sql: block DROP TENANT based on a session var #99607
Conversation
|
This change is |
knz
force-pushed
the
20230326-drop-tenant
branch
4 times, most recently
from
885a6e9 to
6364cee
Compare
There was a problem hiding this comment.
Reviewed 6 of 6 files at r1, all commit messages.
Reviewable status:complete! 0 of 0 LGTMs obtained (waiting on @knz and @stevendanna)
pkg/sql/vars.go line 1547 at r1 (raw file):
// default value (false) to mean that tenant deletion is enabled. // This is needed for backward-compatibility with Cockroach Cloud. return fmt.Sprint(!enableDropTenant.Get(sv))
nit: maybe use formatBoolAsPostgresSetting?
pkg/sql/sessiondatapb/local_only_session_data.proto line 368 at r1 (raw file):
// prepared again. int64 prepared_statements_cache_size = 97;
nit: dangling spaces. Also this proto doesn't use empty lines between members.
In clusters where we will promote tenant management operations, we would like to ensure there is one extra step needed for administrators to drop a tenant (and thus irremedially lose data). Given that `sql_safe_updates` is not set automatically when users open their SQL session using their own client, we need another mechanism. This change introduces the new (hidden) session var, `disable_drop_tenant`. When set, tenant deletion fails with the following error message: ``` [email protected]:26257/movr> drop tenant foo; ERROR: rejected (via sql_safe_updates or disable_drop_tenant): DROP TENANT causes irreversible data loss SQLSTATE: 01000 ``` (The session var `sql_safe_updates` is _also_ included as a blocker in the mechanism so that folk using `cockroach sql` get double protection). The default value of this session var is `false` in single-tenant clusters (set via a cluster setting `sql.drop_tenant.enabled`), for compatibility with CC Serverless. The default will be set to `true` via a config profile when suitable. Release note: None
There was a problem hiding this comment.
Reviewable status:
pkg/sql/vars.go line 1547 at r1 (raw file):
Previously, yuzefovich (Yahor Yuzefovich) wrote…
nit: maybe use
formatBoolAsPostgresSetting?
Done.
pkg/sql/sessiondatapb/local_only_session_data.proto line 368 at r1 (raw file):
Previously, yuzefovich (Yahor Yuzefovich) wrote…
nit: dangling spaces. Also this proto doesn't use empty lines between members.
Done.
knz
force-pushed
the
20230326-drop-tenant
branch
from
6364cee to
bdc8d1a
Compare
There was a problem hiding this comment.
This looks reasonable to me.
Reviewed 4 of 6 files at r1, 2 of 2 files at r2, all commit messages.
Reviewable status:
|
TFYR! bors r=stevendanna |
|
Build failed (retrying...): |
|
Build failed (retrying...): |
|
Build failed (retrying...): |
|
Build failed (retrying...): |
|
bors r=stevendanna |
|
Already running a review |
|
bors r- |
|
Canceled. |
|
bors r=stevendanna single on |
|
Build failed (retrying...): |
There was a problem hiding this comment.
Reviewable status:
pkg/sql/exec_util.go line 764 at r2 (raw file):
var enableDropTenant = settings.RegisterBoolSetting( settings.SystemOnly, "sql.drop_tenant.enabled",
I'm curious - why doesn't this use the convention we use for other cluster settings that set default values for session vars? i.e., name it something like sql.defaults.disable_drop_tenant
|
Build succeeded: |
|
@rafiss because we now have a linter that blocks the introduction of settings named sql.defaults.*. |
|
I see now that this is SystemOnly and non-public, so I'm no longer concerned. I just thought it would be harder to find for users, but that concern doesn't apply here. |
Fixes #97972.
Epic: CRDB-23559
In clusters where we will promote tenant management operations, we would like to ensure there is one extra step needed for administrators to drop a tenant (and thus irremedially lose data). Given that
sql_safe_updatesis not set automatically when users open their SQL session using their own client, we need another mechanism.This change introduces the new (hidden) session var,
disable_drop_tenant. When set, tenant deletion fails with the following error message:(The session var
sql_safe_updatesis also included as a blocker in the mechanism so that folk usingcockroach sqlget double protection).The default value of this session var is
falsein single-tenant clusters, for compatibility with CC Serverless. It will be set totruevia a config profile (#98466) when suitable.Release note: None