astelm/minio
1
0
Fork 0
mirror of https://github.com/pgsty/minio.git synced 2026-10-31 21:02:06 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(replication): recover physical creation time and align policy status

Browse Source 
An independent adversarial review of the bucket metadata convergence
work found three defects it had introduced.

GetBucketInfo overwrote the physical creation probe with cached
metadata, which a bucket that never held a configuration legitimately
lacks. The new creation-time requirement then failed every policy, tag,
SSE, quota, versioning and Object Lock write on such a bucket, with no
operator recovery path, and initial synchronization skipped it silently.
Return the physical result unchanged when metadata is not requested, as
ListBuckets already does, recover the time during initial
synchronization, and pass it to MakeBucketHook so peers adopt the same
bucket generation.

Replication status compared parsed policies statement by statement while
heal compares the canonical key. An upgraded peer that stored an
equivalent statement order was therefore reported as mismatched forever,
and heal never had anything to write. Compare the key heal compares;
per-site presence counting is unchanged.

Heal diagnostics shared one log key across four conditions, so a real
peer RPC failure could be deduplicated away by an earlier message, and
they were logged at error level for the normal transient of a peer that
does not have the bucket yet. Give each reason its own key at warning
level, report only a field state that exists and still cannot be
ordered, and diagnose nothing when no site holds a state to propagate.

The recovery test now runs against the real ObjectLayer; the stub it
replaced returned the expected time and hid the defect. The policy
status test uses a statement order the canonical encoder reorders, and
adoption coverage is extended past a real field time.

Signed-off-by: Feng Ruohang <rh@vonng.com>
This commit is contained in:
Feng Ruohang
2026-09-12 13:50:49 +08:00
parent 1ee64a8d89
commit 62cf066ff5
8 changed files with 206 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/site-replication-metadata.go
+20 -16
View File
@@ -39,7 +39,7 @@ func logBucketConfigReplication(ctx context.Context, bucket, file, reason string
req.AppendTags("created", created.UTC().Format(time.RFC3339Nano))
req.AppendTags("detail", detail)
replLogOnceIf(logger.SetReqInfo(ctx, req), errors.New("bucket metadata replication: "+reason),
"bucket-metadata/"+bucket+"/"+file+"/"+reason)
"bucket-metadata/"+bucket+"/"+file+"/"+reason, logger.WarningKind)
}
func initialBucketConfigReplicationEvent(meta BucketMetadata, file string) (madmin.SRBucketMeta, bool, error) {
@@ -131,27 +131,32 @@ func (c *SiteReplicationSys) healBucketConfig(ctx context.Context, bucket, file
if !c.enabled {
return nil
}
for id := range info.Sites {
if _, present := info.BucketStats[bucket][id]; !present {
logBucketConfigReplication(ctx, bucket, file, "indeterminate", time.Time{}, time.Time{}, "missing peer "+id)
}
}
for id, status := range info.BucketStats[bucket] {
state, err := bucketConfigStateFromInfo(bucket, file, status.meta.SRBucketInfo)
_, known := info.Sites[id]
if !known || id == "" || err != nil || !state.valid {
logBucketConfigReplication(ctx, bucket, file, "indeterminate", state.at, status.meta.CreatedAt, "unusable peer "+id)
}
}
latest, found := latestBucketConfig(bucket, file, info)
if !found {
// No site holds a state worth propagating for this field, so a peer
// that did not report or cannot be ordered is not actionable either.
return nil
}
// Every reason keeps its own log key, so a site that did not report cannot
// deduplicate away an unusable peer state or a real heal RPC failure for
// the same bucket and field.
for id := range info.Sites {
if _, present := info.BucketStats[bucket][id]; !present {
logBucketConfigReplication(ctx, bucket, file, "unreachable", latest.at, time.Time{}, "peer "+id+" did not report")
}
}
for id, status := range info.BucketStats[bucket] {
if _, known := info.Sites[id]; !known || id == "" {
continue
}
target := status.meta.SRBucketInfo
current, currentErr := bucketConfigStateFromInfo(bucket, file, target)
// A peer without the bucket reports neither a field nor a creation
// time; bucket healing covers that normal transient. Report only a
// state that exists and still cannot be ordered.
if currentErr != nil || (!current.valid && (len(current.data) != 0 || !current.at.IsZero())) {
logBucketConfigReplication(ctx, bucket, file, "indeterminate", current.at, target.CreatedAt, "unusable peer "+id)
}
if target.CreatedAt.IsZero() {
continue
}
@@ -166,8 +171,7 @@ func (c *SiteReplicationSys) healBucketConfig(ctx context.Context, bucket, file
if err != nil || !incoming.candidate() {
continue
}
current, err := bucketConfigStateFromInfo(bucket, file, target)
if err == nil && compareBucketConfigStates(incoming, current) <= 0 {
if currentErr == nil && compareBucketConfigStates(incoming, current) <= 0 {
continue
}
if id == globalDeploymentID() {
@@ -182,7 +186,7 @@ func (c *SiteReplicationSys) healBucketConfig(ctx context.Context, bucket, file
if err != nil {
// A missing credential or unreachable peer must not abandon the other
// targets simply because it happened to be visited first in this map.
logBucketConfigReplication(ctx, bucket, file, "indeterminate", latest.at, target.CreatedAt, "peer "+id+": "+err.Error())
logBucketConfigReplication(ctx, bucket, file, "peer-error", latest.at, target.CreatedAt, "peer "+id+": "+err.Error())
}
}
return nil