priyeshkaratha opened a new pull request, #10775: URL: https://github.com/apache/ozone/pull/10775
## What changes were proposed in this pull request? This design proposes a Manual Safe Mode for the Storage Container Manager (SCM), giving administrators an HDFS-style on-demand safe mode for maintenance and operational tasks. Today SCM enters safe mode only at startup and automatically leaves it once its exit rules (datanode registration, container-replica reporting, healthy pipelines, etc.) are satisfied. After that, the only way back into safe mode is a full SCM restart — which is disruptive, re-triggers all startup rules, and cannot be scoped to one node. Operators need a lighter mechanism to temporarily freeze SCM write operations (container allocation, pipeline creation) while continuing to serve reads — for example during disaster recovery, state inspection/repair, or coordinated maintenance windows. The doc describes introducing a second, independent reason for SCM to be in safe mode — manual — alongside the existing startup reason, where the effective state is simply startup OR manual. This is deliberately not a new client-visible mode: OM, the SDKs, and the S3 Gateway continue to observe a single "SCM is in safe mode" boolean with identical exceptions and retry behavior. The startup-vs-manual distinction is surfaced only through the admin CLI. Manual Safe Mode reuses the existing write-blocking and service-pause paths, never auto-exits, and requires an explicit ozone admin safemode exit. Following the HDFS NameNode model (dfsadmin -safemode enter, and -fs <host:port> to target one node), Manual Safe Mode is per-SCM local state: ozone admin safemode enter applies to all SCMs (client fan-out), while --scm host:port targets a single SCM. The doc covers the state model, automatic-exit neutralization, CLI, wire-protocol changes (an additive EnterSafeMode RPC plus an optional admin-only reason field on the existing InSafeMode response — fully backward compatible), SCM HA behavior, a Startup-vs-Manual comparison table, and the alternatives considered (including a Ratis-replicated global flag, rejected because it cannot express single-SCM targeting). ## What is the link to the Apache JIRA HDDS-12706 ## How was this patch tested? Doc generated by AI -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
