Add a way to disable CMS (#27336)

pixcc · CyberROFL · web-flow · commit fcdbfe782a06 · 2025-10-27T16:00:56.000+03:00
Co-authored-by: Ilnaz Nizametdinov &lt;i.nizametdinov@gmail.com&gt;
diff --git a/ydb/core/cms/cms_impl.h b/ydb/core/cms/cms_impl.h
@@ -223,6 +223,17 @@ class TCms : public TActor<TCms>, public TTabletExecutedFlat {
         }
     }
 
+    #define HFuncChecked(TEvType, HandleFunc) \
+        case TEvType::EventType: { \
+            typename TEvType::TPtr* x = reinterpret_cast<typename TEvType::TPtr*>(&ev); \
+            if (State->Config.Enable) { \
+                HandleFunc(*x, this->ActorContext()); \
+            } else { \
+                ReplyWithError<TEvCms::TEvPermissionResponse>(*x, NKikimrCms::TStatus::ERROR_TEMP, "CMS is disabled", this->ActorContext()); \
+            } \
+            break; \
+        } Y_SEMICOLON_GUARD
+
     STFUNC(StateWork) {
         switch (ev->GetTypeRewrite()) {
             HFunc(TEvPrivate::TEvClusterInfo, Handle);
@@ -234,9 +245,9 @@ class TCms : public TActor<TCms>, public TTabletExecutedFlat {
             cFunc(TEvPrivate::EvStartCollecting, StartCollecting);
             cFunc(TEvPrivate::EvProcessQueue, ProcessQueue);
             FFunc(TEvCms::EvClusterStateRequest, EnqueueRequest);
-            HFunc(TEvCms::TEvPermissionRequest, CheckAndEnqueueRequest);
+            HFuncChecked(TEvCms::TEvPermissionRequest, CheckAndEnqueueRequest);
             HFunc(TEvCms::TEvManageRequestRequest, Handle);
-            HFunc(TEvCms::TEvCheckRequest, CheckAndEnqueueRequest);
+            HFuncChecked(TEvCms::TEvCheckRequest, CheckAndEnqueueRequest);
             HFunc(TEvCms::TEvManagePermissionRequest, Handle);
             HFunc(TEvCms::TEvConditionalPermissionRequest, CheckAndEnqueueRequest);
             HFunc(TEvCms::TEvNotification, CheckAndEnqueueRequest);
diff --git a/ydb/core/cms/cms_maintenance_api_ut.cpp b/ydb/core/cms/cms_maintenance_api_ut.cpp
@@ -371,6 +371,67 @@ Y_UNIT_TEST_SUITE(TMaintenanceApiTest) {
         UNIT_ASSERT_VALUES_EQUAL(actionState.status(), ActionState::ACTION_STATUS_PERFORMED);
         UNIT_ASSERT(actionState.action().has_cordon_action());
     }
+
+    Y_UNIT_TEST(DisableCMS){
+        TCmsTestEnv env(16);
+
+        auto r1 = env.CheckMaintenanceTaskCreate("task-1", Ydb::StatusIds::SUCCESS,
+            MakeActionGroup(
+                MakeLockAction(env.GetNodeId(0), TDuration::Minutes(10))
+            )
+        );
+        UNIT_ASSERT_VALUES_EQUAL(r1.action_group_states().size(), 1);
+        UNIT_ASSERT_VALUES_EQUAL(r1.action_group_states(0).action_states().size(), 1);
+        const auto &a1 = r1.action_group_states(0).action_states(0);
+        UNIT_ASSERT_VALUES_EQUAL(a1.status(), ActionState::ACTION_STATUS_PERFORMED);
+
+        // Pending task
+        auto r2 = env.CheckMaintenanceTaskCreate("task-2", Ydb::StatusIds::SUCCESS,
+            MakeActionGroup(
+                MakeLockAction(env.GetNodeId(0), TDuration::Minutes(10))
+            )
+        );
+        UNIT_ASSERT_VALUES_EQUAL(r2.action_group_states().size(), 1);
+        UNIT_ASSERT_VALUES_EQUAL(r2.action_group_states(0).action_states().size(), 1);
+        const auto &a2 = r2.action_group_states(0).action_states(0);
+        UNIT_ASSERT_VALUES_EQUAL(a2.status(), ActionState::ACTION_STATUS_PENDING);
+
+        // Disable CMS
+        NKikimrCms::TCmsConfig config;
+        config.SetEnable(false);
+        env.SetCmsConfig(config);
+
+        env.CheckCompleteAction(a1.action_uid(), Ydb::StatusIds::SUCCESS);
+
+        // Requests should fail
+        env.CheckMaintenanceTaskCreate("task-3", Ydb::StatusIds::UNAVAILABLE,
+            MakeActionGroup(
+                MakeLockAction(env.GetNodeId(0), TDuration::Minutes(10))
+            )
+        );
+        env.CheckMaintenanceTaskRefresh("task-2", Ydb::StatusIds::UNAVAILABLE);
+
+        // Enable CMS back
+        config.SetEnable(true);
+        env.SetCmsConfig(config);
+
+        // Requests should be ok
+        auto r3 = env.CheckMaintenanceTaskCreate("task-3", Ydb::StatusIds::SUCCESS,
+            MakeActionGroup(
+                MakeLockAction(env.GetNodeId(9), TDuration::Minutes(10))
+            )
+        );
+        UNIT_ASSERT_VALUES_EQUAL(r3.action_group_states().size(), 1);
+        UNIT_ASSERT_VALUES_EQUAL(r3.action_group_states(0).action_states().size(), 1);
+        const auto &a3 = r3.action_group_states(0).action_states(0);
+        UNIT_ASSERT_VALUES_EQUAL(a3.status(), ActionState::ACTION_STATUS_PERFORMED);
+
+        auto r4 = env.CheckMaintenanceTaskRefresh("task-2", Ydb::StatusIds::SUCCESS);
+        UNIT_ASSERT_VALUES_EQUAL(r4.action_group_states().size(), 1);
+        UNIT_ASSERT_VALUES_EQUAL(r4.action_group_states(0).action_states().size(), 1);
+        const auto &a4 = r4.action_group_states(0).action_states(0);
+        UNIT_ASSERT_VALUES_EQUAL(a4.status(), ActionState::ACTION_STATUS_PERFORMED);
+    }
 }
 
 } // namespace NKikimr::NCmsTest 
diff --git a/ydb/core/cms/cms_ut.cpp b/ydb/core/cms/cms_ut.cpp
@@ -2773,7 +2773,68 @@ Y_UNIT_TEST_SUITE(TCmsTest) {
         // tablet 'FLAT_BS_CONTROLLER' has too many unavailable nodes.
         env.CheckPermissionRequest("user", false, false, false, true, MODE_MAX_AVAILABILITY, TStatus::DISALLOW_TEMP,
                                    MakeAction(TAction::RESTART_SERVICES, env.GetNodeId(4), 60000000, "storage"));
-        
+    }
+
+    Y_UNIT_TEST(DisableCMS){
+        TCmsTestEnv env(16);
+
+        auto r1 = env.CheckPermissionRequest("user", false, false, true, true, TStatus::ALLOW,
+                                             MakeAction(TAction::SHUTDOWN_HOST, env.GetNodeId(0), 60000000));
+        UNIT_ASSERT_VALUES_EQUAL(r1.PermissionsSize(), 1);
+
+        // Scheduled request
+        auto r2 = env.CheckPermissionRequest("user", false, false, /* scheduled */ true, true, TStatus::DISALLOW_TEMP,
+                                             MakeAction(TAction::SHUTDOWN_HOST, env.GetNodeId(0), 60000000));
+
+        // Disable CMS
+        NKikimrCms::TCmsConfig config;
+        config.SetEnable(false);
+        env.SetCmsConfig(config);
+
+        env.CheckDonePermission("user", r1.GetPermissions(0).GetId());
+
+        // Requests should fail
+        env.CheckPermissionRequest("user", false, false, true, true, TStatus::ERROR_TEMP,
+                                   MakeAction(TAction::SHUTDOWN_HOST, env.GetNodeId(9), 60000000));
+        env.CheckRequest("user", r2.GetRequestId(), true, TStatus::ERROR_TEMP);
+
+        // Enable CMS back
+        config.SetEnable(true);
+        env.SetCmsConfig(config);
+
+        // Requests should be ok
+        auto r3 = env.CheckPermissionRequest("user", false, false, true, true, TStatus::ALLOW,
+                                   MakeAction(TAction::SHUTDOWN_HOST, env.GetNodeId(9), 60000000));
+        UNIT_ASSERT_VALUES_EQUAL(r3.PermissionsSize(), 1);
+        env.CheckRequest("user", r2.GetRequestId(), true, TStatus::ALLOW, 1);
+    }
+
+    Y_UNIT_TEST(WalleDisableCMS){
+        TCmsTestEnv env(16);
+
+        env.CheckWalleCreateTask("task-1", "reboot", false, TStatus::ALLOW, env.GetNodeId(0));
+
+        // Scheduled request
+        env.CheckWalleCreateTask("task-2", "reboot", false, TStatus::DISALLOW_TEMP, env.GetNodeId(0));
+
+        // Disable CMS
+        NKikimrCms::TCmsConfig config;
+        config.SetEnable(false);
+        env.SetCmsConfig(config);
+
+        env.CheckWalleRemoveTask("task-1");
+
+        // Requests should fail
+        env.CheckWalleCreateTask("task-3", "reboot", false, TStatus::ERROR_TEMP, env.GetNodeId(9));
+        env.CheckWalleCheckTask("task-2", TStatus::ERROR_TEMP);
+
+        // Enable CMS back
+        config.SetEnable(true);
+        env.SetCmsConfig(config);
+
+        // Requests should be ok
+        env.CheckWalleCreateTask("task-3", "reboot", false, TStatus::ALLOW, env.GetNodeId(9));
+        env.CheckWalleCheckTask("task-2", TStatus::ALLOW);
     }
 }
 
diff --git a/ydb/core/cms/cms_ut_common.h b/ydb/core/cms/cms_ut_common.h
@@ -506,6 +506,24 @@ class TCmsTestEnv : public TTestBasicRuntime {
         return CheckMaintenanceTaskCreate(taskUid, code, Ydb::Maintenance::AVAILABILITY_MODE_STRONG, actionGroups...);
     }
 
+    Ydb::Maintenance::ManageActionResult CheckCompleteAction(
+        const Ydb::Maintenance::ActionUid &actionUid,
+        Ydb::StatusIds::StatusCode code)
+    {
+        auto ev = std::make_unique<NCms::TEvCms::TEvCompleteActionRequest>();
+
+        auto *req = ev->Record.MutableRequest();
+        req->mutable_action_uids()->Add()->CopyFrom(actionUid);
+
+        SendToPipe(CmsId, Sender, ev.release(), 0, GetPipeConfigWithRetries());
+        TAutoPtr<IEventHandle> handle;
+        auto reply = GrabEdgeEventRethrow<NCms::TEvCms::TEvManageActionResponse>(handle);
+
+        const auto &rec = reply->Record;
+        UNIT_ASSERT_VALUES_EQUAL(rec.GetStatus(), code);
+        return rec.GetResult();
+    }
+
     void EnableBSBaseConfig();
     void DisableBSBaseConfig();
 
diff --git a/ydb/core/cms/config.h b/ydb/core/cms/config.h
@@ -257,6 +257,7 @@ struct TCmsLogConfig {
 };
 
 struct TCmsConfig {
+    bool Enable = true;
     TDuration DefaultRetryTime;
     TDuration DefaultPermissionDuration;
     TDuration DefaultWalleCleanupPeriod = TDuration::Minutes(1);
@@ -275,6 +276,7 @@ struct TCmsConfig {
     }
 
     void Serialize(NKikimrCms::TCmsConfig &config) const {
+        config.SetEnable(Enable);
         config.SetDefaultRetryTime(DefaultRetryTime.GetValue());
         config.SetDefaultPermissionDuration(DefaultPermissionDuration.GetValue());
         config.SetInfoCollectionTimeout(InfoCollectionTimeout.GetValue());
@@ -285,6 +287,7 @@ struct TCmsConfig {
     }
 
     void Deserialize(const NKikimrCms::TCmsConfig &config) {
+        Enable = config.GetEnable();
         DefaultRetryTime = TDuration::MicroSeconds(config.GetDefaultRetryTime());
         DefaultPermissionDuration = TDuration::MicroSeconds(config.GetDefaultPermissionDuration());
         InfoCollectionTimeout = TDuration::MicroSeconds(config.GetInfoCollectionTimeout());
diff --git a/ydb/core/cms/walle_api_handler.cpp b/ydb/core/cms/walle_api_handler.cpp
@@ -277,6 +277,12 @@ class TWalleCrateTaskHandler : public TActorBootstrapped<TWalleCrateTaskHandler>
             return false;
         }
 
+        if (status.GetCode() == TStatus::ERROR_TEMP) {
+            auto err = Sprintf("HTTP/1.1 503 Service Unavailable\r\n\r\n%s", status.GetReason().data());
+            ReplyWithError(err, ctx);
+            return false;
+        }
+
         auto err = Sprintf("HTTP/1.1 500 Internal Server Error\r\n\r\n%s", status.GetReason().data());
         ReplyWithError(err, ctx);
         return false;
diff --git a/ydb/core/protos/cms.proto b/ydb/core/protos/cms.proto
@@ -514,6 +514,7 @@ message TCmsConfig {
     optional uint64 InfoCollectionTimeout = 6 [default = 15000000];
     optional TLogConfig LogConfig = 7;
     optional TSentinelConfig SentinelConfig = 8;
+    optional bool Enable = 9 [default = true];
 }
 
 message TPDiskID {

Original file line number	Diff line number	Diff line change
`@@ -514,6 +514,7 @@ message TCmsConfig {`
`514`	`514`	`optional uint64 InfoCollectionTimeout = 6 [default = 15000000];`
`515`	`515`	`optional TLogConfig LogConfig = 7;`
`516`	`516`	`optional TSentinelConfig SentinelConfig = 8;`
	`517`	`+ optional bool Enable = 9 [default = true];`
`517`	`518`	`}`
`518`	`519`
`519`	`520`	`message TPDiskID {`