[jira] [Commented] (HDDS-9410) Upgrade stall from 1.3 to current code when gRPC TLS is enabled.

["Janus Chow (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/HDDS-9410?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17773197#comment-17773197 ] 

Janus Chow commented on HDDS-9410:
----------------------------------

[~pifta] Can I ask if this is a blocker for 1.4.0 release? If not, I will add the label of "non_1.4.0_blocker" to this ticket.

> Upgrade stall from 1.3 to current code when gRPC TLS is enabled.
> ----------------------------------------------------------------
>
>                 Key: HDDS-9410
>                 URL: https://issues.apache.org/jira/browse/HDDS-9410
>             Project: Apache Ozone
>          Issue Type: Bug
>          Components: Security
>    Affects Versions: 1.4.0
>            Reporter: István Fajth
>            Assignee: István Fajth
>            Priority: Blocker
>
> When a cluster is upgraded from the 1.3 release to the new code, with SCM HA enabled, and gRPC TLS turned on, SCM's stall and can not create the Ratis ring when starting up with the new code.
> It is happening because during the Ratis server setup, ReloadingX509(Key|Trust)Manager tries to create the CertPath object that is used in the new code to identify a role, and the cert path creation tries to reach the SCM leader to get the CA certificates in the system, which fails and is being retried indefinitely, with that SCM remains stuck in this retry loop, as it is still in the Ratis ring creation.
> A possible workaround for the problem is to concatenate the rootCA certificate to the certificate.crt and the <certSerialID>.crt file in the certificate directory (<ozone.metadata.dirs>/scm/sub-CA/certs/ folder).



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org