mirror of
https://github.com/scylladb/scylladb.git
synced 2026-04-27 03:45:11 +00:00
8510568eda
When only inter dc encryption is enabled a non encrypted connection between two nodes is allowed only if both nodes are in the same dc. If a nodes that initiates the connection knows that dst is in the same dc and hence use non encrypted connection, but the dst not yet knows the topology of the src such connection will not be allowed since dst cannot guaranty that dst is in the same dc. Currently, when topology coordinator is used, a replacing node will appear in the coordinator's topology immediately after it is added to the group0. The coordinator will try to send raft message to the new node and (assuming only inter dc encryption is enabled and replacing node and the coordinator are in the same dc) it will try to open regular, non encrypted, connection to it. But the replacing node will not have the coordinator in it's topology yet (it needs to sync the raft state for that). so it will reject such connection. To solve the problem the patch does not add a replacing node that was just added to group0 to the topology. It will be added later, when tokens will be assigned to it. At this point a replacing node will already make sure that its topology state is up-to-date (since it will execute a raft barrier in join_node_response_params handler) and it knows coordinator's topology. This aligns replace behaviour with bootstrap since bootstrap also does not add a node without a ring to the topology. The patch effectively revertsb8ee8911caFixes: scylladb/scylladb#19025 (cherry picked from commit17f4a151ce)
49 lines
1.7 KiB
Python
49 lines
1.7 KiB
Python
#
|
|
# Copyright (C) 2024-present ScyllaDB
|
|
#
|
|
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
#
|
|
import pytest
|
|
from test.pylib.manager_client import ManagerClient
|
|
from test.pylib.scylla_cluster import ReplaceConfig
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_replace_with_encryption(manager: ManagerClient):
|
|
"""Test that a node can be replaced if inter-dc encryption is enabled.
|
|
The test creates 6 node cluster with two DCs and replaces one node in
|
|
each DC"""
|
|
config = {"endpoint_snitch": "GossipingPropertyFileSnitch"}
|
|
property_file_dc1 = {"dc": "dc1", "rack": "myrack"}
|
|
property_file_dc2 = {"dc": "dc2", "rack": "myrack"}
|
|
|
|
s1 = await manager.servers_add(3,
|
|
config=config,
|
|
property_file=property_file_dc1,
|
|
server_encryption="dc"
|
|
)
|
|
s2 = await manager.servers_add(3,
|
|
config=config,
|
|
property_file=property_file_dc2,
|
|
server_encryption="dc"
|
|
)
|
|
|
|
await manager.server_stop_gracefully(s1[1].server_id)
|
|
|
|
replace_cfg = ReplaceConfig(replaced_id = s1[1].server_id, reuse_ip_addr = False,
|
|
use_host_id = True)
|
|
|
|
await manager.server_add(replace_cfg=replace_cfg, config=config,
|
|
property_file=property_file_dc1,
|
|
server_encryption="dc"
|
|
)
|
|
|
|
await manager.server_stop_gracefully(s2[0].server_id)
|
|
|
|
replace_cfg = ReplaceConfig(replaced_id = s2[0].server_id, reuse_ip_addr = False,
|
|
use_host_id = True)
|
|
|
|
await manager.server_add(replace_cfg=replace_cfg, config=config,
|
|
property_file=property_file_dc2,
|
|
server_encryption="dc"
|
|
)
|