ChenSammi commented on code in PR #5064:
URL: https://github.com/apache/ozone/pull/5064#discussion_r1282642199
##########
hadoop-hdds/server-scm/src/main/java/org/apache/hadoop/hdds/scm/server/SCMSecurityProtocolServer.java:
##########
@@ -208,16 +206,31 @@ public String getCertificate(
nodeDetails.getNodeType(), nodeDetails.getHostName(),
nodeDetails.getUuid());
Objects.requireNonNull(nodeDetails);
- if (storageContainerManager.getRootCARotationManager() != null &&
- storageContainerManager.getRootCARotationManager()
- .isRotationInProgress()) {
- throw new SCMException(("Root CA and Sub CA rotation is in-progress." +
- " Please try the operation later again."),
- SCMException.ResultCodes.CA_ROTATION_IN_PROGRESS);
- }
+ checkIsCertSignRequestAllowed(false);
return getEncodedCertToString(certSignReq, nodeDetails.getNodeType());
}
+ private void checkIsCertSignRequestAllowed(boolean isScmCertRenew)
+ throws SCMException {
+ RootCARotationManager rotationManager =
+ storageContainerManager.getRootCARotationManager();
+ if (rotationManager != null) {
+ if (rotationManager.isRotationInProgress() && !isScmCertRenew) {
+ throw new SCMException("Root CA and Sub CA rotation is in-progress." +
+ " Please try the operation later again.",
+ ResultCodes.CA_ROTATION_IN_PROGRESS);
+ }
+ if (rotationManager.isPostRotationInProgress()) {
+ SecurityConfig securityConfig = new SecurityConfig(config);
+ throw new SCMException("This action is prohibited for " +
+ securityConfig.getRootCaCertificatePollingInterval() +
Review Comment:
How about this wording?
"This action is prohibited due to that root CA and sub CA rotation have just
finished."
"The prohibition state will last at most " +
securityConfig.getRootCaCertificatePollingInterval().
"Please try the operation later again."
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
