Doris-Breakwater commented on issue #66558: URL: https://github.com/apache/doris/issues/66558#issuecomment-5209892804
## Breakwater initial analysis ### Decision **Confirmed, actionable code defect.** This is not explained by cloud mode or Aurora-specific behavior: the failure is in the shared Java CDC-client configuration path, before replication starts. It is a startup blocker for SSL-required MySQL when Doris must resolve an effective offset; there is no evidence here of data corruption. The issue currently has no labels. Suggested triage is the repository's bug + streaming-job/CDC labels, plus the appropriate 4.1 backport label after a maintainer confirms the target branch. ### Verified facts - In tag `4.1.2`, `generateMySqlConfig()` evaluates the startup mode at lines 907-953, before constructing and attaching `jdbcProperteis` / `dbzProps` at lines 955-986. The same ordering is present in `4.1.3-rc02` and current `master`. - `latest`, `earliest`, and a 13-digit timestamp all call `initializeEffectiveOffset()`. That method immediately calls `configFactory.createConfig(0)` and passes the resulting config to `DebeziumUtils.createMySqlConnection()`. - Flink CDC's `MySqlSourceConfigFactory.createConfig()` substitutes empty JDBC properties when none have been attached. In the bundled Debezium version, the default `database.ssl.mode` is `disabled`; the forked MySQL connection therefore builds this early connection without the requested `sslMode=required` or truststore properties. - The job's `ssl_mode` mapping, Connector/J `sslMode`, and truststore properties are only added after that early connection attempt. This confirms the reported root cause and explains rejection by a server with `require_secure_transport=ON`. - `initial`, `snapshot`, and an explicit JSON file/position or GTID offset do not call `initializeEffectiveOffset()` during config generation, so they do not hit this particular early-connection defect. They are not necessarily equivalent operational workarounds because their startup semantics differ. - Existing tests cover SSL with `offset=initial` and cover `latest`/`earliest` without mandatory TLS. They do not cover the failing combination. The reported Aurora/MySQL runtime errors and manual validation are plausible and consistent with the code, but I did not independently run an Aurora or TLS-required MySQL reproduction. No additional reporter logs are required to establish the code defect. ### Existing fix PR [#66559](https://github.com/apache/doris/pull/66559) is already open and targets `master`. Its fix direction is correct: it moves property construction **and**, importantly, both `configFactory.jdbcProperties(...)` and `configFactory.debeziumProperties(...)` ahead of the startup-mode block, so the temporary config created by `initializeEffectiveOffset()` contains the SSL settings. Merely moving local `Properties` population without moving those factory setter calls would not fix the bug; the current PR does move them. At the time of this analysis, the PR has no human review and no regression test; its checks are still pending. The change is confined to `MySqlSourceReader.java`. ### Recommended next steps 1. Add a focused integration regression using the module's existing MySQL Testcontainers infrastructure (for example, extend the `MySqlStartupLatestITCase` path): configure MySQL with TLS and `require_secure_transport=ON`, pass `ssl_mode=require`, and assert that effective-offset resolution and subsequent streaming succeed. At minimum cover `latest`; ideally parameterize `latest`, `earliest`, and timestamp because all three use the same early connection path. 2. Also retain a non-SSL `latest` check to verify the reorder does not change existing behavior. If `verify-ca` is in scope, add a CA/truststore case separately from `require`, since it exercises additional properties. 3. Complete review and CI for #66559, then backport to the maintained 4.1 branch. The PR author requested `dev/4.1.x`; a committer should confirm/apply the repository's current backport label rather than relying on an assumed internal tag convention. 4. Until a fixed build is available, use `initial`, `snapshot`, or a known explicit offset only when the changed startup semantics are acceptable. Do not weaken MySQL's secure-transport requirement as a workaround. Breakwater-GitHub-Analysis-Slot: slot_042c2292c8a8 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
