[
https://issues.apache.org/jira/browse/HDDS-16301?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Mohammadhani Fouladgar updated HDDS-16301:
------------------------------------------
Description:
An admin or orchestration step can transfer SCM leadership to a freshly-added
SCM that is a committed Ratis peer but not yet operationally ready (in safe
mode, no DataNode heartbeats, empty NodeManager view). Nothing rejects such a
transfer today, so the new leader cannot allocate blocks or manage pipelines
and client/DN operations stall until it is ready or leadership moves again.
Scope is the explicit leadership-transfer request only; natural Ratis elections
are not gated here
*Proposed change:*
* Add a server-side precondition check to the SCM leadership-transfer admin
path that refuses (or requires --force) transfer to a target that is not ready:
e.g. the SCM target has zero/insufficient DataNode heartbeats or incomplete
pipeline state.
* Return a clear error explaining the unmet precondition.
*Acceptance criteria:*
* Transfer to an SCM with no DN heartbeats is rejected with an explanatory
error (bypassable only with an explicit force flag).
* Transfer to a ready SCM still succeeds.
was:An admin or orchestration step can transfer SCM leadership to a
freshly-added SCM that is a committed Ratis peer but not yet operationally
ready (in safe mode, no DataNode heartbeats, empty NodeManager view). Nothing
rejects such a transfer today, so the new leader cannot allocate blocks or
manage pipelines and client/DN operations stall until it is ready or leadership
moves again. Scope is the explicit leadership-transfer request only; natural
Ratis elections are not gated here
> Reject/guard 'transfer leadership' to an SCM that is not ready to serve (no
> DN heartbeats / empty NodeManager view)
> -------------------------------------------------------------------------------------------------------------------
>
> Key: HDDS-16301
> URL: https://issues.apache.org/jira/browse/HDDS-16301
> Project: Apache Ozone
> Issue Type: New Feature
> Reporter: Mohammadhani Fouladgar
> Assignee: Mohammadhani Fouladgar
> Priority: Major
>
> An admin or orchestration step can transfer SCM leadership to a freshly-added
> SCM that is a committed Ratis peer but not yet operationally ready (in safe
> mode, no DataNode heartbeats, empty NodeManager view). Nothing rejects such a
> transfer today, so the new leader cannot allocate blocks or manage pipelines
> and client/DN operations stall until it is ready or leadership moves again.
> Scope is the explicit leadership-transfer request only; natural Ratis
> elections are not gated here
> *Proposed change:*
> * Add a server-side precondition check to the SCM leadership-transfer admin
> path that refuses (or requires --force) transfer to a target that is not
> ready: e.g. the SCM target has zero/insufficient DataNode heartbeats or
> incomplete pipeline state.
> * Return a clear error explaining the unmet precondition.
> *Acceptance criteria:*
> * Transfer to an SCM with no DN heartbeats is rejected with an explanatory
> error (bypassable only with an explicit force flag).
> * Transfer to a ready SCM still succeeds.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
