{"record":{"id":"daa66d6b1d6f2dc4","repo":"vitessio/vitess","slug":"type-primary-cannot-take-backup-if-you-really-nee","errorCode":null,"errorMessage":"type PRIMARY cannot take backup. if you really need to do this, rerun the backup command with --allow-primary","messagePattern":"type PRIMARY cannot take backup\\. if you really need to do this, rerun the backup command with --allow-primary","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"go/vt/vttablet/tabletmanager/rpc_backup.go","lineNumber":57,"sourceCode":"\nconst (\n\tbackupModeOnline  = \"online\"\n\tbackupModeOffline = \"offline\"\n)\n\n// Backup takes a db backup and sends it to the BackupStorage.\nfunc (tm *TabletManager) Backup(ctx context.Context, logger logutil.Logger, req *tabletmanagerdatapb.BackupRequest) error {\n\tif tm.Cnf == nil {\n\t\treturn errors.New(\"cannot perform backup without my.cnf, please restart vttablet with a my.cnf file specified\")\n\t}\n\n\t// Check tablet type current process has.\n\t// During a network partition it is possible that from the topology perspective this is no longer the primary,\n\t// but the process didn't find out about this.\n\t// It is not safe to take backups from tablet in this state\n\tcurrentTablet := tm.Tablet()\n\tif !req.AllowPrimary && currentTablet.Type == topodatapb.TabletType_PRIMARY {\n\t\treturn errors.New(\"type PRIMARY cannot take backup. if you really need to do this, rerun the backup command with --allow-primary\")\n\t}\n\n\tbackupEngine := \"\"\n\tif req.BackupEngine != nil {\n\t\tbackupEngine = *req.BackupEngine\n\t}\n\n\tengine, err := mysqlctl.GetBackupEngine(backupEngine)\n\tif err != nil {\n\t\treturn vterrors.Wrap(err, \"failed to find backup engine\")\n\t}\n\t// Get Tablet info from topo so that it is up to date\n\ttablet, err := tm.TopoServer.GetTablet(ctx, tm.tabletAlias)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif !req.AllowPrimary && tablet.Type == topodatapb.TabletType_PRIMARY {\n\t\treturn errors.New(\"type PRIMARY cannot take backup. if you really need to do this, rerun the backup command with --allow-primary\")","sourceCodeStart":39,"sourceCodeEnd":75,"githubUrl":"https://github.com/vitessio/vitess/blob/01a25a7d176f94613b8d59d799f438380a8760e4/go/vt/vttablet/tabletmanager/rpc_backup.go#L39-L75","documentation":"Backups are normally taken from replica/rdonly tablets; taking one from the current PRIMARY is disallowed unless explicitly permitted. The in-process tablet type is PRIMARY and the request did not set AllowPrimary. This check exists because a network partition can make the topo think a tablet demoted while the process still believes it is primary.","triggerScenarios":"Running vtctldclient Backup against a tablet whose current tm.Tablet().Type is PRIMARY without --allow-primary.","commonSituations":"Operator targets the wrong tablet alias; scripted backups picking the primary by mistake; split-brain scenarios where a deposed primary still reports PRIMARY locally.","solutions":["Take the backup from a replica or rdonly tablet instead","If truly backing up the primary, pass --allow-primary to the backup command","Verify tablet types via vtctldclient GetTablets before scheduling backups"],"exampleFix":"// before\nvtctldclient Backup alias-1  # alias-1 is PRIMARY\n// after\nvtctldclient Backup --allow-primary alias-1  # or target a replica","handlingStrategy":"validation","validationCode":"tablets, err := ts.GetTabletsByType(ctx, keyspace, topodatapb.TabletType_REPLICA)\nif err != nil { return err }\nif len(tablets) == 0 { return errors.New(\"no replica available for backup\") }\nbackupTarget := tablets[0] // never schedule backups against PRIMARY","typeGuard":null,"tryCatchPattern":"err := tm.Backup(ctx, logger, req)\nif err != nil && strings.Contains(err.Error(), \"--allow-primary\") {\n    return fmt.Errorf(\"refusing backup of PRIMARY %s; target a replica\", alias)\n}","preventionTips":["Select backup targets by current topo type, not static aliases","Filter out PRIMARY tablets in backup scheduling code","Only pass --allow-primary deliberately and with operator sign-off"],"tags":["vttablet","backup","primary","safety-check"],"backgroundTag":"backup-on-primary-not-allowed","analyzedSha":"01a25a7d176f94613b8d59d799f438380a8760e4","analyzedAt":"2026-09-01T17:28:30.605Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}