Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Able to switch on/off SSL in Operator #503

Closed
wenhaocs opened this issue May 22, 2024 · 2 comments
Closed

Able to switch on/off SSL in Operator #503

wenhaocs opened this issue May 22, 2024 · 2 comments
Assignees
Milestone

Comments

@wenhaocs
Copy link

wenhaocs commented May 22, 2024

Operator is doing rolling restart on config update. But it does not help on SSL change. All 3 metads instances need to communicate with each other in order to be live. If only 1 restarts and changes from SSL on to SSL off, it is unable to get heartbeats from other instances. But operator will not continue to restart the next metad instance if the prior restart has not finished...

E20240522 17:48:39.582396    77 PeekingManager.h:115] Received SSL connection on non SSL port
E20240522 17:48:39.586596    78 PeekingManager.h:115] Received SSL connection on non SSL port
E20240522 17:48:39.590667    79 PeekingManager.h:115] Received SSL connection on non SSL port
E20240522 17:48:39.594632    80 PeekingManager.h:115] Received SSL connection on non SSL port
E20240522 17:48:39.598673    65 PeekingManager.h:115] Received SSL connection on non SSL port
E20240522 17:48:39.602654    66 PeekingManager.h:115] Received SSL connection on non SSL port
mau-comm-metad-0                     3/3     Running   0          7d20h
mau-comm-metad-1                     3/3     Running   0          7d20h
mau-comm-metad-2                     2/3     Running   0          12m

rkovvuri@HKWVMPM23L graph-service % kubectl describe pod mau-comm-metad-2 -n mau-comm
Normal   Started    13m                  kubelet           Started container statsd-pubsub
  Warning  Unhealthy  3m1s (x68 over 12m)  kubelet           Readiness probe failed: Get "http://10.66.94.221:19559/status": dial tcp 10.66.94.221:19559: connect: connection refused
@MegaByte875 MegaByte875 self-assigned this May 23, 2024
@MegaByte875 MegaByte875 added this to the v1.8.1 milestone May 24, 2024
@MegaByte875
Copy link
Contributor

The testing cases all passed with operator v1.8.0.

  • SSL on to SSL off
  • SSL off to SSL on

Please note that internal RPC interface calls will fail during SSL switchover.

@wenhaocs
Copy link
Author

Please prioritize this for internal RPC interface. E.g., do not transfer leaders for SSL config changes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants