[
https://issues.apache.org/jira/browse/CASSANDRA-5571?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13789083#comment-13789083
]
Brandon Williams commented on CASSANDRA-5571:
---------------------------------------------
I will note that in working on CASSANDRA-5916, I realize this won't be as
straightforward as I originally thought, either, and will likely need to take
the same approach we end up taking there.
> Reject bootstrapping endpoints that are already in the ring with different
> gossip data
> --------------------------------------------------------------------------------------
>
> Key: CASSANDRA-5571
> URL: https://issues.apache.org/jira/browse/CASSANDRA-5571
> Project: Cassandra
> Issue Type: Improvement
> Components: Core
> Reporter: Rick Branson
> Assignee: Tyler Hobbs
>
> The ring can be silently broken by improperly bootstrapping an endpoint that
> has an existing entry in the gossip table. In the case where a node attempts
> to bootstrap with the same IP address as an existing ring member, the old
> token metadata is dropped without warning, resulting in range shifts for the
> cluster.
> This isn't so bad for non-vnode cases where, in general, tokens are
> explicitly assigned, and a bootstrap on the same token would result in no
> range shifts. For vnode cases, the convention is to just let nodes come up by
> selecting their own tokens, and a bootstrap will override the existing tokens
> for that endpoint.
> While there are some other issues open for adding an explicit rebootstrap
> feature for vnode cases, given the changes in operator habits for vnode
> rings, it seems a bit too easy to make this happen. Even more undesirable is
> the fact that it's basically silent.
> This is a proposal for checking for this exact case: bootstraps on endpoints
> with existing ring entries that have different hostIDs and/or tokens should
> be rejected with an error message describing what happened and how to
> override the safety check. It looks like the override can be supported using
> the existing "nodetool removenode -force".
> I can work up a patch for this.
--
This message was sent by Atlassian JIRA
(v6.1#6144)
