Files
seaweedfs/weed/storage/store_ec_mirror.go
T
Chris Lu c11ff6657b fix(ec): mirror EC sidecars onto every shard-bearing disk at startup (#9525)
* fix(ec): mirror EC sidecars onto every shard-bearing disk at startup

In a multi-disk volume server, ec.balance and ec.rebuild can land shards
on a disk that does not also hold the matching .ecx / .ecj / .vif index
files. The orphan-shard reconciler in reconcileEcShardsAcrossDisks
already loads those shards by pointing the EcVolume at the sibling
disk's index files; reads work, but any failure on the index-owning
disk silently disables every shard on the other disk, even though those
shards are physically fine.

This change adds mirrorEcMetadataToShardDisks, a startup pass that
physically replicates .ecx / .ecj / .vif onto each disk that holds
shards but is missing them. Each copy is atomic (tmp + fsync + rename)
and idempotent (a destination that already has the sidecar is
preserved). After mirroring, the cross-disk reconciler prefers the
local IdxDirectory so the EcVolume mounts self-contained; the
cross-disk virtual mount remains as a fallback for volumes whose mirror
failed (read-only target, out of space, partial copy on a previous
boot).

The same-disk invariant the EC lifecycle (encode / decode / balance /
vacuum / repair) was already documented as promising is now actually
restored at boot, so a future failure of one disk in a split-shards
layout no longer takes the other disk's shards with it.

Tests cover the orphan-layout mirror (dir0 receives the .ecx / .ecj /
.vif from dir1) and idempotency (an existing destination .ecx is not
overwritten with the owner's copy).

* fix(ec): handle legacy pre-dir.idx sidecar layout in mirror skip-check

hasAllEcSidecarsLocally checked only the modern destination path
(IdxDirectory for .ecx/.ecj, Directory for .vif). A destination disk
that still had a legacy .ecx in its data dir (written before -dir.idx
was set) would report "not present" and the mirror would write a
second copy to IdxDirectory, leaving two .ecx files on disk.

Matches HasEcxFileOnDisk's open-with-fallback contract: check the
modern path first, then the opposite directory. Factored the
exists-and-not-a-dir check into a small statRegular helper so the
fallback ladder stays readable.

* rust(seaweed-volume): mirror EC sidecars onto shard-bearing disks at startup

Port of the Go fix (commit 088e26ea6) to the Rust volume server.
Adds Store::mirror_ec_metadata_to_shard_disks, called from
add_location / load_new_volumes before the cross-disk orphan
reconciler. Physically copies .ecx / .ecj / .vif from the disk that
owns the index files onto every disk holding shards but missing
sidecars, so each shard-bearing disk ends up self-contained.

The reconciler now prefers the local idx_directory when the mirror
has installed a .ecx there; the cross-disk virtual mount remains as
the fallback for volumes whose mirror failed (read-only target, out
of space, partial copy on a previous boot). Adds ec_local_ecx_path
helper shared between reconcile and mirror to detect the post-mirror
fast path.

Mirrors the Go-side fallback in hasAllEcSidecarsLocally: when
-dir.idx is configured and the destination still has a legacy .ecx
in its data dir, that's recognized so the mirror does not write a
duplicate copy into idx_directory.

Tests cover the two key cases: orphan layout (dir0 receives the
sidecars from dir1) and idempotency (a pre-existing destination .ecx
is not overwritten).

* trim verbose comments on EC mirror code

Comments now lead with the WHY (non-obvious constraints, the
post-mirror fast path, why local copies are authoritative) and drop
restate-the-code blocks, headers, and section dividers. Behavior is
unchanged; all existing tests still pass on both the Go volume
server and the seaweed-volume Rust port.

* drop github issue refs from added comments

Two stray "#9212" references slipped into comments I added on the
cross-disk reconciler call site. The git log carries the issue
history; comments stand on their own.

* test(ec): accept rebuild on either disk after sidecar mirror

TestEcLifecycleAcrossMultipleDisks asserted the rebuilt shard 9 must
land at the disk-0 path. With the boot-time sidecar mirror, every
shard-bearing disk owns its own .ecx, so VolumeEcShardsRebuild now
picks whichever disk hosts the most shards — disk 1 in this layout
after the deletion. The shard can legitimately rebuild on either
disk; the test now accepts both and uses the chosen path for the
subsequent mount + read verification.
2026-05-17 19:55:15 -07:00

180 lines
5.4 KiB
Go

package storage
import (
"fmt"
"io"
"os"
"path/filepath"
"github.com/seaweedfs/seaweedfs/weed/glog"
"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
"github.com/seaweedfs/seaweedfs/weed/storage/needle"
)
// Listed in the order NewEcVolume opens them.
var ecMirroredSidecars = []string{".ecx", ".ecj", ".vif"}
// mirrorEcMetadataToShardDisks physically copies .ecx / .ecj / .vif
// onto every disk that holds EC shards but lacks the matching
// sidecars, so each shard-bearing disk mounts self-contained instead
// of reaching across to a sibling. Runs before
// reconcileEcShardsAcrossDisks; the cross-disk virtual mount stays
// as the fallback when mirroring fails.
func (s *Store) mirrorEcMetadataToShardDisks() {
if len(s.Locations) < 2 {
return
}
ecxOwners := s.indexEcxOwners()
if len(ecxOwners) == 0 {
return
}
for _, loc := range s.Locations {
orphans := loc.collectOrphanEcShards()
if len(orphans) == 0 {
continue
}
for key := range orphans {
owner, ok := ecxOwners[key]
if !ok {
continue
}
if owner.location == loc {
continue
}
if loc.hasAllEcSidecarsLocally(key.collection, key.vid) {
continue
}
copied, err := loc.mirrorEcSidecarsFrom(owner, key.collection, key.vid)
if err != nil {
glog.Warningf("ec volume %d (collection=%q): mirror sidecars from %s to %s failed after %d files: %v; cross-disk fallback will handle this volume",
key.vid, key.collection, owner.location.Directory, loc.Directory, copied, err)
continue
}
if copied > 0 {
glog.V(0).Infof("ec volume %d (collection=%q): mirrored %d sidecar(s) from %s to %s for same-disk invariant",
key.vid, key.collection, copied, owner.location.Directory, loc.Directory)
}
}
}
}
// hasAllEcSidecarsLocally checks both the modern routing and the
// opposite directory (legacy pre-`-dir.idx` layout) — without the
// fallback, a destination that still has .ecx in its data dir would
// be re-mirrored into IdxDirectory.
func (l *DiskLocation) hasAllEcSidecarsLocally(collection string, vid needle.VolumeId) bool {
for _, ext := range ecMirroredSidecars {
if statRegular(l.ecSidecarDestPath(collection, vid, ext)) {
continue
}
if l.IdxDirectory != l.Directory {
fallbackDir := l.Directory
if ext == ".vif" {
fallbackDir = l.IdxDirectory
}
if statRegular(erasure_coding.EcShardFileName(collection, fallbackDir, int(vid)) + ext) {
continue
}
}
return false
}
return true
}
func statRegular(path string) bool {
info, err := os.Stat(path)
return err == nil && !info.IsDir()
}
// ecSidecarDestPath routes .ecx/.ecj to IdxDirectory and .vif to
// Directory, matching NewEcVolume's open order.
func (l *DiskLocation) ecSidecarDestPath(collection string, vid needle.VolumeId, ext string) string {
if ext == ".vif" {
return erasure_coding.EcShardFileName(collection, l.Directory, int(vid)) + ext
}
return erasure_coding.EcShardFileName(collection, l.IdxDirectory, int(vid)) + ext
}
func (l *DiskLocation) mirrorEcSidecarsFrom(owner ecxOwnerInfo, collection string, vid needle.VolumeId) (int, error) {
srcIdxBase := erasure_coding.EcShardFileName(collection, owner.idxDir, int(vid))
srcDataBase := erasure_coding.EcShardFileName(collection, owner.location.Directory, int(vid))
copied := 0
for _, ext := range ecMirroredSidecars {
dst := l.ecSidecarDestPath(collection, vid, ext)
// An existing local copy is authoritative — it may be newer
// than the owner's after a delete journal append.
if _, err := os.Stat(dst); err == nil {
continue
} else if !os.IsNotExist(err) {
return copied, fmt.Errorf("stat %s: %w", dst, err)
}
var src string
for _, candidate := range []string{srcIdxBase + ext, srcDataBase + ext} {
if info, err := os.Stat(candidate); err == nil && !info.IsDir() {
src = candidate
break
}
}
if src == "" {
glog.V(1).Infof("ec volume %d (collection=%q): sidecar %s not found on owner %s; skipping mirror",
vid, collection, ext, owner.location.Directory)
continue
}
if err := copyEcSidecarAtomic(src, dst); err != nil {
return copied, fmt.Errorf("copy %s: %w", ext, err)
}
copied++
}
return copied, nil
}
// copyEcSidecarAtomic writes to <dst>.mirror.tmp, fsyncs, renames.
// Crash-safe: a partial write leaves the tmp orphaned and the
// canonical dst absent so retries recognise the file still needs
// copying.
func copyEcSidecarAtomic(src, dst string) error {
srcFile, err := os.Open(src)
if err != nil {
return fmt.Errorf("open source %s: %w", src, err)
}
defer srcFile.Close()
if err := os.MkdirAll(filepath.Dir(dst), 0o755); err != nil {
return fmt.Errorf("mkdir %s: %w", filepath.Dir(dst), err)
}
tmpDst := dst + ".mirror.tmp"
_ = os.Remove(tmpDst)
dstFile, err := os.OpenFile(tmpDst, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o644)
if err != nil {
return fmt.Errorf("create %s: %w", tmpDst, err)
}
cleanup := func() {
_ = dstFile.Close()
_ = os.Remove(tmpDst)
}
if _, err := io.Copy(dstFile, srcFile); err != nil {
cleanup()
return fmt.Errorf("copy bytes %s -> %s: %w", src, tmpDst, err)
}
if err := dstFile.Sync(); err != nil {
cleanup()
return fmt.Errorf("fsync %s: %w", tmpDst, err)
}
if err := dstFile.Close(); err != nil {
_ = os.Remove(tmpDst)
return fmt.Errorf("close %s: %w", tmpDst, err)
}
if err := os.Rename(tmpDst, dst); err != nil {
_ = os.Remove(tmpDst)
return fmt.Errorf("rename %s -> %s: %w", tmpDst, dst, err)
}
return nil
}