MDS: lock out snapshots until after a flag has been set in the MDSMap

This way users can't put snapshots on their clusters unless they explicitly
ask for the and have seen a warning message. We take a bit of the MDSMap
flags in order to do so. The only thing a little weird here is that anybody
who upgrades to this patch who already has snapshots will hit the EPERM
and have to go through the warning, but it doesn't impact existing snapshots
at all so they should be good.

Fixes: #6332

Signed-off-by: Greg Farnum <greg@inktank.com>

5 files changed, 24 insertions, 1 deletions

diff --git a/PendingReleaseNotes b/PendingReleaseNotes
index e7fcd7201bb..7d667f3ff59 100644
--- a/PendingReleaseNotes
+++ b/PendingReleaseNotes
@@ -1,2 +1,3 @@
-v0.69
+v0.70
 ~~~~~
+mds: disable adding snapshots by default. (re-enable them with "ceph mds allow_snaps")
\ No newline at end of file
diff --git a/src/include/ceph_fs.h b/src/include/ceph_fs.h
index 6c41d14f5da..ba0b5eb0f19 100644
--- a/src/include/ceph_fs.h
+++ b/src/include/ceph_fs.h
@@ -224,6 +224,7 @@ struct ceph_mon_subscribe_ack {
  * mdsmap flags
  */
 #define CEPH_MDSMAP_DOWN    (1<<0)  /* cluster deliberately down */
+#define CEPH_MDSMAP_ALLOW_SNAPS   (1<<1)  /* cluster allowed to create snapshots */
 
 /*
  * mds states
diff --git a/src/mds/Server.cc b/src/mds/Server.cc
index 466d4818456..cbbe2894ad3 100644
--- a/src/mds/Server.cc
+++ b/src/mds/Server.cc
@@ -7157,6 +7157,12 @@ struct C_MDS_mksnap_finish : public Context {
 /* This function takes responsibility for the passed mdr*/
 void Server::handle_client_mksnap(MDRequest *mdr)
 {
+  if (!mds->mdsmap->test_flag(CEPH_MDSMAP_ALLOW_SNAPS)) {
+    // you can't make snapshots until you set an option right now
+    reply_request(mdr, -EPERM);
+    return;
+  }
+
   MClientRequest *req = mdr->client_request;
   CInode *diri = mdcache->get_inode(req->get_filepath().get_ino());
   if (!diri || diri->state_test(CInode::STATE_PURGING)) {
diff --git a/src/mon/MDSMonitor.cc b/src/mon/MDSMonitor.cc
index b2273274521..8680d2ec096 100644
--- a/src/mon/MDSMonitor.cc
+++ b/src/mon/MDSMonitor.cc
@@ -920,6 +920,17 @@ bool MDSMonitor::prepare_command(MMonCommand *m)
       r = 0;
     }
 
+  } else if (prefix == "mds allow_snaps") {
+    string sure;
+    cmd_getval(g_ceph_context, cmdmap, "sure", sure);
+    if (sure != "--yes-i-really-mean-it") {
+      ss << "Snapshots are unstable and will probably break your FS! Add --yes-i-really-mean-it if you are sure";
+      r = -EPERM;
+    } else {
+      pending_mdsmap.set_flag(CEPH_MDSMAP_ALLOW_SNAPS);
+      ss << "turned on snaps";
+      r = 0;
+    }
   } else if (prefix == "mds add_data_pool") {
     int64_t poolid;
     cmd_getval(g_ceph_context, cmdmap, "poolid", poolid);
diff --git a/src/mon/MonCommands.h b/src/mon/MonCommands.h
index 365fd28b64e..3f0fd43fd39 100644
--- a/src/mon/MonCommands.h
+++ b/src/mon/MonCommands.h
@@ -274,6 +274,10 @@ COMMAND("mds compat rm_compat " \
 COMMAND("mds compat rm_incompat " \
 	"name=feature,type=CephInt,range=0", \
 	"remove incompatible feature", "mds", "rw", "cli,rest")
+COMMAND("mds allow_snaps " \
+        "name=sure,type=CephChoices,strings=--yes-i-really-mean-it,req=false", \
+        "allow snapshots to be created in CephFS", \
+        "mds", "w", "cli,rest")
 COMMAND("mds add_data_pool " \
 	"name=poolid,type=CephInt,range=0", \
 	"add data pool <poolid>", "mds", "rw", "cli,rest")