HDDS-594. SCM CA: DN sends CSR and uses certificate issued by SCM. #547
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
Contributor
|
@ajayydv , thanks for the update. Please fix the unit test failure testGenerateCSRWithInvalidParams and checkstyle issue. I will post another comments on the 2nd revision shortly. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
xiaoyuyao
reviewed
Mar 5, 2019
| LOG.error("DN security initialization failed."); | ||
| throw new RuntimeException("DN security initialization failed."); | ||
| case RECOVER: | ||
| LOG.error("DN security initialization failed. OM certificate is " + |
Contributor
There was a problem hiding this comment.
Can we reword the error message for recovery?
Contributor
Author
There was a problem hiding this comment.
Added case info to all cases.
hadoop-hdds/container-service/src/main/java/org/apache/hadoop/ozone/HddsDatanodeService.java
Outdated
Show resolved
Hide resolved
Contributor
There was a problem hiding this comment.
Can you add todo for handling multiple SCM instances case?
Contributor
There was a problem hiding this comment.
Should we throw RetriableException instead of RuntimeException so that DN can retry if SCM is not available (e.g., reboot, not fully boot up yet)?
Contributor
Author
There was a problem hiding this comment.
I think IPC layer already has logic to retry for socket timeout related errors. If it fails there (unrecoverable), then its best to shutdown DN.
Contributor
There was a problem hiding this comment.
Given that we remove the SCM_ID/CLUSTER_ID from the CSR, can we assert the certificate returned contains a valid SCM_ID and CLUSTER_ID here?
Contributor
Author
There was a problem hiding this comment.
This is unit test for only CSR generation on DN side. Updated Default Approver on SCM side to add scm id and cluster id if not already present. Added corresponding tests in TestDefaultCAServer.
Contributor
There was a problem hiding this comment.
Do we need server side change to populate the SCM_ID/CLUSTER_ID into the certificate returned?
Contributor
Author
There was a problem hiding this comment.
Latest commit handles that.
hadoop-hdds/common/src/main/java/org/apache/hadoop/hdds/HddsUtils.java
Outdated
Show resolved
Hide resolved
hadoop-hdds/container-service/src/main/java/org/apache/hadoop/ozone/HddsDatanodeService.java
Outdated
Show resolved
Hide resolved
hadoop-hdds/container-service/src/main/java/org/apache/hadoop/ozone/HddsDatanodeService.java
Outdated
Show resolved
Hide resolved
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
Contributor
Author
|
rebased with trunk. |
|
💔 -1 overall
This message was automatically generated. |
Contributor
|
why some of the changes from HDDS-1118 are shown up as part of the files changed? |
Contributor
Author
|
@xiaoyuyao rebase seems to have pushed spurious commit. Forced reset it to intended commits. |
Contributor
|
+1 pending Jenkins. |
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
Contributor
Author
|
unit test failure seem unrelated, pass locally. |
Contributor
|
I've tested the patch with docker and validated the DN initialization works as expected. The ci author/acceptance test does not seem to be related to this patch. Will merge it shortly. |
shanthoosh
pushed a commit
to shanthoosh/hadoop
that referenced
this pull request
Oct 15, 2019
…teFunction when input value is null Currently, the behavior of putting a null value is inconsistent: it is a delete for RocksDB, and not supported in in-memory store, and on a case-by-case basis for remote tables. It is desirable to unify the behavior. Furthermore, it eases the writing of a change captured stream to a table. A change captured stream contains typically 3 types of events: INSERT, UPDATE and DELETE, and they need to be applied properly when written to a table to produce a correct snapshot. In a change captured stream the payload of a DELETE event is typically is null, and this would result in a delete operation to a table in sendTo() operator. Author: Wei Song <wsong@wsong-mn2.linkedin.biz> Closes apache#547 from weisong44/table-fix
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.