OmniaGM commented on code in PR #23639:
URL: https://github.com/apache/kafka/pull/23639#discussion_r4456164266
##########
core/src/main/scala/kafka/server/ControllerServer.scala:
##########
@@ -304,6 +304,17 @@ class ControllerServer(
fatal = false,
() => {}
))
+
.setMigrationConflictFaultHandler(sharedServer.faultHandlerFactory.build(
+ "zk migration conflict",
+ fatal = false,
+ () => {
+ try {
+ controller.forceRenounce().get(10, TimeUnit.SECONDS)
+ } catch {
+ case e: TimeoutException =>
sharedServer.fatalQuorumControllerFaultHandler.handleFault("Failed to renounce
leadership", e)
Review Comment:
General thought here: if `forceRenounce` takes more than 10s, we call
`fatalQuorumControllerFaultHandler` and the process exits. The event is queued
with `appendControlEvent`, so it waits behind everything already in the
controller queue. A slow queue therefore turns into a controller crash. Since
the `KRaftMigrationDriver` has already moved to `INACTIVE`, wouldn't logging
the timeout be enough? The next leader change would still recover it. Or is
there a reason we need the hard exit here?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
