Add decommission security catch

1 files changed, 11 insertions, 0 deletions

diff --git a/ydb/core/mind/bscontroller/virtual_group.cpp b/ydb/core/mind/bscontroller/virtual_group.cpp
index df0179942c2..b057b80bf13 100644
--- a/ydb/core/mind/bscontroller/virtual_group.cpp
+++ b/ydb/core/mind/bscontroller/virtual_group.cpp
@@ -110,6 +110,17 @@ namespace NKikimr::NBsController {
                 throw TExError() << "group is already being decommitted" << TErrorParams::GroupId(groupId);
             }
 
+            auto& sp = StoragePools.Get();
+            const auto it = sp.find(group->StoragePoolId);
+            if (it == sp.end()) {
+                throw TExError() << "invalid storage pool for decommitted group";
+            }
+            for (const auto& ch : cmd.GetChannelProfiles()) {
+                if (ch.GetStoragePoolName() == it->second.Name) {
+                    throw TExError() << "BlobDepot can't reside on the same Storage Pool as the decommitted group itself";
+                }
+            }
+
             group->DecommitStatus = NKikimrBlobStorage::TGroupDecommitStatus::PENDING;
             group->VirtualGroupState = NKikimrBlobStorage::EVirtualGroupState::NEW;
             group->HiveId = cmd.GetHiveId();