Copilot commented on code in PR #11224: URL: https://github.com/apache/ozone/pull/11224#discussion_r4031315132
########## hadoop-ozone/common/src/main/java/org/apache/hadoop/ozone/conf/S3GatewayHealthCheckConfig.java: ########## @@ -0,0 +1,91 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.apache.hadoop.ozone.conf; + +import static org.apache.hadoop.hdds.conf.ConfigTag.MANAGEMENT; +import static org.apache.hadoop.hdds.conf.ConfigTag.OZONE; +import static org.apache.hadoop.hdds.conf.ConfigTag.S3GATEWAY; + +import java.util.concurrent.TimeUnit; +import org.apache.hadoop.hdds.conf.Config; +import org.apache.hadoop.hdds.conf.ConfigGroup; +import org.apache.hadoop.hdds.conf.ConfigType; + +/** + * Config for the S3 Gateway health check endpoints served on the web admin + * server (default port 19878). + */ +@ConfigGroup(prefix = "ozone.s3g.health-check") +public class S3GatewayHealthCheckConfig { + + @Config(key = "ozone.s3g.health-check.enabled", + defaultValue = "true", + type = ConfigType.BOOLEAN, + tags = {OZONE, S3GATEWAY, MANAGEMENT}, + description = "If enabled, the S3 Gateway web admin server exposes " + + "unauthenticated health endpoints that a load balancer can poll: " + + "a liveness endpoint at /health/live (process is up) and a " + + "readiness endpoint at /health/ready (the gateway can reach OM). " + + "Disable to remove the endpoints entirely.") Review Comment: The documented `enabled=false` switch removes these servlets, but the Kubernetes manifests and bundled HAProxy configs added in this PR always probe `/health/live` and `/health/ready`. With the switch disabled, liveness returns 404 (causing pod restarts), readiness never succeeds, and HAProxy marks every backend down. Either make those deployment checks conditional or document/enforce that the switch cannot be used with the bundled deployments. ########## hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3/S3GatewayReadinessProbe.java: ########## @@ -0,0 +1,143 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.apache.hadoop.ozone.s3; + +import com.google.common.util.concurrent.ThreadFactoryBuilder; +import java.io.Closeable; +import java.util.concurrent.ExecutorService; +import java.util.concurrent.Executors; +import java.util.concurrent.Future; +import java.util.concurrent.ScheduledExecutorService; +import java.util.concurrent.TimeUnit; +import java.util.concurrent.TimeoutException; +import org.apache.hadoop.hdds.conf.OzoneConfiguration; +import org.apache.hadoop.hdds.utils.IOUtils; +import org.apache.hadoop.ozone.client.OzoneClient; +import org.apache.hadoop.ozone.conf.S3GatewayHealthCheckConfig; +import org.apache.hadoop.ozone.om.protocol.S3Auth; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +/** + * Backs the S3 Gateway readiness endpoint (/health/ready). + * + * <p>A single background thread periodically probes OM reachability and stores + * the result in a volatile flag. The servlet only reads that flag, so + * /health/ready responds immediately (no OM RPC on the request path) and a + * load balancer polling it can never be blocked by a slow or unreachable OM. + * + * <p>Readiness starts as {@code false} and flips to {@code true} only after a + * probe succeeds, so the endpoint reports "not ready" during startup (before + * the first successful probe) without waiting for the first S3 request. The + * probe owns a dedicated {@link OzoneClient} created through + * {@link OzoneClientCache#createClient}, so it exercises the same OM transport + * the gateway serves with, independent of the lazily-created CDI client on the + * S3 listener. + */ +public class S3GatewayReadinessProbe implements Closeable { + + private static final Logger LOG = + LoggerFactory.getLogger(S3GatewayReadinessProbe.class); + + private final OzoneConfiguration conf; + private final long intervalMillis; + private final long timeoutMillis; + + private final ScheduledExecutorService scheduler; + private final ExecutorService probeExecutor; + + private volatile boolean ready = false; + private volatile OzoneClient client; + + S3GatewayReadinessProbe(OzoneConfiguration conf, + S3GatewayHealthCheckConfig healthConfig) { + this.conf = conf; + this.intervalMillis = healthConfig.getProbeInterval(); + this.timeoutMillis = healthConfig.getProbeTimeout(); + this.scheduler = Executors.newSingleThreadScheduledExecutor( + new ThreadFactoryBuilder() + .setNameFormat("s3g-readiness-probe-%d") + .setDaemon(true) + .build()); + this.probeExecutor = Executors.newSingleThreadExecutor( + new ThreadFactoryBuilder() + .setNameFormat("s3g-readiness-om-%d") + .setDaemon(true) + .build()); + } + + public void start() { + scheduler.scheduleWithFixedDelay(this::probe, 0, intervalMillis, + TimeUnit.MILLISECONDS); + } + + public boolean isReady() { + return ready; + } + + /** + * Runs one probe on the scheduler thread, bounded by the configured timeout. + * The OM call runs on a separate single-threaded executor so a hung call + * cannot block the scheduler and gets an enforced deadline: on timeout the + * gateway is reported not ready rather than staying stuck at ready. + */ + private void probe() { + Future<Void> future = probeExecutor.submit(() -> { + OzoneClient c = client; + if (c == null) { + c = OzoneClientCache.createClient(probeClientConf()); Review Comment: The timeout only bounds `future.get`; `Future.cancel(true)` is best-effort. If the underlying OM call remains stuck after interruption, `scheduleWithFixedDelay` continues submitting work and this single-thread executor uses an unbounded queue, so one task is retained per interval and the advertised deadline can turn into unbounded resource growth during an outage. Keep at most one probe in flight, or apply a real RPC deadline and discard/recreate the stuck client/executor on timeout. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
