[
https://issues.apache.org/jira/browse/HDDS-14091?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18134698#comment-18134698
]
Siyao Meng commented on HDDS-14091:
-----------------------------------
fyi, for anyone backporting this commit ([PR
#9445|https://github.com/apache/ozone/pull/9445]) to a branch without the later
STS branch merge: this commit creates {{s3RevokedStsTokenTable}} with a
hardcoded {{CacheType.FULL_CACHE}} in
{{OmMetadataManagerImpl#initializeOmTables}}, instead of the {{cacheType}}
argument.
{{initializeOmTables}} also builds snapshot and checkpoint DBs, which pass
{{PARTIAL_CACHE}} (HDDS-9778). This table ignores that, so every snapshot DB
open creates a {{FullTableCache}}. Its scheduled cleanup thread starts in the
constructor and is never shut down, so each open leaks one
{{s3RevokedStsTokenTable_FullTableCache-Cleanup-0}} thread. Snapshot DBs are
reopened constantly (snapshot cache, KeyDeletingService,
SnapshotDeletingService, snapdiff, defrag).
With this commit backported, a sustained snapshot create, delete and snapdiff
test reached about 170K of these threads per OM at about 18K snapshots. Each
thread wakes once a second, so G1 young pauses grew from about 8 ms to about
300 ms, and OM leadership kept moving between the OMs until clients could not
find a leader.
On master this is already fixed: the STS branch merge
[f7c62ae2329|https://github.com/apache/ozone/commit/f7c62ae232933cebd0d4deca3de1fd18f1fd369d]
changed the line to {{cacheType}}. That change only exists in the merge
commit, so cherry-picking the STS commits alone leaves the bug in. Please pick
up that one line together with this commit. The generic gap that table cache
executors are never shut down is tracked in HDDS-17460.
> [STS] Deny access if STS token is found in revoked table
> --------------------------------------------------------
>
> Key: HDDS-14091
> URL: https://issues.apache.org/jira/browse/HDDS-14091
> Project: Apache Ozone
> Issue Type: Sub-task
> Reporter: Fabian Morgan
> Assignee: Fabian Morgan
> Priority: Major
> Labels: pull-request-available
> Fix For: 2.2.0
>
>
> Deny access if STS token is found in revoked table
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
