Synchronize gpbackup history with the standby coordinator. - #111
Merged
Conversation
Keep the primary operation result while making database and row close failures visible.
Return connection, SQLite, and local cleanup failures to the policy boundary without changing best-effort exit status.
Disable automatic sync in shared helpers and restore the original standby history after the dedicated scenario.
Pass remote paths directly to rsync while retaining shell quoting for SSH install and cleanup commands.
woblerr
marked this pull request as ready for review
August 7, 2026 21:28
Collaborator
Author
|
PR is ready for review. |
MisterRaindrop
left a comment
MisterRaindrop
left a comment
There was a problem hiding this comment.
I found two issues in the standby history synchronization path.
Expose --history-sync-standby-timeout as integer seconds in gpbackup and sync-capable gpBackMan commands. Use int to match existing CLI conventions, default to 300 seconds, and cap values at one day to catch accidental settings without excluding slow transfers. Create one context deadline after SQLite snapshot validation and share its remaining budget across rsync and remote install. This keeps discovery and local snapshot work outside the limit and prevents each transport stage from restarting the timeout. Run rsync and ssh with CommandContext and BatchMode so stalled processes are terminated without waiting for interactive authentication. Use an independent 120-second context for failure cleanup so remote temporary files can still be removed after the transport deadline expires while cleanup remains bounded. Preserve both primary and cleanup errors and keep automatic synchronization best-effort while history-sync stays strict.
Pass remote paths with rsync's `-s` option so shell metacharacters are not interpreted by the remote shell, and document the resulting rsync 3.0.0 requirement.
When rsync or ssh succeeds and the context deadline fires immediately after, the successful transfer was incorrectly treated as a timeout. Only prefer ctx.Err() when the command itself returned an error.
Collaborator
Author
|
The following changes were made based on the review:
|
tuhaihe
pushed a commit
to tuhaihe/gpbackup
that referenced
this pull request
Sep 1, 2026
`gpbackup_history.db` is stored on the active primary coordinator and is not automatically available on the standby. After a failover, the promoted coordinator may have missing or outdated backup history, which affects backup discovery and management. This change keeps the cluster history database synchronized with an available standby coordinator: - `gpbackup` automatically synchronizes history after a successful backup. - gpBackMan automatically synchronizes history after commands that delete backups or clean history. - The new `gpbackman history-sync` command allows synchronization to be started manually. - Automatic synchronization is best-effort: failures are reported as warnings and do not change the result of a successful primary command. - Automatic synchronization can be disabled with `--no-history-sync-standby`. Only `gpbackup_history.db` is synchronized. Backup data, reports, and other backup artifacts are not included. Unit and end-to-end coverage were added, and the related user documentation was updated. Commit history: * Add gpbackman coordinator discovery helpers. * Add gpbackup standby history sync. * Add gpbackman standby history sync engine. * Add gpbackman history sync command and mutation hooks. * Add standby history sync end-to-end coverage. * Document standby history database synchronization. * Tighten standby history sync validation. * Log standby history sync cleanup errors. Keep the primary operation result while making database and row close failures visible. * Simplify the handling of history synchronization errors in standby mode. Return connection, SQLite, and local cleanup failures to the policy boundary without changing best-effort exit status. * Isolate standby history sync end-to-end coverage. Disable automatic sync in shared helpers and restore the original standby history after the dedicated scenario. * Simplify standby history synchronization documentation. * Fix standby history sync tests on macOS. * Fix gpbackman report-info examples. * Fix link in gpBackMan docs. * Fix standby history sync rsync destination. Pass remote paths directly to rsync while retaining shell quoting for SSH install and cleanup commands. * Add configurable standby history sync timeout. Expose --history-sync-standby-timeout as integer seconds in gpbackup and sync-capable gpBackMan commands. Use int to match existing CLI conventions, default to 300 seconds, and cap values at one day to catch accidental settings without excluding slow transfers. Create one context deadline after SQLite snapshot validation and share its remaining budget across rsync and remote install. This keeps discovery and local snapshot work outside the limit and prevents each transport stage from restarting the timeout. Run rsync and ssh with CommandContext and BatchMode so stalled processes are terminated without waiting for interactive authentication. Use an independent 120-second context for failure cleanup so remote temporary files can still be removed after the transport deadline expires while cleanup remains bounded. Preserve both primary and cleanup errors and keep automatic synchronization best-effort while history-sync stays strict. * Protect standby history sync rsync paths. Pass remote paths with rsync's `-s` option so shell metacharacters are not interpreted by the remote shell, and document the resulting rsync 3.0.0 requirement. * Guard standby history sync context error checks with command result. When rsync or ssh succeeds and the context deadline fires immediately after, the successful transfer was incorrectly treated as a timeout. Only prefer ctx.Err() when the command itself returned an error. * Extend standby history sync context error guards to gpbackup.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
closes: #90
gpbackup_history.dbis stored on the active primary coordinator and is not automatically available on the standby. After a failover, the promoted coordinator may have missing or outdated backup history, which affects backup discovery and management.This change keeps the cluster history database synchronized with an available standby coordinator:
gpbackupautomatically synchronizes history after a successful backup.gpbackman history-synccommand allows synchronization to be started manually.--no-history-sync-standby.Only
gpbackup_history.dbis synchronized. Backup data, reports, and other backup artifacts are not included.Unit and end-to-end coverage were added, and the related user documentation was updated.