Skip to content

[Bugfix] Disable Subscription and Pipes containing data insertion under Ratis - #19053

Open
Caideyipi wants to merge 12 commits into
masterfrom
codex/ratis-historical-replay-20261029
Open

Caideyipi wants to merge 12 commits into
masterfrom
codex/ratis-historical-replay-20261029

Conversation

@Caideyipi

@Caideyipi Caideyipi commented Oct 29, 2026 •

Copy link
Copy Markdown
Collaborator

When the DataRegion consensus protocol is Ratis, disable Subscription and only those Pipe synchronizations that capture data insertion (data.insert in the inclusion options, after applying exclusions).

  • Reject Subscription creation, activation, handshakes and requests, and prevent its runtime startup, recovery and internal synchronization under Ratis.
  • Reject creation, alteration and activation of Pipes that include data insertion, prevent their execution and recovery, and reject incoming insertion payloads across the supported transfer protocols.
  • Keep metadata-only and data.delete-only Pipes available under Ratis, including their startup, recovery and transfer paths. Pipes whose effective options exclude data insertion remain available.
  • Keep stop, drop and inspection paths available for cleanup, and preserve existing behavior for non-Ratis DataRegion consensus protocols.

Validation:

  • Before the master synchronization: a clean 29-module source dependency build and nine focused test classes passed (108 tests, zero failures, errors or skips). A clean Chinese-locale compilation also passed in an earlier validation round.
  • After the master synchronization: Spotless passed for Node Commons, DataNode and ConfigNode; whitespace checks passed; both branches' tests in the conflicting class and all 34 PR file deltas were preserved. Compilation and executable tests were not rerun after this merge.
  • Latest cleanup (7936b04cea7): Spotless passed for DataNode and ConfigNode, and whitespace checks passed. The focused unit-test rerun was blocked before compilation while resolving the missing Maven extension com.gradle:develocity-maven-extension:2.6.0; no tests were executed in this rerun.

Treat MinimumProgressIndex as unknown for Ratis historical extraction so
successful writes remain eligible for replay after a leader change.
Preserve valid-index and other consensus-protocol coverage filtering.

Add a regression test for initial and resumed checkpoints and the
unaffected filtering behavior.
@Caideyipi

Copy link
Copy Markdown
Collaborator Author

Initial independent self-review completed at head 1722b53, against master base a927dd6.

I reviewed the complete two-file diff and the surrounding historical extraction, progress filtering, Pipe checkpoint commit ordering, TsFile progress persistence, and Ratis recovery/snapshot paths. No actionable source-behavior or test-logic issues were found, so no fixes were needed.

The dedicated clean DataNode dependency-closure build and Spotless validation passed, and PipeHistoricalDataRegionTsFileAndDeletionSourceTest passed all 21 tests with 0 failures, errors, or skips, including the added Ratis regression. The added regression was not run in this local review session. GitHub CI is reported separately: some checks are still in progress, and SonarCloud Code Analysis failed on findings outside the files changed by this PR.

@Caideyipi
Caideyipi marked this pull request as ready for review October 29, 2026 07:40
@codecov

codecov Bot commented Oct 29, 2026 •

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 44.82759% with 96 lines in your changes missing coverage. Please review.
✅ Project coverage is 48.16%. Comparing base (3a51384) to head (9139707).

Files with missing lines Patch % Lines
...ger/pipe/coordinator/task/PipeTaskCoordinator.java 14.81% 23 Missing ⚠️
...apache/iotdb/confignode/manager/ConfigManager.java 0.00% 17 Missing ⚠️
...ol/thrift/impl/DataNodeInternalRPCServiceImpl.java 33.33% 8 Missing ⚠️
...ion/config/executor/ClusterConfigTaskExecutor.java 42.85% 8 Missing ⚠️
.../db/protocol/thrift/impl/ClientRPCServiceImpl.java 0.00% 7 Missing ⚠️
.../subscription/agent/SubscriptionReceiverAgent.java 50.00% 5 Missing ⚠️
.../ConsensusSubscriptionPrefetchExecutorManager.java 0.00% 5 Missing ⚠️
...ain/java/org/apache/iotdb/db/service/DataNode.java 0.00% 4 Missing ⚠️
...r/consensus/ConsensusSubscriptionSetupHandler.java 0.00% 4 Missing ⚠️
.../manager/subscription/SubscriptionCoordinator.java 0.00% 3 Missing ⚠️
... and 7 more
Additional details and impacted files
@@             Coverage Diff              @@
##             master   #19053      +/-   ##
============================================
+ Coverage     48.05%   48.16%   +0.11%     
- Complexity      604      614      +10     
============================================
  Files          5572     5572              
  Lines        410194   410336     +142     
  Branches      54112    54161      +49     
============================================
+ Hits         197110   197637     +527     
+ Misses       213084   212699     -385     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@Caideyipi
Caideyipi marked this pull request as draft October 29, 2026 08:20
@Caideyipi Caideyipi changed the title [Bugfix] Replay Ratis historical TsFiles without Pipe progress [Bugfix] Disable Pipe and Subscription under Ratis Oct 29, 2026
@Caideyipi

Copy link
Copy Markdown
Collaborator Author

This update changes the PR from replaying Ratis historical TsFiles to disabling Pipe and Subscription under Ratis.

  • Ratis now skips Pipe and Subscription runtime startup, active-metadata recovery, coordination, and receiver processing. Creation and activation are rejected; stop, drop, and inspection remain available for cleanup.
  • The first clean source build exposed two missing ConfigNodeDescriptor imports in ConfigNode Pipe classes. Restored both imports and Spotless passed.
  • Final clean English DataNode/ConfigNode reactor build passed. IoTDBDataNodeReceiverTest passed 21/21 and SubscriptionReceiverAgentTest passed 15/15. Clean with-zh-locale test compilation also passed.

This task-specific behavior update requires a fresh independent review. The PR remains Draft at head e2d2137.

@Caideyipi

Caideyipi commented Oct 30, 2026 •

Copy link
Copy Markdown
Collaborator Author

Independent re-review of d1b7ed27b50d533bff54aa37b5453bfb2d7abbd5 found five behavioral gaps. They are fixed in eab49c25efe9cf004dc84f2c28ea2216b2b0c6c5:

  1. Legacy receiver bypass. File-piece and TsFile-seal requests did not pass through the modern receiver's Ratis restriction. Reject both before file writes, rename, or loading, while retaining the legacy handshake and deletion path. iotdb-core/datanode/src/main/java/org/apache/iotdb/db/pipe/receiver/protocol/legacy/IoTDBLegacyPipeReceiverAgent.java:169,279.
  2. Different inclusion semantics. The guard used prefix matching different from the actual data-region listener: data.insert.extra could bypass rejection, and the same exclusion could cause a false rejection. Use a shared predicate matching DataRegionListeningFilter. iotdb-core/node-commons/src/main/java/org/apache/iotdb/commons/pipe/datastructure/options/PipeInclusionOptions.java:260.
  3. ConfigNode task recovery. The ConfigNode task agent inherited the permissive default, allowing metadata tasks of persisted insertion-containing Pipes to run under Ratis. Apply the task eligibility gate during recovery and metadata updates. iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/manager/pipe/agent/task/PipeConfigNodeTaskAgent.java:72.
  4. Completed subscription snapshot recovery. Single/full metadata restoration could recreate a completed-empty-snapshot broker after the task layer ignored the forbidden subscription Pipe. Apply the subscription feature gate before broker restoration. iotdb-core/datanode/src/main/java/org/apache/iotdb/db/pipe/agent/task/PipeDataNodeTaskAgent.java:273.
  5. Concurrent partial ALTER. Two requests could each pass against the initial RPC snapshot but merge into insertion-containing attributes under the procedure lock. Revalidate the final merged attributes in the existing locked validators, covering CREATE and both START variants as well. iotdb-core/confignode/src/main/java/org/apache/iotdb/confignode/persistence/pipe/PipeTaskInfo.java:315,432.

Ratis itself uses Raft log replication and has no consensus-internal Pipes; internal Pipe compatibility was checked with IoTConsensusV2. The regression coverage also checks permitted metadata/deletion Pipes, rejected file-transfer side effects, and absence of a restored subscription broker. No independent assertion or test-logic defect was identified in the original PR tests.

Validation:

  • Spotless with the with-integration-tests profile and git diff --check passed.
  • A clean source build of the three affected modules and their complete 29-module IoTDB dependency closure passed with the English locale. Seven selected test classes ran 61 tests: zero failures, errors, or skips. All tests newly added in this round ran locally.
  • The same clean source dependency closure passed test-compile -P with-zh-locale -DskipTests. Build caches were disabled for both runs.
  • Verification ran locally after remote toolchain setup failed due to a TLS download error. These checks do not represent a whole-repository test or integration-test run.

Reviewed SHA: d1b7ed27b50d533bff54aa37b5453bfb2d7abbd5. Final local SHA, confirmed source-branch SHA, and confirmed PR head: eab49c25efe9cf004dc84f2c28ea2216b2b0c6c5. The PR remains Draft, and its description was not changed. This round found behavioral issues; successful repair validation does not constitute a fresh issue-free independent review.

@Caideyipi

Copy link
Copy Markdown
Collaborator Author

Independent re-review completed in one round.

Reviewed SHA: eab49c25efe9cf004dc84f2c28ea2216b2b0c6c5. I independently inspected the complete diff against master, including previous fixes, and traced configuration, option matching, creation/alter/start, locked validation, recovery, subscription lifecycle/internal RPCs, receiver protocol envelopes, and the changed tests. The review also covered metadata/delete-only Pipes, non-Ratis protocols, and IoTConsensusV2 internal consensus Pipes; Ratis itself has no internal consensus Pipe.

Found and fixed two behavioral issues:

  1. Concurrent DROP could make ALTER/START throw a null-pointer exception. The existence check and metadata read held separate locks, so DROP could remove the metadata between them, including under non-Ratis protocols. Both operations now use one nullable metadata snapshot and retain the expected missing-Pipe/ALTER IF EXISTS statuses. See ALTER and START. A deterministic regression performs an actual DROP before lookup across four protocols and both models (24 cases).
  2. Insertion PlanNodes could bypass the Ratis restriction through TRANSFER_PLAN_NODE. That generic request accepts insertion nodes but was outside the dedicated tablet/TsFile request-type filter. The receiver now rejects InsertNode before statement conversion/execution using the existing localized response. See the admission check. Regressions cover four insertion node forms and plain, AirGap, compressed and sliced envelopes, plus allowed metadata/delete and non-Ratis insertion paths, with execution-entry assertions.

Validation: Spotless apply and diff checks passed. The 29-module source dependency closure was rebuilt from clean source; after correcting the new test fixture's Mockito compatibility and model dialect setup, ConfigNode was cleaned and rebuilt and the final 29-module reactor passed. All 108 tests in nine suites passed, with zero failures, errors or skips. All newly added tests were run locally. The remote attempt failed resolving a Maven extension before compilation; validation completed locally with JDK 17. This was focused unit-test/dependency-closure validation. Chinese-locale compilation was not repeated this round; no localization constants or cross-module APIs changed.

Final local SHA: f6dedbdddf584d1be959bd3a38bdb1f262c93191.
Confirmed remote source branch and PR head: f6dedbdddf584d1be959bd3a38bdb1f262c93191 (codex/ratis-historical-replay-20261029). The update was pushed successfully, and the PR remains Draft. Its description was unchanged. These behavioral findings require a fresh independent review; repair verification in this session was not a second review round.

@Caideyipi

Copy link
Copy Markdown
Collaborator Author

Independent re-review completed (one round).

  • Reviewed SHA: f6dedbdddf584d1be959bd3a38bdb1f262c93191.
  • Final local SHA and confirmed source-branch/PR head: f6dedbdddf584d1be959bd3a38bdb1f262c93191.
  • Scope: the complete 34-file diff against master (merge base 28c5028bb462403315e46319b57e9beb96ffaa69; fetched master 3a51384b2dcc8c29118b7d082c829450c4408b4c), including all earlier changes, the latest fixes, relevant callers/configuration, and changed test logic. Reviewed CREATE/ALTER/START and procedure locking, recovery and lifecycle, Subscription client/internal RPC paths, inclusion/exclusion matching, metadata/deletion compatibility, IoTConsensusV2 internal Pipes, and legacy/Thrift/air-gap/compressed/sliced receiver paths.
  • Findings: no actionable source-behavior or test-logic issues found. No fixes, source/test edits, new tests, commits, pushes, or PR-description changes were needed.
  • Validation this round: three-module offline Spotless check passed (JDK 17, Maven exit 0; unchanged-file cache used); full-diff whitespace checks passed; static checks passed for the two new bilingual message constants and all 12 Tablet/TsFile request types. Test fixtures, serialization paths, lifecycle assertions, execution-boundary counters, and configuration restoration were independently inspected.
  • Compilation and executable tests were not rerun because no code or test changed. The previously reported 29-module build and nine suites / 108 passing tests remain historical validation, not results from this round. No new unrun tests were introduced.
  • Remote CI: no check runs or individual commit statuses were returned for this SHA; combined status was pending. This is not counted as passing CI.
  • The source branch and PR head were reconfirmed unchanged. The PR remains Draft as requested.

@Caideyipi
Caideyipi marked this pull request as ready for review October 30, 2026 07:35
@Caideyipi Caideyipi changed the title [Bugfix] Disable Pipe and Subscription under Ratis [Bugfix] Disable Subscription and Pipes containing data insertion under Ratis Oct 30, 2026
Comment on lines +435 to +436
if (!staticMeta.getPipeName().startsWith(PipeStaticMeta.CONSENSUS_PIPE_PREFIX)
&& !PipeConfigNodeAgent.isPipeDataInsertionEnabled(staticMeta.getSourceParameters())) {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The condition is a conflict because we cannot use IoTV2 and Ratis at the same time.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed. IoTConsensusV2 and Ratis are mutually exclusive, so the consensus-Pipe-prefix exemption is redundant. It was removed in 7936b04, along with the matching exemptions at the other admission and recovery checks. The merged branch retains that change.

Comment on lines +551 to +568
switch (requestType) {
case TRANSFER_TABLET_INSERT_NODE:
case TRANSFER_TABLET_INSERT_NODE_V2:
case TRANSFER_TABLET_RAW:
case TRANSFER_TABLET_RAW_V2:
case TRANSFER_TABLET_BINARY:
case TRANSFER_TABLET_BINARY_V2:
case TRANSFER_TABLET_BATCH:
case TRANSFER_TABLET_BATCH_V2:
case TRANSFER_TS_FILE_PIECE:
case TRANSFER_TS_FILE_SEAL:
case TRANSFER_TS_FILE_PIECE_WITH_MOD:
case TRANSFER_TS_FILE_SEAL_WITH_MOD:
return true;
default:
return false;
}
}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Use enhanced switch without a default to avoid misusing the default value for future types.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Applied in 35f1f0cd863. isDataInsertionRequest now uses an exhaustive switch expression with no default. All 25 current enum values are classified explicitly, and future enum additions will require an explicit classification at compile time.

Comment on lines +104 to +105
SubscriptionConfig.getInstance().getSubscriptionEnabled()
&& PipeDataNodeAgent.isSubscriptionFeatureEnabled(),

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we merge them?

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Applied in 35f1f0cd863. The constructor now uses one isSubscriptionEnabled() helper for both timeout-checker scheduling and the dynamic subscription-enabled supplier, combining the configuration flag and the Ratis feature check.

@Caideyipi
Caideyipi marked this pull request as draft November 2, 2026 09:57
@Caideyipi

Caideyipi commented Nov 2, 2026 •

Copy link
Copy Markdown
Collaborator Author

Review feedback update, starting from 7936b04cea75395dcf3e65cfcde89b7a7c04ec65:

  • Confirmed that the redundant consensus-Pipe exemptions were already removed in 7936b04 because IoTConsensusV2 and Ratis are mutually exclusive.
  • Changed isDataInsertionRequest to an exhaustive switch expression without a default, explicitly covering all 25 current request types.
  • Shared the subscription configuration/Ratis predicate between timeout-checker scheduling and the dynamic subscription-enabled supplier.
  • Merged current master (1b2158fec358ed9952f5cbca2bc1387dd46b3419) in e0fde549870. The only manual conflict was in PipeTaskInfo imports; both sides' required imports were retained. GitHub now reports the PR as mergeable.

Validation completed locally with JDK 17:

  • Spotless apply passed for Node Commons, DataNode and ConfigNode with the with-integration-tests profile.
  • The clean 29-module ConfigNode/DataNode source dependency closure passed, with build caches disabled.
  • All 41 tests in IoTDBDataNodeReceiverTest (24), SubscriptionReceiverAgentTest (15) and PipeTaskInfoRatisTest (2) passed, with zero failures, errors or skips.
  • Full PR whitespace checks passed. No tests were added or changed in this update. Chinese-locale compilation, whole-repository tests and integration tests were not rerun in this update.

Final local commit and confirmed source-branch/PR head: 35f1f0cd86381fc3242ab5f5add948130fec4406. The update was pushed successfully. This session applied review feedback and did not perform a complete independent re-review. The two verified feedback refactors preserve the behavior of all current request types and both subscription checks; no test logic changed. The master conflict resolution only combined required imports. Under the non-behavioral and target-branch synchronization exceptions, the PR has been restored to Ready for review. All three reviewer threads are left unresolved as requested.

Remote CI is reported separately from the passing focused local validation:

  • codecov failed before compilation or tests (0 build goals executed): Maven could not resolve org.jacoco:jacoco-maven-plugin:0.8.12 from Central.
  • WindowsScripts failed when test_all_configured_directories_and_multiple_tiers timed out after 30 seconds while invoking destroy-edge.bat. The Edge test/scripts and workflows have no PR delta against current master.
  • Other checks were still running at the time of inspection. These CI failures are not counted as passed. No unrelated script, workflow or dependency changes were included in this feedback update; the dependency-resolution failure can be retried and the Edge timeout should be investigated separately.

@Caideyipi
Caideyipi marked this pull request as ready for review November 2, 2026 10:27
@sonarqubecloud

sonarqubecloud Bot commented Nov 2, 2026

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
C Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants