Add --disable-admin-operations flag in Compactor UI and Bucket UI

cmd/thanos/compact.go

@@ -678,6 +678,7 @@ type compactConfig struct {
 	skipBlockWithOutOfOrderChunks                  bool
 	progressCalculateInterval                      time.Duration
 	filterConf                                     *store.FilterConfig
+	disableAdminOperations                         bool
 }
 
 func (cc *compactConfig) registerFlag(cmd extkingpin.FlagClause) {
@@ -786,4 +787,6 @@ func (cc *compactConfig) registerFlag(cmd extkingpin.FlagClause) {
 	cc.webConf.registerFlag(cmd)
 
 	cmd.Flag("bucket-web-label", "External block label to use as group title in the bucket web UI").StringVar(&cc.label)
+
+	cmd.Flag("disable-admin-operations", "Restrict access to Block Mark deletion and no compaction").Default("false").BoolVar(&cc.disableAdminOperations)
 }

cmd/thanos/tools_bucket.go

@@ -112,13 +112,14 @@ type bucketLsConfig struct {
 }
 
 type bucketWebConfig struct {
-	webRoutePrefix      string
-	webExternalPrefix   string
-	webPrefixHeaderName string
-	webDisableCORS      bool
-	interval            time.Duration
-	label               string
-	timeout             time.Duration
+	webRoutePrefix         string
+	webExternalPrefix      string
+	webPrefixHeaderName    string
+	webDisableCORS         bool
+	interval               time.Duration
+	label                  string
+	timeout                time.Duration
+	disableAdminOperations bool
 }
 
 type bucketReplicateConfig struct {
@@ -203,6 +204,8 @@ func (tbc *bucketWebConfig) registerBucketWebFlag(cmd extkingpin.FlagClause) *bu
 	cmd.Flag("timeout", "Timeout to download metadata from remote storage").Default("5m").DurationVar(&tbc.timeout)
 
 	cmd.Flag("label", "External block label to use as group title").StringVar(&tbc.label)
+
+	cmd.Flag("disable-admin-operations", "Restrict access to Block Mark deletion and no compaction").Default("false").BoolVar(&tbc.disableAdminOperations)
 	return tbc
 }
 

pkg/api/blocks/v1.go

@@ -25,12 +25,13 @@ import (
 
 // BlocksAPI is a very simple API used by Thanos Block Viewer.
 type BlocksAPI struct {
-	baseAPI          *api.BaseAPI
-	logger           log.Logger
-	globalBlocksInfo *BlocksInfo
-	loadedBlocksInfo *BlocksInfo
-	disableCORS      bool
-	bkt              objstore.Bucket
+	baseAPI                *api.BaseAPI
+	logger                 log.Logger
+	globalBlocksInfo       *BlocksInfo
+	loadedBlocksInfo       *BlocksInfo
+	disableCORS            bool
+	bkt                    objstore.Bucket
+	disableAdminOperations bool
 }
 
 type BlocksInfo struct {
@@ -61,6 +62,7 @@ func parse(s string) ActionType {
 
 // NewBlocksAPI creates a simple API to be used by Thanos Block Viewer.
 func NewBlocksAPI(logger log.Logger, disableCORS bool, label string, flagsMap map[string]string, bkt objstore.Bucket) *BlocksAPI {
+	disableAdminOperations := flagsMap["disable-admin-operations"] == "true"
 	return &BlocksAPI{
 		baseAPI: api.NewBaseAPI(logger, disableCORS, flagsMap),
 		logger:  logger,
@@ -72,8 +74,9 @@ func NewBlocksAPI(logger log.Logger, disableCORS bool, label string, flagsMap ma
 			Blocks: []metadata.Meta{},
 			Label:  label,
 		},
-		disableCORS: disableCORS,
-		bkt:         bkt,
+		disableCORS:            disableCORS,
+		bkt:                    bkt,
+		disableAdminOperations: disableAdminOperations,
 	}
 }
 
@@ -87,6 +90,9 @@ func (bapi *BlocksAPI) Register(r *route.Router, tracer opentracing.Tracer, logg
 }
 
 func (bapi *BlocksAPI) markBlock(r *http.Request) (interface{}, []error, *api.ApiError, func()) {
+	if bapi.disableAdminOperations {
+		return nil, nil, &api.ApiError{Typ: api.ErrorBadData, Err: errors.New("Admin operations are disabled")}, func() {}
+	}
 	idParam := r.FormValue("id")
 	actionParam := r.FormValue("action")
 	detailParam := r.FormValue("detail")

pkg/ui/react-app/src/thanos/pages/blocks/BlockDetails.tsx

@@ -4,6 +4,8 @@ import styles from './blocks.module.css';
 import moment from 'moment';
 import { Button, Modal, ModalBody, Form, Input, ModalHeader, ModalFooter } from 'reactstrap';
 import { download } from './helpers';
+import { FlagMap } from '../../../pages/flags/Flags';
+import { useFetch } from '../../../hooks/useFetch';
 
 export interface BlockDetailsProps {
   block: Block | undefined;
@@ -40,6 +42,9 @@ export const BlockDetails: FC<BlockDetailsProps> = ({ block, selectBlock }) => {
     }
   };
 
+  const { response: flagsRes } = useFetch<FlagMap>(`/api/v1/status/flags`);
+  const disableAdminOperations = flagsRes?.data?.['disable-admin-operations'] || false;
+
   return (
     <div className={`${styles.blockDetails} ${block && styles.open}`}>
       {block && (
@@ -100,26 +105,30 @@ export const BlockDetails: FC<BlockDetailsProps> = ({ block, selectBlock }) => {
               <Button>Download meta.json</Button>
             </a>
           </div>
-          <div style={{ marginTop: '12px' }}>
-            <Button
-              onClick={() => {
-                setModalAction('DELETION');
-                setDetailValue('');
-              }}
-            >
-              Mark Deletion
-            </Button>
-          </div>
-          <div style={{ marginTop: '12px' }}>
-            <Button
-              onClick={() => {
-                setModalAction('NO_COMPACTION');
-                setDetailValue('');
-              }}
-            >
-              Mark No Compaction
-            </Button>
-          </div>
+          {!disableAdminOperations && (
+            <div style={{ marginTop: '12px' }}>
+              <Button
+                onClick={() => {
+                  setModalAction('DELETION');
+                  setDetailValue('');
+                }}
+              >
+                Mark Deletion
+              </Button>
+            </div>
+          )}
+          {!disableAdminOperations && (
+            <div style={{ marginTop: '12px' }}>
+              <Button
+                onClick={() => {
+                  setModalAction('NO_COMPACTION');
+                  setDetailValue('');
+                }}
+              >
+                Mark No Compaction
+              </Button>
+            </div>
+          )}
           <Modal isOpen={!!modalAction}>
             <ModalBody>
               <ModalHeader toggle={() => setModalAction('')}>