Skip to content

[Bugfix] Disable Subscription and Pipes containing data insertion under Ratis - #19053

Open
Caideyipi wants to merge 9 commits into
masterfrom
codex/ratis-historical-replay-20261029
Open

Caideyipi wants to merge 9 commits into
masterfrom
codex/ratis-historical-replay-20261029

Conversation

@Caideyipi

@Caideyipi Caideyipi commented Oct 29, 2026 •

Copy link
Copy Markdown
Collaborator

When the DataRegion consensus protocol is Ratis, disable Subscription and only those Pipe synchronizations that capture data insertion (data.insert in the inclusion options, after applying exclusions).

  • Reject Subscription creation, activation, handshakes and requests, and prevent its runtime startup, recovery and internal synchronization under Ratis.
  • Reject creation, alteration and activation of Pipes that include data insertion, prevent their execution and recovery, and reject incoming insertion payloads across the supported transfer protocols.
  • Keep metadata-only and data.delete-only Pipes available under Ratis, including their startup, recovery and transfer paths. Pipes whose effective options exclude data insertion remain available.
  • Preserve the internal Pipes used by IoTConsensusV2. Ratis itself does not use consensus-internal Pipes.
  • Keep stop, drop and inspection paths available for cleanup, and preserve existing behavior for non-Ratis DataRegion consensus protocols.

Validation:

  • Before the master synchronization: a clean 29-module source dependency build and nine focused test classes passed (108 tests, zero failures, errors or skips). A clean Chinese-locale compilation also passed in an earlier validation round.
  • After the master synchronization: Spotless passed for Node Commons, DataNode and ConfigNode; whitespace checks passed; both branches' tests in the conflicting class and all 34 PR file deltas were preserved. Compilation and executable tests were not rerun after this merge.

Treat MinimumProgressIndex as unknown for Ratis historical extraction so
successful writes remain eligible for replay after a leader change.
Preserve valid-index and other consensus-protocol coverage filtering.

Add a regression test for initial and resumed checkpoints and the
unaffected filtering behavior.
@Caideyipi

Copy link
Copy Markdown
Collaborator Author

Initial independent self-review completed at head 1722b53, against master base a927dd6.

I reviewed the complete two-file diff and the surrounding historical extraction, progress filtering, Pipe checkpoint commit ordering, TsFile progress persistence, and Ratis recovery/snapshot paths. No actionable source-behavior or test-logic issues were found, so no fixes were needed.

The dedicated clean DataNode dependency-closure build and Spotless validation passed, and PipeHistoricalDataRegionTsFileAndDeletionSourceTest passed all 21 tests with 0 failures, errors, or skips, including the added Ratis regression. The added regression was not run in this local review session. GitHub CI is reported separately: some checks are still in progress, and SonarCloud Code Analysis failed on findings outside the files changed by this PR.

@Caideyipi
Caideyipi marked this pull request as ready for review October 29, 2026 07:40
@codecov

codecov Bot commented Oct 29, 2026 •

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 44.82759% with 96 lines in your changes missing coverage. Please review.
✅ Project coverage is 48.16%. Comparing base (3a51384) to head (9139707).

Files with missing lines Patch % Lines
...ger/pipe/coordinator/task/PipeTaskCoordinator.java 14.81% 23 Missing ⚠️
...apache/iotdb/confignode/manager/ConfigManager.java 0.00% 17 Missing ⚠️
...ol/thrift/impl/DataNodeInternalRPCServiceImpl.java 33.33% 8 Missing ⚠️
...ion/config/executor/ClusterConfigTaskExecutor.java 42.85% 8 Missing ⚠️
.../db/protocol/thrift/impl/ClientRPCServiceImpl.java 0.00% 7 Missing ⚠️
.../subscription/agent/SubscriptionReceiverAgent.java 50.00% 5 Missing ⚠️
.../ConsensusSubscriptionPrefetchExecutorManager.java 0.00% 5 Missing ⚠️
...ain/java/org/apache/iotdb/db/service/DataNode.java 0.00% 4 Missing ⚠️
...r/consensus/ConsensusSubscriptionSetupHandler.java 0.00% 4 Missing ⚠️
.../manager/subscription/SubscriptionCoordinator.java 0.00% 3 Missing ⚠️
... and 7 more
Additional details and impacted files
@@             Coverage Diff              @@
##             master   #19053      +/-   ##
============================================
+ Coverage     48.05%   48.16%   +0.11%     
- Complexity      604      614      +10     
============================================
  Files          5572     5572              
  Lines        410194   410336     +142     
  Branches      54112    54161      +49     
============================================
+ Hits         197110   197637     +527     
+ Misses       213084   212699     -385     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@Caideyipi
Caideyipi marked this pull request as draft October 29, 2026 08:20
@Caideyipi Caideyipi changed the title [Bugfix] Replay Ratis historical TsFiles without Pipe progress [Bugfix] Disable Pipe and Subscription under Ratis Oct 29, 2026
@Caideyipi

Copy link
Copy Markdown
Collaborator Author

This update changes the PR from replaying Ratis historical TsFiles to disabling Pipe and Subscription under Ratis.

  • Ratis now skips Pipe and Subscription runtime startup, active-metadata recovery, coordination, and receiver processing. Creation and activation are rejected; stop, drop, and inspection remain available for cleanup.
  • The first clean source build exposed two missing ConfigNodeDescriptor imports in ConfigNode Pipe classes. Restored both imports and Spotless passed.
  • Final clean English DataNode/ConfigNode reactor build passed. IoTDBDataNodeReceiverTest passed 21/21 and SubscriptionReceiverAgentTest passed 15/15. Clean with-zh-locale test compilation also passed.

This task-specific behavior update requires a fresh independent review. The PR remains Draft at head e2d2137.

@Caideyipi

Caideyipi commented Oct 30, 2026 •

Copy link
Copy Markdown
Collaborator Author

Independent re-review of d1b7ed27b50d533bff54aa37b5453bfb2d7abbd5 found five behavioral gaps. They are fixed in eab49c25efe9cf004dc84f2c28ea2216b2b0c6c5:

  1. Legacy receiver bypass. File-piece and TsFile-seal requests did not pass through the modern receiver's Ratis restriction. Reject both before file writes, rename, or loading, while retaining the legacy handshake and deletion path. iotdb-core/datanode/src/main/java/org/apache/iotdb/db/pipe/receiver/protocol/legacy/IoTDBLegacyPipeReceiverAgent.java:169,279.
  2. Different inclusion semantics. The guard used prefix matching different from the actual data-region listener: data.insert.extra could bypass rejection, and the same exclusion could cause a false rejection. Use a shared predicate matching DataRegionListeningFilter. iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/pipe/datastructure/options/PipeInclusionOptions.java:260.
  3. ConfigNode task recovery. The ConfigNode task agent inherited the permissive default, allowing metadata tasks of persisted insertion-containing Pipes to run under Ratis. Apply the task eligibility gate during recovery and metadata updates. iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/manager/pipe/agent/task/PipeConfigNodeTaskAgent.java:72.
  4. Completed subscription snapshot recovery. Single/full metadata restoration could recreate a completed-empty-snapshot broker after the task layer ignored the forbidden subscription Pipe. Apply the subscription feature gate before broker restoration. iotdb-core/datanode/src/main/java/org/apache/iotdb/db/pipe/agent/task/PipeDataNodeTaskAgent.java:273.
  5. Concurrent partial ALTER. Two requests could each pass against the initial RPC snapshot but merge into insertion-containing attributes under the procedure lock. Revalidate the final merged attributes in the existing locked validators, covering CREATE and both START variants as well. iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/persistence/pipe/PipeTaskInfo.java:315,432.

Ratis itself uses Raft log replication and has no consensus-internal Pipes; internal Pipe compatibility was checked with IoTConsensusV2. The regression coverage also checks permitted metadata/deletion Pipes, rejected file-transfer side effects, and absence of a restored subscription broker. No independent assertion or test-logic defect was identified in the original PR tests.

Validation:

  • Spotless with the with-integration-tests profile and git diff --check passed.
  • A clean source build of the three affected modules and their complete 29-module IoTDB dependency closure passed with the English locale. Seven selected test classes ran 61 tests: zero failures, errors, or skips. All tests newly added in this round ran locally.
  • The same clean source dependency closure passed test-compile -P with-zh-locale -DskipTests. Build caches were disabled for both runs.
  • Verification ran locally after remote toolchain setup failed due to a TLS download error. These checks do not represent a whole-repository test or integration-test run.

Reviewed SHA: d1b7ed27b50d533bff54aa37b5453bfb2d7abbd5. Final local SHA, confirmed source-branch SHA, and confirmed PR head: eab49c25efe9cf004dc84f2c28ea2216b2b0c6c5. The PR remains Draft, and its description was not changed. This round found behavioral issues; successful repair validation does not constitute a fresh issue-free independent review.

@Caideyipi

Copy link
Copy Markdown
Collaborator Author

Independent re-review completed in one round.

Reviewed SHA: eab49c25efe9cf004dc84f2c28ea2216b2b0c6c5. I independently inspected the complete diff against master, including previous fixes, and traced configuration, option matching, creation/alter/start, locked validation, recovery, subscription lifecycle/internal RPCs, receiver protocol envelopes, and the changed tests. The review also covered metadata/delete-only Pipes, non-Ratis protocols, and IoTConsensusV2 internal consensus Pipes; Ratis itself has no internal consensus Pipe.

Found and fixed two behavioral issues:

  1. Concurrent DROP could make ALTER/START throw a null-pointer exception. The existence check and metadata read held separate locks, so DROP could remove the metadata between them, including under non-Ratis protocols. Both operations now use one nullable metadata snapshot and retain the expected missing-Pipe/ALTER IF EXISTS statuses. See ALTER and START. A deterministic regression performs an actual DROP before lookup across four protocols and both models (24 cases).
  2. Insertion PlanNodes could bypass the Ratis restriction through TRANSFER_PLAN_NODE. That generic request accepts insertion nodes but was outside the dedicated tablet/TsFile request-type filter. The receiver now rejects InsertNode before statement conversion/execution using the existing localized response. See the admission check. Regressions cover four insertion node forms and plain, AirGap, compressed and sliced envelopes, plus allowed metadata/delete and non-Ratis insertion paths, with execution-entry assertions.

Validation: Spotless apply and diff checks passed. The 29-module source dependency closure was rebuilt from clean source; after correcting the new test fixture's Mockito compatibility and model dialect setup, ConfigNode was cleaned and rebuilt and the final 29-module reactor passed. All 108 tests in nine suites passed, with zero failures, errors or skips. All newly added tests were run locally. The remote attempt failed resolving a Maven extension before compilation; validation completed locally with JDK 17. This was focused unit-test/dependency-closure validation. Chinese-locale compilation was not repeated this round; no localization constants or cross-module APIs changed.

Final local SHA: f6dedbdddf584d1be959bd3a38bdb1f262c93191.
Confirmed remote source branch and PR head: f6dedbdddf584d1be959bd3a38bdb1f262c93191 (codex/ratis-historical-replay-20261029). The update was pushed successfully, and the PR remains Draft. Its description was unchanged. These behavioral findings require a fresh independent review; repair verification in this session was not a second review round.

@Caideyipi

Copy link
Copy Markdown
Collaborator Author

Independent re-review completed (one round).

  • Reviewed SHA: f6dedbdddf584d1be959bd3a38bdb1f262c93191.
  • Final local SHA and confirmed source-branch/PR head: f6dedbdddf584d1be959bd3a38bdb1f262c93191.
  • Scope: the complete 34-file diff against master (merge base 28c5028bb462403315e46319b57e9beb96ffaa69; fetched master 3a51384b2dcc8c29118b7d082c829450c4408b4c), including all earlier changes, the latest fixes, relevant callers/configuration, and changed test logic. Reviewed CREATE/ALTER/START and procedure locking, recovery and lifecycle, Subscription client/internal RPC paths, inclusion/exclusion matching, metadata/deletion compatibility, IoTConsensusV2 internal Pipes, and legacy/Thrift/air-gap/compressed/sliced receiver paths.
  • Findings: no actionable source-behavior or test-logic issues found. No fixes, source/test edits, new tests, commits, pushes, or PR-description changes were needed.
  • Validation this round: three-module offline Spotless check passed (JDK 17, Maven exit 0; unchanged-file cache used); full-diff whitespace checks passed; static checks passed for the two new bilingual message constants and all 12 Tablet/TsFile request types. Test fixtures, serialization paths, lifecycle assertions, execution-boundary counters, and configuration restoration were independently inspected.
  • Compilation and executable tests were not rerun because no code or test changed. The previously reported 29-module build and nine suites / 108 passing tests remain historical validation, not results from this round. No new unrun tests were introduced.
  • Remote CI: no check runs or individual commit statuses were returned for this SHA; combined status was pending. This is not counted as passing CI.
  • The source branch and PR head were reconfirmed unchanged. The PR remains Draft as requested.

@Caideyipi
Caideyipi marked this pull request as ready for review October 30, 2026 07:35
@Caideyipi Caideyipi changed the title [Bugfix] Disable Pipe and Subscription under Ratis [Bugfix] Disable Subscription and Pipes containing data insertion under Ratis Oct 30, 2026
@sonarqubecloud

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
E Reliability Rating on New Code (required ≥ A)
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant