Sync policies: controlling what replicates

Why this matters in production

Without sync policies, multisite replicates everything in a zonegroup to every zone. Sync policies make replication a per-bucket decision, which is what allows one deployment to serve buckets with different residency and redundancy requirements.

The model

sync policy group          ← a named policy, enabled or disabled
├── flow                   ← which zones data moves between
│   ├── directional        ← A → B
│   └── symmetrical        ← A ↔ B
└── pipe                   ← which buckets and objects the flow applies to

Policies exist at the zonegroup level (defaults) and at the bucket level (overrides).

A zonegroup default of no replication

radosgw-admin sync group create --group-id=default --status=allowed
radosgw-admin sync group flow create --group-id=default \
    --flow-id=sym --flow-type=symmetrical --zones=site-a,site-b
radosgw-admin sync group pipe create --group-id=default \
    --pipe-id=all --source-zones='*' --dest-zones='*'
radosgw-admin period update --commit

--status=allowed means replication is permitted but not enabled by default — buckets opt in individually. Setting it to enabled replicates everything; forbidden prevents it entirely.

Enabling replication for one bucket

radosgw-admin sync group create --bucket=important-data \
    --group-id=bucket-repl --status=enabled
radosgw-admin sync group pipe create --bucket=important-data \
    --group-id=bucket-repl --pipe-id=repl \
    --source-zones='*' --dest-zones='*'

radosgw-admin sync info --bucket=important-data

Now only important-data replicates, while other buckets in the zonegroup stay local.

Directional replication

radosgw-admin sync group flow create --group-id=default \
    --flow-id=a-to-b --flow-type=directional \
    --source-zone=site-a --dest-zone=site-b

Data moves from site-a to site-b and not back — a backup or archive relationship rather than an active-active one.

Prefix-scoped replication

radosgw-admin sync group pipe create --bucket=mixed \
    --group-id=partial --pipe-id=archive-only \
    --source-zones='*' --dest-zones='*' \
    --prefix=archive/

Only objects under the archive/ prefix replicate.

Verifying

radosgw-admin sync info --bucket=important-data
radosgw-admin sync group get --bucket=important-data
radosgw-admin bucket sync status --bucket=important-data

sync info shows the effective policy after combining zonegroup and bucket levels — which is what to check rather than either level alone.

Quiz

Production discipline

Default the zonegroup sync policy to allowed rather than enabled, so replication is an explicit per-bucket decision and buckets created later do not replicate by accident. Check sync info rather than the individual policy levels when verifying, since the effective behaviour is their composition.

Cross-course references

• Kubernetes: NetworkPolicy composition where a deny cannot be overridden follows the same layering
• Linux: layered firewall policies with a restrictive default behave identically