backup: reject incompatible online cluster restores - #174825
Open
shashi1973 wants to merge 1 commit into
Open
shashi1973 wants to merge 1 commit into
shashi1973 wants to merge 1 commit into
Conversation
Online restore cannot rewrite descriptor IDs when backup SSTs retain their table prefixes. Reject these restores during planning instead of linking data under incorrect keys. Add regression coverage for a cluster backup containing a secondary tenant. Release note (bug fix): Online cluster restores now reject backups created with `include_all_virtual_clusters` when descriptor ID rewrites are required. This prevents system-tenant tables from appearing empty and avoids a panic during system table restoration.
|
Thank you for contributing to CockroachDB. Please ensure you have followed the guidelines for creating a PR. My owl senses detect your PR is good for review. Please keep an eye out for any test failures in CI. 🦉 Hoot! I am a Blathers, a bot for CockroachDB. My owner is dev-inf. |
Author
|
Hi @kev-cao, I wanted to follow up on this PR when you have an opportunity. Could you please review the implementation and let me know whether it adequately addresses the linked issue? The implementation and relevant regression coverage are included, and the applicable tests pass locally. I would be glad to make any further changes or add additional test coverage based on your feedback. Thank you for your time and review. |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Online cluster restore cannot rewrite descriptor IDs when backup SSTs retain their table prefixes.
Backups created with
include_all_virtual_clustersuseElidePrefix_Tenant. This strips the tenant prefix but leaves the original table ID in each stored key. Online restore can rewrite the destination span and apply a synthetic tenant prefix, but linking the external SST does not rewrite the table ID embedded in every key.The compatibility check previously accepted
ElidePrefix_Tenantunconditionally. This could link data under incorrect keys, leave restored system-tenant tables empty, and later cause a panic while restoring system tables.This change treats
ElidePrefix_TenantlikeElidePrefix_Nonewhen descriptor IDs must change. The restore is rejected during planning with aFeatureNotSupportederror, before incompatible SSTs are linked.The existing successful online cluster restore coverage is preserved. A separate regression scenario creates a secondary tenant, backs up with
include_all_virtual_clusters, and verifies that online cluster restore fails cleanly instead of panicking.Fixes #174659
Tests
./dev test pkg/backup -f=TestDataDriven_online_restore_cluster -v./dev test pkg/backup -f=TestDataDriven_online_restore_prefix_backups -vRelease note (bug fix): Online cluster restores now reject backups created with
include_all_virtual_clusterswhen descriptor ID rewrites are required. This prevents system-tenant tables from appearing empty and avoids a panic during system table restoration.