'Immutable bit' on pools to prevent deletion

[Wido den Hollander <wido@42on.com>]

Hi,

Although the userland tools like 'ceph' and 'rados' have a safeguard
against fat fingers when it comes to removing a pool there is no such
safeguard when using native librados.

The danger still exists that by accident you remove a pool which is then
completely gone, no way to restore it.

This is still something I find quite dangerous, so I was thinking about
a additional 'Immutable bit' which could be set on a pool before
rados_pool_delete() allows this pool to be removed.

Is it a sane thing to look at 'features' which pools could have? Other
features which might be set on a pool:

- Read Only (all write operations return -EPERM)
- Delete Protected

It's just that looking at a 20TB RBD pool and thinking that just one API
call could remove this pool make me a bit scared.

Am I the only one or is this something worth looking in to?

-- 
Wido den Hollander
42on B.V.
Ceph trainer and consultant

Phone: +31 (0)20 700 9902
Skype: contact42on