Siyao Meng created HDDS-17324:
---------------------------------
Summary: Ozone CLI waits forever for the CA list when SCM has
fewer CA certificates than configured SCM nodes
Key: HDDS-17324
URL: https://issues.apache.org/jira/browse/HDDS-17324
Project: Apache Ozone
Issue Type: Bug
Components: Ozone CLI
Reporter: Siyao Meng
Assignee: Siyao Meng
{{ContainerOperationClient}} loads the CA certificates with
{{HAUtils.buildCAX509List}} before talking to datanodes, e.g. in {{ozone admin
container create}}, {{ozone debug replicas verify}} and {{ozone debug replicas
chunk-info}}. In secure SCM HA it waits until SCM returns at least as many CA
certificates as configured SCM nodes plus one (the root CA), and it retries
forever ({{retryForeverWithFixedSleep}},
{{ozone.scm.ca.list.retry.interval}}=10s). Only an {{AccessControlException}}
stops it (HDDS-13405).
If an SCM listed in the configuration was never bootstrapped, the expected
count is never reached, and the command waits forever. Any other error that
repeats, such as an unreachable SCM, has the same effect. Shell logging is off
by default, so nothing is printed while it waits.
Proposed fix: bound the wait (a maximum number of retries or a deadline), then
fail with a message showing the expected and received number of certificates.
Alternatively fetch the list once, since {{ClientTrustManager}} already fetches
it again when certificate verification fails.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
