[jira] [Created] (NIFI-16290) Node offload should give processors a bounded grace period to stop cleanly before forced termination

["Pierre Villard (Jira)" <ji...@apache.org>]

Pierre Villard created NIFI-16290:
-------------------------------------

             Summary: Node offload should give processors a bounded grace period to stop cleanly before forced termination
                 Key: NIFI-16290
                 URL: https://issues.apache.org/jira/browse/NIFI-16290
             Project: Apache NiFi
          Issue Type: Improvement
          Components: Core Framework
            Reporter: Pierre Villard
            Assignee: Pierre Villard


Currently, StandardFlowService.offload() calls rootGroup.stopProcessing() and immediately discards the returned future, then force-terminates any processor whose logical scheduled state is STOPPED. Because logical STOPPED also covers the physical STOPPING state, this termination can fire before a processor's asynchronous stop lifecycle has actually finished — overtaking @OnUnscheduled, aborting the wait for active threads to drain, and bypassing @OnStopped entirely. As a result, processors that close external resources (connections, files, sessions) during shutdown may never get the chance to do so cleanly when a node is offloaded, even though nothing was actually wedged or slow.

This change introduces a bounded grace period: offload now waits on the aggregate stopProcessing() future for up to nifi.flowcontroller.graceful.shutdown.period (reusing the existing graceful-shutdown setting) before falling through to the existing forced-termination sweep, which still always runs unconditionally afterward. This preserves the current guarantee that a hung or wedged processor — including one that has stashed an uncommitted ProcessSession, per NIFI-15885 — cannot block node offload indefinitely, while giving well-behaved processors a real opportunity to complete @OnUnscheduled/@OnStopped normally first. The outcome of the graceful wait (completed, timed out, interrupted, or exceptional/cancelled) is logged for operational visibility.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)