[
https://issues.apache.org/jira/browse/HDDS-5052?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17312500#comment-17312500
]
Bharat Viswanadham commented on HDDS-5052:
------------------------------------------
Discuss with Xiaoyu offline, and we decided to eliminate persist scmId and
check SCMID during OM startup.
We persist SCM ClusteriD for both HA/non-HA
And in SCM we remove the SCMID check and keep SCM ClusterID check.
> [SCM HA Security] Handle leader changes between SCMInfo and getSCMSigned Cert
> in OM
> -----------------------------------------------------------------------------------
>
> Key: HDDS-5052
> URL: https://issues.apache.org/jira/browse/HDDS-5052
> Project: Apache Ozone
> Issue Type: Bug
> Components: SCM HA
> Reporter: Bharat Viswanadham
> Assignee: Bharat Viswanadham
> Priority: Major
>
> This Jira is to handle leader change between getScmInfo and getScmSignedCert.
> *Problem:*
> *Leader is SCM1 - Returned SCMID is SCM1ID*
> ScmInfo returns the leader SCMID
> *Leader is SCM2 - SCM ID is SCM2ID*
> getSCMSignedCert, during generate certificate it has a check compare the
> scmId passed in CSR, is same as current SCM scmID
> In this case when the leader change between these 2 calls OM will fail to get
> a Certificate.
> *Proposed Solution:*
> getScmInfo returns primary SCM ID, and OM can pass this Primary SCM ID in CSR.
> In this way, even if the leader changes OM can still get a certificate.
> Note: primary SCM Id is the same across the SCM HA quorum nodes.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
