, generation, producers);
|
||||
dirty_buckets.len()
|
||||
};
|
||||
global_metrics().record_scanner_dirty_usage_pending(usize_to_u64_saturated(pending_buckets));
|
||||
@@ -425,29 +366,15 @@ where
|
||||
DIRTY_USAGE_BUCKET_NOTIFY.notify_one();
|
||||
}
|
||||
|
||||
fn record_segment_invalidation_producer_identities_for_generation<I>(
|
||||
identities: &mut DirtyUsageProducerIdentities,
|
||||
generation: u64,
|
||||
producers: I,
|
||||
) where
|
||||
I: IntoIterator<Item = crate::segment_invalidation::SegmentInvalidationProducerIdentity>,
|
||||
{
|
||||
for producer in producers {
|
||||
if producer.producer().is_some() {
|
||||
identities
|
||||
.entry(producer)
|
||||
.and_modify(|state| state.last_generation = state.last_generation.max(generation))
|
||||
.or_insert(DirtyUsageProducerIdentityState {
|
||||
first_generation: generation,
|
||||
last_generation: generation,
|
||||
});
|
||||
}
|
||||
fn record_segment_invalidation_producer_identity(producer: crate::segment_invalidation::SegmentInvalidationProducerIdentity) {
|
||||
if producer.producer().is_some() {
|
||||
dirty_usage_producer_identities().insert(producer);
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
fn dirty_usage_producer_identities_for_tests() -> BTreeSet<crate::segment_invalidation::SegmentInvalidationProducerIdentity> {
|
||||
dirty_usage_producer_identities().keys().copied().collect()
|
||||
dirty_usage_producer_identities().clone()
|
||||
}
|
||||
|
||||
fn dirty_usage_top_level_entry(object: &str) -> Option<String> {
|
||||
@@ -722,31 +649,6 @@ pub(super) fn dirty_usage_snapshot_status(snapshot: &DirtyUsageSnapshot) -> Dirt
|
||||
}
|
||||
}
|
||||
|
||||
pub(super) fn dirty_usage_producer_evidence(snapshot: &DirtyUsageSnapshot) -> DirtyUsageProducerEvidence {
|
||||
let generation_window_bound = dirty_usage_snapshot_status(snapshot) == DirtyUsageSnapshotStatus::Current
|
||||
&& snapshot.generation != 0
|
||||
&& snapshot.generation != u64::MAX;
|
||||
let identities = dirty_usage_producer_identities()
|
||||
.iter()
|
||||
.filter(|(_, state)| state.first_generation <= snapshot.generation)
|
||||
.map(|(identity, _)| *identity)
|
||||
.collect::<BTreeSet<_>>();
|
||||
let producer_identity_coverage_complete =
|
||||
generation_window_bound && crate::segment_invalidation::complete_segment_invalidation_producers(identities).is_ok();
|
||||
|
||||
DirtyUsageProducerEvidence {
|
||||
producer_identity_coverage_complete,
|
||||
// The current producer journal is still process-local. Keep the
|
||||
// durable/restart gates closed until the mutation evidence is persisted
|
||||
// and replayable across scanner restarts.
|
||||
durable_producer_identity: false,
|
||||
restart_gap_absent: false,
|
||||
generation_window_bound,
|
||||
generation_start: snapshot.generation,
|
||||
generation_end: snapshot.generation,
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
pub(super) fn dirty_usage_bucket_count() -> usize {
|
||||
dirty_usage_buckets().len()
|
||||
|
||||
@@ -172,8 +172,6 @@ impl ScannerIOCache for SetDisks {
|
||||
bucket_failures,
|
||||
pending_maintenance_work,
|
||||
cache_cycle_floor,
|
||||
cold_zero_walk_reuse_observed,
|
||||
segment_invalidation_proof,
|
||||
} = scan_plan;
|
||||
let scan_plan_digest = scanner_bucket_work_digest(scan_plan_digest, scan_mode, requires_full_scan);
|
||||
let bucket_work_digest = scanner_bucket_work_digest(bucket_coverage_digest, scan_mode, requires_full_scan);
|
||||
@@ -221,9 +219,6 @@ impl ScannerIOCache for SetDisks {
|
||||
},
|
||||
current_bucket_incarnations.as_ref(),
|
||||
);
|
||||
let cold_zero_walk_reuse_candidate = scoped_scan.as_ref().is_some_and(|prepared| {
|
||||
old_cache.info.next_cycle < want_cycle && !prepared.buckets.is_empty() && prepared.buckets.len() < all_buckets.len()
|
||||
});
|
||||
let mut scoped_cache = scoped_scan.map(|mut prepared| {
|
||||
buckets = prepared.buckets;
|
||||
prepared.cache.info.scan_coverage_digest = Some(bucket_coverage_digest);
|
||||
@@ -244,7 +239,6 @@ impl ScannerIOCache for SetDisks {
|
||||
scan_plan_digest: Some(scan_plan_digest),
|
||||
scan_coverage_digest: Some(bucket_coverage_digest),
|
||||
cache_key_format: DATA_USAGE_CACHE_KEY_FORMAT,
|
||||
segment_invalidation_proof: segment_invalidation_proof.clone(),
|
||||
scan_bucket_incarnations: current_bucket_incarnations.clone().unwrap_or_default(),
|
||||
..Default::default()
|
||||
},
|
||||
@@ -260,7 +254,6 @@ impl ScannerIOCache for SetDisks {
|
||||
cache.info.last_update = Some(now);
|
||||
cache.info.snapshot_complete = true;
|
||||
cache.info.scan_execution_digest = Some(execution_digest);
|
||||
cache.info.segment_invalidation_proof = segment_invalidation_proof.clone();
|
||||
cache.info.lkg_snapshot_complete = false;
|
||||
cache.info.lkg_next_cycle = None;
|
||||
cache.info.lkg_last_update = None;
|
||||
@@ -542,7 +535,6 @@ impl ScannerIOCache for SetDisks {
|
||||
lkg_last_update: old_cache.info.lkg_last_update,
|
||||
lkg_leader_epoch: old_cache.info.lkg_leader_epoch,
|
||||
lkg_scan_plan_digest: old_cache.info.lkg_scan_plan_digest,
|
||||
segment_invalidation_proof: None,
|
||||
scan_bucket_incarnations: current_bucket_incarnations.clone().unwrap_or_default(),
|
||||
..Default::default()
|
||||
},
|
||||
@@ -1469,15 +1461,11 @@ impl ScannerIOCache for SetDisks {
|
||||
cache.info.last_update.get_or_insert_with(SystemTime::now);
|
||||
cache.info.snapshot_complete = true;
|
||||
cache.info.scan_execution_digest = Some(execution_digest);
|
||||
cache.info.segment_invalidation_proof = segment_invalidation_proof.clone();
|
||||
cache.info.lkg_snapshot_complete = false;
|
||||
cache.info.lkg_next_cycle = None;
|
||||
cache.info.lkg_last_update = None;
|
||||
cache.info.lkg_leader_epoch = None;
|
||||
cache.info.lkg_scan_plan_digest = None;
|
||||
if cold_zero_walk_reuse_candidate {
|
||||
cold_zero_walk_reuse_observed.store(true, Ordering::Release);
|
||||
}
|
||||
cache.clone()
|
||||
};
|
||||
let _ = persist_and_publish_cache_snapshot(
|
||||
@@ -1498,7 +1486,6 @@ impl ScannerIOCache for SetDisks {
|
||||
incomplete_scope.info.tier_registry_generation = Some(tier_registry_generation);
|
||||
incomplete_scope.info.source = Some(source);
|
||||
incomplete_scope.info.snapshot_complete = false;
|
||||
incomplete_scope.info.segment_invalidation_proof = None;
|
||||
incomplete_scope.info.scan_plan_digest = Some(scan_plan_digest);
|
||||
incomplete_scope.info.cache_key_format = DATA_USAGE_CACHE_KEY_FORMAT;
|
||||
if let Err(e) = updates.send(incomplete_scope).await {
|
||||
|
||||
@@ -122,7 +122,6 @@ where
|
||||
let default_result = |scope: ScannerBucketScanScope| ScannerBucketScopeResolutionResult {
|
||||
scope,
|
||||
remote_dirty_usage_acknowledgements: Vec::new(),
|
||||
distributed_segment_invalidation_evidence: None,
|
||||
};
|
||||
if resolution.requires_full_scan {
|
||||
return default_result(ScannerBucketScanScope::default());
|
||||
@@ -409,9 +408,7 @@ where
|
||||
)
|
||||
.await;
|
||||
let remote_dirty_usage_acknowledgements = scope_resolution.remote_dirty_usage_acknowledgements;
|
||||
let distributed_segment_invalidation_evidence = scope_resolution.distributed_segment_invalidation_evidence;
|
||||
let scan_scope = scope_resolution.scope;
|
||||
let segment_invalidation_proof = dirty_usage_producer_evidence(&dirty_usage_snapshot).segment_invalidation_proof();
|
||||
#[cfg(test)]
|
||||
if let Some(observer) = resolved_scope_observer {
|
||||
let _ = observer.send(scan_scope.clone());
|
||||
@@ -468,20 +465,12 @@ where
|
||||
} else {
|
||||
Vec::new()
|
||||
};
|
||||
let segment_reuse_activation_preflight = scanner_segment_reuse_activation_preflight_for_cycle(
|
||||
&dirty_usage_snapshot,
|
||||
dirty_usage_producer_evidence(&dirty_usage_snapshot),
|
||||
distributed,
|
||||
None,
|
||||
false,
|
||||
);
|
||||
return Ok(ScannerCycleResult::new(status, dirty_usage_clear)
|
||||
.with_publication_epoch(publication_epoch)
|
||||
.with_activity_digest(activity_digest)
|
||||
.with_observational_snapshot_published(observational_snapshot_published)
|
||||
.with_remote_publication_lease_targets(remote_publication_lease_targets)
|
||||
.with_remote_dirty_usage_acknowledgements(remote_dirty_usage_acknowledgements)
|
||||
.with_segment_reuse_activation_preflight(segment_reuse_activation_preflight)
|
||||
.with_publication_expectation(publication_expectation));
|
||||
}
|
||||
|
||||
@@ -506,7 +495,6 @@ where
|
||||
);
|
||||
let bucket_failures = ScannerBucketFailureState::default();
|
||||
let pending_maintenance_work = Arc::new(AtomicBool::new(false));
|
||||
let cold_zero_walk_reuse_observed = Arc::new(AtomicBool::new(false));
|
||||
record_set_scan_concurrency_limit(set_scan_limit);
|
||||
debug!(
|
||||
target: "rustfs::scanner::io",
|
||||
@@ -600,8 +588,6 @@ where
|
||||
bucket_failures: bucket_failures.clone(),
|
||||
pending_maintenance_work: pending_maintenance_work.clone(),
|
||||
cache_cycle_floor: cache_cycle_floor.clone(),
|
||||
cold_zero_walk_reuse_observed: cold_zero_walk_reuse_observed.clone(),
|
||||
segment_invalidation_proof: segment_invalidation_proof.clone(),
|
||||
};
|
||||
// Spawn task to run the scanner
|
||||
let scanner_fut = tokio::spawn(async move {
|
||||
@@ -705,21 +691,6 @@ where
|
||||
scan_scope_matches && !partial_buckets.is_empty(),
|
||||
scan_scope_matches && !namespace_not_found_buckets.is_empty(),
|
||||
);
|
||||
let cold_zero_walk_oracle = scanner_cycle_cold_zero_walk_oracle(
|
||||
&scan_scope,
|
||||
&all_buckets,
|
||||
completed_all_sets,
|
||||
scan_scope_matches,
|
||||
bucket_scan_status,
|
||||
cold_zero_walk_reuse_observed.load(Ordering::Acquire),
|
||||
);
|
||||
let segment_reuse_activation_preflight = scanner_segment_reuse_activation_preflight_for_cycle(
|
||||
&dirty_usage_snapshot,
|
||||
dirty_usage_producer_evidence(&dirty_usage_snapshot),
|
||||
distributed,
|
||||
distributed_segment_invalidation_evidence,
|
||||
cold_zero_walk_oracle,
|
||||
);
|
||||
let pending_maintenance_work = pending_maintenance_work_for_cycle(&pending_maintenance_work, &results);
|
||||
let observed_cycle_floor = cache_cycle_floor.load(Ordering::Acquire);
|
||||
let required_cycle_floor = (observed_cycle_floor > want_cycle).then_some(observed_cycle_floor);
|
||||
@@ -812,8 +783,6 @@ where
|
||||
.with_observational_snapshot_published(observational_snapshot_published)
|
||||
.with_remote_publication_lease_targets(remote_publication_lease_targets)
|
||||
.with_remote_dirty_usage_acknowledgements(remote_dirty_usage_acknowledgements)
|
||||
.with_distributed_segment_invalidation_evidence(distributed_segment_invalidation_evidence)
|
||||
.with_segment_reuse_activation_preflight(segment_reuse_activation_preflight)
|
||||
.with_failed_dirty_usage(!failed_buckets.is_empty())
|
||||
.with_pending_maintenance_work(pending_maintenance_work)
|
||||
.with_required_cycle_floor(required_cycle_floor)
|
||||
|
||||
@@ -85,196 +85,6 @@ fn scanner_activity_preflight_defers_a_temporarily_offline_peer() {
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn scanner_segment_reuse_activation_preflight_reports_release_gate_inputs() {
|
||||
let preflight = scanner_segment_reuse_activation_preflight();
|
||||
|
||||
assert!(!preflight.production_activation);
|
||||
assert!(!preflight.scanner_segment_reuse_activated);
|
||||
assert!(!scanner_segment_reuse_activated());
|
||||
assert_eq!(preflight.proof_inputs, SCANNER_SEGMENT_ACTIVATION_PROOF_INPUTS);
|
||||
assert_eq!(preflight.fail_closed_checks, SCANNER_SEGMENT_ACTIVATION_FAIL_CLOSED_CHECKS);
|
||||
assert_eq!(
|
||||
preflight.fail_closed_blockers().collect::<Vec<_>>(),
|
||||
SCANNER_SEGMENT_ACTIVATION_FAIL_CLOSED_CHECKS
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn scanner_segment_reuse_activation_requires_every_preflight_proof() {
|
||||
let complete_proof = ScannerSegmentReuseActivationProof {
|
||||
production_activation: true,
|
||||
producer_identity_coverage_complete: true,
|
||||
durable_producer_identity: true,
|
||||
restart_gap_absent: true,
|
||||
generation_window_bound: true,
|
||||
overflow_absent: true,
|
||||
cold_zero_walk_oracle: true,
|
||||
distributed_peer_invalidation: true,
|
||||
};
|
||||
|
||||
let mut production_disabled = complete_proof;
|
||||
production_disabled.production_activation = false;
|
||||
let preflight = scanner_segment_reuse_activation_preflight_from_proof(production_disabled);
|
||||
assert!(!preflight.production_activation);
|
||||
assert!(!preflight.scanner_segment_reuse_activated);
|
||||
assert_eq!(preflight.fail_closed_blockers().collect::<Vec<_>>(), Vec::<&str>::new());
|
||||
|
||||
let preflight = scanner_segment_reuse_activation_preflight_from_proof(complete_proof);
|
||||
assert!(preflight.production_activation);
|
||||
assert!(preflight.scanner_segment_reuse_activated);
|
||||
assert_eq!(preflight.fail_closed_blockers().collect::<Vec<_>>(), Vec::<&str>::new());
|
||||
|
||||
let mut missing_identity = complete_proof;
|
||||
missing_identity.producer_identity_coverage_complete = false;
|
||||
assert_segment_reuse_activation_blocked_by(missing_identity, "missing_producer_identity");
|
||||
|
||||
let mut non_durable_identity = complete_proof;
|
||||
non_durable_identity.durable_producer_identity = false;
|
||||
assert_segment_reuse_activation_blocked_by(non_durable_identity, "missing_producer_identity");
|
||||
|
||||
let mut restart_gap = complete_proof;
|
||||
restart_gap.restart_gap_absent = false;
|
||||
assert_segment_reuse_activation_blocked_by(restart_gap, "restart_gap");
|
||||
|
||||
let mut generation_gap = complete_proof;
|
||||
generation_gap.generation_window_bound = false;
|
||||
assert_segment_reuse_activation_blocked_by(generation_gap, "generation_gap");
|
||||
|
||||
let mut overflow = complete_proof;
|
||||
overflow.overflow_absent = false;
|
||||
assert_segment_reuse_activation_blocked_by(overflow, "overflow");
|
||||
|
||||
let mut missing_cold_oracle = complete_proof;
|
||||
missing_cold_oracle.cold_zero_walk_oracle = false;
|
||||
assert_segment_reuse_activation_blocked_by(missing_cold_oracle, "missing_cold_zero_walk_oracle");
|
||||
|
||||
let mut missing_distributed_invalidation = complete_proof;
|
||||
missing_distributed_invalidation.distributed_peer_invalidation = false;
|
||||
assert_segment_reuse_activation_blocked_by(missing_distributed_invalidation, "distributed_without_peer_invalidation");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn scanner_segment_reuse_activation_preflight_for_cycle_reports_cycle_inputs_without_activation() {
|
||||
let dirty_usage_snapshot = DirtyUsageSnapshot {
|
||||
buckets: Arc::new(DirtyUsageBuckets::from([("photos".to_string(), 7)])),
|
||||
scopes: Arc::new(DirtyUsageBucketScopes::default()),
|
||||
generation: 7,
|
||||
covers_all_pending: true,
|
||||
};
|
||||
let distributed_evidence = DistributedSegmentInvalidationEvidence {
|
||||
invalidation_domain: crate::segment_invalidation::SegmentInvalidationDomain::DistributedEc,
|
||||
distributed_ec_invalidation: true,
|
||||
peer_count: 2,
|
||||
dirty_peer_count: 1,
|
||||
same_window_remote_proof: true,
|
||||
all_peers_bound_to_generation_window: true,
|
||||
};
|
||||
|
||||
let preflight = scanner_segment_reuse_activation_preflight_for_cycle(
|
||||
&dirty_usage_snapshot,
|
||||
complete_process_local_producer_evidence(),
|
||||
true,
|
||||
Some(distributed_evidence),
|
||||
true,
|
||||
);
|
||||
|
||||
assert!(!preflight.production_activation);
|
||||
assert!(!preflight.scanner_segment_reuse_activated);
|
||||
assert_eq!(
|
||||
preflight.fail_closed_blockers().collect::<Vec<_>>(),
|
||||
vec!["missing_producer_identity", "restart_gap"]
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn scanner_segment_reuse_activation_preflight_for_cycle_blocks_unbounded_inputs() {
|
||||
let dirty_usage_snapshot = DirtyUsageSnapshot {
|
||||
buckets: Arc::new(DirtyUsageBuckets::default()),
|
||||
scopes: Arc::new(DirtyUsageBucketScopes::default()),
|
||||
generation: u64::MAX,
|
||||
covers_all_pending: false,
|
||||
};
|
||||
|
||||
let preflight = scanner_segment_reuse_activation_preflight_for_cycle(
|
||||
&dirty_usage_snapshot,
|
||||
DirtyUsageProducerEvidence::default(),
|
||||
true,
|
||||
None,
|
||||
false,
|
||||
);
|
||||
|
||||
assert!(!preflight.production_activation);
|
||||
assert!(!preflight.scanner_segment_reuse_activated);
|
||||
assert_eq!(
|
||||
preflight.fail_closed_blockers().collect::<Vec<_>>(),
|
||||
SCANNER_SEGMENT_ACTIVATION_FAIL_CLOSED_CHECKS
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn scanner_segment_reuse_activation_preflight_for_cycle_skips_distributed_blocker_for_local_scan() {
|
||||
let dirty_usage_snapshot = DirtyUsageSnapshot {
|
||||
buckets: Arc::new(DirtyUsageBuckets::from([("photos".to_string(), 7)])),
|
||||
scopes: Arc::new(DirtyUsageBucketScopes::default()),
|
||||
generation: 7,
|
||||
covers_all_pending: true,
|
||||
};
|
||||
|
||||
let preflight = scanner_segment_reuse_activation_preflight_for_cycle(
|
||||
&dirty_usage_snapshot,
|
||||
complete_process_local_producer_evidence(),
|
||||
false,
|
||||
None,
|
||||
true,
|
||||
);
|
||||
|
||||
assert!(!preflight.production_activation);
|
||||
assert!(!preflight.scanner_segment_reuse_activated);
|
||||
assert_eq!(
|
||||
preflight.fail_closed_blockers().collect::<Vec<_>>(),
|
||||
vec!["missing_producer_identity", "restart_gap"]
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn scanner_cycle_result_returns_segment_reuse_activation_preflight() {
|
||||
let proof = ScannerSegmentReuseActivationProof {
|
||||
production_activation: true,
|
||||
producer_identity_coverage_complete: true,
|
||||
durable_producer_identity: true,
|
||||
restart_gap_absent: true,
|
||||
generation_window_bound: true,
|
||||
overflow_absent: true,
|
||||
cold_zero_walk_oracle: true,
|
||||
distributed_peer_invalidation: true,
|
||||
};
|
||||
let preflight = scanner_segment_reuse_activation_preflight_from_proof(proof);
|
||||
|
||||
let result = ScannerCycleResult::new(ScannerCycleStatus::Complete, None).with_segment_reuse_activation_preflight(preflight);
|
||||
|
||||
assert_eq!(result.segment_reuse_activation_preflight, preflight);
|
||||
}
|
||||
|
||||
fn assert_segment_reuse_activation_blocked_by(proof: ScannerSegmentReuseActivationProof, blocker: &'static str) {
|
||||
let preflight = scanner_segment_reuse_activation_preflight_from_proof(proof);
|
||||
|
||||
assert!(preflight.production_activation);
|
||||
assert!(!preflight.scanner_segment_reuse_activated);
|
||||
assert_eq!(preflight.fail_closed_blockers().collect::<Vec<_>>(), vec![blocker]);
|
||||
}
|
||||
|
||||
fn complete_process_local_producer_evidence() -> DirtyUsageProducerEvidence {
|
||||
DirtyUsageProducerEvidence {
|
||||
producer_identity_coverage_complete: true,
|
||||
durable_producer_identity: false,
|
||||
restart_gap_absent: false,
|
||||
generation_window_bound: true,
|
||||
generation_start: 7,
|
||||
generation_end: 7,
|
||||
}
|
||||
}
|
||||
|
||||
async fn setup_two_pool_scanner_store() -> (tempfile::TempDir, Arc<ECStore>) {
|
||||
init_ecstore_config_for_scanner_tests();
|
||||
let temp_dir = tempfile::tempdir().expect("multi-pool scanner test directory should be created");
|
||||
@@ -1229,29 +1039,6 @@ fn dirty_usage_snapshot_detects_uncovered_generation() {
|
||||
clear_dirty_usage_buckets_for_tests();
|
||||
}
|
||||
|
||||
#[test]
|
||||
#[serial]
|
||||
fn dirty_usage_producer_evidence_tracks_process_local_coverage_without_durable_restart_authority() {
|
||||
use crate::segment_invalidation::SegmentInvalidationProducerIdentity;
|
||||
|
||||
clear_dirty_usage_buckets_for_tests();
|
||||
record_dirty_usage_bucket_from_producers("photos", SegmentInvalidationProducerIdentity::REQUIRED_PRODUCTION);
|
||||
let snapshot = snapshot_dirty_usage_buckets(&[bucket_info("photos")], dirty_usage_generation());
|
||||
|
||||
let evidence = dirty_usage_producer_evidence(&snapshot);
|
||||
|
||||
assert!(evidence.generation_window_bound);
|
||||
assert!(evidence.producer_identity_coverage_complete);
|
||||
assert!(!evidence.durable_producer_identity);
|
||||
assert!(!evidence.restart_gap_absent);
|
||||
|
||||
record_dirty_usage_bucket_from_producer("videos", SegmentInvalidationProducerIdentity::PutObject);
|
||||
let stale_evidence = dirty_usage_producer_evidence(&snapshot);
|
||||
assert!(!stale_evidence.generation_window_bound);
|
||||
assert!(!stale_evidence.producer_identity_coverage_complete);
|
||||
clear_dirty_usage_buckets_for_tests();
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn generation_saturates_instead_of_wrapping() {
|
||||
let generation = AtomicU64::new(u64::MAX - 1);
|
||||
@@ -1559,12 +1346,6 @@ async fn set_snapshot_reuse_requires_execution_identity_and_fences_stale_writers
|
||||
|
||||
let ctx = CancellationToken::new();
|
||||
let empty_execution = DataUsageScanPlanDigest([5; 32]);
|
||||
let segment_invalidation_proof = crate::DataUsageSegmentInvalidationProof {
|
||||
process_epoch: scanner_activity_epoch().to_string(),
|
||||
generation_start: 8,
|
||||
generation_end: 8,
|
||||
producer_identity_coverage_complete: true,
|
||||
};
|
||||
set.nsscanner_cache(
|
||||
ctx.clone(),
|
||||
ScannerCycleBudget::new(&ctx, ScannerCycleBudgetConfig::default()),
|
||||
@@ -1584,8 +1365,6 @@ async fn set_snapshot_reuse_requires_execution_identity_and_fences_stale_writers
|
||||
bucket_failures: ScannerBucketFailureState::default(),
|
||||
pending_maintenance_work: Arc::new(AtomicBool::new(false)),
|
||||
cache_cycle_floor: Arc::new(AtomicU64::new(8)),
|
||||
cold_zero_walk_reuse_observed: Arc::new(AtomicBool::new(false)),
|
||||
segment_invalidation_proof: Some(segment_invalidation_proof.clone()),
|
||||
},
|
||||
tx,
|
||||
8,
|
||||
@@ -1595,7 +1374,6 @@ async fn set_snapshot_reuse_requires_execution_identity_and_fences_stale_writers
|
||||
.expect("empty set scope should replace its prior nonempty cache");
|
||||
let empty = rx.try_recv().expect("empty set snapshot should be published");
|
||||
assert_eq!(empty.info.scan_execution_digest, Some(empty_execution));
|
||||
assert_eq!(empty.info.segment_invalidation_proof, Some(segment_invalidation_proof));
|
||||
assert!(empty.info.snapshot_complete);
|
||||
let root = empty.checked_flatten(DATA_USAGE_ROOT).expect("complete empty root");
|
||||
assert_eq!((root.size, root.objects), (0, 0));
|
||||
@@ -2003,18 +1781,6 @@ fn remote_dirty_usage_invalidates_local_prefix_hints_until_distributed_proof_exi
|
||||
"peer dirty state is not a distributed segment invalidation proof"
|
||||
);
|
||||
assert_eq!(distributed.remote_dirty_usage_acknowledgements.len(), 1);
|
||||
let evidence = distributed
|
||||
.distributed_segment_invalidation_evidence
|
||||
.expect("same-window peer snapshot and scoped ACK capability form distributed evidence");
|
||||
assert_eq!(evidence.peer_count, 1);
|
||||
assert_eq!(evidence.dirty_peer_count, 1);
|
||||
assert_eq!(
|
||||
evidence.invalidation_domain,
|
||||
crate::segment_invalidation::SegmentInvalidationDomain::DistributedEc
|
||||
);
|
||||
assert!(evidence.distributed_ec_invalidation);
|
||||
assert!(evidence.same_window_remote_proof);
|
||||
assert!(evidence.all_peers_bound_to_generation_window);
|
||||
}
|
||||
|
||||
fn peer_dirty_usage_snapshot(
|
||||
@@ -2061,7 +1827,7 @@ fn verified_remote_dirty_usage_buckets_merges_only_complete_current_snapshots()
|
||||
ScannerPeerDirtyUsageExpectation {
|
||||
instance_id: "instance-b".to_string(),
|
||||
generation: 3,
|
||||
pending: true,
|
||||
pending: false,
|
||||
},
|
||||
),
|
||||
]);
|
||||
@@ -2108,36 +1874,10 @@ fn verified_remote_dirty_usage_buckets_merges_only_complete_current_snapshots()
|
||||
},
|
||||
},
|
||||
],
|
||||
peer_count: 2,
|
||||
dirty_peer_count: 2,
|
||||
})
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn verified_remote_dirty_usage_rejects_peer_snapshot_that_contradicts_activity_pending_state() {
|
||||
let expected_peers = HashMap::from([(
|
||||
"node-a:9000".to_string(),
|
||||
ScannerPeerDirtyUsageExpectation {
|
||||
instance_id: "instance-a".to_string(),
|
||||
generation: 7,
|
||||
pending: false,
|
||||
},
|
||||
)]);
|
||||
|
||||
assert!(
|
||||
verified_remote_dirty_usage(
|
||||
&expected_peers,
|
||||
vec![(
|
||||
"node-a:9000".to_string(),
|
||||
peer_dirty_usage_snapshot("instance-a", 7, true, &[("photos", 7)]),
|
||||
)],
|
||||
)
|
||||
.is_none(),
|
||||
"a clean activity window cannot authorize a dirty peer snapshot or scoped ACK"
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn scanner_scoped_dirty_usage_ack_cost_threshold_is_single_protocol_batch() {
|
||||
let acknowledgement = |entry_count: usize| crate::scanner::ScannerDirtyUsageAcknowledgement {
|
||||
@@ -2211,7 +1951,6 @@ fn remote_dirty_usage_scope_resolution_falls_back_when_ack_batch_exceeds_thresho
|
||||
result.remote_dirty_usage_acknowledgements.is_empty(),
|
||||
"full-scan fallback must not send a scoped ACK that peers would reject or split"
|
||||
);
|
||||
assert!(result.distributed_segment_invalidation_evidence.is_none());
|
||||
}
|
||||
|
||||
#[test]
|
||||
@@ -2353,11 +2092,6 @@ async fn distributed_scoped_scan_falls_back_when_remote_scoped_ack_capability_is
|
||||
|
||||
assert_eq!(result.scope.selected_buckets.as_deref(), expected_buckets.as_ref());
|
||||
assert_eq!(result.remote_dirty_usage_acknowledgements.len(), expected_ack_count);
|
||||
assert_eq!(
|
||||
result.distributed_segment_invalidation_evidence.is_some(),
|
||||
capability,
|
||||
"distributed evidence requires an authenticated scoped ACK capability probe"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -138,7 +138,6 @@ async fn run_entry(store: &Arc<ECStore>, cycle: u64, selected: Option<&str>, exp
|
||||
.expect("entry cycle should finish within the fixture deadline")
|
||||
.expect("entry cycle should succeed");
|
||||
assert_eq!(result.status, ScannerCycleStatus::Complete);
|
||||
let activation_preflight = result.segment_reuse_activation_preflight;
|
||||
let scope = observed.await.expect("production resolver should report its decision");
|
||||
assert_eq!(
|
||||
scope.selected_buckets.as_deref(),
|
||||
@@ -175,20 +174,6 @@ async fn run_entry(store: &Arc<ECStore>, cycle: u64, selected: Option<&str>, exp
|
||||
actual, expected_walks,
|
||||
"each listed source/bucket must have exactly the expected real walks"
|
||||
);
|
||||
assert!(!activation_preflight.production_activation);
|
||||
assert!(!activation_preflight.scanner_segment_reuse_activated);
|
||||
let activation_blockers = activation_preflight.fail_closed_blockers().collect::<Vec<_>>();
|
||||
if selected.is_some() && expect_walks {
|
||||
assert!(
|
||||
!activation_blockers.contains(&"missing_cold_zero_walk_oracle"),
|
||||
"a complete scoped reuse cycle must carry the cold zero-walk oracle: cycle={cycle} selected={selected:?} blockers={activation_blockers:?}"
|
||||
);
|
||||
} else {
|
||||
assert!(
|
||||
activation_blockers.contains(&"missing_cold_zero_walk_oracle"),
|
||||
"unscoped or same-cycle cache reuse must not claim the cold zero-walk oracle: cycle={cycle} selected={selected:?} expect_walks={expect_walks} blockers={activation_blockers:?}"
|
||||
);
|
||||
}
|
||||
assert_eq!(
|
||||
read_config_with_revision(store.clone(), DATA_USAGE_OBJ_NAME_PATH.as_str())
|
||||
.await
|
||||
|
||||
@@ -57,9 +57,6 @@ pub enum SegmentInvalidationProducerIdentity {
|
||||
DeleteObject,
|
||||
DeleteMarker,
|
||||
CompleteMultipartUpload,
|
||||
AbortMultipartUpload,
|
||||
ObjectMetadata,
|
||||
BucketMetadata,
|
||||
Replication,
|
||||
TierTransition,
|
||||
TierExpiration,
|
||||
@@ -69,14 +66,11 @@ pub enum SegmentInvalidationProducerIdentity {
|
||||
}
|
||||
|
||||
impl SegmentInvalidationProducerIdentity {
|
||||
pub const REQUIRED_PRODUCTION: [Self; 11] = [
|
||||
pub const REQUIRED_PRODUCTION: [Self; 8] = [
|
||||
Self::PutObject,
|
||||
Self::DeleteObject,
|
||||
Self::DeleteMarker,
|
||||
Self::CompleteMultipartUpload,
|
||||
Self::AbortMultipartUpload,
|
||||
Self::ObjectMetadata,
|
||||
Self::BucketMetadata,
|
||||
Self::Replication,
|
||||
Self::TierTransition,
|
||||
Self::TierExpiration,
|
||||
@@ -88,9 +82,7 @@ impl SegmentInvalidationProducerIdentity {
|
||||
Self::PutObject => Some(SegmentInvalidationProducer::Put),
|
||||
Self::DeleteObject => Some(SegmentInvalidationProducer::Delete),
|
||||
Self::DeleteMarker => Some(SegmentInvalidationProducer::DeleteMarker),
|
||||
Self::CompleteMultipartUpload | Self::AbortMultipartUpload => Some(SegmentInvalidationProducer::Multipart),
|
||||
Self::ObjectMetadata => Some(SegmentInvalidationProducer::Put),
|
||||
Self::BucketMetadata => Some(SegmentInvalidationProducer::DirectoryObject),
|
||||
Self::CompleteMultipartUpload => Some(SegmentInvalidationProducer::Multipart),
|
||||
Self::Replication => Some(SegmentInvalidationProducer::Replication),
|
||||
Self::TierTransition | Self::TierExpiration => Some(SegmentInvalidationProducer::Tier),
|
||||
Self::DirectoryObject => Some(SegmentInvalidationProducer::DirectoryObject),
|
||||
@@ -410,12 +402,8 @@ mod tests {
|
||||
SegmentInvalidationProducerIdentity::DeleteObject,
|
||||
SegmentInvalidationProducerIdentity::DeleteMarker,
|
||||
SegmentInvalidationProducerIdentity::CompleteMultipartUpload,
|
||||
SegmentInvalidationProducerIdentity::AbortMultipartUpload,
|
||||
SegmentInvalidationProducerIdentity::ObjectMetadata,
|
||||
SegmentInvalidationProducerIdentity::BucketMetadata,
|
||||
SegmentInvalidationProducerIdentity::Replication,
|
||||
SegmentInvalidationProducerIdentity::TierTransition,
|
||||
SegmentInvalidationProducerIdentity::TierExpiration,
|
||||
SegmentInvalidationProducerIdentity::DirectoryObject,
|
||||
SegmentInvalidationProducerIdentity::Unknown,
|
||||
]),
|
||||
@@ -427,12 +415,8 @@ mod tests {
|
||||
SegmentInvalidationProducerIdentity::DeleteObject,
|
||||
SegmentInvalidationProducerIdentity::DeleteMarker,
|
||||
SegmentInvalidationProducerIdentity::CompleteMultipartUpload,
|
||||
SegmentInvalidationProducerIdentity::AbortMultipartUpload,
|
||||
SegmentInvalidationProducerIdentity::ObjectMetadata,
|
||||
SegmentInvalidationProducerIdentity::BucketMetadata,
|
||||
SegmentInvalidationProducerIdentity::Replication,
|
||||
SegmentInvalidationProducerIdentity::TierTransition,
|
||||
SegmentInvalidationProducerIdentity::TierExpiration,
|
||||
SegmentInvalidationProducerIdentity::DirectoryObject,
|
||||
SegmentInvalidationProducerIdentity::TestFixture,
|
||||
]),
|
||||
@@ -443,7 +427,6 @@ mod tests {
|
||||
SegmentInvalidationProducerIdentity::PutObject,
|
||||
SegmentInvalidationProducerIdentity::DeleteObject,
|
||||
SegmentInvalidationProducerIdentity::DeleteMarker,
|
||||
SegmentInvalidationProducerIdentity::CompleteMultipartUpload,
|
||||
SegmentInvalidationProducerIdentity::Replication,
|
||||
SegmentInvalidationProducerIdentity::TierTransition,
|
||||
SegmentInvalidationProducerIdentity::DirectoryObject,
|
||||
@@ -456,9 +439,6 @@ mod tests {
|
||||
SegmentInvalidationProducerIdentity::DeleteObject,
|
||||
SegmentInvalidationProducerIdentity::DeleteMarker,
|
||||
SegmentInvalidationProducerIdentity::CompleteMultipartUpload,
|
||||
SegmentInvalidationProducerIdentity::AbortMultipartUpload,
|
||||
SegmentInvalidationProducerIdentity::ObjectMetadata,
|
||||
SegmentInvalidationProducerIdentity::BucketMetadata,
|
||||
SegmentInvalidationProducerIdentity::Replication,
|
||||
SegmentInvalidationProducerIdentity::TierTransition,
|
||||
SegmentInvalidationProducerIdentity::DirectoryObject,
|
||||
|
||||
@@ -355,13 +355,6 @@ pub(crate) trait ScannerStorage:
|
||||
async fn list_bucket_for_scanner(&self, opts: &storage_contracts::BucketOptions) -> EcstoreResultType<ScannerBucketListing>;
|
||||
fn all_set_disks(&self) -> Vec<Arc<EcstoreSetDisks>>;
|
||||
async fn scanner_pause_backlog_writable_set_disks(&self) -> Vec<Arc<EcstoreSetDisks>>;
|
||||
async fn save_scanner_pause_backlog_replica(
|
||||
self: Arc<Self>,
|
||||
pool_index: usize,
|
||||
set_index: usize,
|
||||
data: Vec<u8>,
|
||||
preconditions: storage_contracts::HTTPPreconditions,
|
||||
) -> EcstoreResultType<()>;
|
||||
#[cfg(test)]
|
||||
fn scanner_observed_probe_store_key(&self) -> usize;
|
||||
}
|
||||
@@ -424,18 +417,6 @@ impl ScannerStorage for EcstoreStore {
|
||||
EcstoreStore::scanner_pause_backlog_writable_set_disks(self).await
|
||||
}
|
||||
|
||||
async fn save_scanner_pause_backlog_replica(
|
||||
self: Arc<Self>,
|
||||
pool_index: usize,
|
||||
set_index: usize,
|
||||
data: Vec<u8>,
|
||||
preconditions: storage_contracts::HTTPPreconditions,
|
||||
) -> EcstoreResultType<()> {
|
||||
EcstoreStore::save_scanner_pause_backlog_replica(&self, pool_index, set_index, data, preconditions)
|
||||
.await
|
||||
.map(|_| ())
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
fn scanner_observed_probe_store_key(&self) -> usize {
|
||||
std::ptr::from_ref(self).cast::<()>() as usize
|
||||
@@ -596,20 +577,6 @@ mod tests {
|
||||
Vec::new()
|
||||
}
|
||||
|
||||
async fn save_scanner_pause_backlog_replica(
|
||||
self: Arc<Self>,
|
||||
_pool_index: usize,
|
||||
_set_index: usize,
|
||||
_data: Vec<u8>,
|
||||
_preconditions: storage_contracts::HTTPPreconditions,
|
||||
) -> EcstoreResultType<()> {
|
||||
Err(EcstoreErrorType::InvalidArgument(
|
||||
"scanner-backlog".into(),
|
||||
"replica".into(),
|
||||
"fake storage has no writable replicas".into(),
|
||||
))
|
||||
}
|
||||
|
||||
fn scanner_observed_probe_store_key(&self) -> usize {
|
||||
0
|
||||
}
|
||||
|
||||
@@ -919,22 +919,6 @@ where
|
||||
}
|
||||
}
|
||||
|
||||
// The filename's item count is untrusted. Reject a payload that contains
|
||||
// more items than advertised instead of returning success and allowing the
|
||||
// caller to delete the entry with trailing events still in the file.
|
||||
match deserializer.next() {
|
||||
None => {}
|
||||
Some(Ok(_)) => {
|
||||
return Err(StoreError::Deserialization(format!(
|
||||
"Batch for key {key} contains more than {} items",
|
||||
key.item_count
|
||||
)));
|
||||
}
|
||||
Some(Err(e)) => {
|
||||
return Err(StoreError::Deserialization(format!("Failed to deserialize trailing batch item: {e}")));
|
||||
}
|
||||
}
|
||||
|
||||
if items.is_empty() && key.item_count > 0 {
|
||||
return Err(StoreError::Deserialization("No items found".to_string()));
|
||||
}
|
||||
@@ -1397,39 +1381,6 @@ mod tests {
|
||||
let _ = store.delete();
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn get_multiple_errors_on_batch_with_trailing_items_instead_of_partial_success() {
|
||||
let dir = temp_store_dir("trailing-batch-items");
|
||||
let store = QueueStore::<String>::new_with_compression(&dir, 8, ".test", false);
|
||||
store.open().unwrap();
|
||||
|
||||
let items = vec!["aa".to_string(), "bb".to_string(), "cc".to_string()];
|
||||
let original_key = store.put_multiple(items).unwrap();
|
||||
assert_eq!(original_key.item_count, 3);
|
||||
|
||||
// Keep the three-item payload but make its filename claim that it contains
|
||||
// only two items, simulating a corrupt or otherwise untrusted queue key.
|
||||
let original_path = store.file_path(&original_key);
|
||||
let advertised_key = Key {
|
||||
item_count: 2,
|
||||
..original_key
|
||||
};
|
||||
let advertised_path = store.file_path(&advertised_key);
|
||||
std::fs::rename(&original_path, &advertised_path).unwrap();
|
||||
|
||||
let err = store.get_multiple(&advertised_key).unwrap_err();
|
||||
assert!(
|
||||
matches!(err, StoreError::Deserialization(_)),
|
||||
"expected Deserialization error, got {err:?}"
|
||||
);
|
||||
|
||||
// Because get_multiple failed, the batch entry remains available for
|
||||
// inspection or recovery instead of being silently discarded.
|
||||
assert!(advertised_path.exists());
|
||||
|
||||
let _ = store.delete();
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn concurrent_put_raw_respects_entry_limit() {
|
||||
let dir = temp_store_dir("concurrent-limit");
|
||||
|
||||
@@ -1,23 +0,0 @@
|
||||
# Documentation
|
||||
|
||||
Use the focused indexes rather than treating this directory as an unordered
|
||||
collection:
|
||||
|
||||
- [Architecture knowledge base](architecture/README.md)
|
||||
- [Testing references](testing/README.md)
|
||||
|
||||
## Operations
|
||||
|
||||
Operational runbooks live under [`operations/`](operations/). Replication
|
||||
operators should start with:
|
||||
|
||||
| Runbook | Use it for |
|
||||
|---|---|
|
||||
| [Site replication operations](operations/site-replication-operations.md) | Health fields, pending operations, outage recovery, re-pair admission, IAM/SSE boundaries, and upgrades. |
|
||||
| [Replication target check](operations/replication-check.md) | Validating an S3 destination and version fidelity before enabling replication. |
|
||||
| [Replication object size limits](operations/replication-object-size-limits.md) | Multipart routing, large-object limits, and retry characteristics. |
|
||||
| [Replication outbound transport](operations/replication-outbound-transport.md) | Integrity headers, generic target behavior, and transport knobs. |
|
||||
|
||||
Other runbooks remain grouped by filename in [`operations/`](operations/);
|
||||
architecture pages link to the relevant runbook where a cross-boundary
|
||||
procedure is required.
|
||||
@@ -60,8 +60,6 @@ Required headings and strings in these files are asserted by `scripts/check_arch
|
||||
| [minio-rustfs-router-compatibility.md](minio-rustfs-router-compatibility.md) | a client or `mc` call that works against MinIO fails against RustFS and you need to know whether the endpoint is missing, stubbed, or deliberately different |
|
||||
| [minio-file-format-compat.md](minio-file-format-compat.md) | deciding whether a MinIO drive set, bucket-metadata blob, or SSE object can be read or imported by a given RustFS build, or before touching a listed version anchor |
|
||||
|
||||
Operations runbooks are registered in the [documentation operations index](../README.md#operations), and testing references live in [../testing/README.md](../testing/README.md).
|
||||
|
||||
For replication operations, start with [site replication operations](../operations/site-replication-operations.md), [replication target check](../operations/replication-check.md), [replication object size limits](../operations/replication-object-size-limits.md), and [replication outbound transport](../operations/replication-outbound-transport.md).
|
||||
Operations runbooks live in [../operations/](../operations/) and testing references in [../testing/README.md](../testing/README.md).
|
||||
|
||||
For per-node HTTP failure ratios and cached storage probe provenance, see [S3 write failure diagnostics](../operations/s3-write-failure-diagnostics.md).
|
||||
|
||||
@@ -38,10 +38,9 @@
|
||||
- `put-file-auth-epoch-strict` internode put_file epoch compatibility: rc.2 peers can cache a remote put_file capability before that remote node restarts, then continue sending v1 authenticated uploads with the old server epoch; those peers cannot recover from the 409 conflict used by newer clients to trigger a re-probe. Servers temporarily accept signed, non-nil stale put_file epochs while legacy put_file auth remains non-strict so mixed-version rolling upgrades can finish multipart/object writes. Remove the stale-epoch fallback after the minimum supported RustFS peer version re-probes put_file capability after server-epoch conflicts and legacy put_file auth is no longer accepted.
|
||||
- `disk-mutation-body-digest` internode mutating disk RPCs: servers temporarily accept mutating disk RPCs (RenameData, DeleteVersion, DeleteVersions, WriteMetadata, UpdateMetadata, WriteAll, Delete, DeletePaths, RenameFile, RenamePart, DeleteVolume, MakeVolume, MakeVolumes) that carry no signature-bound canonical body digest, so peers from releases that predate body-digest signing remain available during rolling upgrades. Accepted digestless mutations increment the internode body-digest fallback counter; that counter must read zero fleet-wide across a release window before RUSTFS_INTERNODE_RPC_BODY_DIGEST_STRICT is enabled. Because body-bound requests now consume replay-cache nonces on the receiver, deploy the raised RUSTFS_INTERNODE_RPC_REPLAY_CACHE_CAPACITY default fleet-wide before enabling strict mode, and watch the internode replay-cache overflow counter for undersized capacity during the rollout. Remove the digestless fallback after the minimum supported RustFS peer version body-binds every mutating disk RPC.
|
||||
- `heal-status-rpc-v1` node heal status capability: new peers treat an unimplemented BackgroundHealStatus RPC as an explicitly incomplete rolling-upgrade response. Remove the fallback after the minimum supported RustFS peer version implements BackgroundHealStatus.
|
||||
- `backlog-1316` legacy encrypted multipart range seek: the feature is on by default (RUSTFS_ENCRYPTED_RANGE_SEEK, default true) and the switch remains only as a kill switch until every server that can initiate, write, or complete multipart uploads supports the candidate-to-final marker protocol and uploadId commit lock, and pre-upgrade multipart uploads have drained. Remove the RUSTFS_ENCRYPTED_RANGE_SEEK switch after the minimum supported release does so; keep the quorum marker and malformed-layout full-read guards permanently.
|
||||
- `backlog-1316` legacy encrypted multipart range seek: the feature remains opt-in until every server that can initiate, write, or complete multipart uploads supports the candidate-to-final marker protocol and uploadId commit lock, and pre-upgrade multipart uploads have drained. Remove the RUSTFS_ENCRYPTED_RANGE_SEEK switch after the minimum supported release does so; keep the quorum marker and malformed-layout full-read guards permanently.
|
||||
- `tonic-013-status-render` peer RPC failure classification: internode failures that reach a node only as text (a peer's error_info payload, a status flattened through format!) are classified by matching the rendering of an Unavailable gRPC status. Releases up to 1.0.0-alpha.38 shipped tonic 0.13, which rendered that status as "status: Unavailable, message: ..."; tonic 0.14 renders it as "code: 'The service is currently unavailable', message: ...". Both forms are matched so an older peer's relayed text still marks an unreachable peer offline. Remove the tonic 0.13 form after the minimum supported RustFS peer version ships tonic 0.14 or later.
|
||||
- `rustfs-5063` pre-beta.9 Local KMS recovery: persisted Local KMS configs from beta.8 and earlier predate the explicit insecure-development flag, and encrypted key files use the legacy SHA-256 KDF. Remove the config fallback after supported upgrades have rewritten or explicitly resaved all pre-beta.9 configs with the development-default field, and remove the legacy KDF after supported upgrades have rewritten all pre-beta.9 Local KMS key files with explicit at-rest protection.
|
||||
- `backlog-2369-legacy-nonce-fallback` pre-alpha.91 v1 segment nonce layout: releases before `1.0.0-alpha.91` reused a segment's part nonce for every block inside it, so the decrypt reader keeps that layout as its third and last v1 fallback. Because block zero's derived nonce equals that base nonce, the layout also lets a frame encrypted at index zero authenticate anywhere in its segment. Reads now lock a segment to whichever layout decoded its first non-zero block, which rejects a replay as soon as a later frame disagrees; a stream that is nothing but repeats of frame zero has no such later frame, so a deployment holding no pre-alpha.91 objects should set RUSTFS_ENCRYPTION_LEGACY_NONCE_FALLBACK=false to drop the layout outright. Remove the fallback (and the switch) after the minimum supported direct-upgrade release, and after migration tooling has rewritten every pre-alpha.91 encrypted object.
|
||||
- `sse-local-dek-json-v1` legacy local SSE DEK decoding: releases before the JSON envelope wrote wrapped DEKs as `base64(nonce):base64(ciphertext)`, so readers retain that decoder while all new writes use the versioned JSON envelope. Remove the colon decoder after the minimum supported direct-upgrade release writes JSON envelopes and migration tooling has rewritten every retained legacy object.
|
||||
- `not-initialized-error-code-v1` typed control-plane not-initialized wire code: control-plane RPC responses historically signaled an uninitialized peer only through the literal error_info string "errServerNotInitialized" (one drift site says "storage layer not initialized"). Responses now dual-carry a typed ControlPlaneErrorCode beside the legacy string, and clients prefer the code; the string stays populated and the client substring fallback (is_err_not_initialized, control_plane_failure) stays in place so mixed-version clusters keep classifying older peers' responses. Remove the substring fallback (and stop populating error_info for this case) after the minimum supported RustFS peer version always sends error_code.
|
||||
- `backlog-2097-tier-mutation-v4-error-text` tier-mutation Prepare rejection classification: a v3 server rejects a v4 request before store/runtime dispatch with the FailedPrecondition status and an authenticated, byte-exact unsupported-version message. A v4 coordinator recognizes only that exact code/message/requested-version tuple as definitely not persisted and fails the mutation without sending that peer an incompatible Abort; Unimplemented, near-text, missing/unknown failure classes, timeouts, and every other transport outcome remain ambiguous and stay in identity-bound Abort fanout. There is no automatic v3 retry. New servers retain v3 request/proof decoding for older coordinators, while operators must pause tier edit/remove/clear during a mixed v3/v4 rollout. Remove the text classifier after the minimum supported RustFS peer version returns the signed v4 PreDispatchRejected failure class.
|
||||
|
||||
@@ -7,8 +7,6 @@
|
||||
|
||||
RustFS supports queued multi-pool decommission start requests on multi-pool deployments. The admin handler accepts the MinIO-compatible request shape, including comma-separated pool targets. An empty target list is rejected; single-pool deployments reject decommission because there is no destination pool; on multi-pool deployments one or more valid target pools are accepted as a single queued operation.
|
||||
|
||||
Deterministic request rejections (unsupported single-pool operations, missing or terminal targets, an empty start request, removing the last active pool, and clearing unresolved recovery entries) retain the typed `InvalidArgument` error and its actionable reason. Active-operation conflicts retain their existing `InvalidRequest` or `OperationAborted` contract. Storage, quorum, and fleet-proof failures are not converted into argument errors.
|
||||
|
||||
### Request Semantics
|
||||
|
||||
`POST /v3/pools/decommission` with comma-separated pool targets is a queue submission:
|
||||
@@ -17,8 +15,7 @@ Deterministic request rejections (unsupported single-pool operations, missing or
|
||||
- reject duplicate target pools in the same request;
|
||||
- reject active or queued target pools;
|
||||
- reject completed decommission targets, because completion means the pool can be removed from the deployment configuration;
|
||||
- require failed or canceled targets to be cleared before restarting, except
|
||||
when unresolved listing entries require an explicit recovery retry;
|
||||
- allow failed or canceled targets to be retried;
|
||||
- persist queued metadata before starting workers;
|
||||
- start only the local-leader prefix of the queue on the receiving node.
|
||||
|
||||
@@ -59,29 +56,6 @@ Cancel separates active and queued behavior:
|
||||
|
||||
Cancel requests can be accepted on non-leader nodes as remote cancel intent; the leader observes the pending cancel and applies it to the active worker.
|
||||
|
||||
`queuedBuckets` retains the unfinished work inventory after cancellation. It is
|
||||
not evidence of active scheduling: `queued` is false and `startTime` is absent.
|
||||
Operators and tests must inspect the terminal flags, peer state and progress
|
||||
stability instead of requiring the historical inventory to be empty. A normal
|
||||
canceled entry remains blocked until clear; unresolved listing entries instead
|
||||
retain the explicit retry path that can re-observe or resolve those entries.
|
||||
|
||||
### Publication On Retiring Pools
|
||||
|
||||
Ordinary publication rechecks the selected pool against the durable pool metadata under its existing read fence. Selection may have happened before retirement, or on a node whose local pool state has not been refreshed. A staged new PUT must return `SlowDown` instead of publishing into a pool that has since become suspended. The staged input is not automatically replayed into another pool.
|
||||
|
||||
Running, queued, failed, canceled, and completed decommission states exclude the source from new ordinary publication, including new multipart uploads. Previously created multipart uploads retain their drain path while the source remains non-terminal; terminal source states reject further multipart publication. Failed and canceled entries become writable for new ordinary publication only after an allowed clear operation removes that state. This check does not change repair admission or the separate fence for operations that only release capacity.
|
||||
|
||||
For mixed batch deletes, only the pools selected to receive new delete markers are publication targets. Exact-version deletions on other pools remain protected by the same pool metadata read fence, without treating the retiring source or an unrelated reserved target as a destination for those markers.
|
||||
|
||||
### Shared Capacity On Healthy Targets
|
||||
|
||||
Ordinary publication into a healthy target is not rejected solely because that pool has an active decommission reservation. This follows the MinIO decommission write-routing contract: the retiring source stops accepting new writes, while the remaining pools share physical capacity between foreground requests and migration. A reservation remains a migration budget and recovery ledger, not an exclusive foreground-write quota. Repair retains its existing conservative reservation admission policy.
|
||||
|
||||
The existing durable metadata fence, valid active reservation checks, owner/mutation identity, pending-intent recovery, target write quorum and source-cleanup preflight remain required. Foreground writes do not acquire the mover's target I/O lock or settle its pending intent. Capacity estimates, including filesystem free-space deltas observed during migration, may include concurrent unrelated I/O; they are not proof of exclusive space or of a committed target object. Actual write failures and identity/quorum checks remain authoritative. Space loss can stop migration with the source retained, including after a target copy has committed. Capacity exhaustion can also fail foreground writes; this policy does not guarantee foreground priority or success. RustFS retains its existing capacity-blocked state and recovery behavior rather than changing terminal-state or retry semantics here.
|
||||
|
||||
The native regression overlaps public PUT and multipart create/part replacement/complete/abort operations with a paused target rename on another node context, checks that foreground publication leaves the pending migration ledger unchanged, and then checks both sufficient-capacity cleanup and injected capacity loss with byte-for-byte retained source and target data. Mixed batch deletion covers marker publication on both reserved and unreserved healthy targets together with exact-version removal on the retiring source. Capacity is injected deterministically; the object and metadata operations use real temporary disks, not a physical disk-exhaustion test.
|
||||
|
||||
### Status Response Shape
|
||||
|
||||
`GET /v3/pools/list` and `GET /v3/pools/status?pool=...` expose per-pool machine-readable decommission state. The `status` field can report `active`, `running`, `queued`, `complete`, `failed`, or `canceled`.
|
||||
@@ -96,40 +70,6 @@ When decommission metadata is present, `decommissionInfo` includes:
|
||||
|
||||
This makes queued pools and stalled metadata visible without requiring operators to inspect pool metadata files directly.
|
||||
|
||||
### Scanner Backlog Replica Conflicts
|
||||
|
||||
Native scanner CAS publication uses the storage-owned replica write path, not a
|
||||
direct write to a set selected from node-local pool state. On multi-pool stores,
|
||||
the fixed object namespace precedes the durable pool metadata read fence and
|
||||
the actual replica-set namespace. Admission excludes running, queued and
|
||||
completed sources; failed/canceled sources retain the scanner's existing
|
||||
membership-repair behavior. Missing pool metadata does not authorize a replica.
|
||||
Healthy reserved targets remain writable under the shared-capacity contract.
|
||||
|
||||
The replica writer retains both outer guards in an owned task and waits for the
|
||||
rename tail, including when its caller is canceled. Lock-loss signals remain
|
||||
attached to the set commit. This does not require every disk to succeed or alter
|
||||
write quorum/fsync policy. Replica writes for this one internal key serialize
|
||||
through its fixed namespace; ordinary PUT/GET do not enter this writer. The
|
||||
scanner still requires CAS success on every surviving set before acknowledging
|
||||
a ledger generation, and retains its partial-commit recovery protocol.
|
||||
Older scanner writers still use direct set CAS; this source-publication fence
|
||||
requires updating every scanner-capable node. No new on-disk or wire format is
|
||||
introduced.
|
||||
|
||||
The exact internal object `.rustfs.sys/buckets/.scanner-pause-backlog.json` is
|
||||
published with CAS to surviving sets. Its replica-local object modification
|
||||
times are not scanner ledger generations. A cross-pool migration receiving
|
||||
`PreconditionFailed` can therefore accept an existing unversioned replica with
|
||||
an identical known ETag, payload identity and metadata even when its write time
|
||||
differs. This exception does not apply to other keys, versioned objects, delete
|
||||
markers, missing identity evidence, or a different older ledger payload.
|
||||
|
||||
The source is still revalidated under its mutation fence before migration.
|
||||
Existing capacity-owner and mutation checks reconcile the pending intent before
|
||||
source cleanup; the replica exception does not clear an unknown intent, rewrite
|
||||
the native target, or change the scanner's committed-membership selection.
|
||||
|
||||
## MinIO Divergence Decisions
|
||||
|
||||
Behavior that is close to MinIO but not byte-for-byte identical. Changing either decision requires an operator compatibility note and updated characterization tests.
|
||||
|
||||
@@ -38,42 +38,6 @@ Counts ignore blank lines and comments; compute them from the files. The lifecyc
|
||||
|
||||
"Supported" for the SSE row means RustFS encrypts and decrypts its own objects. MinIO SSE objects (SSE-S3, SSE-KMS, SSE-C) are not readable in default builds; see [minio-file-format-compat.md Part C](minio-file-format-compat.md#part-c--server-side-encryption-sse) for the `rio-v2` migration build.
|
||||
|
||||
## Replication Support Boundary
|
||||
|
||||
Site replication and bucket replication are not the same compatibility claim.
|
||||
Site replication requires RustFS-compatible peer admin APIs and coordinates
|
||||
IAM, topology, buckets, and metadata. A generic S3-compatible service can only
|
||||
be a bucket-replication data target.
|
||||
|
||||
For a generic S3 target, RustFS supports object PUT/HEAD/DELETE, multipart
|
||||
uploads, tags, version deletes, and Object Lock mutations when the target
|
||||
implements the corresponding S3 APIs and has versioning enabled. Targets that
|
||||
mint their own version IDs are supported through a per-target version ledger;
|
||||
pre-ledger replicas are adopted only when exact key and ETag identify one
|
||||
unambiguous target version. `NoSuchVersion` for an already absent addressed
|
||||
replica is treated as converged.
|
||||
|
||||
The following are capability boundaries, not universal S3 claims:
|
||||
|
||||
- `GET /BUCKET?replication-check` must pass the phases required by the intended
|
||||
workload. `VersionFidelity` may report a minting target as mismatched even
|
||||
though ledger-addressed delete and Object Lock phases succeed.
|
||||
- A target that rejects standard multipart constraints, required Object Lock
|
||||
integrity headers, or the configured checksum framing is unsupported until
|
||||
its transport settings are made compatible.
|
||||
- SSE-S3 and SSE-KMS are decrypted at the source and re-encrypted by the
|
||||
destination's KMS. SSE-C uses ciphertext passthrough and requires target
|
||||
evidence. Unsupported or ambiguous encryption metadata fails closed.
|
||||
- ACL authorization is intentionally unsupported, and generic targets never
|
||||
receive RustFS IAM/site-control-plane state.
|
||||
- RustFS does not guess between multiple target versions with the same key and
|
||||
ETag. The mutation remains failed and retryable until repair establishes an
|
||||
unambiguous mapping.
|
||||
|
||||
See [site replication operations](../operations/site-replication-operations.md)
|
||||
for health, recovery, and upgrade rules and [replication outbound transport](../operations/replication-outbound-transport.md)
|
||||
for the tested target classes and knobs.
|
||||
|
||||
## Not Yet Passing
|
||||
|
||||
Standard S3 areas that must not be described as complete:
|
||||
|
||||
@@ -15,16 +15,6 @@ RustFS ships several KMS backends. They differ not only in deployment effort but
|
||||
| Vault Transit | `VaultTransit` | Key-encryption keys never leave Vault; only Transit ciphertext is visible outside | Vault Transit engine (cryptographic isolation) | Delegated to Vault storage | Via Vault Transit key versioning | Deployments that need key material to be unreadable through storage APIs |
|
||||
| AWS KMS | `AWS` (alias `AwsKms`) | Key material never leaves AWS KMS; RustFS mirrors no key state | AWS KMS (cryptographic isolation) + IAM | Delegated to AWS | On-demand `RotateKeyOnDemand`; prior backing keys stay usable for decryption | Deployments rooted in AWS IAM — read [AWS KMS: deviations from the shared backend contract](#aws-kms-deviations-from-the-shared-backend-contract) first |
|
||||
|
||||
## No KMS configured: the SSE-S3 local master key
|
||||
|
||||
A deployment that never configures a KMS can still serve **SSE-S3** by setting `RUSTFS_SSE_S3_MASTER_KEY` to a base64-encoded 32-byte key. Data keys are then wrapped with that key using AES-256-GCM, on the node that serves the write. Understand three consequences before relying on it:
|
||||
|
||||
- **The key is the whole confidentiality boundary.** It lives in the process environment of every node, with no ACL, no audit trail and no policy engine in front of it.
|
||||
- **Objects written this way can never be rotated.** There is no key record to rotate and no rewrap path; changing the value makes every object written under the old one unreadable. Migrating to a KMS later means rewriting those objects (for example with CopyObject), not reconfiguring.
|
||||
- **It does not serve SSE-KMS.** A request for `x-amz-server-side-encryption: aws:kms` on a node with no running KMS is refused — `400 InvalidRequest` when KMS was never configured, `503` when a configured service is not running. Earlier releases silently wrapped the data key with the local master key while still stamping `aws:kms` and the requested key id into the object metadata; that metadata claimed a KMS protection the object never had. If a deployment depended on that, either configure a KMS or ask for `AES256`.
|
||||
|
||||
The value is unset by default, and a deployment that neither configures a KMS nor sets it simply cannot serve SSE-S3 (the write is refused, never silently downgraded to plaintext).
|
||||
|
||||
## Migrating from MinIO: encrypted objects do not carry over
|
||||
|
||||
> **Warning: default RustFS builds fail closed on objects that MinIO encrypted.** This applies to SSE-S3, SSE-KMS, and SSE-C, whichever KMS backend you configure; configuring `Static` with MinIO's key material does not make them readable. Such objects list and HEAD normally (their `xl.meta` parses), and only the payload read fails — with S3 `InvalidObjectState`, never plaintext. Read a sample of encrypted objects, not just their listings, before decommissioning the MinIO deployment.
|
||||
@@ -127,37 +117,6 @@ Decryption loads exactly the version recorded in the envelope and fails closed w
|
||||
|
||||
Do not rotate any key until **every** RustFS node runs a build that understands the `master_key_version` envelope field. Older binaries ignore the field and always decrypt with the current material: harmless while nothing has been rotated, but after a rotation they fail to decrypt every object wrapped by an earlier key version. Complete the rolling upgrade of the entire cluster first, then rotate. The rest of this constraint class is collected in [Mixed-version clusters during a rolling upgrade](#mixed-version-clusters-during-a-rolling-upgrade).
|
||||
|
||||
## SSE-C requires a secure transport
|
||||
|
||||
An SSE-C request carries the customer's AES key in a request header, so AWS S3 and MinIO both refuse one that did not arrive over TLS. A plaintext hop hands that key to anyone on the path, and because the object cannot be read without the same key, the exposure lasts as long as the object does.
|
||||
|
||||
This release reports rather than refuses, because flipping straight to a rejection would break every plaintext staging and test deployment inside a release window:
|
||||
|
||||
- Every SSE-C request on a plaintext transport increments `rustfs_ssec_plaintext_requests_total` and logs one `ssec_request_without_tls` warning per process.
|
||||
- `RUSTFS_SSE_C_REQUIRE_TLS=true` (default `false`) refuses those requests now, with the same `400 InvalidRequest` wording AWS uses. Confirm the counter reads zero before enabling it.
|
||||
- The default is expected to flip in a later release.
|
||||
|
||||
The verdict is per connection: a listener that terminates TLS satisfies it, and so does an `https` protocol forwarded by a proxy the trusted-proxy configuration accepts. A direct plaintext client asserts nothing, and a forwarded protocol from an untrusted peer is not consulted.
|
||||
|
||||
## Object ciphertext format: what the v1 frame layout does and does not authenticate
|
||||
|
||||
Every object RustFS writes today uses the **v1** frame layout (the v2 layout exists and is read automatically, but its write switch `RUSTFS_ENCRYPTION_FRAME_V2` is off by default). Each frame is authenticated with AES-256-GCM under a nonce derived from the object's base nonce and the frame's index. Three properties do **not** follow from that, and an operator's threat model has to account for them:
|
||||
|
||||
- **No frame-index binding.** A frame's index is not part of its associated data. Authentication proves a frame was produced under this object's key; it does not by itself prove the frame belongs at the position it occupies.
|
||||
- **No final-frame authentication.** Nothing in a v1 stream marks the last frame, so a stream that has been cut short is not distinguishable from a shorter object by cryptographic means.
|
||||
- **Truncation is not detected server-side.** A full GET is cut off by the length gate mid-stream and surfaces as `IncompleteBody` — after the response headers have already gone out. A ranged GET that ends early looks like an ordinary EOF and is not reported at all. A client that needs a truncation signal must compare the delivered length against `Content-Length` itself.
|
||||
|
||||
These matter only to an attacker who can already rewrite the underlying shards. Shard integrity uses a keyed-hash-free checksum (HighwayHash), which such an attacker can recompute, so it is not a barrier.
|
||||
|
||||
Two historical shapes additionally reuse a GCM nonce and cannot be repaired by any read-side change:
|
||||
|
||||
| Shape | Written by | Consequence | Migration |
|
||||
| --- | --- | --- | --- |
|
||||
| Multipart objects written before `1.0.0-alpha.91` | The pre-alpha.91 writer reused a segment's part nonce for every block in it | The whole segment shares one nonce; a frame from index zero authenticates anywhere in that segment | Rewrite in place with CopyObject; then set `RUSTFS_ENCRYPTION_LEGACY_NONCE_FALLBACK=false` |
|
||||
| SSE-C objects written before `1.0.0-beta.9` that carry no stored IV | The nonce was derived deterministically from bucket and key | Historical versions of the same key share a nonce, which affects confidentiality as well as forgeability | Rewrite in place with CopyObject |
|
||||
|
||||
The decrypt reader locks each segment to whichever nonce layout decoded its first non-zero-index frame, so a replayed frame is rejected as soon as any later frame disagrees. A stream that is nothing but repeats of frame zero has no later frame to disagree, so a deployment that holds no pre-alpha.91 objects should set `RUSTFS_ENCRYPTION_LEGACY_NONCE_FALLBACK=false` (default `true`) to drop that layout entirely. Turning it off refuses to decrypt pre-alpha.91 objects, so migrate first.
|
||||
|
||||
## Mixed-version clusters during a rolling upgrade
|
||||
|
||||
During a rolling upgrade KMS state is shared three ways: **Vault** holds key records and Transit metadata, **cluster storage** holds the persisted KMS configuration, and **each node's process memory** holds caches and the live backend instance. Nodes on different builds agree on the first, may disagree on the third, and can disagree on configuration for as long as the operator leaves them running, because the reload broadcast that converges configuration is one of the things an older build rejects. This section is written for the KV2 and Transit backends; the Local backend is unsupported for multi-node deployments regardless of version (see the [deployment support matrix](#deployment-support-matrix)).
|
||||
@@ -278,7 +237,6 @@ The Local backend stores one JSON record per key (`<key_id>.key`) plus an Argon2
|
||||
- `Local` is the default backend (`kms_backend` defaults to `local`) and is a development, testing and demo backend; it is not supported for production. Activating a backend whose capabilities report `production_supported: false` logs a `kms_backend_positioning` warning on every start, restart and reconfigure, and the `kms/status` capability matrix carries the same flag. The positioning is a warning, not a gate.
|
||||
- Configuration validation enforces stricter rules outside explicit development mode: a master key is required and `key_dir` must not live under the process temp directory.
|
||||
- The RustFS Kubernetes operator places the key directory on a PersistentVolumeClaim, so keys survive pod rescheduling.
|
||||
- **A multi-node deployment cannot share it.** Key material lives on each node's own disk and the Argon2id salt is generated per node, so two nodes derive different keys from the same `master_key`. An object encrypted on node A cannot be decrypted on node B; behind a load balancer that appears as intermittent 500s on reads that succeeded a moment earlier. Configuring `Local` while the deployment is distributed logs `kms_node_local_backend_in_distributed_deployment` and appends the same warning to the `kms/configure` response. This stays a warning, not a gate.
|
||||
- Production multi-node deployments should use the Vault Transit backend.
|
||||
|
||||
### Deployment support matrix
|
||||
|
||||
@@ -9,14 +9,12 @@ The drill rehearses the complete loop — back up, lose the persistence layer, p
|
||||
|
||||
The drill covers the **Local** backend, the only backend RustFS produces a full-material bundle for. The responsibility split is described in `crates/kms/src/backup/capability.rs`:
|
||||
|
||||
| Backend | RustFS bundle export | What restores it |
|
||||
| Backend | What a RustFS bundle carries | What restores it |
|
||||
| --- | --- | --- |
|
||||
| Local | Key records, all stored versions, the KDF salt, sanitized configuration | The RustFS restore in this runbook |
|
||||
| Static | Refused with `501`; RustFS holds no material to export | The operator re-supplies the secret out of band |
|
||||
| Vault KV2 | Refused with `501` | Vault's native snapshot restore, then the RustFS orchestration |
|
||||
| Vault Transit | Refused with `501` | Vault's native snapshot restore, then the RustFS orchestration |
|
||||
|
||||
The `501` is not a gap in this runbook: `POST /rustfs/admin/v3/kms/backup` refuses any backend other than `Local` (`rustfs/src/admin/handlers/kms_backup.rs`, `execute_backup`), so no RustFS bundle exists to plan around for the other three. Note that `capability.rs` still *declares* `FullMaterial` responsibility for Vault KV2 in storage-only mode; no export path implements it, so treat the declaration as a reservation, not a capability.
|
||||
| Static | Non-sensitive references only | The operator re-supplies the secret out of band |
|
||||
| Vault KV2 + Transit | KV metadata and Transit ciphertext references | Vault's native snapshot restore, then the RustFS orchestration |
|
||||
| Vault Transit | Metadata, configuration references, verification data | Vault's native snapshot restore, then the RustFS orchestration |
|
||||
|
||||
For the Vault backends there is no RustFS-side export: the cryptographic root is non-exportable and comes back through Vault's own disaster-recovery flow. RustFS owns the refusal to proceed before that has happened and the ordering of everything after it — see the Vault section below.
|
||||
|
||||
|
||||
@@ -225,10 +225,6 @@ KMS configured through the admin API is persisted to cluster storage and restore
|
||||
|
||||
To recover from `load_failed` — or from any state where the server runs but its in-memory KMS lags the persisted configuration — call `POST /rustfs/admin/v3/kms/reload` (`kms:ServiceControl`). It re-reads the persisted configuration from cluster storage and reconfigures the service without resubmitting secrets, then broadcasts the reload to peer nodes. If reload keeps failing, check cluster storage health first (the read needs quorum), then `RUSTFS_KMS_CONFIG_SECRET`: an unseal error means the secret is missing or differs from the one that sealed the persisted copy — it must be identical on every node.
|
||||
|
||||
Reload short-circuits only when this node is **already running** the persisted configuration. A node whose KMS failed to start keeps that configuration and sits in `Error`, so reload reconfigures it — which starts the service — rather than reporting success while the node stays down. The same holds on every peer, which reaches the same path through the reload broadcast.
|
||||
|
||||
**Cluster-wide versus node-local routes.** `configure`, `reconfigure` and `reload` are cluster operations: the node that serves the request broadcasts to its peers. `start` and `stop` are node-local and are **not** broadcast. Calling `POST /rustfs/admin/v3/kms/stop` through a load balancer therefore stops whichever node answered and leaves the cluster in a mixed state; address a specific node directly when you mean node-local semantics, and expect a later cluster-wide `reload` to start a stopped node again.
|
||||
|
||||
A separate event, `kms_config_load_skipped` with `reason="storage_uninitialized"`, comes from the ambient loader used by the peer-reload RPC path; seeing it outside a peer reload indicates a request arrived before storage initialization finished.
|
||||
|
||||
## Threshold calibration
|
||||
|
||||
@@ -1,43 +0,0 @@
|
||||
# Lock RPC storm protection
|
||||
|
||||
**Use this when:** a slow lock endpoint turns into cluster-wide `Remote lock RPC timed out`, `Evicting cached remote lock connection`, and `GOAWAY too_many_resets` log floods, or when you tune how the remote lock client reacts to per-request deadlines (rustfs#7363).
|
||||
|
||||
## What the client does on a failed lock RPC
|
||||
|
||||
Every remote lock call (`lock`, `lock_batch`, `release`, `refresh`, `force_release`, `check_status`, and the readiness `ping`) runs under the deadline from `RUSTFS_OBJECT_LOCK_RPC_TIMEOUT_MS` (readiness uses `RUSTFS_HEALTH_LOCK_ONLINE_TIMEOUT_MS`). A deadline only says that one stream was slow; it says nothing about the shared HTTP/2 channel it ran on. The client therefore keeps a small per-peer history and decides per failure:
|
||||
|
||||
| Failure | Verdict | Effect |
|
||||
| --- | --- | --- |
|
||||
| Deadline expired, peer completed any lock RPC within two deadlines | `peer_recently_served` | Channel kept. The peer is slow, not gone. |
|
||||
| Deadline expired, peer quiet for longer than two deadlines | `evict` | Cached channel evicted once, then the next request re-dials. |
|
||||
| Any failure while the last eviction is younger than the cooldown | `cooling_down` | Channel kept so the fresh dial can prove itself; no re-dial burst. |
|
||||
| Transport failure (refused, reset, `GOAWAY`) outside the cooldown | `evict` | Cached channel evicted once. |
|
||||
|
||||
A timed-out request is no longer cancelled. Cancelling sends `RST_STREAM`, and enough resets against a server that is slow to accept streams make it answer `GOAWAY too_many_resets`, which kills every stream on the connection and restarts the loop. Instead the stream is detached: it keeps running in the background (bounded by the internode RPC timeout), the caller still gets its timeout error, and if the peer grants a lock after the caller gave up the client releases it immediately instead of leaving an orphan for the lease to expire.
|
||||
|
||||
Unlocks that fail three quick retries no longer stop there. The background task continues with a deferred schedule (1s, 2s, 4s, 8s, 16s) before it gives up and leaves the entry to the server-side lease.
|
||||
|
||||
## Configuration
|
||||
|
||||
| Environment variable | Default | Behavior |
|
||||
| --- | ---: | --- |
|
||||
| `RUSTFS_OBJECT_LOCK_RPC_TIMEOUT_MS` | `3000` | Per-request deadline for remote lock RPCs. |
|
||||
| `RUSTFS_OBJECT_LOCK_RPC_EVICTION_COOLDOWN_MS` | `5000` | Minimum interval between channel evictions per peer. `0` restores eviction on every qualifying failure. |
|
||||
| `RUSTFS_OBJECT_LOCK_RPC_DETACHED_LIMIT` | `256` | How many timed-out lock RPCs per peer may keep running in the background. Beyond the budget a timed-out stream is cancelled as before. |
|
||||
|
||||
## Metrics
|
||||
|
||||
| Metric | Labels | Meaning |
|
||||
| --- | --- | --- |
|
||||
| `rustfs_remote_lock_rpc_timeouts_total` | `peer`, `op` | Remote lock RPCs that exceeded their deadline. |
|
||||
| `rustfs_remote_lock_channel_evictions_total` | `peer`, `trigger` | Cached channel evictions; `trigger` is `timeout` or `transport`. |
|
||||
| `rustfs_remote_lock_channel_evictions_suppressed_total` | `peer`, `verdict` | Failures that kept the channel; `verdict` is `peer_recently_served` or `cooling_down`. |
|
||||
| `rustfs_remote_lock_rpc_detached_total` | `op`, `outcome` | Timed-out RPCs left running (`detached`) or cancelled for budget (`aborted`). |
|
||||
| `rustfs_remote_lock_rpc_late_completions_total` | `op`, `outcome` | How detached RPCs ended (`success`, `error`, `join_error`). |
|
||||
| `rustfs_remote_lock_late_releases_total` | `outcome` | Releases of locks granted after their caller timed out (`released`, `partial`, `failed`). |
|
||||
|
||||
## Reading an incident
|
||||
|
||||
A healthy-but-slow endpoint now shows a rising `rustfs_remote_lock_rpc_timeouts_total{peer}` with `evictions_suppressed_total{verdict="peer_recently_served"}` and at most one eviction per cooldown. A dead endpoint shows `evictions_total{trigger="transport"}` once per cooldown while the connection re-dials. Sustained `GOAWAY too_many_resets` in the server log means detached streams are being cancelled, which only happens once `RUSTFS_OBJECT_LOCK_RPC_DETACHED_LIMIT` is exhausted; raise the limit or fix the slow lock service (`http_request_inflight_slow` on `NodeService/Lock` names the endpoint).
|
||||
|
||||
The client code lives in `crates/ecstore/src/cluster/rpc/remote_locker.rs`; the deferred unlock schedule lives in `crates/lock/src/distributed_lock.rs`.
|
||||
@@ -39,8 +39,8 @@ The `scanner` and `heal` subsystems are served by `GetConfigKVHandler` (`rustfs/
|
||||
The `--abba` mode runs five independent scenario cells: `cold-hot`, `fresh-hot`,
|
||||
`multi-hot-new`, `running-heal`, and `mrf-replay`. Each scenario runs at least
|
||||
three A1/B1/B2/A2 groups for both baseline/candidate with background work on,
|
||||
and candidate-only background off/on. A measured release leg lasts at least 7200
|
||||
seconds; the minimum matrix contains 120 legs (240 hours before setup/oracles).
|
||||
and candidate-only background off/on. A measured leg lasts at least 900
|
||||
seconds; the minimum matrix contains 120 legs (30 hours before setup/oracles).
|
||||
The existing `performance-ab.yml` supplies the pattern for immutable build
|
||||
provenance and failure propagation, but its short Warp workload is not this
|
||||
scanner gate. No scheduled workflow starts this matrix automatically.
|
||||
@@ -63,7 +63,7 @@ The manifest has the following JSON contract (all fields are required):
|
||||
| Field | Value |
|
||||
|---|---|
|
||||
| `schema`, `evidence` | `1`, and `measured` or `synthetic`. |
|
||||
| `rounds`, `duration_seconds`, `min_free_bytes` | 3..10 groups, 7200..86400 seconds for measured release runs, and the independently estimated free-space reservation in bytes. Synthetic runs may use 1 second. |
|
||||
| `rounds`, `duration_seconds`, `min_free_bytes` | 3..10 groups, 900..86400 seconds for measured runs, and the independently estimated free-space reservation in bytes. Synthetic runs may use 1 second. |
|
||||
| `baseline`, `candidate` | Each contains executable `binary`, full 40-character `revision`, and verified `sha256`. The runner rehashes binaries before every leg. |
|
||||
| `fixed` | `config_sha256`, `dataset_sha256`, `release_flags`, `durability`, `disk_type`, `cache_state`, `load_command`, `resource_isolation`, `topology` (`EC8+4`), and positive `offered_load_ops`. Hashes use 64 lowercase hexadecimal characters. |
|
||||
| `release_evidence` | Required for `measured` runs. It binds the 3x4 EC8+4 topology, multi-pool/multi-set coverage, per-node metrics endpoints, same-window distributed sampling, process restart and crash-restart fault modes, mixed-version reader/writer/rollback participation, and allocation/flamegraph/RSS/save-frequency profile artifact requirements. Synthetic runs do not need this field and still cannot approve release evidence. |
|
||||
@@ -159,14 +159,6 @@ delay counts are both retained so an operator can reject unrelated or
|
||||
process-lifetime counter contamination. Correct repair oracles and the existing
|
||||
regression limits still apply in every case.
|
||||
|
||||
The `running-heal` build comparison also records a `w11` section for the bounded
|
||||
retry-window evidence. `status=observed` requires same-window healthy-page
|
||||
latency improvement, reduced heal lock-wait p99, bounded candidate RSS growth,
|
||||
and a candidate attempt-cost value. `rss_regression` means latency and lock-wait
|
||||
improved but RSS exceeded the allowed growth limit; `no_measured_benefit` means
|
||||
attempt-cost evidence exists without the full W11 benefit; `pending` means the
|
||||
attempt-cost evidence needed for the comparison is missing.
|
||||
|
||||
For P2, `measure.convergence` contains booleans `writes_stopped`,
|
||||
`last_mutation_observed`, `first_complete_publication`; numeric
|
||||
`last_mutation_time`, `last_mutation_observed_time`, `writes_stopped_time`, `window_start`, `window_end`,
|
||||
@@ -228,10 +220,7 @@ non-passing report.
|
||||
Measured passing reports must also retain the W10/W11 foreground-pressure,
|
||||
heal-lock-wait, and heal-attempt-cost fields emitted by the ABBA evaluator. If
|
||||
those fields are removed, empty, malformed, or length-mismatched, the quiet
|
||||
summary fails closed instead of treating the report as performance evidence. For
|
||||
`running-heal` build comparisons, the summary additionally requires the emitted
|
||||
W11 section to be `observed` and to retain the RSS-growth, lock-wait,
|
||||
healthy-page-latency, and candidate attempt-cost values.
|
||||
summary fails closed instead of treating the report as performance evidence.
|
||||
|
||||
They cover the complete 120-cell schedule, data isolation, missing builds and
|
||||
oracles, zero samples/requests, swallowed request errors, offered-load drift,
|
||||
|
||||
@@ -1,258 +0,0 @@
|
||||
# Site Replication Operations
|
||||
|
||||
**Use this when:** operating a site-replication deployment, diagnosing a peer
|
||||
outage or incomplete topology change, pairing sites that already contain data,
|
||||
or planning an upgrade.
|
||||
|
||||
**Source of truth:** `rustfs/src/admin/handlers/site_replication.rs`,
|
||||
`rustfs/src/site_replication/`, and the bucket-replication worker under
|
||||
`crates/ecstore/src/bucket/replication/`.
|
||||
|
||||
Site replication combines two different convergence paths:
|
||||
|
||||
- the control plane replicates buckets, bucket metadata, IAM, and topology;
|
||||
- ordinary bucket replication moves object versions and delete operations.
|
||||
|
||||
An `enabled: true` response only says that a site has more than one configured
|
||||
peer. It does not prove that every peer is reachable or caught up. Always read
|
||||
`pendingOperation`, `retryStats`, `PeerErrors`, and `Metrics` as well.
|
||||
|
||||
## Routine checks
|
||||
|
||||
Run these commands from an admin workstation with one alias per site:
|
||||
|
||||
```console
|
||||
mc admin replicate info site-a
|
||||
mc admin replicate status site-a
|
||||
```
|
||||
|
||||
Check more than one site. A partition can leave each side with a different but
|
||||
locally valid view.
|
||||
|
||||
`replicate info` is the compact control-plane view:
|
||||
|
||||
| Field | Interpretation |
|
||||
|---|---|
|
||||
| `enabled` | More than one site is configured; this is not a health verdict. |
|
||||
| `sites` | The locally persisted topology. Compare deployment IDs and endpoints on every site. |
|
||||
| `retryStats.pending` | Collapsed peer deliveries waiting to be retried. |
|
||||
| `retryStats.failed` | Deliveries that crossed the escalation threshold and require attention. |
|
||||
| `retryStats.lastError` | A redacted summary of the most recent delivery failure. |
|
||||
| `pendingOperation` | A durable multi-step topology operation described below. Absence is the healthy steady state. |
|
||||
|
||||
`replicate status` adds detailed convergence state:
|
||||
|
||||
| Field | Interpretation |
|
||||
|---|---|
|
||||
| `Sites` / `PeerStates` | Configured peers and derived reachability/configuration state. |
|
||||
| `PeerErrors` | A peer could not be queried. Its detailed counters may be absent; do not read zeros as success. |
|
||||
| `BucketStats` | Per-bucket presence and versioning, replication, lifecycle, Object Lock, and metadata mismatches. |
|
||||
| `PolicyStats`, `UserStats`, `GroupStats` | IAM inventory mismatches. |
|
||||
| `RetryStats` | Durable control-plane retry backlog and escalation count. |
|
||||
| `Metrics.replMetrics` | Per-destination online state, downtime, replicated counts/bytes, and `failed` totals/windows. |
|
||||
| `Metrics.queued` / `Metrics.inProgress` | Object work waiting or active on the responding node. |
|
||||
| `Metrics.errors` | Node-level object-replication failures. When only queue statistics are available, RustFS synthesizes a node entry and preserves this counter rather than reporting zero. |
|
||||
| `Metrics.retries` | Redeliveries. Always zero today: a failed object is not retried by an event, it waits for the scanner pass described below. Read `errors` instead. |
|
||||
|
||||
Healthy means: the same topology is visible on all sites, no pending operation,
|
||||
no peer error, no failed retry escalation, required bucket/IAM state is in sync,
|
||||
and queue/error counters are stable or falling. Counters are cumulative; alert on
|
||||
their rate and on a backlog that does not drain, not merely on a non-zero total.
|
||||
|
||||
## Pending operations and recovery
|
||||
|
||||
`pendingOperation` contains `operation`, an opaque `id`, `pendingPeers`, and
|
||||
`ackedPeers`. Do not edit the site-replication state object by hand. The marker
|
||||
is the crash-recovery journal and removing it can make a partially applied
|
||||
operation look complete.
|
||||
|
||||
The heavyweight reconciler runs once at startup and every 600 seconds. The
|
||||
lightweight retry drain runs every 30 seconds. A restart is therefore a valid
|
||||
way to cause an immediate heavyweight pass after the underlying fault has been
|
||||
fixed, but it is not a substitute for fixing connectivity, credentials, TLS,
|
||||
or the remote endpoint.
|
||||
|
||||
### `remove`
|
||||
|
||||
The original topology and each peer acknowledgement are persisted before the
|
||||
operation finalizes. While peers remain in `pendingPeers`, restore access to
|
||||
them and wait for reconciliation. If a peer is permanently gone, a new remove
|
||||
request may remove all currently active unacknowledged peers; RustFS permits
|
||||
that request and then finalizes against the remaining topology. Removing the
|
||||
local site or all sites is also an explicit completion path.
|
||||
|
||||
Do not re-add a site merely to hide this marker. First compare the topology on
|
||||
all reachable peers. If the same operation ID makes no progress for more than
|
||||
one heavyweight interval, collect `PeerErrors`, `RetryStats`, and the
|
||||
site-replication logs before retrying the remove.
|
||||
|
||||
### `rotate-svc-acct`
|
||||
|
||||
Service-account rotation keeps the candidate secrets and peer acknowledgements
|
||||
until every current remote peer accepts the rotation. Restore the failing peer
|
||||
and allow the reconciler to resume it. Do not manually delete either candidate
|
||||
credential during this window: doing so can remove the only credential that a
|
||||
not-yet-acknowledged peer accepts.
|
||||
|
||||
After the marker clears, verify `replicate status` from every site, then retire
|
||||
any separately retained old credential material according to local policy.
|
||||
|
||||
### `endpoint-refresh`
|
||||
|
||||
An endpoint, CA, or TLS-verification edit first refreshes the replication
|
||||
target on every active peer and records acknowledgements. On startup and every
|
||||
heavyweight pass, RustFS probes peer capability, uses the endpoint-refresh API
|
||||
when supported (or the legacy peer-edit fallback), refreshes local bucket
|
||||
targets, and commits the edit only after every still-active peer acknowledges.
|
||||
|
||||
If this marker is stuck:
|
||||
|
||||
1. Confirm that the proposed endpoint and CA are correct and reachable from
|
||||
every site, not only from the admin workstation.
|
||||
2. Restore the site-replication service account and TLS trust path.
|
||||
3. Wait for one 600-second pass or restart one healthy node to trigger the
|
||||
startup pass.
|
||||
4. Re-run the identical edit only if the operation remains visible; a different
|
||||
endpoint edit is rejected while the existing refresh is pending. The journal
|
||||
pins the edit's payload, so a re-run without `--replicate-ilm-expiry` keeps
|
||||
the value the first attempt recorded, and a re-run asking for a different
|
||||
value is rejected. Finish or remove the pending refresh before changing it.
|
||||
|
||||
A peer removed from the topology no longer blocks completion. A remove request
|
||||
is accepted when it removes every active unacknowledged peer.
|
||||
|
||||
While this marker is present, control-plane retry replay to the other peers
|
||||
keeps running, but bucket wiring reconciliation waits: it rewrites the same
|
||||
targets the refresh is changing. Expect bucket-level drift on this site to
|
||||
persist until the refresh settles.
|
||||
|
||||
## Outage recovery and convergence time
|
||||
|
||||
Control-plane retry begins on the 30-second drain, while heavyweight snapshots,
|
||||
pending topology operations, and bucket wiring are revisited on the 600-second
|
||||
pass. Object MRF entries are persisted every 10 seconds by default and target
|
||||
health is probed every 5 seconds. These are scheduling bounds, not delivery
|
||||
SLAs: network timeouts and the amount of queued work add to them.
|
||||
|
||||
Objects that must be rediscovered by the scanner have this conservative upper
|
||||
bound before discovery:
|
||||
|
||||
```text
|
||||
RUSTFS_DATA_USAGE_UPDATE_DIR_CYCLES
|
||||
× max(RUSTFS_SCANNER_CYCLE, actual duration of one scanner cycle)
|
||||
```
|
||||
|
||||
The defaults re-descend a compacted directory every 16 cycles. A practical
|
||||
production starting point for a tighter recovery objective is
|
||||
`RUSTFS_DATA_USAGE_UPDATE_DIR_CYCLES=4`; `1` forces re-descent every cycle.
|
||||
Measure the additional disk and metadata load before lowering it further or
|
||||
tuning the scanner cadence. For an immediate operator-driven recovery, start a
|
||||
site resync with `mc admin replicate resync start` and monitor its status.
|
||||
Transfer time after discovery remains proportional to backlog size, bandwidth,
|
||||
worker capacity, and target latency. Use queue depth and the rate of
|
||||
`Metrics.errors` rather than the formula alone to decide whether convergence is
|
||||
progressing.
|
||||
|
||||
## Pairing sites that already contain data
|
||||
|
||||
When more than one requested site is non-empty, preflight considers each bucket
|
||||
name held by more than one site:
|
||||
|
||||
- versioning must be `Enabled` on every site holding the shared bucket;
|
||||
- Object Lock enablement must be identical on every holder.
|
||||
|
||||
A bucket present on only one site is safe: post-add backfill creates it on the
|
||||
other peers. A shared unversioned bucket is rejected because merging can
|
||||
overwrite the only copy of an object. An Object Lock mismatch is rejected
|
||||
because lock enablement cannot be changed after bucket creation and convergence
|
||||
could otherwise strip a WORM guarantee.
|
||||
|
||||
If preflight rejects the pair, keep the authoritative copy, delete the
|
||||
conflicting bucket (or its contents) from all other sites, run `replicate add`
|
||||
again, and then start `replicate resync` from the surviving site. Back up and
|
||||
validate the authoritative data before deleting anything.
|
||||
|
||||
## IAM convergence and repair boundary
|
||||
|
||||
Ordinary IAM changes are delivered to each peer. A successful bulk IAM import
|
||||
also schedules one collapsed full-IAM snapshot per remote peer. A failed IAM
|
||||
deletion is replayed before that snapshot so the snapshot cannot re-create a
|
||||
principal or grant that was already revoked.
|
||||
|
||||
The safety state has two bounds:
|
||||
|
||||
- deletion high-water marks are retained for 30 days;
|
||||
- deletion replay bodies are capped at 256 distinct entities per peer.
|
||||
|
||||
Repeated deletion of the same entity replaces its saved body. When the per-peer
|
||||
cap is exceeded or the body cannot be serialized, the retry entry remains
|
||||
escalated rather than pretending the deletion is replayable. An item from an
|
||||
older sender without a source timestamp cannot install the 30-day high-water
|
||||
mark, so verify it explicitly after a prolonged split. A successful drain
|
||||
clears replay bodies; removing the peer prunes its bodies. For an escalated IAM
|
||||
retry, use the site-replication repair workflow for the affected peer and IAM
|
||||
family, then verify users, service accounts, groups, policies, and mappings on
|
||||
both sides. Repair is the operator's explicit accountability transfer and
|
||||
clears the saved deletion bodies only after the IAM repair succeeds.
|
||||
|
||||
A group's status converges in one direction. An explicit disable is applied
|
||||
everywhere, including through a snapshot, but a membership change never
|
||||
carries an enable - it would otherwise re-enable a group frozen on the
|
||||
receiving site. If a group ended up disabled on one site only, re-enable it
|
||||
there explicitly with `mc admin group enable`; a snapshot or repair will not
|
||||
do it.
|
||||
|
||||
Treat IAM divergence as a security incident: a user deleted on one site can
|
||||
remain usable on an unreachable peer until replay or repair completes. A peer
|
||||
whose IAM entry is escalated does not receive scheduled snapshots either -
|
||||
including the one a bulk import schedules - until the repair settles it.
|
||||
|
||||
## Encrypted objects
|
||||
|
||||
| Source form | Replication behavior | Fail-closed condition |
|
||||
|---|---|---|
|
||||
| SSE-S3 | The source decrypts the object; the request sends only `AES256` intent; the destination encrypts with its own KMS. Source envelope material never leaves the site. | The destination cannot satisfy the encryption request, or the source metadata is incomplete/unsupported. The replica is `FAILED`; plaintext is not silently stored. |
|
||||
| SSE-KMS | The source decrypts the object; the request sends `aws:kms` intent without the source-local key ID; the destination selects its own configured KMS key. | Either side cannot decrypt/encrypt, or the metadata mixes incompatible encryption evidence. |
|
||||
| SSE-C | Stored ciphertext and the required SSE-C replication transport metadata pass through. RustFS verifies target evidence before accepting the replica. | The target does not echo the customer-algorithm evidence, required material/layout is absent, or the metadata is ambiguous. |
|
||||
|
||||
Unknown MinIO/RustFS encryption markers are never forwarded as ordinary user
|
||||
metadata. They fail replication so an operator must migrate or repair the
|
||||
object with a supported format.
|
||||
|
||||
## Rolling upgrades and rollback
|
||||
|
||||
Keep every node in one site on the same version whenever possible. Upgrade all
|
||||
nodes of one site consecutively, verify its startup reconciliation and status,
|
||||
then move to the next site. Do not intentionally leave a site mixed-version:
|
||||
admin requests can land on different nodes, and an older node may not resume a
|
||||
new pending-operation shape or expose its health fields.
|
||||
|
||||
Current state additions are optional and defaulted, so older readers ignore
|
||||
them. The target-version ledger is stored as dual-prefixed internal object
|
||||
metadata and is also ignored by older readers; rollback does not corrupt the
|
||||
object format, but older code loses the assigned-version routing improvement.
|
||||
|
||||
Before rolling back across the fix that retains the data directory of a version
|
||||
awaiting purge replication (rustfs/rustfs#7307), ensure no version purge is
|
||||
pending. Older code can free that retained version's data directory before the
|
||||
remote purge is acknowledged, leaving unreadable metadata and blocking bucket
|
||||
deletion. Drain or repair replication and take a metadata/data backup first.
|
||||
|
||||
## Runtime knobs
|
||||
|
||||
These values are read when the owning background task starts. Restart the
|
||||
server after changing them. The millisecond intervals have a 10 ms floor;
|
||||
invalid values fall back to the default with a warning.
|
||||
|
||||
| Variable | Default | Effect |
|
||||
|---|---:|---|
|
||||
| `RUSTFS_REPL_HEALTH_CHECK_INTERVAL_MS` | `5000` | Remote-target health probe interval. Lowering it increases outbound probes. |
|
||||
| `RUSTFS_REPL_MRF_FLUSH_INTERVAL_MS` | `10000` | Maximum periodic interval between MRF persistence flushes; 1,000 new entries also trigger a flush. |
|
||||
| `RUSTFS_REPL_RESYNC_POLL_MAX_MS` | `60000` | Upper bound for randomized resync retry-poll sleep. |
|
||||
| `RUSTFS_REPL_RESYNC_MAX_JOBS` | `2` | Concurrent resync jobs; values are bounded to `1..=32`. |
|
||||
|
||||
Transport-specific controls and target behavior are documented in
|
||||
[Replication outbound transport](replication-outbound-transport.md). Validate a
|
||||
new destination with [Replication target check](replication-check.md), and read
|
||||
[Replication object size limits](replication-object-size-limits.md) before
|
||||
moving large objects.
|
||||
@@ -8,21 +8,11 @@
|
||||
|
||||
| Method | Config tag | Credential lifetime | Background renewal | Recommended for |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| Static token | `Token` | Whatever the operator provisioned; read from Vault at login | Renewed at half TTL when Vault reports the token as renewable | Development; short-lived experiments |
|
||||
| Static token | `Token` | Whatever the operator provisioned; RustFS never renews it | None | Development; short-lived experiments |
|
||||
| AppRole | `AppRole` | Lease-bound token obtained by login; renewed by RustFS | Renew at half TTL, re-login on failure | Production without a Vault Agent sidecar |
|
||||
| Kubernetes | `Kubernetes` | Lease-bound token obtained by login; renewed by RustFS | Renew at half TTL, re-login on failure | Production on Kubernetes, with no credential to distribute |
|
||||
| Agent token file | `TokenFile` | Owned by Vault Agent; RustFS only re-reads the sink file | File re-read once per poll interval | Production with a Vault Agent (or equivalent) managing auth |
|
||||
|
||||
### Static token: what RustFS now knows about it
|
||||
|
||||
`vault token create` grants a 768-hour TTL by default, so a static token normally *does* expire. At login RustFS calls `auth/token/lookup-self` and adopts whatever Vault reports:
|
||||
|
||||
- **No expiry** (a root or periodic-root token, `ttl` 0): unchanged — no lease is tracked, no renewal task runs, and the token is never refused locally.
|
||||
- **Expiring and renewable:** the ordinary renewal loop takes over, renewing at half the remaining TTL and publishing the remaining-TTL gauge.
|
||||
- **Expiring but not renewable:** a `vault_static_token_not_renewable` warning is logged with the remaining TTL, the gauge is published, and requests fail closed inside the safety window rather than lapsing mid-flight against Vault. Rotate to a fresh token, or move to AppRole, Kubernetes, or an agent-managed token file.
|
||||
|
||||
The probe never fails the login. A token whose policy omits `lookup-self` (Vault's `default` policy grants it), or a Vault that is unreachable at that moment, logs `vault_static_token_lookup_failed` and falls back to the previous behaviour — no lease tracked, no renewal — so a deployment that works today keeps working. That fallback lasts for the life of the client generation, so treat the warning as something to fix rather than tolerate.
|
||||
|
||||
Exactly one method must be configured. Setting `RUSTFS_KMS_VAULT_TOKEN_FILE` together with any other method, or `RUSTFS_KMS_VAULT_KUBERNETES_ROLE` together with `RUSTFS_KMS_VAULT_APPROLE_ROLE_ID`, is rejected at startup with a configuration error because the effective identity would be ambiguous. A leftover `RUSTFS_KMS_VAULT_TOKEN` alongside a configured login method is tolerated and ignored, so a stale variable cannot silently downgrade the identity.
|
||||
|
||||
All of these are read the same way whether the service is started with `RUSTFS_KMS_ENABLE=true` or configured later through `POST /rustfs/admin/v3/kms/configure`.
|
||||
|
||||
@@ -262,33 +262,6 @@ mixed-peer fallback oracles; G09 keeps mixed-version reader, writer, and rollbac
|
||||
payload evidence explicit. These fields are part of the release contract, not
|
||||
evidence by themselves.
|
||||
|
||||
The upgrade compatibility E2E can emit raw G09 JSON artifacts when
|
||||
`RUSTFS_SCANNER_HEAL_G09_EVIDENCE_DIR` points at a fresh, task-owned directory.
|
||||
The rolling mixed-version test writes `G09-mixed_version_reader_evidence.json`
|
||||
and `G09-mixed_version_writer_evidence.json` after the old/new reader and writer
|
||||
assertions pass. The bucket-metadata rollback test writes
|
||||
`G09-rollback_payload_evidence.json` after the current -> previous -> current
|
||||
round trip has read back the known bucket configuration and objects. These
|
||||
artifacts are measured inputs for a later release bundle; the bundle must still
|
||||
record their relative paths, hashes, command provenance, timestamps, roles,
|
||||
participating revisions, and case lists before
|
||||
`--check-scanner-heal-release-bundle` can validate them.
|
||||
|
||||
For a release-candidate or PR-head Linux x86_64 host, run the full raw G09
|
||||
artifact pass with:
|
||||
|
||||
```bash
|
||||
scripts/run_scanner_heal_g09_upgrade_evidence.sh
|
||||
```
|
||||
|
||||
The script mirrors the pinned previous-release asset used by the upgrade
|
||||
workflow, builds the current checkout, runs the mixed-version and rollback E2E
|
||||
lanes, and fails unless all three raw G09 artifacts are measured, revision-bound,
|
||||
and role-bound. Use `--source-binary` for a custom previous-release binary on
|
||||
another platform, or `--test mixed-version|rollback` while narrowing a failure.
|
||||
It performs a free-space preflight before building so a saturated validation
|
||||
host fails before producing partial evidence.
|
||||
|
||||
When the real release lanes have produced their dedicated artifacts, validate
|
||||
the complete hard-gate bundle with:
|
||||
|
||||
@@ -306,12 +279,6 @@ also binds each evidence field to its own run provenance: `source_revision`,
|
||||
`finished_at`, command arguments, and artifact format. The field
|
||||
`source_revision` must match the bundle revision, and measured performance
|
||||
duration cannot exceed the recorded run window.
|
||||
When an evidence or profile artifact declares a JSON format, the checker also
|
||||
opens that artifact and requires its payload to repeat the same measured
|
||||
`source_revision`, `run_id`, `measurement_window_id`, gate and field identity;
|
||||
profile sub-artifacts must additionally name their artifact kind. Updating only
|
||||
the outer bundle hash cannot turn a stale JSON summary into current release
|
||||
evidence.
|
||||
|
||||
The hard evidence shape remains claim-specific: mixed-version gates must name at
|
||||
least two participating versions, crash/durable replay gates must include
|
||||
@@ -321,19 +288,9 @@ measured durations, P3's pressure run needs at least two hours, and P1 needs a
|
||||
symbolized profile summary with resolved samples. Every G14 field and every
|
||||
performance gate's fields must also share one `measurement_window_id`, so EC8+4,
|
||||
multi-set/multi-pool, ABBA, throughput, and profiling artifacts cannot be
|
||||
stitched together from unrelated runs. P1 `profile_evidence` must bind every
|
||||
required profile artifact kind (`allocation-profile`, `flamegraph`,
|
||||
`rss-samples`, and `save-frequency`) with a relative path, artifact format,
|
||||
non-empty file, matching SHA256, and the same measurement window when a
|
||||
per-artifact window is declared. Missing, synthetic, stale, tampered, undersized,
|
||||
or topology-mismatched evidence returns a compact blocked or invalid JSON result
|
||||
and a nonzero exit.
|
||||
|
||||
The scheduler-pressure lane must also carry the numbers needed to close W09,
|
||||
W10, and W11: bounded deferred item/byte/age limits, zero duplicate tasks,
|
||||
pressure pacing engagement, recovery and lock-hold timings, fixed offered load,
|
||||
foreground p95/p99 latency, throughput, error count, attempt-cost samples, and
|
||||
completed heal object counts.
|
||||
stitched together from unrelated runs. Missing, synthetic, stale, tampered,
|
||||
undersized, or topology-mismatched evidence returns a compact blocked or invalid
|
||||
JSON result and a nonzero exit.
|
||||
|
||||
This command validates the evidence package; it does not create evidence. A
|
||||
handwritten JSON file, a synthetic harness pass, a single focused case, or a
|
||||
@@ -343,16 +300,3 @@ crash-restart, durable MRF replay, EC8+4, ABBA, or profiling gates.
|
||||
Run parser/receipt regressions with
|
||||
`scripts/python_bin.sh scripts/check_test_wiring.py --self-test`. Those fixtures
|
||||
validate the checker only and produce no runtime or performance evidence.
|
||||
|
||||
For local bundle-shape dry runs, generate a task-owned fixture directory with:
|
||||
|
||||
```bash
|
||||
scripts/python_bin.sh scripts/check_test_wiring.py \
|
||||
--write-scanner-heal-release-bundle-fixture /path/to/fixture-dir
|
||||
```
|
||||
|
||||
The generated file is marked `fixture_only` and is intentionally rejected by the
|
||||
release bundle checker. Use it to rehearse field names, artifact paths, hashes,
|
||||
profile artifact membership, mixed-version roles, and same-window provenance
|
||||
before copying the shape into a real measured bundle. It is not ABBA, profile,
|
||||
mixed-version, crash-restart, or release approval evidence.
|
||||
|
||||
@@ -77,18 +77,4 @@ cargo nextest run --profile e2e-distributed -p e2e_test -E 'not test(/^distribut
|
||||
|
||||
The upgrade topology is `ClusterTopology::single_pool(4)` (4 nodes × 1 drive). That matches the proven mixed-version fixture in `upgrade_compatibility_test`; 4×4 localhost drives are rejected by the previous release's same-device disk check.
|
||||
|
||||
Scanner/Heal G09 release evidence can be collected on Linux x86_64 with the
|
||||
same pinned previous-release binary used by `e2e-upgrade.yml`:
|
||||
|
||||
```bash
|
||||
scripts/run_scanner_heal_g09_upgrade_evidence.sh
|
||||
```
|
||||
|
||||
The runner builds the current `rustfs` binary, downloads and verifies the
|
||||
pinned previous release, runs the mixed-version rolling-upgrade and rollback
|
||||
tests, and leaves the required raw G09 artifacts under
|
||||
`target/scanner-heal-g09-upgrade-evidence/<timestamp>/`. These artifacts are
|
||||
inputs for the Scanner/Heal release bundle gate; the runner does not mark the
|
||||
full release matrix complete by itself.
|
||||
|
||||
Membership is pinned by `.config/e2e-distributed-selection.txt`. Update the Linux and Darwin entries with `python3 ./scripts/check_test_wiring.py --update-profile e2e-distributed <listing.json> <platform>` after adding or renaming a case.
|
||||
|
||||
+1
-1
@@ -160,7 +160,7 @@ behavior.
|
||||
| config.rustfs.kms.vault.vault_backend | string | `""`| The vault backend, `vault-kv2` or `vault-transit`. |
|
||||
| config.rustfs.kms.vault.vault_address | string | `""`| The vault address. |
|
||||
| config.rustfs.kms.vault.vault_token | string | `""`| The vault token. Rendered into a dedicated Secret (`<fullname>-kms-secret`), never into the ConfigMap. |
|
||||
| config.rustfs.kms.vault.vault_mount_path | string | `"transit"`| The vault mount path. Rendered as `RUSTFS_KMS_VAULT_MOUNT_PATH` for `vault-transit`, and as `RUSTFS_KMS_VAULT_KV_MOUNT` for `vault-kv2` (only when set; unset keeps the `secret` default). |
|
||||
| config.rustfs.kms.vault.vault_mount_path | string | `"transit"`| The vault mount path, only works if `vault_backend` equals `vault-transit` . |
|
||||
| config.rustfs.kms.vault.default_key | string | `"transit"`| The master key id for RustFS. |
|
||||
| extraEnv | list | `[]` | Extra environment variables for the RustFS container. An explicit `RUSTFS_LOCAL_ENDPOINT_HOST` or `RUSTFS_VOLUMES`, or a bounded, dynamic, or unrecognized startup mode, disables generated anchor injection. `POD_NAME` and `RUSTFS_ADDRESS` remain independent overrides. |
|
||||
| extraVolumes | list | `[]` | Extra volumes to add to the pod spec. Supported in both standalone (Deployment) and distributed (StatefulSet) modes. |
|
||||
|
||||
@@ -23,7 +23,6 @@ use crate::admin::runtime_sources::{
|
||||
current_or_init_kms_runtime_service_manager,
|
||||
};
|
||||
use crate::admin::storage_api::config::{read_admin_config, save_admin_config};
|
||||
use crate::admin::storage_api::ecstore_topology::is_dist_erasure;
|
||||
use crate::admin::storage_api::error::StorageError;
|
||||
use crate::admin::storage_api::runtime::ECStore;
|
||||
use crate::admin::storage_api::s3::{S3ErrorCode, error as admin_s3_error};
|
||||
@@ -508,21 +507,6 @@ pub async fn reload_persisted_kms_config() -> Result<(), String> {
|
||||
reload_persisted_kms_config_from_store(store, kms_service_manager_from_context(), "peer_reload").await
|
||||
}
|
||||
|
||||
/// Whether a reload may return early because this node is already serving
|
||||
/// exactly the persisted configuration.
|
||||
///
|
||||
/// Byte-identical configuration is not sufficient on its own. A node whose KMS
|
||||
/// failed to start keeps its configuration and sits in `Error`, so comparing
|
||||
/// only the bytes turned the documented recovery call
|
||||
/// (`POST /rustfs/admin/v3/kms/reload`) into a no-op that reported success and
|
||||
/// left the node down — including on every peer, which reaches this same
|
||||
/// function through the reload broadcast (backlog#2369 P1). Any state other
|
||||
/// than `Running` falls through to `reconfigure`, which starts the service when
|
||||
/// none is running.
|
||||
fn kms_reload_is_already_current(status: rustfs_kms::KmsServiceStatus, config_is_unchanged: bool) -> bool {
|
||||
matches!(status, rustfs_kms::KmsServiceStatus::Running) && config_is_unchanged
|
||||
}
|
||||
|
||||
async fn reload_persisted_kms_config_from_store(
|
||||
store: Arc<ECStore>,
|
||||
service_manager: Arc<rustfs_kms::KmsServiceManager>,
|
||||
@@ -541,11 +525,11 @@ async fn reload_persisted_kms_config_from_store(
|
||||
return Err("no persisted KMS configuration is available".to_string());
|
||||
};
|
||||
|
||||
let config_is_unchanged = service_manager
|
||||
if service_manager
|
||||
.get_config()
|
||||
.await
|
||||
.is_some_and(|current| kms_config_is_unchanged(¤t, &config));
|
||||
if kms_reload_is_already_current(service_manager.get_status().await, config_is_unchanged) {
|
||||
.is_some_and(|current| kms_config_is_unchanged(¤t, &config))
|
||||
{
|
||||
info!(
|
||||
event = "kms_service_state",
|
||||
component = LOG_COMPONENT_ADMIN,
|
||||
@@ -640,51 +624,6 @@ fn local_success_with_peer_report(message: &str, unconverged: &[String]) -> (boo
|
||||
)
|
||||
}
|
||||
|
||||
/// What a node-local KMS backend means for a multi-node deployment
|
||||
/// (backlog#2369 P7.4).
|
||||
///
|
||||
/// The Local backend keeps key material on each node's own disk and generates
|
||||
/// its KDF salt per node, so two nodes derive different keys from the same
|
||||
/// `master_key`. An object encrypted on node A cannot be decrypted on node B:
|
||||
/// behind a load balancer that shows up as intermittent 500s on reads that
|
||||
/// worked a moment earlier. The product decision to warn rather than refuse
|
||||
/// stands; the generic "development only" warning simply never said what
|
||||
/// actually goes wrong, so an operator had no way to connect the symptom to
|
||||
/// the cause.
|
||||
///
|
||||
/// Returns the sentence to append to the configure response, or `None` when the
|
||||
/// combination does not apply.
|
||||
async fn node_local_backend_warning(backend: &rustfs_kms::KmsBackend) -> Option<&'static str> {
|
||||
if !matches!(backend, rustfs_kms::KmsBackend::Local) || !is_dist_erasure().await {
|
||||
return None;
|
||||
}
|
||||
|
||||
warn!(
|
||||
component = LOG_COMPONENT_ADMIN,
|
||||
subsystem = LOG_SUBSYSTEM_KMS,
|
||||
event = "kms_node_local_backend_in_distributed_deployment",
|
||||
backend = rustfs_kms::KmsBackend::Local.as_str(),
|
||||
"The Local KMS backend stores key material on each node's own disk with a per-node salt, so objects \
|
||||
encrypted on one node cannot be decrypted on another. In a distributed deployment this surfaces as \
|
||||
intermittent 500s on reads behind a load balancer. Use Vault Transit, Vault KV2 or AWS KMS for a \
|
||||
multi-node deployment"
|
||||
);
|
||||
|
||||
Some(
|
||||
"Warning: the Local KMS backend is node-local. Key material and its salt live on each node's own disk, so \
|
||||
objects encrypted on one node cannot be decrypted on another and reads behind a load balancer will fail \
|
||||
intermittently. Use Vault Transit, Vault KV2 or AWS KMS for a distributed deployment",
|
||||
)
|
||||
}
|
||||
|
||||
/// Append the node-local backend warning to a successful configure message.
|
||||
fn with_node_local_backend_warning(message: String, warning: Option<&'static str>) -> String {
|
||||
match warning {
|
||||
Some(warning) => format!("{message}. {warning}"),
|
||||
None => message,
|
||||
}
|
||||
}
|
||||
|
||||
pub fn register_kms_dynamic_route(r: &mut S3Router<AdminOperation>) -> std::io::Result<()> {
|
||||
r.insert(
|
||||
Method::POST,
|
||||
@@ -807,7 +746,6 @@ impl Operation for ConfigureKmsHandler {
|
||||
let kms_config = configure_request.to_kms_config();
|
||||
|
||||
let persisted_config = kms_config.clone();
|
||||
let node_local_warning = node_local_backend_warning(&kms_config.backend).await;
|
||||
let (success, message, status) = match service_manager
|
||||
.configure_with_persistence(kms_config, || async move {
|
||||
save_kms_config(&persisted_config)
|
||||
@@ -830,7 +768,7 @@ impl Operation for ConfigureKmsHandler {
|
||||
let unconverged = broadcast_kms_config_reload().await;
|
||||
let (success, message) = local_success_with_peer_report("KMS configured successfully", &unconverged);
|
||||
audit.finish(KmsAdminOperation::Configure, None, None);
|
||||
(success, with_node_local_backend_warning(message, node_local_warning), status)
|
||||
(success, message, status)
|
||||
}
|
||||
Err(e) => {
|
||||
let error_msg = format!("Failed to configure KMS: {e}");
|
||||
@@ -1407,7 +1345,6 @@ impl Operation for ReconfigureKmsHandler {
|
||||
let kms_config = configure_request.to_kms_config();
|
||||
|
||||
let persisted_config = kms_config.clone();
|
||||
let node_local_warning = node_local_backend_warning(&kms_config.backend).await;
|
||||
let (success, message, status) = match service_manager
|
||||
.reconfigure_with_persistence(kms_config, || async move {
|
||||
save_kms_config(&persisted_config)
|
||||
@@ -1431,7 +1368,7 @@ impl Operation for ReconfigureKmsHandler {
|
||||
let (success, message) =
|
||||
local_success_with_peer_report("KMS reconfigured and restarted successfully", &unconverged);
|
||||
audit.finish(KmsAdminOperation::Reconfigure, None, None);
|
||||
(success, with_node_local_backend_warning(message, node_local_warning), status)
|
||||
(success, message, status)
|
||||
}
|
||||
Err(e) => {
|
||||
let error_msg = format!("Failed to reconfigure KMS: {e}");
|
||||
@@ -1483,10 +1420,9 @@ impl Operation for ReconfigureKmsHandler {
|
||||
mod tests {
|
||||
use super::{
|
||||
KmsConfigLoadError, decode_persisted_kms_config, ensure_kms_config_persistable, ensure_kms_request_persistable,
|
||||
kms_config_fingerprint, kms_config_is_unchanged, kms_configure_actions, kms_reload_is_already_current,
|
||||
kms_service_control_actions, load_kms_config_with, local_success_with_peer_report, normalize_configure_request_secrets,
|
||||
open_persisted_kms_config, redacted_canonical_config, register_kms_dynamic_route, seal_persisted_kms_config,
|
||||
with_node_local_backend_warning,
|
||||
kms_config_fingerprint, kms_config_is_unchanged, kms_configure_actions, kms_service_control_actions,
|
||||
load_kms_config_with, local_success_with_peer_report, normalize_configure_request_secrets, open_persisted_kms_config,
|
||||
redacted_canonical_config, register_kms_dynamic_route, seal_persisted_kms_config,
|
||||
};
|
||||
use crate::admin::router::{AdminOperation, S3Router};
|
||||
use crate::admin::storage_api::error::StorageError;
|
||||
@@ -1496,49 +1432,6 @@ mod tests {
|
||||
use std::path::PathBuf;
|
||||
use tempfile::TempDir;
|
||||
|
||||
/// backlog#2369 P1: a node whose KMS failed to start keeps its persisted
|
||||
/// configuration, so an unchanged-bytes comparison made the documented
|
||||
/// recovery call a no-op that still reported success.
|
||||
#[test]
|
||||
fn kms_reload_only_short_circuits_for_a_running_service() {
|
||||
use rustfs_kms::KmsServiceStatus;
|
||||
|
||||
assert!(
|
||||
kms_reload_is_already_current(KmsServiceStatus::Running, true),
|
||||
"a running service on identical configuration has nothing to apply"
|
||||
);
|
||||
assert!(
|
||||
!kms_reload_is_already_current(KmsServiceStatus::Running, false),
|
||||
"changed configuration must always be applied"
|
||||
);
|
||||
|
||||
for status in [
|
||||
KmsServiceStatus::NotConfigured,
|
||||
KmsServiceStatus::Configured,
|
||||
KmsServiceStatus::Error("vault unreachable at startup".to_string()),
|
||||
] {
|
||||
assert!(
|
||||
!kms_reload_is_already_current(status.clone(), true),
|
||||
"reload must reconfigure instead of reporting success from {status:?}"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
/// backlog#2369 P7.4: the operator has to learn the consequence from the
|
||||
/// response, not just from a log line the configuring client never sees.
|
||||
#[test]
|
||||
fn a_node_local_backend_warning_reaches_the_configure_response() {
|
||||
let plain = with_node_local_backend_warning("KMS configured successfully".to_string(), None);
|
||||
assert_eq!(plain, "KMS configured successfully");
|
||||
|
||||
let warned = with_node_local_backend_warning(
|
||||
"KMS configured successfully".to_string(),
|
||||
Some("Warning: the Local KMS backend is node-local"),
|
||||
);
|
||||
assert!(warned.starts_with("KMS configured successfully."), "{warned}");
|
||||
assert!(warned.contains("node-local"), "{warned}");
|
||||
}
|
||||
|
||||
fn assert_has_action(actions: &[Action], action: Action) {
|
||||
assert!(actions.contains(&action), "expected action list to contain {action:?}");
|
||||
}
|
||||
|
||||
@@ -627,32 +627,6 @@ pub(crate) async fn cluster_replication_stats(bucket: &str, context: Option<Arc<
|
||||
.await
|
||||
}
|
||||
|
||||
/// Reload the bucket's metadata on every peer so a follow-up
|
||||
/// `put-bucket-replication` on another node does not read a stale target.
|
||||
///
|
||||
/// Best effort, like every S3 bucket-config write path
|
||||
/// (`app::bucket_usecase::notify_bucket_metadata_reload`): the target is
|
||||
/// already persisted and live on this node, and the 15-minute refresh closes
|
||||
/// the gap, so a peer that cannot be reached must not turn a completed write
|
||||
/// into a failed request.
|
||||
async fn notify_remote_target_metadata_reload(bucket: &str, context: Option<Arc<AppContext>>, action: &'static str) {
|
||||
let Some(notification_system) = current_notification_system_for_context(context.as_deref()) else {
|
||||
return;
|
||||
};
|
||||
if let Err(err) = notification_system.load_bucket_metadata(bucket).await {
|
||||
warn!(
|
||||
event = EVENT_ADMIN_REMOTE_TARGET_STATE,
|
||||
component = LOG_COMPONENT_ADMIN,
|
||||
subsystem = LOG_SUBSYSTEM_REPLICATION,
|
||||
action = action,
|
||||
result = "peer_metadata_reload_failed",
|
||||
bucket = %bucket,
|
||||
error = ?err,
|
||||
"admin remote target state"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
fn unique_replication_peers(peer_clients: &[Option<PeerRestClient>]) -> (Vec<&PeerRestClient>, u32) {
|
||||
let mut seen_grid_hosts = HashSet::new();
|
||||
let peers: Vec<_> = peer_clients
|
||||
@@ -725,7 +699,6 @@ pub struct SetRemoteTargetHandler {}
|
||||
impl Operation for SetRemoteTargetHandler {
|
||||
async fn call(&self, req: S3Request<Body>, _params: Params<'_, '_>) -> S3Result<S3Response<(StatusCode, Body)>> {
|
||||
let cred = validate_replication_admin_request(&req, AdminAction::SetBucketTargetAction).await?;
|
||||
let app_context = app_context_from_req(&req);
|
||||
|
||||
let queries = extract_query_params(&req.uri);
|
||||
|
||||
@@ -953,8 +926,6 @@ impl Operation for SetRemoteTargetHandler {
|
||||
.map_err(map_bucket_target_error)?;
|
||||
let _targets_guard = lock_bucket_targets_metadata(bucket).await;
|
||||
let arn = persist_remote_target_write(bucket, remote_target, incarnation, mode).await?;
|
||||
drop(_targets_guard);
|
||||
notify_remote_target_metadata_reload(bucket, app_context, "set_remote_target").await;
|
||||
let arn_str = serde_json::to_string(&arn)
|
||||
.map_err(|_| S3Error::with_message(S3ErrorCode::InternalError, "Failed to serialize target ARN"))?;
|
||||
|
||||
@@ -1035,7 +1006,6 @@ pub struct RemoveRemoteTargetHandler {}
|
||||
impl Operation for RemoveRemoteTargetHandler {
|
||||
async fn call(&self, req: S3Request<Body>, _params: Params<'_, '_>) -> S3Result<S3Response<(StatusCode, Body)>> {
|
||||
validate_replication_admin_request(&req, AdminAction::SetBucketTargetAction).await?;
|
||||
let app_context = app_context_from_req(&req);
|
||||
|
||||
debug!("remove remote target called");
|
||||
let queries = extract_query_params(&req.uri);
|
||||
@@ -1111,7 +1081,6 @@ impl Operation for RemoveRemoteTargetHandler {
|
||||
}
|
||||
let json_targets = serde_json::to_vec(&targets)
|
||||
.map_err(|_| S3Error::with_message(S3ErrorCode::InternalError, "Failed to serialize targets"))?;
|
||||
let notification_bucket = bucket.clone();
|
||||
let bucket = bucket.clone();
|
||||
let arn = arn_str.clone();
|
||||
// The pool cancellation owns a detached task. Both outer guards must
|
||||
@@ -1132,8 +1101,6 @@ impl Operation for RemoveRemoteTargetHandler {
|
||||
S3Error::with_message(S3ErrorCode::InternalError, format!("remote target removal task failed: {error}"))
|
||||
})??;
|
||||
|
||||
notify_remote_target_metadata_reload(¬ification_bucket, app_context, "remove_remote_target").await;
|
||||
|
||||
Ok(S3Response::new((StatusCode::NO_CONTENT, Body::from("".to_string()))))
|
||||
}
|
||||
}
|
||||
@@ -1820,25 +1787,6 @@ mod tests {
|
||||
pairs.iter().map(|(k, v)| (k.to_string(), v.to_string())).collect()
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn remote_target_writes_notify_peer_metadata_caches() {
|
||||
let source = include_str!("replication.rs");
|
||||
for (start, end) in [
|
||||
("impl Operation for SetRemoteTargetHandler", "pub struct ListRemoteTargetHandler"),
|
||||
("impl Operation for RemoveRemoteTargetHandler", "async fn cancel_active_resync_intent"),
|
||||
] {
|
||||
let body = source
|
||||
.split(start)
|
||||
.nth(1)
|
||||
.and_then(|rest| rest.split(end).next())
|
||||
.expect(start);
|
||||
assert!(
|
||||
body.contains("notify_remote_target_metadata_reload"),
|
||||
"{start} must notify every node before returning success"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn update_ops_parse_minio_query_contract() {
|
||||
let ops = parse_remote_target_update_ops(&query_map(&[
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1318,24 +1318,6 @@ impl Operation for ImportIam {
|
||||
failed,
|
||||
};
|
||||
|
||||
// The entities are already imported locally. A snapshot that cannot be
|
||||
// scheduled is a convergence delay the reconcile pass still closes, so
|
||||
// it must not turn a completed import into a failed request - the same
|
||||
// best-effort contract every other site-replication hook here follows.
|
||||
if let Err(err) =
|
||||
crate::site_replication::enqueue_site_replication_iam_snapshot("iam import scheduled a full snapshot").await
|
||||
{
|
||||
warn!(
|
||||
component = LOG_COMPONENT_ADMIN,
|
||||
subsystem = LOG_SUBSYSTEM_USER,
|
||||
event = EVENT_ADMIN_USER_STATE,
|
||||
action = "import_iam",
|
||||
result = "site_replication_snapshot_not_scheduled",
|
||||
error = ?err,
|
||||
"admin user state"
|
||||
);
|
||||
}
|
||||
|
||||
let body = serde_json::to_vec(&ret).map_err(|e| S3Error::with_message(S3ErrorCode::InternalError, e.to_string()))?;
|
||||
|
||||
let mut header = HeaderMap::new();
|
||||
@@ -1442,16 +1424,6 @@ mod tests {
|
||||
assert!(include_str!("user.rs").contains(mapper_call));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn import_iam_enqueues_a_site_replication_snapshot() {
|
||||
let body = source_block(include_str!("user.rs"), "impl Operation for ImportIam");
|
||||
|
||||
assert!(
|
||||
body.contains("enqueue_site_replication_iam_snapshot"),
|
||||
"a successful IAM import must schedule a full IAM snapshot for every remote site"
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_should_check_deny_only_for_regular_self_request() {
|
||||
let cred = Credentials {
|
||||
|
||||
@@ -409,26 +409,6 @@ fn transfer_summaries(stats: &InternalReplicationStats) -> (XferSummaryWire, Tar
|
||||
(summary, per_target)
|
||||
}
|
||||
|
||||
/// Node-level failure counters for `errors`. The sibling `retries` field
|
||||
/// stays zero on purpose: it means redeliveries in the minio-go shape, and a
|
||||
/// failed object is not retried by an event today (it waits for the scanner's
|
||||
/// heal pass), so reporting failures there would claim a redelivery that
|
||||
/// never happened.
|
||||
fn failure_counters(stats: &InternalReplicationStats) -> CounterSummaryWire {
|
||||
let (total, last1m, last1hr) = stats.stats.values().fold((0i64, 0i64, 0i64), |acc, stat| {
|
||||
(
|
||||
acc.0.saturating_add(stat.fail_stats.count),
|
||||
acc.1.saturating_add(stat.fail_stats.last_minute.count),
|
||||
acc.2.saturating_add(stat.fail_stats.last_hour.count),
|
||||
)
|
||||
});
|
||||
CounterSummaryWire {
|
||||
total: u64::try_from(total.max(0)).unwrap_or_default(),
|
||||
last1m: u64::try_from(last1m.max(0)).unwrap_or_default(),
|
||||
last1hr: u64::try_from(last1hr.max(0)).unwrap_or_default(),
|
||||
}
|
||||
}
|
||||
|
||||
impl MetricsV2Wire {
|
||||
/// Project the aggregated internal stats onto the `MetricsV2` shape.
|
||||
///
|
||||
@@ -438,7 +418,6 @@ impl MetricsV2Wire {
|
||||
/// `queueStats.nodes` and treats an empty list as "no data".
|
||||
pub(crate) fn from_stats(bucket_stats: &BucketStats, node_name: &str) -> Self {
|
||||
let (xfer_stats, tgt_xfer_stats) = transfer_summaries(&bucket_stats.replication_stats);
|
||||
let failed = failure_counters(&bucket_stats.replication_stats);
|
||||
let mut nodes: Vec<ReplQNodeStatsWire> = bucket_stats
|
||||
.queue_stats
|
||||
.nodes
|
||||
@@ -457,7 +436,6 @@ impl MetricsV2Wire {
|
||||
q_stats: InQueueMetricWire::from(&bucket_stats.replication_stats.q_stat),
|
||||
xfer_stats: xfer_stats.clone(),
|
||||
tgt_xfer_stats: tgt_xfer_stats.clone(),
|
||||
errors: failed,
|
||||
..Default::default()
|
||||
});
|
||||
} else {
|
||||
@@ -466,7 +444,6 @@ impl MetricsV2Wire {
|
||||
if let Some(first) = nodes.first_mut() {
|
||||
first.xfer_stats = xfer_stats.clone();
|
||||
first.tgt_xfer_stats = tgt_xfer_stats.clone();
|
||||
first.errors = failed;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -501,12 +478,6 @@ mod tests {
|
||||
target.replicated_size = 4096;
|
||||
target.failed.count = 3;
|
||||
target.failed.size = 900;
|
||||
target.fail_stats.count = 3;
|
||||
target.fail_stats.size = 900;
|
||||
target.fail_stats.last_minute.count = 2;
|
||||
target.fail_stats.last_minute.size = 600;
|
||||
target.fail_stats.last_hour.count = 3;
|
||||
target.fail_stats.last_hour.size = 900;
|
||||
target.bandwidth_limit_bytes_per_sec = 1024;
|
||||
target.current_bandwidth_bytes_per_sec = 512.5;
|
||||
stats
|
||||
@@ -566,10 +537,6 @@ mod tests {
|
||||
assert_eq!(node["queueStats"]["peak"], node["queueStats"]["max"]);
|
||||
assert!(node["activeWorkers"].get("curr").is_some());
|
||||
assert!(node["transferSummary"].get("Total").is_some());
|
||||
assert_eq!(node["errors"]["total"], 3);
|
||||
assert_eq!(node["errors"]["last1m"], 2);
|
||||
assert_eq!(node["errors"]["last1hr"], 3);
|
||||
assert_eq!(node["retries"]["total"], 0, "failures are not redeliveries; retries must not claim one");
|
||||
assert_eq!(json["downtimeInfo"], serde_json::json!({}));
|
||||
}
|
||||
|
||||
|
||||
@@ -41,12 +41,6 @@ pub(crate) mod ecstore_cluster {
|
||||
};
|
||||
}
|
||||
|
||||
/// Deployment topology. The KMS configure path needs it to tell an operator
|
||||
/// that a node-local backend cannot serve a multi-node deployment.
|
||||
pub(crate) mod ecstore_topology {
|
||||
pub(crate) use crate::storage::storage_api::is_dist_erasure;
|
||||
}
|
||||
|
||||
mod ecstore_config {
|
||||
pub(crate) use crate::storage::storage_api::ecstore_config::{com, init, storageclass};
|
||||
}
|
||||
|
||||
@@ -1389,10 +1389,7 @@ impl DefaultBucketUsecase {
|
||||
counter!("rustfs_create_bucket_total").increment(1);
|
||||
let result = Ok(S3Response::new(output));
|
||||
let _ = helper.complete(&result);
|
||||
rustfs_scanner::record_dirty_usage_bucket_from_producer(
|
||||
&bucket,
|
||||
rustfs_scanner::SegmentInvalidationProducerIdentity::BucketMetadata,
|
||||
);
|
||||
rustfs_scanner::record_dirty_usage_bucket(&bucket);
|
||||
result
|
||||
}
|
||||
|
||||
@@ -1784,10 +1781,7 @@ impl DefaultBucketUsecase {
|
||||
warn!(bucket = %bucket, error = ?err, "site replication bucket tagging delete hook failed");
|
||||
}
|
||||
|
||||
rustfs_scanner::record_dirty_usage_bucket_from_producer(
|
||||
&bucket,
|
||||
rustfs_scanner::SegmentInvalidationProducerIdentity::BucketMetadata,
|
||||
);
|
||||
rustfs_scanner::record_dirty_usage_bucket(&bucket);
|
||||
Ok(S3Response::new(DeleteBucketTaggingOutput {}))
|
||||
}
|
||||
|
||||
@@ -2704,10 +2698,7 @@ impl DefaultBucketUsecase {
|
||||
warn!(bucket = %bucket, error = ?err, "site replication bucket tagging hook failed");
|
||||
}
|
||||
|
||||
rustfs_scanner::record_dirty_usage_bucket_from_producer(
|
||||
&bucket,
|
||||
rustfs_scanner::SegmentInvalidationProducerIdentity::BucketMetadata,
|
||||
);
|
||||
rustfs_scanner::record_dirty_usage_bucket(&bucket);
|
||||
Ok(S3Response::new(PutBucketTaggingOutput::default()))
|
||||
}
|
||||
|
||||
@@ -2742,10 +2733,7 @@ impl DefaultBucketUsecase {
|
||||
warn!(bucket = %bucket, error = ?err, "site replication bucket versioning hook failed");
|
||||
}
|
||||
|
||||
rustfs_scanner::record_dirty_usage_bucket_from_producer(
|
||||
&bucket,
|
||||
rustfs_scanner::SegmentInvalidationProducerIdentity::BucketMetadata,
|
||||
);
|
||||
rustfs_scanner::record_dirty_usage_bucket(&bucket);
|
||||
Ok(S3Response::new(PutBucketVersioningOutput {}))
|
||||
}
|
||||
|
||||
|
||||
@@ -532,11 +532,7 @@ impl DefaultMultipartUsecase {
|
||||
.await
|
||||
{
|
||||
Ok(_) => {
|
||||
rustfs_scanner::record_dirty_usage_object_from_producer(
|
||||
&bucket,
|
||||
&key,
|
||||
rustfs_scanner::SegmentInvalidationProducerIdentity::AbortMultipartUpload,
|
||||
);
|
||||
rustfs_scanner::record_dirty_usage_object(&bucket, &key);
|
||||
Ok(S3Response::new(AbortMultipartUploadOutput { ..Default::default() }))
|
||||
}
|
||||
Err(err) => {
|
||||
@@ -806,11 +802,7 @@ impl DefaultMultipartUsecase {
|
||||
schedule_object_replication(obj_info.clone(), store, completion_replication_decision).await;
|
||||
}
|
||||
|
||||
rustfs_scanner::record_dirty_usage_object_from_producer(
|
||||
&bucket,
|
||||
&key,
|
||||
rustfs_scanner::SegmentInvalidationProducerIdentity::CompleteMultipartUpload,
|
||||
);
|
||||
rustfs_scanner::record_dirty_usage_bucket(&bucket);
|
||||
Ok::<_, S3Error>(obj_info)
|
||||
}
|
||||
});
|
||||
|
||||
@@ -797,18 +797,6 @@ impl DefaultObjectUsecase {
|
||||
let resp_elements =
|
||||
build_event_resp_elements(&S3Response::new(DeleteObjectsOutput::default()), &request_context.request_id);
|
||||
let deleted_any = delete_results.iter().any(|result| result.delete_object.is_some());
|
||||
let delete_producers = delete_results
|
||||
.iter()
|
||||
.filter_map(|result| {
|
||||
result.delete_object.as_ref().map(|deleted_object| {
|
||||
if deleted_object.delete_marker && result.requested_version_id.is_none() {
|
||||
rustfs_scanner::SegmentInvalidationProducerIdentity::DeleteMarker
|
||||
} else {
|
||||
rustfs_scanner::SegmentInvalidationProducerIdentity::DeleteObject
|
||||
}
|
||||
})
|
||||
})
|
||||
.collect::<Vec<_>>();
|
||||
let notify_bucket = bucket.clone();
|
||||
spawn_background_with_context(Some(request_context), async move {
|
||||
let _activity_guard = DeleteTailActivityGuard::new(DeleteTailStage::Notify);
|
||||
@@ -850,7 +838,7 @@ impl DefaultObjectUsecase {
|
||||
let result = Ok(S3Response::new(output));
|
||||
let _ = helper.complete(&result);
|
||||
if deleted_any {
|
||||
rustfs_scanner::record_dirty_usage_bucket_from_producers(&bucket, delete_producers);
|
||||
rustfs_scanner::record_dirty_usage_bucket(&bucket);
|
||||
}
|
||||
// Record write operation for capacity management (inline to avoid per-request tokio::spawn overhead)
|
||||
let manager = get_capacity_manager();
|
||||
@@ -1113,10 +1101,7 @@ impl DefaultObjectUsecase {
|
||||
let manager = get_capacity_manager();
|
||||
manager.record_write_operation().await;
|
||||
let _ = helper.complete(&result);
|
||||
rustfs_scanner::record_dirty_usage_bucket_from_producer(
|
||||
&bucket,
|
||||
rustfs_scanner::SegmentInvalidationProducerIdentity::DeleteObject,
|
||||
);
|
||||
rustfs_scanner::record_dirty_usage_bucket(&bucket);
|
||||
return result;
|
||||
}
|
||||
|
||||
|
||||
@@ -627,7 +627,6 @@ struct ExtractPreparedMember<R = ExtractStagedBody> {
|
||||
write_plan: WritePlan,
|
||||
opts: ObjectOptions,
|
||||
replication: ReplicateDecision,
|
||||
producer_identity: rustfs_scanner::SegmentInvalidationProducerIdentity,
|
||||
staging_permit: OwnedSemaphorePermit,
|
||||
member_permit: OwnedSemaphorePermit,
|
||||
}
|
||||
@@ -766,7 +765,6 @@ where
|
||||
write_plan,
|
||||
opts,
|
||||
replication,
|
||||
producer_identity,
|
||||
staging_permit,
|
||||
member_permit,
|
||||
} = member;
|
||||
@@ -795,7 +793,7 @@ where
|
||||
// the scanner before its post-store awaits, then retains the lifecycle slot
|
||||
// through quota, cache, replication, and event construction.
|
||||
if !context.wrote_any_entry.swap(true, Ordering::AcqRel) {
|
||||
rustfs_scanner::record_dirty_usage_bucket_from_producer(&context.bucket, producer_identity);
|
||||
rustfs_scanner::record_dirty_usage_bucket(&context.bucket);
|
||||
}
|
||||
let success =
|
||||
complete_extract_member_post_commit(context, key, opts, replication, obj_info, backfilled_old_current_size).await;
|
||||
@@ -2044,7 +2042,7 @@ impl DefaultObjectUsecase {
|
||||
bucket_sse_config.as_ref().map(|(config, _timestamp)| config),
|
||||
original_sse,
|
||||
ssekms_key_id,
|
||||
sse_customer_algorithm.is_some() || sse_customer_key.is_some() || sse_customer_key_md5.is_some(),
|
||||
false,
|
||||
);
|
||||
if effective_sse
|
||||
.as_ref()
|
||||
@@ -2605,7 +2603,6 @@ impl DefaultObjectUsecase {
|
||||
write_plan,
|
||||
opts,
|
||||
replication,
|
||||
producer_identity: rustfs_scanner::SegmentInvalidationProducerIdentity::DirectoryObject,
|
||||
staging_permit,
|
||||
member_permit,
|
||||
},
|
||||
@@ -2630,7 +2627,6 @@ impl DefaultObjectUsecase {
|
||||
write_plan,
|
||||
opts,
|
||||
replication,
|
||||
producer_identity: rustfs_scanner::SegmentInvalidationProducerIdentity::PutObject,
|
||||
staging_permit,
|
||||
member_permit,
|
||||
},
|
||||
@@ -2660,11 +2656,6 @@ impl DefaultObjectUsecase {
|
||||
write_plan,
|
||||
opts,
|
||||
replication,
|
||||
producer_identity: if is_dir {
|
||||
rustfs_scanner::SegmentInvalidationProducerIdentity::DirectoryObject
|
||||
} else {
|
||||
rustfs_scanner::SegmentInvalidationProducerIdentity::PutObject
|
||||
},
|
||||
staging_permit,
|
||||
member_permit,
|
||||
});
|
||||
|
||||
@@ -733,11 +733,7 @@ impl DefaultObjectUsecase {
|
||||
)
|
||||
.await
|
||||
.map_err(ApiError::from)?;
|
||||
rustfs_scanner::record_dirty_usage_object_from_producer(
|
||||
bucket,
|
||||
key,
|
||||
rustfs_scanner::SegmentInvalidationProducerIdentity::AbortMultipartUpload,
|
||||
);
|
||||
rustfs_scanner::record_dirty_usage_bucket(bucket);
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1515,7 +1515,7 @@ impl DefaultObjectUsecase {
|
||||
bucket_sse_config.as_ref().map(|(config, _timestamp)| config),
|
||||
server_side_encryption,
|
||||
ssekms_key_id,
|
||||
sse_customer_algorithm.is_some() || sse_customer_key.is_some() || sse_customer_key_md5.is_some(),
|
||||
false,
|
||||
);
|
||||
debug!(
|
||||
target: "rustfs::app::object_usecase",
|
||||
@@ -3524,104 +3524,6 @@ mod tests {
|
||||
);
|
||||
}
|
||||
|
||||
async fn install_bucket_default_sse_for_test(bucket: &str, algorithm: &'static str, kms_key_id: Option<&str>) {
|
||||
use crate::app::storage_api::test::bucket::utils::serialize;
|
||||
use crate::app::storage_api::test::{get_global_bucket_metadata_sys, set_bucket_metadata};
|
||||
|
||||
let sys = get_global_bucket_metadata_sys().expect("bucket metadata system");
|
||||
let metadata = {
|
||||
let sys = sys.read().await;
|
||||
sys.get(bucket).await.expect("bucket metadata cached")
|
||||
};
|
||||
let mut metadata = (*metadata).clone();
|
||||
let config = ServerSideEncryptionConfiguration {
|
||||
rules: vec![ServerSideEncryptionRule {
|
||||
apply_server_side_encryption_by_default: Some(ServerSideEncryptionByDefault {
|
||||
sse_algorithm: ServerSideEncryption::from_static(algorithm),
|
||||
kms_master_key_id: kms_key_id.map(|id| id.to_string()),
|
||||
}),
|
||||
blocked_encryption_types: None,
|
||||
bucket_key_enabled: None,
|
||||
}],
|
||||
};
|
||||
metadata.encryption_config_xml = serialize(&config).expect("sse config serializes");
|
||||
metadata.sse_config = Some(config);
|
||||
set_bucket_metadata(bucket.to_string(), metadata)
|
||||
.await
|
||||
.expect("install bucket default SSE");
|
||||
}
|
||||
|
||||
/// backlog#2368 B1: an SSE-C request suppresses the bucket default, the way
|
||||
/// COPY already did. PUT passed a hard-coded `has_explicit_ssec = false`,
|
||||
/// so the default filled in a managed algorithm and the request then failed
|
||||
/// its own mutual-exclusion check — every bucket with default encryption
|
||||
/// refused SSE-C outright.
|
||||
#[tokio::test]
|
||||
#[serial_test::serial]
|
||||
async fn sse_c_put_is_accepted_on_a_bucket_with_default_encryption() {
|
||||
use md5::{Digest as _, Md5};
|
||||
|
||||
for (algorithm, kms_key_id, prefix) in [
|
||||
(ServerSideEncryption::AES256, None, "ssec-over-aes256-default"),
|
||||
(ServerSideEncryption::AWS_KMS, Some("bucket-key"), "ssec-over-kms-default"),
|
||||
] {
|
||||
let (store, bucket) = crate::app::gating_test_env::durable_quota_test_bucket(prefix, 1 << 20).await;
|
||||
install_bucket_default_sse_for_test(&bucket, algorithm, kms_key_id).await;
|
||||
|
||||
let customer_key = [0x2a_u8; 32];
|
||||
let key_md5 = {
|
||||
let mut hasher = Md5::new();
|
||||
hasher.update(customer_key);
|
||||
base64_simd::STANDARD.encode_to_string(hasher.finalize())
|
||||
};
|
||||
let payload = Bytes::from_static(b"customer-key protected payload");
|
||||
let input = PutObjectInput::builder()
|
||||
.bucket(bucket.clone())
|
||||
.key("ledger.csv".to_string())
|
||||
.body(Some(StreamingBlob::from(s3s::Body::from(payload.clone()))))
|
||||
.content_length(Some(i64::try_from(payload.len()).expect("test payload length must fit i64")))
|
||||
.sse_customer_algorithm(Some("AES256".to_string()))
|
||||
.sse_customer_key(Some(base64_simd::STANDARD.encode_to_string(customer_key)))
|
||||
.sse_customer_key_md5(Some(key_md5))
|
||||
.build()
|
||||
.expect("SSE-C PUT input must build");
|
||||
|
||||
DefaultObjectUsecase::from_global()
|
||||
.execute_put_object(&FS::new(), build_request(input, Method::PUT))
|
||||
.await
|
||||
.unwrap_or_else(|err| panic!("a {algorithm} default bucket must accept an SSE-C PUT: {err:?}"));
|
||||
|
||||
let stored = store
|
||||
.get_object_info(&bucket, "ledger.csv", &ObjectOptions::default())
|
||||
.await
|
||||
.expect("the SSE-C object should be readable");
|
||||
assert!(
|
||||
stored
|
||||
.user_defined
|
||||
.keys()
|
||||
.any(|key| key.eq_ignore_ascii_case("x-amz-server-side-encryption-customer-algorithm")),
|
||||
"the object must be stored as SSE-C: {:?}",
|
||||
stored.user_defined
|
||||
);
|
||||
assert!(
|
||||
!stored
|
||||
.user_defined
|
||||
.keys()
|
||||
.any(|key| key.eq_ignore_ascii_case("x-amz-server-side-encryption-aws-kms-key-id")),
|
||||
"the bucket default must not attach a KMS key to an SSE-C object: {:?}",
|
||||
stored.user_defined
|
||||
);
|
||||
assert!(
|
||||
!stored
|
||||
.user_defined
|
||||
.values()
|
||||
.any(|value| value == ServerSideEncryption::AWS_KMS),
|
||||
"the bucket default must not claim managed encryption on an SSE-C object: {:?}",
|
||||
stored.user_defined
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
#[serial_test::serial]
|
||||
async fn quota_rejects_ciphertext_replication_before_polling_the_body() {
|
||||
|
||||
@@ -420,11 +420,7 @@ impl DefaultObjectUsecase {
|
||||
)
|
||||
.await
|
||||
.map_err(ApiError::from)?;
|
||||
rustfs_scanner::record_dirty_usage_object_from_producer(
|
||||
&bucket,
|
||||
&object,
|
||||
rustfs_scanner::SegmentInvalidationProducerIdentity::TierTransition,
|
||||
);
|
||||
rustfs_scanner::record_dirty_usage_object(&bucket, &object);
|
||||
#[cfg(test)]
|
||||
maybe_pause_after_restore_status_commit(&bucket, &object).await;
|
||||
drop(superseded_worker_guard.take());
|
||||
@@ -498,11 +494,7 @@ impl DefaultObjectUsecase {
|
||||
err.to_string()
|
||||
);
|
||||
} else {
|
||||
rustfs_scanner::record_dirty_usage_object_from_producer(
|
||||
&bucket_clone,
|
||||
&object_clone,
|
||||
rustfs_scanner::SegmentInvalidationProducerIdentity::TierTransition,
|
||||
);
|
||||
rustfs_scanner::record_dirty_usage_object(&bucket_clone, &object_clone);
|
||||
debug!(bucket = %bucket_clone, object = %object_clone, "Transitioned object restored");
|
||||
}
|
||||
});
|
||||
|
||||
@@ -240,8 +240,10 @@ pub(super) fn has_put_sse_request_headers(headers: &HeaderMap) -> bool {
|
||||
/// A request-level value always wins; the bucket default only fills a gap, and
|
||||
/// the unknown-algorithm fallback lives once in [`bucket_default_write_sse`].
|
||||
///
|
||||
/// `has_explicit_ssec` suppresses the default entirely: an SSE-C destination
|
||||
/// must not also be given managed encryption.
|
||||
/// `has_explicit_ssec` suppresses the default entirely. Only COPY passes `true`
|
||||
/// today: its destination may carry SSE-C, which must not also be given managed
|
||||
/// encryption. PUT and extract pass `false`, matching their current behaviour —
|
||||
/// see backlog#1826 for the divergence that leaves.
|
||||
///
|
||||
/// Callers layering further overrides (PUT's `ciphertext_passthrough`) apply
|
||||
/// them to the returned pair.
|
||||
@@ -261,14 +263,7 @@ pub(super) fn resolve_bucket_default_sse(
|
||||
};
|
||||
|
||||
let effective_sse = requested_sse.or_else(|| bucket_default().map(bucket_default_write_sse));
|
||||
let effective_kms_key_id = if effective_sse
|
||||
.as_ref()
|
||||
.is_some_and(|sse| sse.as_str() == ServerSideEncryption::AWS_KMS)
|
||||
{
|
||||
requested_kms_key_id.or_else(|| bucket_default().and_then(|sse| sse.kms_master_key_id.clone()))
|
||||
} else {
|
||||
requested_kms_key_id
|
||||
};
|
||||
let effective_kms_key_id = requested_kms_key_id.or_else(|| bucket_default().and_then(|sse| sse.kms_master_key_id.clone()));
|
||||
(effective_sse, effective_kms_key_id)
|
||||
}
|
||||
|
||||
@@ -1192,21 +1187,6 @@ mod tests {
|
||||
assert_eq!(kms_key_id.as_deref(), Some("request-key"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn resolve_bucket_default_sse_does_not_inherit_a_kms_key_for_an_explicit_sse_s3_request() {
|
||||
let config = bucket_sse_config_with(ServerSideEncryption::AWS_KMS, Some("bucket-key"));
|
||||
|
||||
let (sse, kms_key_id) = resolve_bucket_default_sse(
|
||||
Some(&config),
|
||||
Some(ServerSideEncryption::from_static(ServerSideEncryption::AES256)),
|
||||
None,
|
||||
false,
|
||||
);
|
||||
|
||||
assert_eq!(sse.as_ref().map(|sse| sse.as_str()), Some(ServerSideEncryption::AES256));
|
||||
assert!(kms_key_id.is_none(), "an SSE-S3 request must not inherit the bucket KMS key");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn resolve_bucket_default_sse_fills_gaps_from_the_bucket_default() {
|
||||
let config = bucket_sse_config_with(ServerSideEncryption::AWS_KMS, Some("bucket-key"));
|
||||
|
||||
+13
-161
@@ -24,77 +24,6 @@ const MAX_VERSIONS_EXCEEDED_MESSAGE: &str = "You've exceeded the limit on the nu
|
||||
/// S3 error code for a request that names a KMS key the KMS does not hold.
|
||||
pub const KMS_KEY_NOT_FOUND_ERROR_CODE: &str = "KMS.NotFoundException";
|
||||
|
||||
/// Map a KMS failure that surfaced on the S3 data path to its S3 error code.
|
||||
///
|
||||
/// The contract deliberately differs from the admin lifecycle handlers
|
||||
/// (`kms_key_lifecycle::lifecycle_error_status`): there a key id is the
|
||||
/// resource being addressed, so a missing key is `404`. Here the key id
|
||||
/// arrives inside a request header or a bucket default, so a key that is
|
||||
/// missing, disabled, or otherwise unusable is configuration the caller has to
|
||||
/// correct — AWS answers `400`, and reporting `500` instead both misfiles the
|
||||
/// failure as a server fault and makes SDKs back off and retry a request that
|
||||
/// cannot succeed.
|
||||
///
|
||||
/// `None` keeps the caller's fallthrough, which is the `500` that integrity
|
||||
/// faults — damaged, unreadable, or unknown-format key material — must keep.
|
||||
///
|
||||
/// Messages either name what the caller asked for or stay generic; detail that
|
||||
/// belongs to the deployment rather than the request stays in `source`, which
|
||||
/// the caller attaches and the logs retain.
|
||||
fn data_plane_kms_error(error: &rustfs_kms::KmsError) -> Option<(S3ErrorCode, String)> {
|
||||
use rustfs_kms::KmsError as Kms;
|
||||
|
||||
let generic = |code: S3ErrorCode| {
|
||||
let message = ApiError::error_code_to_message(&code);
|
||||
Some((code, message))
|
||||
};
|
||||
|
||||
match error {
|
||||
Kms::KeyNotFound { key_id } => Some((
|
||||
S3ErrorCode::Custom(KMS_KEY_NOT_FOUND_ERROR_CODE.into()),
|
||||
format!("KMS key not found: {key_id}"),
|
||||
)),
|
||||
Kms::KeyVersionNotFound { key_id, version } => Some((
|
||||
S3ErrorCode::Custom(KMS_KEY_NOT_FOUND_ERROR_CODE.into()),
|
||||
format!("KMS key version {version} not found for key {key_id}"),
|
||||
)),
|
||||
// The key exists but its state forbids the operation (disabled,
|
||||
// pending deletion). AWS treats an invalid key state as a request
|
||||
// error, not a server fault.
|
||||
Kms::InvalidOperation { .. } => Some((S3ErrorCode::InvalidRequest, error.to_string())),
|
||||
// A policy decision needs a human, so it must be distinguishable from
|
||||
// the transient classes an SDK retries.
|
||||
Kms::AccessDenied { .. } => generic(S3ErrorCode::AccessDenied),
|
||||
// Request-side faults: what was asked for cannot be served as asked.
|
||||
Kms::ContextMismatch { .. }
|
||||
| Kms::InvalidKey { .. }
|
||||
| Kms::ValidationError { .. }
|
||||
| Kms::UnsupportedAlgorithm { .. }
|
||||
| Kms::InvalidKeySize { .. } => Some((S3ErrorCode::InvalidRequest, error.to_string())),
|
||||
// A deployment whose KMS configuration cannot serve the request (for
|
||||
// example no key named and no default). Actionable, but the detail
|
||||
// describes the deployment, so it stays out of the response body.
|
||||
Kms::ConfigurationError { .. } => {
|
||||
Some((S3ErrorCode::InvalidRequest, "The KMS configuration cannot serve this request".to_string()))
|
||||
}
|
||||
// Transient: worth retrying, and must be counted against availability
|
||||
// rather than against the caller. `IoError` belongs here because it is
|
||||
// how a backend reports that its key store itself was unreachable —
|
||||
// rustfs/rustfs#7470 separated that from a missing key precisely so the
|
||||
// two stop looking alike, and leaving it on the 500 fallthrough would
|
||||
// erase that distinction again at the S3 boundary.
|
||||
Kms::BackendError { .. }
|
||||
| Kms::IoError { .. }
|
||||
| Kms::OperationTimedOut { .. }
|
||||
| Kms::OperationCancelled { .. }
|
||||
| Kms::CredentialsUnavailable { .. }
|
||||
| Kms::CacheError { .. } => generic(S3ErrorCode::ServiceUnavailable),
|
||||
// A permanent gap in the configured backend, never a missing resource.
|
||||
Kms::UnsupportedCapability { .. } => Some((S3ErrorCode::NotImplemented, error.to_string())),
|
||||
_ => None,
|
||||
}
|
||||
}
|
||||
|
||||
/// HTTP status of the error codes s3s cannot derive on its own.
|
||||
///
|
||||
/// s3s answers `None` for every `Custom` code, which the response layer turns
|
||||
@@ -543,7 +472,12 @@ impl From<StorageError> for ApiError {
|
||||
};
|
||||
}
|
||||
|
||||
if inner.downcast_ref::<KmsUnavailableError>().is_some() {
|
||||
if inner.downcast_ref::<KmsUnavailableError>().is_some()
|
||||
|| matches!(
|
||||
inner.downcast_ref::<rustfs_kms::KmsError>(),
|
||||
Some(rustfs_kms::KmsError::BackendError { .. })
|
||||
)
|
||||
{
|
||||
return ApiError {
|
||||
code: S3ErrorCode::ServiceUnavailable,
|
||||
message: ApiError::error_code_to_message(&S3ErrorCode::ServiceUnavailable),
|
||||
@@ -551,11 +485,14 @@ impl From<StorageError> for ApiError {
|
||||
};
|
||||
}
|
||||
|
||||
if let Some(kms_error) = inner.downcast_ref::<rustfs_kms::KmsError>()
|
||||
&& let Some((code, message)) = data_plane_kms_error(kms_error)
|
||||
{
|
||||
// A request header or bucket default naming a key the KMS does not
|
||||
// hold is the caller's mistake to correct, and S3 reports it as
|
||||
// 400 `KMS.NotFoundException`. Left to the fallthrough it became a
|
||||
// 500 whose generic message hid which key was missing.
|
||||
if let Some(rustfs_kms::KmsError::KeyNotFound { key_id }) = inner.downcast_ref::<rustfs_kms::KmsError>() {
|
||||
let message = format!("KMS key not found: {key_id}");
|
||||
return ApiError {
|
||||
code,
|
||||
code: S3ErrorCode::Custom(KMS_KEY_NOT_FOUND_ERROR_CODE.into()),
|
||||
message,
|
||||
source: Some(Box::new(err)),
|
||||
};
|
||||
@@ -1123,91 +1060,6 @@ mod tests {
|
||||
assert_eq!(s3_error.status_code(), Some(StatusCode::BAD_REQUEST));
|
||||
}
|
||||
|
||||
/// backlog#2368 B6: every KMS failure class that is not an integrity fault
|
||||
/// carries a status that says whether retrying, fixing the request, or
|
||||
/// calling a human is the right response. Collapsing them onto 500 made
|
||||
/// SDKs back off on unfixable configuration errors and filed every one of
|
||||
/// them as a server fault.
|
||||
#[test]
|
||||
fn kms_data_plane_errors_are_classified_by_what_the_caller_should_do() {
|
||||
let cases: Vec<(rustfs_kms::KmsError, S3ErrorCode)> = vec![
|
||||
// Names something the KMS does not hold.
|
||||
(
|
||||
rustfs_kms::KmsError::key_version_not_found("finance-key", 7),
|
||||
S3ErrorCode::Custom(KMS_KEY_NOT_FOUND_ERROR_CODE.into()),
|
||||
),
|
||||
// The key exists but its state forbids the operation.
|
||||
(rustfs_kms::KmsError::invalid_key_state("disabled"), S3ErrorCode::InvalidRequest),
|
||||
// Request-side faults.
|
||||
(rustfs_kms::KmsError::context_mismatch("bucket differs"), S3ErrorCode::InvalidRequest),
|
||||
(rustfs_kms::KmsError::invalid_key("malformed key id"), S3ErrorCode::InvalidRequest),
|
||||
(rustfs_kms::KmsError::validation_error("empty key id"), S3ErrorCode::InvalidRequest),
|
||||
(rustfs_kms::KmsError::unsupported_algorithm("aes-999"), S3ErrorCode::InvalidRequest),
|
||||
(rustfs_kms::KmsError::invalid_key_size(32, 16), S3ErrorCode::InvalidRequest),
|
||||
(
|
||||
rustfs_kms::KmsError::configuration_error("no default key configured"),
|
||||
S3ErrorCode::InvalidRequest,
|
||||
),
|
||||
// A policy decision that needs a human, never retried by an SDK.
|
||||
(rustfs_kms::KmsError::access_denied("no kms:Decrypt grant"), S3ErrorCode::AccessDenied),
|
||||
// Transient, worth retrying, counted against availability.
|
||||
(rustfs_kms::KmsError::backend_error("vault refused"), S3ErrorCode::ServiceUnavailable),
|
||||
(
|
||||
rustfs_kms::KmsError::operation_timed_out("attempt deadline"),
|
||||
S3ErrorCode::ServiceUnavailable,
|
||||
),
|
||||
(
|
||||
rustfs_kms::KmsError::operation_cancelled("shutting down"),
|
||||
S3ErrorCode::ServiceUnavailable,
|
||||
),
|
||||
(
|
||||
rustfs_kms::KmsError::credentials_unavailable("approle login failed"),
|
||||
S3ErrorCode::ServiceUnavailable,
|
||||
),
|
||||
(rustfs_kms::KmsError::cache_error("poisoned"), S3ErrorCode::ServiceUnavailable),
|
||||
// A key store that cannot be read is an outage, not a missing key:
|
||||
// rustfs/rustfs#7470 made the backend say so, and the S3 boundary
|
||||
// has to keep the two apart.
|
||||
(
|
||||
rustfs_kms::KmsError::io_error("No such file or directory (os error 2)"),
|
||||
S3ErrorCode::ServiceUnavailable,
|
||||
),
|
||||
// A permanent gap in the configured backend, never a missing resource.
|
||||
(
|
||||
rustfs_kms::KmsError::unsupported_capability("local", "rewrap"),
|
||||
S3ErrorCode::NotImplemented,
|
||||
),
|
||||
];
|
||||
|
||||
for (error, expected) in cases {
|
||||
let description = error.to_string();
|
||||
let api_error = ApiError::from(StorageError::other(error));
|
||||
assert_eq!(api_error.code, expected, "wrong code for: {description}");
|
||||
assert_ne!(api_error.code, S3ErrorCode::InternalError, "must not be a server fault: {description}");
|
||||
}
|
||||
}
|
||||
|
||||
/// A deployment-side configuration message describes the server, not the
|
||||
/// request, so it stays in `source` the way the storage-IO mapping does.
|
||||
#[test]
|
||||
fn kms_configuration_errors_do_not_echo_deployment_detail() {
|
||||
let detail = "vault mount /secret/rustfs-prod has no default key";
|
||||
let api_error = ApiError::from(StorageError::other(rustfs_kms::KmsError::configuration_error(detail)));
|
||||
|
||||
assert_eq!(api_error.code, S3ErrorCode::InvalidRequest);
|
||||
assert!(
|
||||
!api_error.message.contains(detail),
|
||||
"message leaked deployment detail: {}",
|
||||
api_error.message
|
||||
);
|
||||
let source = api_error
|
||||
.source
|
||||
.as_deref()
|
||||
.and_then(|source| source.downcast_ref::<StorageError>())
|
||||
.expect("API error should retain the storage error source");
|
||||
assert!(source.to_string().contains(detail), "the detail must survive on the source");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_generated_error_codes_keep_their_own_status() {
|
||||
let s3_error = S3Error::from(ApiError::from(StorageError::other(rustfs_kms::KmsError::backend_error("down"))));
|
||||
|
||||
@@ -28,7 +28,6 @@ use crate::server::{
|
||||
StsQueryApiCompatLayer, VirtualHostStyleHintLayer, redact_sensitive_uri_query,
|
||||
},
|
||||
rate_limit::{RateLimitLayer, api_rate_limit_layer_from_env},
|
||||
ssec_transport::SsecTransportLayer,
|
||||
strip_valid_port_suffix,
|
||||
tls_material::{
|
||||
TlsAcceptFailure, TlsAcceptorHolder, TlsHandshakeFailureKind, accept_tls_with_deadline, build_acceptor_from_loaded,
|
||||
@@ -1847,11 +1846,6 @@ fn process_connection(
|
||||
request_body_idle_timeout,
|
||||
} = context;
|
||||
|
||||
// Whether this listener terminated TLS for this connection; the SSE-C
|
||||
// transport policy needs the connection's own answer, not a
|
||||
// deployment-wide setting.
|
||||
let connection_is_tls = tls_acceptor.is_some();
|
||||
|
||||
// Build the hybrid service per-connection.
|
||||
// Note: NodeService is not Clone (holds LocalPeerS3Client), and the SwiftService
|
||||
// type is feature-gated, so we cannot pre-build the full hybrid service.
|
||||
@@ -1970,14 +1964,6 @@ fn process_connection(
|
||||
// a spoof-proof client IP. Absent (None) unless enabled via
|
||||
// RUSTFS_API_RATE_LIMIT_ENABLE with a non-zero RPM.
|
||||
.option_layer(rate_limit_layer.clone())
|
||||
// backlog#2369 P7.2: an SSE-C request carries the customer key
|
||||
// in a header, so a plaintext hop leaks it permanently. Sits
|
||||
// beside the rate limiter: after the trusted-proxy layer, which
|
||||
// is what makes a forwarded `https` protocol trustworthy, and
|
||||
// after the request context so a rejection can echo the request
|
||||
// id. Reports by default; refuses only under
|
||||
// RUSTFS_SSE_C_REQUIRE_TLS.
|
||||
.layer(SsecTransportLayer::new(connection_is_tls))
|
||||
// CRITICAL: Insert ReadinessGateLayer before business logic
|
||||
// This stops requests from hitting IAMAuth or Storage if they are not ready.
|
||||
.layer(ReadinessGateLayer::new(readiness.clone()))
|
||||
|
||||
@@ -27,7 +27,6 @@ mod readiness;
|
||||
mod runtime;
|
||||
pub(crate) mod runtime_sources;
|
||||
mod service_state;
|
||||
mod ssec_transport;
|
||||
pub mod tls_material;
|
||||
|
||||
use tracing::warn;
|
||||
|
||||
@@ -1,276 +0,0 @@
|
||||
// Copyright 2024 RustFS Team
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
//! SSE-C transport policy (backlog#2369 P7.2).
|
||||
//!
|
||||
//! An SSE-C request carries the customer's AES key in a request header, so AWS
|
||||
//! S3 and MinIO both refuse one that did not arrive over TLS. RustFS accepted
|
||||
//! them on any transport, which means a plaintext hop hands the key to anyone
|
||||
//! on the path — and the object is then unreadable without that same key, so
|
||||
//! the exposure is permanent for as long as the object lives.
|
||||
//!
|
||||
//! Refusing outright is the correct end state but not a safe default to adopt
|
||||
//! inside a release window: the project's own s3-tests and e2e lanes, and most
|
||||
//! staging deployments, speak plain HTTP. This release therefore reports:
|
||||
//! every SSE-C request on a plaintext transport increments
|
||||
//! `rustfs_ssec_plaintext_requests_total` and logs one warning per process, so
|
||||
//! an operator can see whether anything would break before the default flips.
|
||||
//! `RUSTFS_SSE_C_REQUIRE_TLS=true` opts a deployment into the rejection now.
|
||||
//!
|
||||
//! The transport verdict is per connection, not per deployment: the layer is
|
||||
//! built with whether *this* listener terminates TLS, and additionally accepts
|
||||
//! a `https` forwarded protocol resolved by the trusted-proxy layer, which is
|
||||
//! the only spoof-resistant source for a TLS-terminating proxy in front.
|
||||
|
||||
use bytes::Bytes;
|
||||
use futures::future::{Either, Ready, ready};
|
||||
use http::{HeaderMap, HeaderValue, Request, Response, StatusCode};
|
||||
use http_body_util::{BodyExt, Full};
|
||||
use metrics::counter;
|
||||
use rustfs_trusted_proxies::ClientInfo;
|
||||
use rustfs_utils::http::headers::{
|
||||
AMZ_SERVER_SIDE_ENCRYPTION_CUSTOMER_ALGORITHM, AMZ_SERVER_SIDE_ENCRYPTION_CUSTOMER_KEY,
|
||||
AMZ_SERVER_SIDE_ENCRYPTION_CUSTOMER_KEY_MD5,
|
||||
};
|
||||
use std::sync::Once;
|
||||
use std::task::{Context, Poll};
|
||||
use tower::{Layer, Service};
|
||||
use tracing::warn;
|
||||
|
||||
use crate::storage_api::server::layer::request_context::RequestContext;
|
||||
|
||||
/// Opt in to refusing SSE-C on a plaintext transport. Default `false` for this
|
||||
/// release; the reporting path runs either way.
|
||||
pub(crate) const ENV_SSE_C_REQUIRE_TLS: &str = "RUSTFS_SSE_C_REQUIRE_TLS";
|
||||
pub(crate) const DEFAULT_SSE_C_REQUIRE_TLS: bool = false;
|
||||
|
||||
/// Counts SSE-C requests that arrived without TLS. A deployment planning to
|
||||
/// enable [`ENV_SSE_C_REQUIRE_TLS`] should see this at zero first.
|
||||
pub(crate) const METRIC_SSEC_PLAINTEXT_REQUESTS_TOTAL: &str = "rustfs_ssec_plaintext_requests_total";
|
||||
|
||||
type BoxError = Box<dyn std::error::Error + Send + Sync>;
|
||||
type BoxBody = http_body_util::combinators::UnsyncBoxBody<Bytes, BoxError>;
|
||||
|
||||
/// Whether the request carries any SSE-C header.
|
||||
///
|
||||
/// Any one of the three is enough: an incomplete triple is still an attempt to
|
||||
/// use SSE-C, and it is rejected later for being incomplete — but the key may
|
||||
/// already have crossed the wire.
|
||||
fn carries_ssec_headers(headers: &HeaderMap) -> bool {
|
||||
headers.contains_key(AMZ_SERVER_SIDE_ENCRYPTION_CUSTOMER_ALGORITHM)
|
||||
|| headers.contains_key(AMZ_SERVER_SIDE_ENCRYPTION_CUSTOMER_KEY)
|
||||
|| headers.contains_key(AMZ_SERVER_SIDE_ENCRYPTION_CUSTOMER_KEY_MD5)
|
||||
}
|
||||
|
||||
/// Whether this request reached the server over TLS.
|
||||
///
|
||||
/// `connection_is_tls` is what this listener actually did. The forwarded
|
||||
/// protocol is only consulted as a second source because the trusted-proxy
|
||||
/// layer has already decided whether the peer is allowed to assert it; a
|
||||
/// request that arrives direct carries no such assertion.
|
||||
fn is_secure_transport(connection_is_tls: bool, client_info: Option<&ClientInfo>) -> bool {
|
||||
if connection_is_tls {
|
||||
return true;
|
||||
}
|
||||
client_info
|
||||
.and_then(|info| info.forwarded_proto.as_deref())
|
||||
.is_some_and(|proto| proto.eq_ignore_ascii_case("https"))
|
||||
}
|
||||
|
||||
fn require_tls() -> bool {
|
||||
rustfs_utils::get_env_bool(ENV_SSE_C_REQUIRE_TLS, DEFAULT_SSE_C_REQUIRE_TLS)
|
||||
}
|
||||
|
||||
/// One warning per process: plaintext SSE-C traffic is driven by clients, so a
|
||||
/// per-request warning would let a busy client flood the log. The counter
|
||||
/// carries the per-request volume.
|
||||
fn warn_once_about_plaintext_ssec() {
|
||||
static WARNED: Once = Once::new();
|
||||
WARNED.call_once(|| {
|
||||
warn!(
|
||||
event = "ssec_request_without_tls",
|
||||
require_tls = ENV_SSE_C_REQUIRE_TLS,
|
||||
metric = METRIC_SSEC_PLAINTEXT_REQUESTS_TOTAL,
|
||||
"SSE-C requests are arriving without TLS, so the customer key crosses the network in \
|
||||
cleartext. AWS S3 refuses these; RustFS will too in a later release. Terminate TLS on \
|
||||
this listener or on a trusted proxy, then set RUSTFS_SSE_C_REQUIRE_TLS=true. Reported \
|
||||
once per process; the counter carries the volume."
|
||||
);
|
||||
});
|
||||
}
|
||||
|
||||
/// The S3 rejection AWS returns for SSE-C without TLS. Built by hand because
|
||||
/// the rejection short-circuits the inner response stack, mirroring the
|
||||
/// rate-limit layer.
|
||||
fn ssec_requires_tls_response(request_id: Option<&str>) -> Response<BoxBody> {
|
||||
let request_id_xml = request_id
|
||||
.filter(|id| !id.is_empty() && id.bytes().all(|b| b.is_ascii_alphanumeric() || b == b'-'))
|
||||
.map(|id| format!("<RequestId>{id}</RequestId>"))
|
||||
.unwrap_or_default();
|
||||
let body = format!(
|
||||
"<?xml version=\"1.0\" encoding=\"UTF-8\"?>\
|
||||
<Error><Code>InvalidRequest</Code>\
|
||||
<Message>Requests specifying Server Side Encryption with Customer provided keys must be made over a secure connection.</Message>\
|
||||
{request_id_xml}</Error>"
|
||||
);
|
||||
let body: BoxBody = Full::new(Bytes::from(body))
|
||||
.map_err(|e| -> BoxError { Box::new(e) })
|
||||
.boxed_unsync();
|
||||
|
||||
let mut response = Response::new(body);
|
||||
*response.status_mut() = StatusCode::BAD_REQUEST;
|
||||
response
|
||||
.headers_mut()
|
||||
.insert(http::header::CONTENT_TYPE, HeaderValue::from_static("application/xml"));
|
||||
response
|
||||
}
|
||||
|
||||
/// Layer that reports — and optionally refuses — SSE-C over a plaintext
|
||||
/// transport. `connection_is_tls` is whether the listener that accepted this
|
||||
/// connection terminated TLS.
|
||||
#[derive(Clone, Copy)]
|
||||
pub(crate) struct SsecTransportLayer {
|
||||
connection_is_tls: bool,
|
||||
}
|
||||
|
||||
impl SsecTransportLayer {
|
||||
pub(crate) fn new(connection_is_tls: bool) -> Self {
|
||||
Self { connection_is_tls }
|
||||
}
|
||||
}
|
||||
|
||||
impl<S> Layer<S> for SsecTransportLayer {
|
||||
type Service = SsecTransportService<S>;
|
||||
|
||||
fn layer(&self, inner: S) -> Self::Service {
|
||||
SsecTransportService {
|
||||
inner,
|
||||
connection_is_tls: self.connection_is_tls,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Clone)]
|
||||
pub(crate) struct SsecTransportService<S> {
|
||||
inner: S,
|
||||
connection_is_tls: bool,
|
||||
}
|
||||
|
||||
impl<S, ReqBody> Service<Request<ReqBody>> for SsecTransportService<S>
|
||||
where
|
||||
S: Service<Request<ReqBody>, Response = Response<BoxBody>>,
|
||||
{
|
||||
type Response = Response<BoxBody>;
|
||||
type Error = S::Error;
|
||||
type Future = Either<S::Future, Ready<Result<Response<BoxBody>, S::Error>>>;
|
||||
|
||||
fn poll_ready(&mut self, cx: &mut Context<'_>) -> Poll<Result<(), Self::Error>> {
|
||||
self.inner.poll_ready(cx)
|
||||
}
|
||||
|
||||
fn call(&mut self, req: Request<ReqBody>) -> Self::Future {
|
||||
if !carries_ssec_headers(req.headers())
|
||||
|| is_secure_transport(self.connection_is_tls, req.extensions().get::<ClientInfo>())
|
||||
{
|
||||
return Either::Left(self.inner.call(req));
|
||||
}
|
||||
|
||||
counter!(METRIC_SSEC_PLAINTEXT_REQUESTS_TOTAL).increment(1);
|
||||
warn_once_about_plaintext_ssec();
|
||||
|
||||
if !require_tls() {
|
||||
return Either::Left(self.inner.call(req));
|
||||
}
|
||||
|
||||
Either::Right(ready(Ok(ssec_requires_tls_response(
|
||||
req.extensions()
|
||||
.get::<RequestContext>()
|
||||
.map(|context| context.request_id.as_str()),
|
||||
))))
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use std::net::{IpAddr, SocketAddr};
|
||||
|
||||
fn ssec_headers() -> HeaderMap {
|
||||
let mut headers = HeaderMap::new();
|
||||
headers.insert(AMZ_SERVER_SIDE_ENCRYPTION_CUSTOMER_ALGORITHM, HeaderValue::from_static("AES256"));
|
||||
headers
|
||||
}
|
||||
|
||||
fn proxied(proto: &str) -> ClientInfo {
|
||||
ClientInfo::from_trusted_proxy(
|
||||
IpAddr::from([203, 0, 113, 10]),
|
||||
None,
|
||||
Some(proto.to_string()),
|
||||
IpAddr::from([10, 0, 0, 1]),
|
||||
1,
|
||||
rustfs_trusted_proxies::ValidationMode::Lenient,
|
||||
Vec::new(),
|
||||
)
|
||||
}
|
||||
|
||||
fn direct() -> ClientInfo {
|
||||
ClientInfo::direct(SocketAddr::new(IpAddr::from([203, 0, 113, 10]), 443))
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn any_ssec_header_counts_as_an_ssec_request() {
|
||||
assert!(!carries_ssec_headers(&HeaderMap::new()));
|
||||
assert!(carries_ssec_headers(&ssec_headers()));
|
||||
|
||||
// An incomplete triple is still an attempt, and the key may already
|
||||
// have crossed the wire.
|
||||
let mut only_key = HeaderMap::new();
|
||||
only_key.insert(AMZ_SERVER_SIDE_ENCRYPTION_CUSTOMER_KEY, HeaderValue::from_static("a2V5"));
|
||||
assert!(carries_ssec_headers(&only_key));
|
||||
|
||||
let mut only_md5 = HeaderMap::new();
|
||||
only_md5.insert(AMZ_SERVER_SIDE_ENCRYPTION_CUSTOMER_KEY_MD5, HeaderValue::from_static("bWQ1"));
|
||||
assert!(carries_ssec_headers(&only_md5));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn transport_is_secure_only_on_tls_or_a_resolved_https_proxy() {
|
||||
assert!(is_secure_transport(true, None), "a TLS listener needs no header to prove it");
|
||||
assert!(is_secure_transport(true, Some(&proxied("http"))), "the listener's own TLS wins");
|
||||
assert!(
|
||||
is_secure_transport(false, Some(&proxied("https"))),
|
||||
"a TLS-terminating trusted proxy is a secure transport"
|
||||
);
|
||||
assert!(
|
||||
!is_secure_transport(false, Some(&proxied("http"))),
|
||||
"a proxy that forwarded plain HTTP is not"
|
||||
);
|
||||
assert!(
|
||||
!is_secure_transport(false, Some(&direct())),
|
||||
"a direct plaintext client asserts no protocol"
|
||||
);
|
||||
assert!(!is_secure_transport(false, None), "no transport evidence means not secure");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn the_rejection_carries_the_aws_wording_and_a_safe_request_id() {
|
||||
let response = ssec_requires_tls_response(Some("abc-123"));
|
||||
assert_eq!(response.status(), StatusCode::BAD_REQUEST);
|
||||
|
||||
// A request id that is not plain enough to embed must be dropped
|
||||
// rather than escaped into the XML body.
|
||||
let injected = ssec_requires_tls_response(Some("<injected>"));
|
||||
assert_eq!(injected.status(), StatusCode::BAD_REQUEST);
|
||||
}
|
||||
}
|
||||
@@ -217,26 +217,6 @@ pub(crate) fn settle_observed_site_replication_retry_event(
|
||||
before.saturating_sub(queue.len())
|
||||
}
|
||||
|
||||
/// Make sure `peer` has a collapsed entry for `path` without counting the
|
||||
/// call as a delivery failure. A bulk local mutation (`import-iam`) needs the
|
||||
/// entry to exist so the next drain sends the snapshot; routing it through
|
||||
/// [`upsert_site_replication_retry_event`] would raise `retry_count` on every
|
||||
/// import and escalate a healthy peer to `failed` after
|
||||
/// [`SITE_REPLICATION_RETRY_FAILED_AFTER`] of them, with the scheduling note
|
||||
/// shown to operators as `lastError`.
|
||||
pub(crate) fn ensure_site_replication_retry_event(
|
||||
queue: &mut Vec<SiteReplicationRetryEvent>,
|
||||
peer: &PeerInfo,
|
||||
path: &str,
|
||||
reason: &str,
|
||||
) -> S3Result<Vec<SiteReplicationRetryEvent>> {
|
||||
let path = collapsed_retry_queue_path(path).unwrap_or(path);
|
||||
if queue.iter().any(|event| retry_event_matches(event, peer, path)) {
|
||||
return Ok(Vec::new());
|
||||
}
|
||||
push_site_replication_retry_event(queue, peer, path, summarize_peer_error_detail(reason), false, None)
|
||||
}
|
||||
|
||||
pub(crate) fn upsert_site_replication_retry_event(
|
||||
queue: &mut Vec<SiteReplicationRetryEvent>,
|
||||
peer: &PeerInfo,
|
||||
@@ -264,17 +244,6 @@ pub(crate) fn upsert_site_replication_retry_event(
|
||||
return Ok(Vec::new());
|
||||
}
|
||||
|
||||
push_site_replication_retry_event(queue, peer, path, detail, peer_unreachable, generation)
|
||||
}
|
||||
|
||||
fn push_site_replication_retry_event(
|
||||
queue: &mut Vec<SiteReplicationRetryEvent>,
|
||||
peer: &PeerInfo,
|
||||
path: &str,
|
||||
detail: String,
|
||||
peer_unreachable: bool,
|
||||
generation: Option<u64>,
|
||||
) -> S3Result<Vec<SiteReplicationRetryEvent>> {
|
||||
let slots_needed = queue
|
||||
.len()
|
||||
.saturating_add(1)
|
||||
@@ -305,7 +274,7 @@ fn push_site_replication_retry_event(
|
||||
retry_count: 1,
|
||||
failed: false,
|
||||
last_error: detail,
|
||||
updated_at: Some(OffsetDateTime::now_utc()),
|
||||
updated_at: Some(now),
|
||||
edit_generation: generation,
|
||||
peer_unreachable,
|
||||
deletions_recorded: false,
|
||||
@@ -396,60 +365,6 @@ pub(crate) async fn enqueue_site_replication_retry_event_for_generation(
|
||||
}
|
||||
}
|
||||
|
||||
/// Returns the number of peers whose snapshot entry is escalated and therefore
|
||||
/// will not carry this scheduling: the marker records a deletion that a
|
||||
/// snapshot cannot replay, and only a repair settles it, so clearing it to make
|
||||
/// the entry drainable again would drop that liability.
|
||||
pub(crate) fn record_iam_snapshot_retries(
|
||||
state: &mut SiteReplicationState,
|
||||
local_peer: &PeerInfo,
|
||||
reason: &str,
|
||||
) -> S3Result<usize> {
|
||||
let peers = state
|
||||
.peers
|
||||
.values()
|
||||
.filter(|peer| {
|
||||
peer.deployment_id != local_peer.deployment_id && !same_identity_endpoint(&peer.endpoint, &local_peer.endpoint)
|
||||
})
|
||||
.cloned()
|
||||
.collect::<Vec<_>>();
|
||||
let mut escalated = 0usize;
|
||||
for peer in peers {
|
||||
if state.retry_queue.iter().any(|event| {
|
||||
retry_event_matches(event, &peer, SITE_REPLICATION_RETRY_IAM_SNAPSHOT_PATH)
|
||||
&& event.last_error == SITE_REPLICATION_RETRY_SNAPSHOT_REPLAYED_MARKER
|
||||
}) {
|
||||
escalated += 1;
|
||||
continue;
|
||||
}
|
||||
ensure_site_replication_retry_event(&mut state.retry_queue, &peer, SITE_REPLICATION_RETRY_IAM_SNAPSHOT_PATH, reason)?;
|
||||
}
|
||||
Ok(escalated)
|
||||
}
|
||||
|
||||
/// Schedule one collapsed full-IAM snapshot per remote peer after a bulk
|
||||
/// local mutation such as `import-iam`.
|
||||
pub(crate) async fn enqueue_site_replication_iam_snapshot(reason: &str) -> S3Result<()> {
|
||||
let state = load_site_replication_state().await?;
|
||||
if !state.enabled() {
|
||||
return Ok(());
|
||||
}
|
||||
let local_peer = current_local_runtime_peer(&state);
|
||||
let reason = reason.to_string();
|
||||
let escalated = update_site_replication_state(move |state| record_iam_snapshot_retries(state, &local_peer, &reason)).await?;
|
||||
if escalated > 0 {
|
||||
warn!(
|
||||
component = LOG_COMPONENT_ADMIN,
|
||||
subsystem = LOG_SUBSYSTEM_SITE_REPLICATION,
|
||||
event = EVENT_ADMIN_SITE_REPLICATION_STATE,
|
||||
escalated,
|
||||
result = "iam_snapshot_not_scheduled_for_escalated_peer",
|
||||
"site replication peers hold an escalated IAM entry; the snapshot waits for a repair"
|
||||
);
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub(crate) const SITE_REPLICATION_PEER_IAM_ITEM_WIRE_PATH: &str = "/rustfs/admin/v3/site-replication/peer/iam-item";
|
||||
|
||||
/// Per-peer cap on recorded deletion bodies. Beyond it the peer's collapsed
|
||||
|
||||
@@ -168,8 +168,6 @@ mod rfc3339_map {
|
||||
pub(crate) struct PendingEndpointRefresh {
|
||||
pub(crate) id: String,
|
||||
pub(crate) peer: PeerInfo,
|
||||
#[serde(default, skip_serializing_if = "Option::is_none")]
|
||||
pub(crate) ilm_expiry_override: Option<bool>,
|
||||
#[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
|
||||
pub(crate) remote_peers: BTreeMap<String, PeerInfo>,
|
||||
#[serde(default, skip_serializing_if = "BTreeSet::is_empty")]
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user