Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

etcdctl: add etcdctl snapshot pipe command #16243

Open
wants to merge 11 commits into
base: main
Choose a base branch
from

Conversation

Ais8Ooz8
Copy link

To improve the security of etcdctl. Added the ability to write snapshots to stdout without writing data to disk. Useful for read-only file systems.

Solves #16242

@Ais8Ooz8 Ais8Ooz8 force-pushed the main branch 2 times, most recently from ab01e0c to 11fb917 Compare July 14, 2023 22:51
Copy link
Member

@jmhbnz jmhbnz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for putting this proposal forward @Ais8Ooz8.

My initial feeling is that there is now unnecessary duplication here. Just as an idea we could maybe mostly refactor the SaveWithVersion and PipeWithVersion functions into a single new SaveSnapshotWithVersion function that accepts an additional io writer / file parameter?

This way, we could reuse most of the logic while providing flexibility in saving the snapshot to different destinations, such as an actual file or os.Stdout.

The implementations for Save vs Pipe would then become something roughly like this perhaps:

func SaveWithVersion(ctx context.Context, lg *zap.Logger, cfg clientv3.Config, dbPath string) (string, error) {
	file, err := os.OpenFile(dbPath+".part", os.O_WRONLY|os.O_CREATE|os.O_TRUNC, fileutil.PrivateFileMode)
	if err != nil {
		return "", fmt.Errorf("could not open %s (%v)", dbPath+".part", err)
	}
	defer os.RemoveAll(dbPath + ".part")
	defer file.Close()

	return SaveSnapshotWithVersion(ctx, lg, cfg, file)
}

func PipeWithVersion(ctx context.Context, lg *zap.Logger, cfg clientv3.Config) (string, error) {
	return SaveSnapshotWithVersion(ctx, lg, cfg, os.Stdout)
}

Just an idea and not tested at all so feel free to hold off until more people review.

@stale
Copy link

stale bot commented Oct 15, 2023

This issue has been automatically marked as stale because it has not had recent activity. It will be closed after 21 days if no further activity occurs. Thank you for your contributions.

@stale stale bot added the stale label Oct 15, 2023
@siyuanfoundation
Copy link
Contributor

This way, we could reuse most of the logic while providing flexibility in saving the snapshot to different destinations, such as an actual file or os.Stdout.

I agree with James. Much of the logic can be refactored by passing a file writer into SaveWithVersion.

@Ais8Ooz8 can you followup on this? Thanks!

@stale stale bot removed the stale label Mar 15, 2024
etcdctl: add etcdctl snapshot pipe command

To improve the security of etcdctl. Added the ability to write snapshots to stdout without writing data to disk.

Signed-off-by: Ais8Ooz8 <[email protected]>
@jmhbnz
Copy link
Member

jmhbnz commented Mar 18, 2024

/ok-to-test

To improve the security of etcdctl. Added the ability to write snapshots to stdout without writing data to disk.

Signed-off-by: Ais8Ooz8 <[email protected]>
@siyuanfoundation
Copy link
Contributor

/ok-to-test

@siyuanfoundation
Copy link
Contributor

@Ais8Ooz8 can you fix the fmt error? It is a nitty one about an empty line. Thanks!

To improve the security of etcdctl. Added the ability to write snapshots to stdout without writing data to disk.

Signed-off-by: Ais8Ooz8 <[email protected]>
@Ais8Ooz8
Copy link
Author

/retest

@Ais8Ooz8 Ais8Ooz8 requested a review from jmhbnz March 22, 2024 20:15
@siyuanfoundation
Copy link
Contributor

/lgtm

Copy link
Member

@jmhbnz jmhbnz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall looks good to me - Thanks @Ais8Ooz8. A couple small suggestions below if you have time.

Additionally - Given this is user facing new feature I would suggest we add an entry to https://github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.6.md#etcdctl-v3.

To improve the security of etcdctl. Added the ability to write snapshots to stdout without writing data to disk.

Signed-off-by: Ais8Ooz8 <[email protected]>
To improve the security of etcdctl. Added the ability to write snapshots to stdout without writing data to disk.

Signed-off-by: Ais8Ooz8 <[email protected]>
@jmhbnz
Copy link
Member

jmhbnz commented Mar 28, 2024

Discussed during sig-etcd triage - this is looking good, @ahrtr could you please take a look for final review?

@ahrtr
Copy link
Member

ahrtr commented Mar 28, 2024

Is there a real use case for the etcdctl snapshot pipe command? @Ais8Ooz8

@serathius
Copy link
Member

serathius commented Mar 29, 2024

QQ, isn't the UNIX convention to use - as a file name to mean writing to pipe? At least tar does it.
So that would be etcdctl snapshot safe -.

High level, I don't think we need a separate command, it can be just a flag.

To improve the security of etcdctl. Added the ability to write snapshots to stdout without writing data to disk.

Signed-off-by: Ais8Ooz8 <[email protected]>
To improve the security of etcdctl. Added the ability to write snapshots to stdout without writing data to disk.

Signed-off-by: Ais8Ooz8 <[email protected]>
To improve the security of etcdctl. Added the ability to write snapshots to stdout without writing data to disk.

Signed-off-by: Ais8Ooz8 <[email protected]>
To improve the security of etcdctl. Added the ability to write snapshots to stdout without writing data to disk.

Signed-off-by: Ais8Ooz8 <[email protected]>
@Ais8Ooz8
Copy link
Author

/retest

@Ais8Ooz8
Copy link
Author

@ahrtr Since most encryption and compression utilities work with standard streams, and s3 utilities have subcommands such as aws s3 cp - or mc pipe, it seems like a real use case because it can be used in a single pipeline.

@serathius I think tar uses - along as --files-from=- for stdin and --to-stdout for stdout. In general, I agree that we can use a flag instead of a subcommand. Let's discuss which solution would be the most elegant.

@Ais8Ooz8
Copy link
Author

/retest

To improve the security of etcdctl. Added the ability to write snapshots to stdout without writing data to disk.

Signed-off-by: Ais8Ooz8 <[email protected]>
@siyuanfoundation siyuanfoundation requested a review from ahrtr May 2, 2024 21:04
Copy link
Member

@ahrtr ahrtr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Thanks @Ais8Ooz8 for your first contribution!

@ahrtr
Copy link
Member

ahrtr commented May 3, 2024

Since @serathius has a comment on adding a flag instead of a new command, so leave to @serathius to take a second look.

Either a flag or a new command works for me. A new command is slight clearer, but not a big deal in this case.

@k8s-ci-robot
Copy link

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Development

Successfully merging this pull request may close these issues.

6 participants