[GitHub] [incubator-druid] gianm commented on issue #8686: Router management Proxy routing should have a way to route to any node in the cluster
gianm commented on issue #8686: Router management Proxy routing should have a way to route to any node in the cluster URL: https://github.com/apache/incubator-druid/issues/8686#issuecomment-542964407 > Also there is already an open proxy in the sampler (http firehose). I think it's different, because the http firehose at least can't be used unless you are an authenticated user and have write access to some datasource. (Not ideal but there is at least something that protects it.) The proxy route IIRC would be open to anyone anywhere. I believe it relies on the target server to do authentication. Limiting it to just Druid servers could lower the scariness levels enough. > From a scalability perspective I do not think it is a problem if this is a user initiated action (with a warning in the UI). Also remember that it would be OK for this to be slow, taking a 100ms pause between every request. I think with the pause, the scalability issue is less scary, so that sounds good. Or, we could also limit it to a certain number of servers. Probably if someone has, like, 100 servers, then they have figured out how to set their properties properly by then. This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org With regards, Apache Git Services - To unsubscribe, e-mail: commits-unsubscr...@druid.apache.org For additional commands, e-mail: commits-h...@druid.apache.org
[GitHub] [incubator-druid] gianm commented on issue #8686: Router management Proxy routing should have a way to route to any node in the cluster
gianm commented on issue #8686: Router management Proxy routing should have a way to route to any node in the cluster URL: https://github.com/apache/incubator-druid/issues/8686#issuecomment-542903549 > It might be better for the servers to all self-check themselves, and report the results of the self-check to a central location. Of course this has scalability problems too I thought it might be worth considering, though, because I am worried that since the Doctor is user-driven, it could cause stampedes of broadcast blasts to all servers in the cluster. This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org With regards, Apache Git Services - To unsubscribe, e-mail: commits-unsubscr...@druid.apache.org For additional commands, e-mail: commits-h...@druid.apache.org
[GitHub] [incubator-druid] gianm commented on issue #8686: Router management Proxy routing should have a way to route to any node in the cluster
gianm commented on issue #8686: Router management Proxy routing should have a way to route to any node in the cluster URL: https://github.com/apache/incubator-druid/issues/8686#issuecomment-542903041 This sounds like an open proxy and therefore I am scared of it. In the context of the Druid Doctor I think it would be better to put the checks into the Router itself, and have it contact other nodes on the caller's behalf if necessary, rather than run an open proxy. But even then, the issue implies you are thinking about contacting all servers in a cluster as part of a health check. For large clusters this has potential scalability problems. It might be better for the servers to all self-check themselves, and report the results of the self-check to a central location. Maybe they can report a hash of the important properties, and if the hashes differ we know there is a proxy. This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org With regards, Apache Git Services - To unsubscribe, e-mail: commits-unsubscr...@druid.apache.org For additional commands, e-mail: commits-h...@druid.apache.org
