shashank created CAMEL-26800:
--------------------------------
Summary: camel-master - MasterConsumer gives up the leadership
before its delegated consumer has stopped
Key: CAMEL-26800
URL: https://issues.apache.org/jira/browse/CAMEL-26800
Project: Camel
Issue Type: Bug
Components: camel-master
Reporter: shashank
Assignee: shashank
*Leadership given up before the consumer stopped.* {{MasterConsumer.doStop}}
removes its listener and releases the cluster view (which gives up the
leadership) before it stops the delegated consumer. On every graceful stop of a
leader (route stop, CamelContext shutdown, rolling restart), another node can
take the leadership and start consuming while this node is still stopping its
consumer (for example a JMS consumer that completes the messages it is
processing). The {{master}} component is meant to have one active consumer in
the cluster.
*The route is stopped before the delegated consumer.* {{doStop}} first stops
the processor of the route ({{super.doStop()}}), so a delegated consumer that
still routes messages while it stops (such as JMS, which completes the messages
it is processing) sends them into a stopped route, where they fail.
*A failure to release the view leaves the consumer running.* There is no
try/finally: when {{releaseView}} throws (for example the file lock cluster
service when its data storage stalls), the delegated consumer is not stopped at
all.
Expected: the leadership is released, and the route processor stopped, only
after the delegated consumer stopped, and the delegated consumer is stopped
also when releasing the view fails.
Suggested fix: in {{doStop}} stop the delegated consumer first, then the route
processor, and release the view in a finally block.
Found with Specula (TLA+ model checked against traces of the real code) and
code review, and confirmed with tests on the real classes.
_Filed with Claude Code on behalf of allthingssecurity._
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
