mon/Monitor: do not join cluster that is >2 releases old

This enforces the N+2 upgrade rule from the mon's perspective.

Note that this safety check is not as safe as the OSDs.  Notably, we
start up our backend store (rocksdb) *before* we probe other monitors
and discover any newer monmap that tells us we shouldn't join.  If there
is a *rocksdb* backward-compatibility problem it is too late by this
point.  Unfortunately, I don't see an easy way to get this far before
rocksdb is read-write--not without a lot more code, at least!

However, we'll still protect against a whole class of other potential
problems by not getting involved in a cluster that is too old.  :)

Signed-off-by: Sage Weil <sage@redhat.com>

diff --git a/src/mon/Monitor.cc b/src/mon/Monitor.cc
index 0cd2938e302a333ab14928d3920008823cdf0abf..59af20fe580cae63e133b3d6842b3fdfa54b94ba 100644 (file)
--- a/src/mon/Monitor.cc
+++ b/src/mon/Monitor.cc
@@ -1102,6 +1102,16 @@ void Monitor::bootstrap()
   }
   dout(10) << "monmap " << *monmap << dendl;
 
+  if (monmap->min_mon_release &&
+      monmap->min_mon_release + 2 < (int)ceph_release()) {
+    derr << "current monmap has min_mon_release "
+        << ceph_release() << " (" << ceph_release_name(monmap->min_mon_release)
+        << ") which is >2 releases older than me " << ceph_release()
+        << " (" << ceph_release_name(ceph_release()) << "), stopping."
+        << dendl;
+    exit(0);
+  }
+
   // note my rank
   int newrank = monmap->get_rank(messenger->get_myaddrs());
   if (newrank < 0 && rank >= 0) {