[
https://issues.apache.org/jira/browse/HDDS-16302?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Mohammadhani Fouladgar updated HDDS-16302:
------------------------------------------
Description:
Description:
When OM leadership moves to a newly added OM that a client (or a dependent
service holding an OM proxy) does not yet have in its configuration, the client
cannot reach the leader and the operation fails.
*Root cause:* {{OMFailoverProxyProviderBase}} follows
{{OMNotLeaderException.getSuggestedLeader() }} only when
{{omNodeAddressMap.containsKey(suggestedNodeId)}}; otherwise it round-robins
the (stale) configured nodes and eventually returns {{RetryAction.FAIL}}.
*Result:* transferring OM leadership to a not-yet-known OM strands every
config-staleclient even though the OM Ratis ring is healthy.
*Proposed change:*
* Allow {{OMFailoverProxyProviderBase}} to construct a proxy to the
suggested-leader address returned in {{OMNotLeaderException}} even when it is
not in static config, and route to it.
* Do this safely: validate/allowlist the suggested address (e.g. require it to
resolve within the configured service/security realm) so a peer cannot redirect
a client to an arbitrary host. This preserves operator-controlled membership
while removing the hard failure.
*Acceptance criteria:*
* With a new OM as leader and clients still on the old config, client
operations succeed by following the suggested OM leader.
* A suggested leader outside the trusted OM service is rejected (negative test).
was:When OM leadership moves to a newly added OM that a client (or a
dependent service holding an OM proxy) does not yet have in its configuration,
the client cannot reach the leader and the operation fails.
> Allow OM clients to route to a Ratis-suggested OM leader that is not in the
> client's static config (dynamic leader discovery)
> -----------------------------------------------------------------------------------------------------------------------------
>
> Key: HDDS-16302
> URL: https://issues.apache.org/jira/browse/HDDS-16302
> Project: Apache Ozone
> Issue Type: New Feature
> Reporter: Mohammadhani Fouladgar
> Assignee: Mohammadhani Fouladgar
> Priority: Major
>
> Description:
> When OM leadership moves to a newly added OM that a client (or a dependent
> service holding an OM proxy) does not yet have in its configuration, the
> client cannot reach the leader and the operation fails.
> *Root cause:* {{OMFailoverProxyProviderBase}} follows
> {{OMNotLeaderException.getSuggestedLeader() }} only when
> {{omNodeAddressMap.containsKey(suggestedNodeId)}}; otherwise it round-robins
> the (stale) configured nodes and eventually returns {{RetryAction.FAIL}}.
> *Result:* transferring OM leadership to a not-yet-known OM strands every
> config-staleclient even though the OM Ratis ring is healthy.
> *Proposed change:*
> * Allow {{OMFailoverProxyProviderBase}} to construct a proxy to the
> suggested-leader address returned in {{OMNotLeaderException}} even when it is
> not in static config, and route to it.
> * Do this safely: validate/allowlist the suggested address (e.g. require it
> to resolve within the configured service/security realm) so a peer cannot
> redirect a client to an arbitrary host. This preserves operator-controlled
> membership while removing the hard failure.
> *Acceptance criteria:*
> * With a new OM as leader and clients still on the old config, client
> operations succeed by following the suggested OM leader.
> * A suggested leader outside the trusted OM service is rejected (negative
> test).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
