Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

kvserver: don't allow VOTER_DEMOTING to acquire lease after transfer #89564

Merged
merged 1 commit into from
Oct 8, 2022

Conversation

shralex
Copy link
Contributor

@shralex shralex commented Oct 7, 2022

This PR restricts the case when a VOTER_DEMOTING_LEARNER can aquire the lease in a joint configuration to only the case where it was the last leaseholder. Since it is being removed, we only want it to get the lease if no other replica can aquire it, the scenario described in #83687

This fix solves a potential starvation scenario where a VOTER_DEMOTING_LEARNER keeps transferring the lease to the VOTER_INCOMING, succeeding, but then re-acquiring because the VOTER_INCOMING is dead and the lease expires. In this case, we would want another replica to pick up the lease, which would allow us to exit the joint configuration.

This PR also removes the leaseHolderRemovalAllowed parameter of CheckCanReceiveLease,
since it is always true since 22.2.

Release note (bug fix): narrows down the conditions under which a VOTER_DEMOTING_LEARNER can acquire the lease in a joint configuration to a) there has to be an VOTER_INCOMING in the configuration and b) the VOTER_DEMOTING_LEARNER was the last leaseholder. This prevents it from acquiring the lease unless it is the only one that can acquire it, because transferring the lease away is necessary before exiting the joint config (without the fix the system can be stuck in a joint configuration in some rare situations).

Fixes: #88667
See also #89340

@shralex shralex requested a review from a team as a code owner October 7, 2022 05:57
@cockroach-teamcity
Copy link
Member

This change is Reviewable

@shralex shralex requested a review from nvanbenschoten October 7, 2022 05:58
@shralex shralex force-pushed the harden_joint_lease_transfers1 branch from 1df3280 to f79466b Compare October 7, 2022 06:04
Copy link
Member

@nvanbenschoten nvanbenschoten left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This :lgtm:. Thanks for putting it together.

This PR also removes the leaseHolderRemovalAllowed parameter of CheckCanReceiveLease,
since it is always true since 22.2.

This is fine, but it will make the backport of this PR to v22.1.x a little harder. Reminder that we need to backport this to:

  • branch-release-v22.1.x
  • branch-release-v22.2.x
  • branch-release-v22.2.0

Consider pulling that into a separate commit. You could then use the backport tool to backport only the first part of this change. Although I guess it's going to skew on 9f5f60b no matter what.

Release note (bug fix): stability fix.

Since we're going to have to backport this to v22.1, let's add some more detail to the release note.

Reviewed 9 of 9 files at r1, all commit messages.
Reviewable status: :shipit: complete! 1 of 0 LGTMs obtained (waiting on @shralex)


pkg/roachpb/metadata_replicas.go line 514 at r1 (raw file):

// to update replica filter in report to keep it correct.
func CheckCanReceiveLease(
	wouldbeLeaseholder ReplicaDescriptor, replDescs ReplicaSet, wasLastLeaseholder bool,

Could we add a paragraph to the comment on this function explaining what this wasLastLeaseholder param means?


pkg/kv/kvserver/client_lease_test.go line 461 at r1 (raw file):

	}

	// Complte the replication change.

s/Complte/Complete/


pkg/kv/kvserver/batcheval/cmd_lease_test.go line 279 at r1 (raw file):

		leaseholderType         roachpb.ReplicaType
		anotherReplicaType      roachpb.ReplicaType
		wasLastLeaseholderTrue  bool

nit: consider renaming these to expIfWasLastLeaseholderTrue bool and expIfWasLastLeaseholderFalse bool to make it more clear that these are expected outputs for the test, not inputs.

Copy link
Contributor Author

@shralex shralex left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated the release note. I think the test will conflict either way, not sure a separate commit is easier.

Reviewable status: :shipit: complete! 0 of 0 LGTMs obtained (and 1 stale) (waiting on @shralex)


pkg/roachpb/metadata_replicas.go line 514 at r1 (raw file):

Previously, nvanbenschoten (Nathan VanBenschoten) wrote…

Could we add a paragraph to the comment on this function explaining what this wasLastLeaseholder param means?

Done


pkg/kv/kvserver/client_lease_test.go line 461 at r1 (raw file):

Previously, nvanbenschoten (Nathan VanBenschoten) wrote…

s/Complte/Complete/

Done


pkg/kv/kvserver/batcheval/cmd_lease_test.go line 279 at r1 (raw file):

Previously, nvanbenschoten (Nathan VanBenschoten) wrote…

nit: consider renaming these to expIfWasLastLeaseholderTrue bool and expIfWasLastLeaseholderFalse bool to make it more clear that these are expected outputs for the test, not inputs.

Done

@shralex shralex force-pushed the harden_joint_lease_transfers1 branch 5 times, most recently from 5f39738 to 7301a44 Compare October 7, 2022 17:22
Copy link
Member

@nvanbenschoten nvanbenschoten left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:lgtm: once the test flakiness is resolved.

Reviewed 3 of 3 files at r2, all commit messages.
Reviewable status: :shipit: complete! 1 of 0 LGTMs obtained (waiting on @shralex)

This PR restricts the case when a VOTER_DEMOTING_LEARNER can
aquire the lease in a joint configuration to only the case where
it was the last leaseholder. Since it is being removed, we only
want it to get the lease if no other replica can aquire it,
the scenario described in cockroachdb#83687

This fix solves a potential starvation scenario where a VOTER_DEMOTING_LEARNER keeps
transferring the lease to the VOTER_INCOMING, succeeding, but then re-acquiring
because the VOTER_INCOMING is dead and the lease expires. In this case, we would
want another replica to pick up the lease, which would allow us to exit the joint configuration.

This PR also removes the leaseHolderRemovalAllowed parameter of CheckCanReceiveLease,
since it is always true since 22.2.

Release note (bug fix): narrows down the conditions under which a VOTER_DEMOTING_LEARNER
can acquire the lease in a joint configuration to a) there has to be an VOTER_INCOMING
in the configuration and b) the VOTER_DEMOTING_LEARNER was the last leaseholder. This
prevents it from acquiring the lease unless it is the only one that can acquire it,
because transferring the lease away is necessary before exiting the joint config (without
the fix the system can be stuck in a joint configuration in some rare situations).

Fixes: cockroachdb#88667
See also cockroachdb#89340
@shralex shralex force-pushed the harden_joint_lease_transfers1 branch from 7301a44 to 17d288b Compare October 7, 2022 20:25
@shralex
Copy link
Contributor Author

shralex commented Oct 8, 2022

bors r+

@craig
Copy link
Contributor

craig bot commented Oct 8, 2022

Build succeeded:

@blathers-crl
Copy link

blathers-crl bot commented Oct 8, 2022

Encountered an error creating backports. Some common things that can go wrong:

  1. The backport branch might have already existed.
  2. There was a merge conflict.
  3. The backport branch contained merge commits.

You might need to create your backport manually using the backport tool.


error creating merge commit from 17d288b to blathers/backport-release-22.1-89564: POST https://api.github.com/repos/cockroachdb/cockroach/merges: 409 Merge conflict []

you may need to manually resolve merge conflicts with the backport tool.

Backport to branch 22.1.x failed. See errors above.


🦉 Hoot! I am a Blathers, a bot for CockroachDB. My owner is otan.

craig bot pushed a commit that referenced this pull request Oct 9, 2022
89340: kv: bypass lease transfer safety checks during joint consensus r=shralex a=nvanbenschoten

This commit adds logic to bypass lease transfer safety checks (added in 034611b) when in a joint configuration and transferring the lease from a VOTER_DEMOTING to a VOTER_INCOMING. We do so because we could get stuck without a path to exit the joint configuration if we rejected this lease transfer while waiting to confirm that the target is up-to-date on its log. That confirmation may never arrive if the target is dead or partitioned away, and while we'd rather not transfer the lease to a dead node, at least we have a mechanism to recovery from that state. We also just sent the VOTER_INCOMING a snapshot (as a LEARNER, before promotion), so it is unlikely that the replica is actually dead or behind on its log.

A better alternative here would be to introduce a mechanism to choose an alternate lease transfer target after some amount of time, if the lease transfer to the VOTER_INCOMING cannot be confirmed to be safe. We may do this in the future, but given the proximity to the release and given that this matches the behavior in v22.1, we choose this approach for now.

Release note: None

Release justification: Needed to resolve release blocker.

Fixes: #88667
See also #89564

Co-authored-by: Nathan VanBenschoten <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

roachtest: restore/nodeShutdown/worker failed
3 participants