[
https://issues.apache.org/jira/browse/HDDS-17324?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Siyao Meng reassigned HDDS-17324:
---------------------------------
Assignee: (was: Siyao Meng)
> Ozone CLI waits forever for the CA list when SCM has fewer CA certificates
> than configured SCM nodes
> ----------------------------------------------------------------------------------------------------
>
> Key: HDDS-17324
> URL: https://issues.apache.org/jira/browse/HDDS-17324
> Project: Apache Ozone
> Issue Type: Bug
> Components: Ozone CLI
> Reporter: Siyao Meng
> Priority: Major
>
> {{ContainerOperationClient}} loads the CA certificates with
> {{HAUtils.buildCAX509List}} before talking to datanodes, e.g. in {{ozone
> admin container create}}, {{ozone debug replicas verify}} and {{ozone debug
> replicas chunk-info}}. In secure SCM HA it waits until SCM returns at least
> as many CA certificates as configured SCM nodes plus one (the root CA), and
> it retries forever ({{retryForeverWithFixedSleep}},
> {{ozone.scm.ca.list.retry.interval}}=10s). Only an {{AccessControlException}}
> stops it (HDDS-13405).
> If an SCM listed in the configuration was never bootstrapped, the expected
> count is never reached, and the command waits forever. Any other error that
> repeats, such as an unreachable SCM, has the same effect. Shell logging is
> off by default, so nothing is printed while it waits.
> Proposed fix: bound the wait (a maximum number of retries or a deadline),
> then fail with a message showing the expected and received number of
> certificates. Alternatively fetch the list once, since {{ClientTrustManager}}
> already fetches it again when certificate verification fails.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
