Skip to content

kvserver: intent resolution by IntentResolver (at least batcher) does not use the tenant of the range for admission control #135853

@sumeerbhola

Description

@sumeerbhola

mvccGCQueue, when resolving intents, sets a AdmissionHeader using a gcAdmissionHeader. An AdmissionHeader does not include a tenantID since it is supposed to be extracted in Node.Batch using roachpb.ClientTenantFromContext(ctx). AFAIK, we don't provide a context in this case that includes the tenantID of the range. This means the intent resolution will be charged to the system tenant.

For proper inter-tenant isolation, intent resolution in this case should use the range's tenant.

This is motivated by an escalation -- e.g. see thread https://cockroachlabs.slack.com/archives/C081JBE946P/p1732121444459029?thread_ts=1732114829.937389&cid=C081JBE946P

Edit: I've changed the title of this issue. The IntentResolver.irBatcher which batches requests to a range, does not use the tenant of the range. It is also unclear whether non-batched intent resolution is using the tenant either.

Jira issue: CRDB-44749

Metadata

Metadata

Assignees

Labels

A-kv-transactionsRelating to MVCC and the transactional model.C-enhancementSolution expected to add code/behavior + preserve backward-compat (pg compat issues are exception)O-postmortemOriginated from a Postmortem action item.O-supportWould prevent or help troubleshoot a customer escalation - bugs, missing observability/tooling, docsP-3Issues/test failures with no fix SLAT-kvKV Teambranch-release-25.2branch-release-25.3Used to mark GA and release blockers and technical advisories for 25.3target-release-25.3.3target-release-25.4.0v25.4.0-prerelease

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions