Erik Grinaker 3c7235669a pageserver: don't delete parent shard files until split is committed (#12146) ...

## Problem

If a shard split fails and must roll back, the tenant may hit a cold
start as the parent shard's files have already been removed from local
disk.

External contribution with minor adjustments, see
https://neondb.slack.com/archives/C08TE3203RQ/p1748246398269309.

## Summary of changes

Keep the parent shard's files on local disk until the split has been
committed, such that they are available if the spilt is rolled back. If
all else fails, the files will be removed on the next Pageserver
restart.

This should also be fine in a mixed version:

* New storcon, old Pageserver: the Pageserver will delete the files
during the split, storcon will log an error when the cleanup detach
fails.

* Old storcon, new Pageserver: the Pageserver will leave the parent's
files around until the next Pageserver restart.

The change looks good to me, but shard splits are delicate so I'd like
some extra eyes on this.

2025-06-06 15:55:14 +00:00

..

client

storcon + safekeeper + scrubber: propagate root CA certs everywhere (#11418)

2025-04-04 06:30:48 +00:00

migrations

storcon: Introduce deletion tombstones to support flaky node scenario (#12096)

2025-06-06 10:16:55 +00:00

src

pageserver: don't delete parent shard files until split is committed (#12146)

2025-06-06 15:55:14 +00:00

Cargo.toml

storcon: add https API (#11239)

2025-03-20 08:22:02 +00:00