Skip to content

backup: reject incompatible online cluster restores - #174825

Open
shashi1973 wants to merge 1 commit into
cockroachdb:masterfrom
shashi1973:investigate/issue-174659-online-restore
Open

shashi1973 wants to merge 1 commit into
cockroachdb:masterfrom
shashi1973:investigate/issue-174659-online-restore

Conversation

@shashi1973

Copy link
Copy Markdown

Summary

Online cluster restore cannot rewrite descriptor IDs when backup SSTs retain their table prefixes.

Backups created with include_all_virtual_clusters use ElidePrefix_Tenant. This strips the tenant prefix but leaves the original table ID in each stored key. Online restore can rewrite the destination span and apply a synthetic tenant prefix, but linking the external SST does not rewrite the table ID embedded in every key.

The compatibility check previously accepted ElidePrefix_Tenant unconditionally. This could link data under incorrect keys, leave restored system-tenant tables empty, and later cause a panic while restoring system tables.

This change treats ElidePrefix_Tenant like ElidePrefix_None when descriptor IDs must change. The restore is rejected during planning with a FeatureNotSupported error, before incompatible SSTs are linked.

The existing successful online cluster restore coverage is preserved. A separate regression scenario creates a secondary tenant, backs up with include_all_virtual_clusters, and verifies that online cluster restore fails cleanly instead of panicking.

Fixes #174659

Tests

  • ./dev test pkg/backup -f=TestDataDriven_online_restore_cluster -v
  • ./dev test pkg/backup -f=TestDataDriven_online_restore_prefix_backups -v

Release note (bug fix): Online cluster restores now reject backups created with include_all_virtual_clusters when descriptor ID rewrites are required. This prevents system-tenant tables from appearing empty and avoids a panic during system table restoration.

Online restore cannot rewrite descriptor IDs when backup SSTs retain
their table prefixes. Reject these restores during planning instead of
linking data under incorrect keys.

Add regression coverage for a cluster backup containing a secondary
tenant.

Release note (bug fix): Online cluster restores now reject backups
created with `include_all_virtual_clusters` when descriptor ID rewrites
are required. This prevents system-tenant tables from appearing empty
and avoids a panic during system table restoration.
@shashi1973
shashi1973 requested a review from a team as a code owner September 8, 2026 04:36
@shashi1973
shashi1973 requested review from kev-cao and removed request for a team September 8, 2026 04:36
@blathers-crl

blathers-crl Bot commented Sep 8, 2026

Copy link
Copy Markdown

Thank you for contributing to CockroachDB. Please ensure you have followed the guidelines for creating a PR.

My owl senses detect your PR is good for review. Please keep an eye out for any test failures in CI.

🦉 Hoot! I am a Blathers, a bot for CockroachDB. My owner is dev-inf.

@blathers-crl blathers-crl Bot added the O-community Originated from the community label Sep 8, 2026
@shashi1973

shashi1973 commented Sep 17, 2026

Copy link
Copy Markdown
Author

Hi @kev-cao,

I wanted to follow up on this PR when you have an opportunity. Could you please review the implementation and let me know whether it adequately addresses the linked issue?

The implementation and relevant regression coverage are included, and the applicable tests pass locally. I would be glad to make any further changes or add additional test coverage based on your feedback.

Thank you for your time and review.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

O-community Originated from the community

Projects

None yet

Development

Successfully merging this pull request may close these issues.

backup: online cluster restore of system tenant restores misses data if backup contained secondary tenants

1 participant