cluster_link: gate shadow-link role sync behind a feature flag#30976
Open
nguyen-andrew wants to merge 5 commits into
Open
cluster_link: gate shadow-link role sync behind a feature flag#30976nguyen-andrew wants to merge 5 commits into
nguyen-andrew wants to merge 5 commits into
Conversation
Gates the role-sync mode for shadow links so its replicated config is only written once every node supports it. Temporarily acknowledge the flag in PERTURB_ACKNOWLEDGED_FEATURES to satisfy the unfinalized-upgrade coverage guard. A follow-up commit will add an unfinalized upgrade test that exercises the feature instead.
ManualFinalizationUpgradeTest acknowledged shadow_link_role_sync as out of scope; promote it to an exercised feature so the upgrade gate is actually covered. Before finalize, assert DescribeRedpandaRoles is absent from ApiVersions and a validate-only role-sync config is refused with FAILED_PRECONDITION via the feature gate. After finalize, assert the feature auto-activates, the Kafka API is advertised, and the config gate no longer rejects.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR introduces a new cluster feature flag, shadow_link_role_sync, to keep shadow-link role sync configuration and the DescribeRedpandaRoles Kafka API inert until the cluster is fully upgraded (feature becomes active).
Changes:
- Adds
shadow_link_role_syncto the feature table (schema + string mapping) atrelease_version::v26_2_1. - Gates shadow-link role sync configuration on create/update in the admin shadow-link service unless the feature is active.
- Gates
DescribeRedpandaRolesby (a) removing it fromApiVersionsuntil active and (b) returningunsupported_versionfrom the handler until active, with unit + ducktape coverage.
Reviewed changes
Copilot reviewed 11 out of 11 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| tests/rptest/tests/cluster_linking_e2e_test.py | Adds an e2e test asserting role-sync config is rejected when the feature is inactive. |
| tests/rptest/tests/cluster_features_test.py | Extends unfinalized-upgrade perturbation coverage to exercise role-sync gating and post-finalize behavior. |
| src/v/redpanda/admin/services/shadow_link/shadow_link.cc | Adds server-side validation gate for role sync config based on feature activation. |
| src/v/kafka/server/tests/BUILD | Updates test build deps for new feature-table and protocol usage in tests. |
| src/v/kafka/server/tests/api_versions_test.cc | Adds a unit test ensuring the reserved API is removed from ApiVersions when gated. |
| src/v/kafka/server/handlers/describe_redpanda_roles.cc | Returns unsupported_version (with message) until shadow_link_role_sync is active. |
| src/v/kafka/server/handlers/api_versions.h | Exposes helper to remove reserved APIs based on feature state. |
| src/v/kafka/server/handlers/api_versions.cc | Implements reserved-API filtering for DescribeRedpandaRoles behind the feature flag. |
| src/v/features/tests/feature_table_test.cc | Adds string mapping test coverage for the new feature name. |
| src/v/features/feature_table.h | Adds the new feature bit and registers the feature spec in feature_schema. |
| src/v/features/feature_table.cc | Adds to_string_view mapping for shadow_link_role_sync. |
Collaborator
CI test resultstest results on build#86559
|
nguyen-andrew
requested review from
bartoszpiekny-redpanda,
dotnwat,
mnajda-redpanda and
pgellert
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a
shadow_link_role_syncfeature flag and gates shadow-link rolesync behind it, so the per-link
role_sync_cfgand theDescribeRedpandaRolesKafka API stay inert until the cluster is fullyupgraded.
features:new flag atrelease_version::v26_2_1,available_policy::always/prepare_policy::always.redpanda/admin/shadow_link:check_role_sync_supported()oncreate/update rejects non-empty
role_name_filtersuntil the flag isactive; empty filters stay inert.
kafka:theDescribeRedpandaRoleshandler returnsunsupported_version, and the reserved API is filtered out of theApiVersionsresponse, until the flag is active.and for gating across finalization.
Fixes CORE-16767
Backports Required
Release Notes