mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-09-14 10:30:45 +02:00
Chris Lu
75ec5ec193
* admin: support setting volume read-only and read/write modes
* admin: address PR review on volume access-mode persistence
Reject trailing JSON values in the SetVolumeReadOnly handler so
requests like {"read_only":true}{} no longer pass validation, and add
a trailing-value case to the invalid-request test.
Propagate .vif persistence failures through the access-mode chain.
PersistReadOnly now returns the SaveVolumeInfo error and rolls back
the in-memory volumeInfo on failure; Store.MarkVolumeReadonly and
Store.MarkVolumeWritable propagate that error and roll back their
noWrite flags, so the API reports failure instead of success while
restart would revert the mode.
* admin: make .vif persistence atomic and preserve error chain
SaveVolumeInfo now writes to a .vif.tmp file, syncs it, renames it
over the target, and fsyncs the directory. A write/sync/close failure
leaves the existing .vif intact, so the PersistReadOnly in-memory
rollback matches the durable state instead of diverging from a
partially written file that restart would apply.
Switch the error wrappers in PersistReadOnly, MarkVolumeReadonly, and
MarkVolumeWritable from %v to %w so callers can use errors.Is and
errors.As to classify persistence failures.
* admin: treat post-rename dir fsync failure as a warning
After os.Rename commits the new .vif, the on-disk file already holds
the requested mode. A directory fsync failure only risks losing the
rename across a crash; returning an error here would make
PersistReadOnly roll back in-memory state while the durable file keeps
the new mode, splitting the replica. Log the failure as a warning
instead, matching the best-effort nature of FsyncDir (already skipped
on Windows).
* admin: distinguish post-rename durability failures and use unique temp files
SaveVolumeInfo now uses os.CreateTemp for the staging file, preventing
concurrent saves for the same volume from colliding on a shared .tmp
path.
A directory fsync failure after os.Rename returns a
NotCrashDurableError instead of being silently swallowed. The rename
already committed the new metadata to disk, so PersistReadOnly,
MarkVolumeReadonly, and MarkVolumeWritable skip the in-memory rollback
for this error type (keeping state aligned with the durable file) while
still propagating the failure to the API. Pre-commit failures continue
to roll back as before.
* admin: continue post-commit work after NotCrashDurableError
MarkVolumeWritable now clears the EIO quarantine and the gRPC handlers
(makeVolumeReadonly step 3, makeVolumeWritable master notification)
proceed with their post-commit work when SaveVolumeInfo returns a
NotCrashDurableError, instead of aborting and leaving the volume
unavailable or the master unaware of the mode change. The durability
warning is still propagated to the API caller. Pre-commit failures
continue to abort early as before.
* admin: handle NotCrashDurableError in tier and EC callers
VolumeTierMoveDatFromRemote and VolumeEcShardsGenerate now check for
NotCrashDurableError from SaveVolumeInfo. When the rename has already
committed the new .vif, they continue with their post-commit work
(backend switch, remote deletion, keeping generated EC shards) instead
of aborting and leaving the on-disk metadata inconsistent with the
file layout. The durability warning is logged for the operator.
90 lines
3.2 KiB
Go
90 lines
3.2 KiB
Go
package storage
|
|
|
|
import (
|
|
"errors"
|
|
"os"
|
|
"testing"
|
|
|
|
"github.com/seaweedfs/seaweedfs/weed/storage/needle"
|
|
"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
|
|
)
|
|
|
|
// A volume booted with .vif ReadOnly=true used to come back stuck: load()
|
|
// opens .idx as O_RDONLY and builds a SortedFileNeedleMap whose Put returns
|
|
// os.ErrInvalid, and MarkVolumeWritable only flipped the in-memory flag and
|
|
// rewrote .vif. Subsequent writes failed at v.nm.Put.
|
|
func TestMarkVolumeWritable_ReopensPersistedReadOnly(t *testing.T) {
|
|
dir := t.TempDir()
|
|
|
|
v, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
|
|
if err != nil {
|
|
t.Fatalf("create volume: %v", err)
|
|
}
|
|
|
|
if _, _, _, err := v.writeNeedle2(newRandomNeedle(1), true, false, false); err != nil {
|
|
t.Fatalf("initial write: %v", err)
|
|
}
|
|
|
|
// Persist read-only state into .vif, then simulate a server restart by
|
|
// closing and re-opening the volume from the same directory.
|
|
if err := v.PersistReadOnly(true, false); err != nil {
|
|
t.Fatalf("persist read-only: %v", err)
|
|
}
|
|
v.Close()
|
|
|
|
v2, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
|
|
if err != nil {
|
|
t.Fatalf("reload volume: %v", err)
|
|
}
|
|
defer v2.Close()
|
|
|
|
if !v2.noWriteOrDelete {
|
|
t.Fatalf("reloaded volume should be in noWriteOrDelete=true after .vif ReadOnly=true")
|
|
}
|
|
if _, ok := v2.nm.(*SortedFileNeedleMap); !ok {
|
|
t.Fatalf("reloaded readonly volume should use SortedFileNeedleMap, got %T", v2.nm)
|
|
}
|
|
|
|
// Pre-fix behaviour: SortedFileNeedleMap.Put returns os.ErrInvalid even
|
|
// once noWriteOrDelete is cleared. Confirm the failure mode the issue
|
|
// describes — flipping only the flag is not enough.
|
|
v2.noWriteOrDelete = false
|
|
_, _, _, writeErr := v2.writeNeedle2(newRandomNeedle(2), true, false, false)
|
|
if !errors.Is(writeErr, os.ErrInvalid) {
|
|
t.Fatalf("expected write through SortedFileNeedleMap to fail with os.ErrInvalid, got %v", writeErr)
|
|
}
|
|
v2.noWriteOrDelete = true // restore so reopenIdxForWrite reflects the real entry condition
|
|
|
|
if err := v2.reopenIdxForWrite(); err != nil {
|
|
t.Fatalf("reopenIdxForWrite: %v", err)
|
|
}
|
|
if _, stillSorted := v2.nm.(*SortedFileNeedleMap); stillSorted {
|
|
t.Fatalf("reopenIdxForWrite left SortedFileNeedleMap in place")
|
|
}
|
|
|
|
v2.noWriteOrDelete = false
|
|
if _, _, _, err := v2.writeNeedle2(newRandomNeedle(3), true, false, false); err != nil {
|
|
t.Fatalf("write after reopen: %v", err)
|
|
}
|
|
}
|
|
|
|
// reopenIdxForWrite must be a no-op when the volume already has a writable
|
|
// needle map — otherwise repeated MarkVolumeWritable calls would churn the
|
|
// index file handle for no reason.
|
|
func TestReopenIdxForWrite_NoopWhenAlreadyWritable(t *testing.T) {
|
|
dir := t.TempDir()
|
|
v, err := NewVolume(dir, dir, "", 2, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
|
|
if err != nil {
|
|
t.Fatalf("create volume: %v", err)
|
|
}
|
|
defer v.Close()
|
|
|
|
before := v.nm
|
|
if err := v.reopenIdxForWrite(); err != nil {
|
|
t.Fatalf("reopenIdxForWrite on writable volume: %v", err)
|
|
}
|
|
if v.nm != before {
|
|
t.Fatalf("reopenIdxForWrite replaced nm on a writable volume (before=%p after=%p)", before, v.nm)
|
|
}
|
|
}
|