andyhuangdev commented on code in PR #11824:
URL: https://github.com/apache/ozone/pull/11824#discussion_r4407554400
##########
hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/symmetric/TestDefaultSecretKeyClient.java:
##########
@@ -30,10 +32,35 @@
import java.time.Instant;
import org.apache.hadoop.hdds.conf.OzoneConfiguration;
import org.apache.hadoop.hdds.protocol.SecretKeyProtocol;
+import org.apache.ozone.test.GenericTestUtils;
import org.junit.jupiter.api.Test;
/** Tests refreshing the signing key through the composite client. */
class TestDefaultSecretKeyClient {
+ @Test
+ void pollerKeepsRefreshingAfterFailedPolls() throws Exception {
+ OzoneConfiguration conf = new OzoneConfiguration();
+ conf.set(HDDS_SECRET_KEY_ROTATE_DURATION, "1d");
+ conf.set(HDDS_SECRET_KEY_ROTATE_CHECK_DURATION, "10ms");
+ SecretKeyProtocol scm = mock(SecretKeyProtocol.class);
+ ManagedSecretKey oldKey = SecretKeyTestUtil.generateHmac(
+ Instant.now().minus(Duration.ofDays(2)), Duration.ofDays(9));
+ ManagedSecretKey newKey = SecretKeyTestUtil.generateHmac(Instant.now(),
Duration.ofDays(9));
+ when(scm.getCurrentSecretKey()).thenReturn(oldKey)
+ .thenThrow(new IOException("SCM fetch failed"))
+ .thenThrow(new IllegalStateException("Unexpected failure"))
+ .thenThrow(new LinkageError("Unexpected error"))
+ .thenReturn(newKey);
+ SecretKeyClient client = DefaultSecretKeyClient.create(conf, scm, "test-");
+ try {
+ client.start(conf);
+ GenericTestUtils.waitFor(() ->
newKey.equals(client.getCurrentSecretKey()), 10, 5_000);
+ verify(scm, times(5)).getCurrentSecretKey();
Review Comment:
The poller runs every 10ms, but it only calls SCM when the cached key is
past its rotation interval. Once newKey is cached, its creation time is current
and the rotation interval is one day, so subsequent polls skip the SCM call.
The expected count therefore remains exactly five: one initial fetch, three
failed refreshes, and one successful refresh. times(5) should be safe here.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
