hanahmily commented on code in PR #882:
URL:
https://github.com/apache/skywalking-banyandb/pull/882#discussion_r2593112473
##########
banyand/queue/pub/pub.go:
##########
@@ -441,13 +486,55 @@ func isFailoverError(err error) bool {
}
func (p *pub) getClientTransportCredentials() ([]grpc.DialOption, error) {
+ if !p.tlsEnabled {
+ return grpchelper.SecureOptions(nil, false, false, "")
+ }
+
+ // Use reloader if available (for dynamic reloading)
+ if p.caCertReloader != nil {
+ // Extract server name from the connection (we'll use a default
for now)
+ // The actual server name will be validated by the TLS handshake
+ tlsConfig, err := p.caCertReloader.GetClientTLSConfig("")
+ if err != nil {
+ return nil, fmt.Errorf("failed to get TLS config from
reloader: %w", err)
+ }
+ creds := credentials.NewTLS(tlsConfig)
+ return []grpc.DialOption{grpc.WithTransportCredentials(creds)},
nil
+ }
+
+ // Fallback to static file reading if reloader is not available
opts, err := grpchelper.SecureOptions(nil, p.tlsEnabled, false,
p.caCertPath)
if err != nil {
return nil, fmt.Errorf("failed to load TLS config: %w", err)
}
return opts, nil
}
+// reconnectAllClients reconnects all active clients when CA certificate is
updated.
+func (p *pub) reconnectAllClients() {
+ // Collect nodes from p.register with lock
+ p.mu.Lock()
+ nodesToReconnect := make([]schema.Metadata, 0, len(p.registered))
+ for _, node := range p.registered {
+ md := schema.Metadata{
+ TypeMeta: schema.TypeMeta{
+ Kind: schema.KindNode,
+ },
+ Spec: node,
+ }
+ nodesToReconnect = append(nodesToReconnect, md)
+ }
+ p.mu.Unlock()
+
+ // Reconnect all nodes using OnDelete and OnAddOrUpdate
+ for _, md := range nodesToReconnect {
+ // Call OnDelete to properly clean up the old connection
+ p.OnDelete(md)
+ // Call OnAddOrUpdate to reconnect with new certificate
Review Comment:
@OmCheeLin colipot's founding makes sense. but it doesn't handle
`evictable`. If the node is in the evictable list, you should remove it in the
loop
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
