Discussion: Should the default data_directory: hummock001 be removed？

[huangjw806]

Yesterday cloud found a Risingwave data directory got overwritten issue.

This is because the kernel has changed the configuration, but the cloud has not been modified synchronously, and data_directory is not provided, and the kernel will use hummock001 as the default value, which will cause data overwritten.

This parameter is too important, should the default value be removed to avoid risks?

[fuyufjh]

Agree.

By the way, so it sounds like multiple tenants share the same S3 bucket, right?

[huangjw806]

multiple tenants share the same S3 bucket, right?

Yes, now the cloud is designed like this.

[fuyufjh]

multiple tenants share the same S3 bucket, right?

Yes, now the cloud is designed like this.

Not sure whether this is a good design. Especially considering

1. Isolation of resource. Performance of different tenants should not intervene with each other.
2. Permission control. We are considering to let the users to access the bucket in some cases directly, for example, run analytic queries via Spark/Presto. In this case, it seems to be painful to do permission control over the shared bucket.
3. Radius of impact of some extreme failure. For example, some software bugs or human error delete this bucket accidently, then all tenants are affected.

Anyway, this is another topic. We can fix this issue first and discuss this later.

[huangjw806]

The bucket quota limit should be the reason why cloud adopts this design.

[wjf3121]

Regarding sharing S3 bucket, there's a 1000 bucket number limit: https://docs.aws.amazon.com/AmazonS3/latest/userguide/BucketRestrictions.html

[Gun9niR]

We should deny uninitialized state_store as well.