admin/felhom-agent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

GL-5: explicit rootfs override for DR restore (live-discovered PVE constraint)

Browse Source 
The live validation hit PVE's all-or-nothing restore rule: mpN params
without an explicit rootfs -> HTTP 500 "mount points configured, but
'rootfs' not set" (the same constraint restoretest.go:211 documents for the
live-config path; the spike never ran an override restore). The lost guest
has no live config, so the rootfs SIZE now comes from the archive's own
embedded config via NEW Client.ExtractArchiveConfig (GET vzdump/
extractconfig - verified live: answers 200 under the scoped agent token;
PBS keys stay server-side, the spike's candidate-1 rejection holds; used
for the SIZE ONLY - the bind layout stays the platform constants).
Unparseable/unreadable archive config -> clean refusal before any restore.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
This commit is contained in:
authentik Default Admin
2026-07-08 09:02:36 +02:00
parent c12b512316
commit 3bf0110697
5 changed files with 122 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/reconcile/bringup.go
+32
View File
@@ -82,6 +82,22 @@ func structuralBootHostDir(stateDir string, vmid int) string {
return strings.TrimRight(stateDir, "/") + "/guests/" + strconv.Itoa(vmid) + "/bootstrap"
}
// archiveRootfsSizeGB parses the current-config "rootfs:" line out of an extracted archive config
// (raw pct-conf text) and returns its size in whole GB — 0 if absent/unparseable. Snapshot sections
// ("[name]") follow the current config; parsing stops at the first one so a snapshot's rootfs can
// never shadow the live value.
func archiveRootfsSizeGB(raw string) int {
for _, line := range strings.Split(raw, "\n") {
if strings.HasPrefix(line, "[") {
break
}
if v, ok := strings.CutPrefix(line, "rootfs:"); ok {
return rootfsSizeGB(strings.TrimSpace(v))
}
}
return 0
}
// configLockMaxAttempts bounds the F4 config-lock retry. configLockBackoff is a package var so
// tests can shrink it (the production value gives PVE time to release its async config lock).
const configLockMaxAttempts = 5
@@ -265,7 +281,23 @@ func (e *Engine) runBringUp(ctx context.Context, spec BringUpSpec, res *BringUpR
// back-half adds them post-bring-up) — that asymmetry is the whole GL-5 bug.
var overrides map[string]string
if spec.Mode == ModeDRGuestLoss {
// PVE refuses a restore that carries mountpoint params unless `rootfs` is ALSO explicit
// ("mount points configured, but 'rootfs' not set" — the same all-or-nothing constraint
// restoretest.go:211 documents for the live-config path; hit live in the GL-5 validation).
// The lost guest has no live config, so the rootfs SIZE comes from the archive's own
// embedded config — used for the SIZE ONLY; the bind LAYOUT stays the platform constants.
raw, err := e.api.ExtractArchiveConfig(ctx, spec.Archive)
if err != nil {
res.Err = fmt.Errorf("reconcile: bring-up dr: extract archive config (for the explicit rootfs size): %w", err)
return
}
sz := archiveRootfsSizeGB(raw)
if sz <= 0 {
res.Err = fmt.Errorf("reconcile: bring-up dr: archive config carries no parseable rootfs size — refusing a mount-override restore without an explicit rootfs")
return
}
overrides = map[string]string{
"rootfs": fmt.Sprintf("%s:%d", spec.RestoreStorage, sz),
structuralParentSlot: throwawayVolumeOverride(spec.RestoreStorage, structuralParentDir),
structuralBootSlot: throwawayVolumeOverride(spec.RestoreStorage, structuralBootGuestPath),
}