mon, doc: overriding ec profile requires --yes-i-really-mean-it

This is per https://tracker.ceph.com/issues/64333#note-17 describing
driving factors of a catastrophic cluster failure.

Signed-off-by: Radoslaw Zarzynski <rzarzyns@redhat.com>
(cherry picked from commit 629ba7bd349d48cdaa6d094751e7cfce651ba2bc)

diff --git a/doc/rados/operations/erasure-code-profile.rst b/doc/rados/operations/erasure-code-profile.rst
index 947b34c1f0064c99267204e4a51d25d70587fa90..a8f006398fa30cc71edadaac2fb4408796ef23e5 100644 (file)
--- a/doc/rados/operations/erasure-code-profile.rst
+++ b/doc/rados/operations/erasure-code-profile.rst
@@ -96,7 +96,9 @@ Where:
 ``--force``
 
 :Description: Override an existing profile by the same name, and allow
-              setting a non-4K-aligned stripe_unit.
+              setting a non-4K-aligned stripe_unit. Overriding an existing
+              profile can be dangerous, and thus ``--yes-i-really-mean-it``
+              must be used as well.
 
 :Type: String
 :Required: No.

diff --git a/src/mon/OSDMonitor.cc b/src/mon/OSDMonitor.cc
index 917e9c47d45e25e8b5f2426dfa53ccb020a30d01..518ce8c109a59d8bc3cd9cc2bf4cf4240b67372d 100644 (file)
--- a/src/mon/OSDMonitor.cc
+++ b/src/mon/OSDMonitor.cc
@@ -11302,6 +11302,8 @@ bool OSDMonitor::prepare_command_impl(MonOpRequestRef op,
          err = 0;
          goto reply_no_propose;
        }
+       bool force_no_fake = false;
+       cmd_getval(cmdmap, "yes_i_really_mean_it", force_no_fake);
        if (!force) {
          err = -EPERM;
          ss << "will not override erasure code profile " << name
@@ -11310,6 +11312,11 @@ bool OSDMonitor::prepare_command_impl(MonOpRequestRef op,
             << " is different from the proposed profile "
             << profile_map;
          goto reply_no_propose;
+       } else if (!force_no_fake) {
+         err = -EPERM;
+         ss << "overriding erasure code profile can be DANGEROUS"
+            << "; add --yes-i-really-mean-it to do it anyway";
+         goto reply_no_propose;
        }
       }