Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

pageserver: implement "emergency mode" for starting without a control plane #5381

Closed
Tracked by #5050
jcsp opened this issue Sep 26, 2023 · 0 comments · Fixed by #5469
Closed
Tracked by #5050

pageserver: implement "emergency mode" for starting without a control plane #5381

jcsp opened this issue Sep 26, 2023 · 0 comments · Fixed by #5469
Assignees
@jcsp
Labels
c/storage/pageserver Component: storage: pageserver t/feature Issue type: feature, for new features or requests

Comments

@jcsp
Copy link
Contributor

jcsp commented Sep 26, 2023

Dependency on:

Once we persist a LocationConf that contains a generation, then it is possible (but inadvisable) for the pageserver to start up and skip the re-attach call to the control plane.

This is only appropriate in a major incident where the time to recover the control plane would exceed an acceptable downtime for the pageservers.

This will be a global pageserver configuration property, which skips re-attach, and also skips attempts to validate deletions.
@jcsp jcsp added t/feature Issue type: feature, for new features or requests c/storage/pageserver Component: storage: pageserver labels Sep 26, 2023
@jcsp jcsp self-assigned this Sep 26, 2023
@jcsp jcsp mentioned this issue Sep 26, 2023
Closed
@jcsp jcsp mentioned this issue Oct 4, 2023
Merged
@jcsp jcsp closed this as completed in #5469 Oct 6, 2023
jcsp added a commit that referenced this issue Oct 6, 2023
@jcsp
pageserver: implement emergency mode for operating without control pl…
ea5a97e 
…ane (#5469)

## Problem

Pageservers with `control_plane_api` configured require a control plane
to start up: in an incident this might be a problem.

## Summary of changes

Note to reviewers: most of the code churn in mgr.rs is the refactor
commit that enables the later emergency mode commit: you may want to
review commits separately.

- Add `control_plane_emergency_mode` configuration property
- Refactor init_tenant_mgr to separate loading configurations from the
main loop where we construct Tenant, so that the generations fetch can
peek at the configs in emergency mode.
- During startup, in emergency mode, attach any tenants that were
attached on their last run, using the same generation number.

Closes: #5381 
Closes: #5492
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jcsp jcsp

Labels
c/storage/pageserver Component: storage: pageserver t/feature Issue type: feature, for new features or requests
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

pageserver: implement emergency mode for operating without control plane neondatabase/neon
1 participant
@jcsp