Geo: invalid lfs object deletion on secondary when managed object replication is disabled

Summary

Customer has configured a primary and two secondary GitLab instances with Geo. They are using object storage in S3 for LFS objects, but are currently using AWS replication for the storage buckets rather than GitLab managed replication of the storage buckets. What they are seeing is that objects are replicated to the secondary bucket by AWS replication and then they are deleted by GitLab's Geo::RegistryConsistencyWorker on the secondary host.

This seems to be associated with a bug while finding the LFS Object for the current secondary site in https://gitlab.com/gitlab-org/gitlab/-/blob/master/ee/app/models/ee/lfs_object.rb#L43-47 when object storage is enabled, and GitLab's managed object replication is disabled. When sync object storage is disabled, we return only LFS object whether the file is stored locally, and this relation will not include the new LFS object that is on object storage. So, the Geo::RegistryConsistenceService triggers the deletion.

Workaround

Use GitLab managed object replication

Root cause

From !95937 (comment 1073517003):

The customer is experiencing the bug described in #371397 (closed) while importing Bitbucket projects. This happens because during the LFS objects import phase we:

1. Download the file into a temporary folder
2. Create an entry in the lfs_objects table with file_store = 1
3. Move the file to the object store
4. Update the file_store column

Since LfsObject.replicables_for_current_seconndary return only LFS objects whether the file is stored locally (file_store = 1) when the GitLab managed-replication is disabled, this relation will include the LFS object created in step 2 above and the Geo::RegistryConsistenceWorker will create a registry in the tracking database. The next time Geo::RegistryConsistenceWorker runs, it removes the registry rows improperly created due to the workflow described above. We can validate this locally following steps 1-11 in !95937 (merged), then:

1. In a Rails console session on your primary site, create an LFS object:

   > LfsObject.safe_find_or_create_by!(oid: 'f2b0a1e7550e9b718dafc9b525a04879a766de62e4fbdfc46593d47f7ab74642', size: 10.kilobytes)
   => #<LfsObject:0x00000001186819b0
   id: 6,
   oid: "f2b0a1e7550e9b718dafc9b525a04879a766de62e4fbdfc46593d47f7ab74642",
   size: 51200,
   created_at: Mon, 22 Aug 2022 23:32:13.297947000 UTC +00:00,
   updated_at: Mon, 22 Aug 2022 23:32:13.297947000 UTC +00:00,
   file: "a1e7550e9b718dafc9b525a04879a766de62e4fbdfc46593d47f7ab74642",
   file_store: 1,
   verification_checksum: nil>

2. In a Rails console session on your secondary site, check the latest Geo::LfsObjectRegistry record:

 > Geo::LfsObjectRegistry.last
 => #<Geo::LfsObjectRegistry:0x0000000130853000
  id: 6,
  created_at: Mon, 22 Aug 2022 23:32:16.167890000 UTC +00:00,
  retry_at: Mon, 22 Aug 2022 23:33:01.291105000 UTC +00:00,
  bytes: nil,
  lfs_object_id: 6,
  retry_count: 1,
  missing_on_primary: false,
  success: false,
  sha256: nil,
  state: 3,
  last_synced_at: Mon, 22 Aug 2022 23:32:16.166723000 UTC +00:00,
  last_sync_failure: "The file is missing on the Geo primary site",
  verification_started_at: nil,
  verified_at: nil,
  verification_retry_at: nil,
  verification_retry_count: 0,
  verification_state: 0,
  checksum_mismatch: false,
  verification_checksum: nil,
  verification_checksum_mismatched: nil,
  verification_failure: nil>

That's why we also have the same check introduced in this MR in the GitLab::Geo::Replication to avoid downloading unnecessary LFS objects.

If someone wants to go deeper into the current implementation, follow the method calls called in the workflow above:

1. Projects::ImportService#execute
2. Projects::ImportService#download_lfs_objects
3. Projects::LfsPointers::LfsImportService.new(project).execute
4. Projects::LfsDownloadService.new(project, lfs_download_object).execute
5. Projects::LfsDownloadService.find_or_create_lfs_object
6. LfsObject.safe_find_or_create_by!(oid: lfs_oid, size: lfs_size)
7. lfs_obj.update!(file: tmp_file) unless lfs_obj.file.file

The bug was introduced in !80007 (merged) and only affects the following scenarios on GitLab instances running version => 15.0.

1. LFS objects created while importing a project with object storage enabled and the GitLab managed replication disabled due to how we import those files.
2. If a customer is using the GitLab-managed replication to sync object storage, then disables it. The next time Geo::RegistryConsistenceWorker runs, it removes the registry rows and the file on object storage.