raghavyadav01 commented on code in PR #19892:
URL: https://github.com/apache/pinot/pull/19892#discussion_r4392885188
##########
pinot-common/src/main/java/org/apache/pinot/common/metrics/BrokerMeter.java:
##########
@@ -216,6 +216,14 @@ public class BrokerMeter implements AbstractMetrics.Meter {
public static final BrokerMeter ROUTING_TABLE_UPDATE_FAILURE =
create("ROUTING_TABLE_UPDATE_FAILURE", "failures", false);
+ // Panic routing metrics
Review Comment:
This still carries the first version of the #19891 metrics (the "Panic
routing" comment and the older SegmentStates). Could you rebase on #19891 so
this PR only shows the policy?
##########
pinot-broker/src/main/java/org/apache/pinot/broker/broker/helix/BaseBrokerStarter.java:
##########
@@ -231,8 +233,14 @@ public void init(PinotConfiguration brokerConf)
// Remove all white-spaces from the list of zkServers (if any).
_zkServers =
brokerConf.getProperty(Helix.CONFIG_OF_ZOOKEEPER_SERVER).replaceAll("\\s+", "");
_clusterName = brokerConf.getProperty(Helix.CONFIG_OF_CLUSTER_NAME);
+ // Capture the instance-level fallback before applying the cluster config
overlay.
+ boolean brokerConfiguredFailOpenEnabled =
brokerConf.getProperty(Broker.CONFIG_OF_ENABLE_FAIL_OPEN,
+ Broker.DEFAULT_ENABLE_FAIL_OPEN);
ServiceStartableUtils.applyClusterConfig(_brokerConf, _zkServers,
_clusterName, ServiceRole.BROKER);
applyCustomConfigs(brokerConf);
+ boolean startupFailOpenEnabled =
brokerConf.getProperty(Broker.CONFIG_OF_ENABLE_FAIL_OPEN,
Review Comment:
Every other broker setting resolves the other way at startup:
applyClusterConfig only fills in a cluster value when the broker config doesn't
set the key. Here the cluster value wins, because registering the listener
replays all cluster keys into onChange, and that also makes
startupFailOpenEnabled redundant. Is cluster over broker intended? If so, can
we drop the startup value and note the order in the config docs?
##########
pinot-broker/src/main/java/org/apache/pinot/broker/routing/FailOpenPolicy.java:
##########
@@ -0,0 +1,75 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.pinot.broker.routing;
+
+import java.util.Map;
+import java.util.Set;
+import javax.annotation.concurrent.ThreadSafe;
+import org.apache.pinot.spi.config.provider.PinotClusterConfigChangeListener;
+import org.apache.pinot.spi.utils.CommonConstants.Broker;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+
+/// Thread-safe policy for broker fail-open routing.
+///
+/// The broker-configured value is retained separately from the effective
startup value so removing a dynamic
+/// cluster override restores the broker value (or the default when the broker
did not configure one).
+///
+/// This class currently only lands the config plumbing: the policy is
constructed and registered for cluster config
+/// changes, but is not yet consulted on the routing path. Instance selection
will read [#isEnabled()] in a
+/// follow-up change.
+@ThreadSafe
+public final class FailOpenPolicy implements PinotClusterConfigChangeListener {
+ private static final Logger LOGGER =
LoggerFactory.getLogger(FailOpenPolicy.class);
+
+ private final boolean _brokerConfiguredEnabled;
+ private volatile boolean _enabled;
+
+ public FailOpenPolicy(boolean brokerConfiguredEnabled, boolean
startupEnabled) {
+ _brokerConfiguredEnabled = brokerConfiguredEnabled;
+ _enabled = startupEnabled;
+ }
+
+ /// Returns a policy with fail-open routing disabled and no
broker-configured override. Not yet called; intended for
+ /// routing components that are constructed without a broker-provided policy
once fail-open routing is wired in.
+ public static FailOpenPolicy disabled() {
+ return new FailOpenPolicy(false, false);
+ }
+
+ /// Returns whether fail-open routing is currently enabled. Not yet read on
the routing path; instance selection will
+ /// consult this in a follow-up change.
+ public boolean isEnabled() {
Review Comment:
When the selectors start reading this, which excluded replica gets the
request, so one sick server doesn't take all the fail-open traffic for its
segments? And should those requests use a shorter server timeout, since the
excluded server is often the one that's timing out?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
