fapifta commented on code in PR #5064:
URL: https://github.com/apache/ozone/pull/5064#discussion_r1282818194
##########
hadoop-hdds/server-scm/src/main/java/org/apache/hadoop/hdds/scm/server/SCMSecurityProtocolServer.java:
##########
@@ -208,16 +206,31 @@ public String getCertificate(
nodeDetails.getNodeType(), nodeDetails.getHostName(),
nodeDetails.getUuid());
Objects.requireNonNull(nodeDetails);
- if (storageContainerManager.getRootCARotationManager() != null &&
- storageContainerManager.getRootCARotationManager()
- .isRotationInProgress()) {
- throw new SCMException(("Root CA and Sub CA rotation is in-progress." +
- " Please try the operation later again."),
- SCMException.ResultCodes.CA_ROTATION_IN_PROGRESS);
- }
+ checkIsCertSignRequestAllowed(false);
return getEncodedCertToString(certSignReq, nodeDetails.getNodeType());
}
+ private void checkIsCertSignRequestAllowed(boolean isScmCertRenew)
+ throws SCMException {
+ RootCARotationManager rotationManager =
+ storageContainerManager.getRootCARotationManager();
+ if (rotationManager != null) {
+ if (rotationManager.isRotationInProgress() && !isScmCertRenew) {
+ throw new SCMException("Root CA and Sub CA rotation is in-progress." +
+ " Please try the operation later again.",
+ ResultCodes.CA_ROTATION_IN_PROGRESS);
+ }
+ if (rotationManager.isPostRotationInProgress()) {
+ SecurityConfig securityConfig = new SecurityConfig(config);
+ throw new SCMException("This action is prohibited for " +
+ securityConfig.getRootCaCertificatePollingInterval() +
Review Comment:
I like this wording more, if you would change it that would be good. Thank
you!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
