ss77892 opened a new pull request, #11803:
URL: https://github.com/apache/ozone/pull/11803
## What changes were proposed in this pull request?
`TestHddsSecureDatanodeInit.testCertificateRotationRecoverableFailure` (and,
less often, `testCertificateRotation`) timed out intermittently. The test was
marked `@Flaky("HDDS-8873")`.
Causes:
- **Racy renewal on a background thread.** The rotation tests started the
scheduled `CertificateRenewerService` twice: once lazily, through
`getCertificate()` → `loadAllCertificates()`, and once explicitly. While that
background thread called the shared Mockito SCM client, the test thread was
still re-stubbing it.
- **Timing-based waits.** The tests waited with `Thread.sleep` and `waitFor`
ceilings derived from the 15-second certificate created in `@BeforeAll`.
Whether a renewal happened inside that window depended on scheduling.
- **Slow host resolution.** Each CSR resolved the local host name and
addresses (`InetAddress.getLocalHost().getCanonicalHostName()`,
`getValidInetsForCurrentHost()`). On hosts with a slow resolver, this alone
could use up the timeout.
Changes:
- **`DefaultCertificateClient`**: moved address lookup for the CSR's SAN
extension into a new overridable method, `protected List<InetAddress>
getLocalInetAddresses()`. Production behaviour is unchanged.
- **`DNCertificateClient`**: moved host-name lookup for the CSR subject into
a new overridable method, `protected String getLocalHostName()`. Production
behaviour is unchanged.
- **`TestHddsSecureDatanodeInit`**:
- The test client turns off the scheduled renewer
(`shouldStartCertificateRenewerService()` returns `false`) and returns fixed,
mocked addresses for the CSR, so nothing is resolved.
- Renewal runs synchronously on the test thread (`renewCertificateNow()`),
and the `sleep`/`waitFor` polling is replaced by direct assertions.
- Renewal only proceeds for a certificate that is already inside its grace
period. So each test first installs a certificate in the state it needs: one
inside the grace period for `testCertificateRotation`, an expired one for
`testCertificateRotationRecoverableFailure`. The client is then rebuilt with
that serial id.
- `@BeforeAll` no longer starts `HddsDatanodeService`, whose failures were
swallowed by `callQuietly`, just to get a key pair. It generates the pair
directly with `HDDSKeyGenerator`.
- Removed `@Flaky("HDDS-8873")`.
- **`OzoneContainer.stopContainerScrub()`**: each scanner is now shut down
independently. Previously, an early return when `dataScanners` was `null`
skipped shutting down `onDemandScanner`. And when the data scanners were set
but `onDemandScanner` was not, the method threw an NPE.
## What is the link to the Apache JIRA
https://issues.apache.org/jira/browse/HDDS-8873
## How was this patch tested?
50 runs on the node with 16 network interfaces. Before the fix the test was
failing 100% times.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
