[
https://issues.apache.org/jira/browse/HDDS-16299?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Mohammadhani Fouladgar updated HDDS-16299:
------------------------------------------
Description:
An admin or orchestration step can transfer OM leadership to a freshly-added OM
that is a committed Ratis peer but not yet ready to serve (state not fully
loaded). Nothing rejects such a transfer today, so it strands config-stale
clients cluster-wide ("Failed to connect to OMs ... Attempted N failovers")
until the target is ready or leadership moves again. Scope is the explicit
leadership-transfer request only; natural Ratis elections are not gated here.
*Proposed change:*
* Add a server-side precondition check to the OM leadership-transfer admin
path that refuses (or requires {{{}--force{}}}) transfer to a target that is
not ready: e.g. the OM target is not present in the current committed Ratis
peer set.
* Return a clear error explaining the unmet precondition.
*Acceptance criteria:*
* Transfer to an OM not yet a committed peer is rejected with an explanatory
error (bypassable only with an explicit force flag).
* Transfer to a ready OM still succeeds.
was:An admin or orchestration step can transfer OM leadership to a
freshly-added OM that is a committed Ratis peer but not yet ready to serve
(state not fully loaded). Nothing rejects such a transfer today, so it strands
config-stale clients cluster-wide ("Failed to connect to OMs ... Attempted N
failovers") until the target is ready or leadership moves again. Scope is the
explicit leadership-transfer request only; natural Ratis elections are not
gated here
> Reject/guard 'transfer leadership' to an OM that is not ready to serve (not
> fully present in the committed Ratis peer set)
> --------------------------------------------------------------------------------------------------------------------------
>
> Key: HDDS-16299
> URL: https://issues.apache.org/jira/browse/HDDS-16299
> Project: Apache Ozone
> Issue Type: New Feature
> Reporter: Mohammadhani Fouladgar
> Assignee: Mohammadhani Fouladgar
> Priority: Major
>
> An admin or orchestration step can transfer OM leadership to a freshly-added
> OM that is a committed Ratis peer but not yet ready to serve (state not fully
> loaded). Nothing rejects such a transfer today, so it strands config-stale
> clients cluster-wide ("Failed to connect to OMs ... Attempted N failovers")
> until the target is ready or leadership moves again. Scope is the explicit
> leadership-transfer request only; natural Ratis elections are not gated here.
> *Proposed change:*
> * Add a server-side precondition check to the OM leadership-transfer admin
> path that refuses (or requires {{{}--force{}}}) transfer to a target that is
> not ready: e.g. the OM target is not present in the current committed Ratis
> peer set.
> * Return a clear error explaining the unmet precondition.
> *Acceptance criteria:*
> * Transfer to an OM not yet a committed peer is rejected with an explanatory
> error (bypassable only with an explicit force flag).
> * Transfer to a ready OM still succeeds.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
