You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ozone.apache.org by "Bharat Viswanadham (Jira)" <ji...@apache.org> on 2021/03/31 16:16:00 UTC
[jira] [Comment Edited] (HDDS-5052) [SCM HA Security] Handle leader
changes between SCMInfo and getSCMSigned Cert in OM
[ https://issues.apache.org/jira/browse/HDDS-5052?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17312500#comment-17312500 ]
Bharat Viswanadham edited comment on HDDS-5052 at 3/31/21, 4:15 PM:
--------------------------------------------------------------------
Discuss with Xiaoyu offline, and we decided to eliminate persist scmId and check SCMID during OM startup.
We persist SCM ClusteriD for both HA/non-HA in OzoneManager.
And in SCM we remove the SCMID check and keep SCM ClusterID check.
was (Author: bharatviswa):
Discuss with Xiaoyu offline, and we decided to eliminate persist scmId and check SCMID during OM startup.
We persist SCM ClusteriD for both HA/non-HA
And in SCM we remove the SCMID check and keep SCM ClusterID check.
> [SCM HA Security] Handle leader changes between SCMInfo and getSCMSigned Cert in OM
> -----------------------------------------------------------------------------------
>
> Key: HDDS-5052
> URL: https://issues.apache.org/jira/browse/HDDS-5052
> Project: Apache Ozone
> Issue Type: Bug
> Components: SCM HA
> Reporter: Bharat Viswanadham
> Assignee: Bharat Viswanadham
> Priority: Major
>
> This Jira is to handle leader change between getScmInfo and getScmSignedCert.
> *Problem:*
> *Leader is SCM1 - Returned SCMID is SCM1ID*
> ScmInfo returns the leader SCMID
> *Leader is SCM2 - SCM ID is SCM2ID*
> getSCMSignedCert, during generate certificate it has a check compare the scmId passed in CSR, is same as current SCM scmID
> In this case when the leader change between these 2 calls OM will fail to get a Certificate.
> *Proposed Solution:*
> getScmInfo returns primary SCM ID, and OM can pass this Primary SCM ID in CSR.
> In this way, even if the leader changes OM can still get a certificate.
> Note: primary SCM Id is the same across the SCM HA quorum nodes.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org