fix(decommission): rustfs shims v2 with explicit timeouts (stage 2 retry) #272

Merged
k.renner merged 1 commits from chore/rustfs-destroy-stage2b into master 2026-07-16 20:24:08 +00:00
Member

Runs 1180/1181 both failed identically: instant context deadline exceeded on the pre-destroy status GET, while pvesh get .../status/current answers in 0.7s on the node. Root cause: the bpg provider takes timeout_delete from STATE at destroy time, and importing the timeout-less stage-1 shims stored 0 — a zero-second context. (Import/plan use read-path timeouts, hence stage 1 looked clean. Provider timeout-handling weaknesses are a known theme: bpg issues #1621, #1620, discussion #1037.)

v2 shims declare all timeouts explicitly and mirror the real attributes (unprivileged=true matters — it is ForceNew, mirroring prevents a replace). One in-place apply writes the timeouts into state; then the follow-up PR deletes the file and the destroy has a real deadline.

After merge: plan (I verify in-place only, no replace) → apply → stage-2c file deletion PR → destroy apply → PVE final census.

tofu validate passes.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NV7bZzZLeoFUEdAeCSLEei

Runs 1180/1181 both failed identically: instant `context deadline exceeded` on the pre-destroy status GET, while `pvesh get .../status/current` answers in 0.7s on the node. Root cause: the bpg provider takes `timeout_delete` from STATE at destroy time, and importing the timeout-less stage-1 shims stored **0** — a zero-second context. (Import/plan use read-path timeouts, hence stage 1 looked clean. Provider timeout-handling weaknesses are a known theme: bpg issues #1621, #1620, discussion #1037.) v2 shims declare all timeouts explicitly and mirror the real attributes (`unprivileged=true` matters — it is ForceNew, mirroring prevents a replace). One in-place apply writes the timeouts into state; then the follow-up PR deletes the file and the destroy has a real deadline. After merge: plan (I verify in-place only, no replace) → apply → stage-2c file deletion PR → destroy apply → PVE final census. `tofu validate` passes. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01NV7bZzZLeoFUEdAeCSLEei
claude-bot added 1 commit 2026-07-16 19:58:06 +00:00
Both destroy applies (runs 1180/1181) died instantly with 'context
deadline exceeded' on the pre-destroy status GET while the PVE API
answers in <1s: the bpg provider reads timeout_delete from STATE at
destroy time, and the stage-1 import stored 0 for the timeout-less
shims — a zero-second context. Read paths carry their own timeout,
which is why import and plan were clean.

v2 declares all timeouts explicitly (one in-place, no-API update
writes them into state) and mirrors the real container attributes
(unprivileged=true is ForceNew — mirroring prevents a replace).
No ignore_changes this time: the timeout update must actually apply.
Flow: merge -> plan (must be in-place only) -> apply -> follow-up PR
deletes the file -> destroy apply.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NV7bZzZLeoFUEdAeCSLEei
k.renner merged commit d3841b6eb6 into master 2026-07-16 20:24:08 +00:00
Sign in to join this conversation.