-
Notifications
You must be signed in to change notification settings - Fork 3.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
kvserver: don't allow VOTER_DEMOTING to acquire lease after transfer #89564
kvserver: don't allow VOTER_DEMOTING to acquire lease after transfer #89564
Conversation
1df3280
to
f79466b
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This . Thanks for putting it together.
This PR also removes the leaseHolderRemovalAllowed parameter of CheckCanReceiveLease,
since it is always true since 22.2.
This is fine, but it will make the backport of this PR to v22.1.x a little harder. Reminder that we need to backport this to:
branch-release-v22.1.x
branch-release-v22.2.x
branch-release-v22.2.0
Consider pulling that into a separate commit. You could then use the backport
tool to backport only the first part of this change. Although I guess it's going to skew on 9f5f60b no matter what.
Release note (bug fix): stability fix.
Since we're going to have to backport this to v22.1, let's add some more detail to the release note.
Reviewed 9 of 9 files at r1, all commit messages.
Reviewable status:complete! 1 of 0 LGTMs obtained (waiting on @shralex)
pkg/roachpb/metadata_replicas.go
line 514 at r1 (raw file):
// to update replica filter in report to keep it correct. func CheckCanReceiveLease( wouldbeLeaseholder ReplicaDescriptor, replDescs ReplicaSet, wasLastLeaseholder bool,
Could we add a paragraph to the comment on this function explaining what this wasLastLeaseholder
param means?
pkg/kv/kvserver/client_lease_test.go
line 461 at r1 (raw file):
} // Complte the replication change.
s/Complte/Complete/
pkg/kv/kvserver/batcheval/cmd_lease_test.go
line 279 at r1 (raw file):
leaseholderType roachpb.ReplicaType anotherReplicaType roachpb.ReplicaType wasLastLeaseholderTrue bool
nit: consider renaming these to expIfWasLastLeaseholderTrue bool
and expIfWasLastLeaseholderFalse bool
to make it more clear that these are expected outputs for the test, not inputs.
f79466b
to
811e199
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Updated the release note. I think the test will conflict either way, not sure a separate commit is easier.
Reviewable status:
complete! 0 of 0 LGTMs obtained (and 1 stale) (waiting on @shralex)
pkg/roachpb/metadata_replicas.go
line 514 at r1 (raw file):
Previously, nvanbenschoten (Nathan VanBenschoten) wrote…
Could we add a paragraph to the comment on this function explaining what this
wasLastLeaseholder
param means?
Done
pkg/kv/kvserver/client_lease_test.go
line 461 at r1 (raw file):
Previously, nvanbenschoten (Nathan VanBenschoten) wrote…
s/Complte/Complete/
Done
pkg/kv/kvserver/batcheval/cmd_lease_test.go
line 279 at r1 (raw file):
Previously, nvanbenschoten (Nathan VanBenschoten) wrote…
nit: consider renaming these to
expIfWasLastLeaseholderTrue bool
andexpIfWasLastLeaseholderFalse bool
to make it more clear that these are expected outputs for the test, not inputs.
Done
5f39738
to
7301a44
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
once the test flakiness is resolved.
Reviewed 3 of 3 files at r2, all commit messages.
Reviewable status:complete! 1 of 0 LGTMs obtained (waiting on @shralex)
This PR restricts the case when a VOTER_DEMOTING_LEARNER can aquire the lease in a joint configuration to only the case where it was the last leaseholder. Since it is being removed, we only want it to get the lease if no other replica can aquire it, the scenario described in cockroachdb#83687 This fix solves a potential starvation scenario where a VOTER_DEMOTING_LEARNER keeps transferring the lease to the VOTER_INCOMING, succeeding, but then re-acquiring because the VOTER_INCOMING is dead and the lease expires. In this case, we would want another replica to pick up the lease, which would allow us to exit the joint configuration. This PR also removes the leaseHolderRemovalAllowed parameter of CheckCanReceiveLease, since it is always true since 22.2. Release note (bug fix): narrows down the conditions under which a VOTER_DEMOTING_LEARNER can acquire the lease in a joint configuration to a) there has to be an VOTER_INCOMING in the configuration and b) the VOTER_DEMOTING_LEARNER was the last leaseholder. This prevents it from acquiring the lease unless it is the only one that can acquire it, because transferring the lease away is necessary before exiting the joint config (without the fix the system can be stuck in a joint configuration in some rare situations). Fixes: cockroachdb#88667 See also cockroachdb#89340
7301a44
to
17d288b
Compare
bors r+ |
Build succeeded: |
Encountered an error creating backports. Some common things that can go wrong:
You might need to create your backport manually using the backport tool. error creating merge commit from 17d288b to blathers/backport-release-22.1-89564: POST https://api.github.com/repos/cockroachdb/cockroach/merges: 409 Merge conflict [] you may need to manually resolve merge conflicts with the backport tool. Backport to branch 22.1.x failed. See errors above. 🦉 Hoot! I am a Blathers, a bot for CockroachDB. My owner is otan. |
89340: kv: bypass lease transfer safety checks during joint consensus r=shralex a=nvanbenschoten This commit adds logic to bypass lease transfer safety checks (added in 034611b) when in a joint configuration and transferring the lease from a VOTER_DEMOTING to a VOTER_INCOMING. We do so because we could get stuck without a path to exit the joint configuration if we rejected this lease transfer while waiting to confirm that the target is up-to-date on its log. That confirmation may never arrive if the target is dead or partitioned away, and while we'd rather not transfer the lease to a dead node, at least we have a mechanism to recovery from that state. We also just sent the VOTER_INCOMING a snapshot (as a LEARNER, before promotion), so it is unlikely that the replica is actually dead or behind on its log. A better alternative here would be to introduce a mechanism to choose an alternate lease transfer target after some amount of time, if the lease transfer to the VOTER_INCOMING cannot be confirmed to be safe. We may do this in the future, but given the proximity to the release and given that this matches the behavior in v22.1, we choose this approach for now. Release note: None Release justification: Needed to resolve release blocker. Fixes: #88667 See also #89564 Co-authored-by: Nathan VanBenschoten <[email protected]>
This PR restricts the case when a VOTER_DEMOTING_LEARNER can aquire the lease in a joint configuration to only the case where it was the last leaseholder. Since it is being removed, we only want it to get the lease if no other replica can aquire it, the scenario described in #83687
This fix solves a potential starvation scenario where a VOTER_DEMOTING_LEARNER keeps transferring the lease to the VOTER_INCOMING, succeeding, but then re-acquiring because the VOTER_INCOMING is dead and the lease expires. In this case, we would want another replica to pick up the lease, which would allow us to exit the joint configuration.
This PR also removes the leaseHolderRemovalAllowed parameter of CheckCanReceiveLease,
since it is always true since 22.2.
Release note (bug fix): narrows down the conditions under which a VOTER_DEMOTING_LEARNER can acquire the lease in a joint configuration to a) there has to be an VOTER_INCOMING in the configuration and b) the VOTER_DEMOTING_LEARNER was the last leaseholder. This prevents it from acquiring the lease unless it is the only one that can acquire it, because transferring the lease away is necessary before exiting the joint config (without the fix the system can be stuck in a joint configuration in some rare situations).
Fixes: #88667
See also #89340