Pierre Villard created NIFI-16290:
-------------------------------------
Summary: Node offload should give processors a bounded grace
period to stop cleanly before forced termination
Key: NIFI-16290
URL: https://issues.apache.org/jira/browse/NIFI-16290
Project: Apache NiFi
Issue Type: Improvement
Components: Core Framework
Reporter: Pierre Villard
Assignee: Pierre Villard
Currently, StandardFlowService.offload() calls rootGroup.stopProcessing() and
immediately discards the returned future, then force-terminates any processor
whose logical scheduled state is STOPPED. Because logical STOPPED also covers
the physical STOPPING state, this termination can fire before a processor's
asynchronous stop lifecycle has actually finished — overtaking @OnUnscheduled,
aborting the wait for active threads to drain, and bypassing @OnStopped
entirely. As a result, processors that close external resources (connections,
files, sessions) during shutdown may never get the chance to do so cleanly when
a node is offloaded, even though nothing was actually wedged or slow.
This change introduces a bounded grace period: offload now waits on the
aggregate stopProcessing() future for up to
nifi.flowcontroller.graceful.shutdown.period (reusing the existing
graceful-shutdown setting) before falling through to the existing
forced-termination sweep, which still always runs unconditionally afterward.
This preserves the current guarantee that a hung or wedged processor —
including one that has stashed an uncommitted ProcessSession, per NIFI-15885 —
cannot block node offload indefinitely, while giving well-behaved processors a
real opportunity to complete @OnUnscheduled/@OnStopped normally first. The
outcome of the graceful wait (completed, timed out, interrupted, or
exceptional/cancelled) is logged for operational visibility.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
