Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

etcdserver: make corruption check work under peer mTLS #11621

Merged
merged 1 commit into from
Feb 18, 2020

Conversation

jingyih
Copy link
Contributor

@jingyih jingyih commented Feb 13, 2020

Currently, corruption check does not work when mTLS is enabled between peers. (See #10934)

With this PR, corruption check uses the existing peer-to-peer http communication framework to get peer hashKV.

Manually tested it works. Example server log:

09:18:14 etcd1 | {"level":"info","ts":"2020-02-13T09:18:14.234-0800","caller":"etcdserver/corrupt.go:130","msg":"enabled corruption checking","local-member-id":"d05e7521f6de6bab","interval":"10s"}
09:18:14 etcd3 | {"level":"info","ts":"2020-02-13T09:18:14.245-0800","caller":"etcdserver/corrupt.go:130","msg":"enabled corruption checking","local-member-id":"3fb0bb8f51408909","interval":"10s"}
09:18:14 etcd2 | {"level":"info","ts":"2020-02-13T09:18:14.257-0800","caller":"etcdserver/corrupt.go:130","msg":"enabled corruption checking","local-member-id":"f0c6bf0f0690ad50","interval":"10s"}
09:18:24 etcd2 | {"level":"info","ts":"2020-02-13T09:18:24.261-0800","caller":"etcdserver/corrupt.go:244","msg":"finished peer corruption check","number-of-peers-checked":2}
09:18:34 etcd2 | {"level":"info","ts":"2020-02-13T09:18:34.266-0800","caller":"etcdserver/corrupt.go:244","msg":"finished peer corruption check","number-of-peers-checked":2}
09:18:44 etcd2 | {"level":"info","ts":"2020-02-13T09:18:44.267-0800","caller":"etcdserver/corrupt.go:244","msg":"finished peer corruption check","number-of-peers-checked":2}
09:18:54 etcd2 | {"level":"info","ts":"2020-02-13T09:18:54.277-0800","caller":"etcdserver/corrupt.go:244","msg":"finished peer corruption check","number-of-peers-checked":2}

@codecov-io
Copy link

codecov-io commented Feb 13, 2020

Codecov Report

Merging #11621 into master will decrease coverage by 0.09%.
The diff coverage is 50%.

Impacted file tree graph

@@            Coverage Diff            @@
##           master   #11621     +/-   ##
=========================================
- Coverage    66.2%    66.1%   -0.1%     
=========================================
  Files         403      401      -2     
  Lines       36674    36628     -46     
=========================================
- Hits        24280    24213     -67     
+ Misses      10924    10914     -10     
- Partials     1470     1501     +31
Impacted Files Coverage Δ
etcdserver/api/etcdhttp/peer.go 87.67% <100%> (+0.34%) ⬆️
etcdserver/corrupt.go 41.11% <47.12%> (+0.35%) ⬆️
pkg/transport/timeout_conn.go 60% <0%> (-20%) ⬇️
auth/range_perm_cache.go 51.42% <0%> (-17.15%) ⬇️
proxy/httpproxy/director.go 52.43% <0%> (-15.86%) ⬇️
client/client.go 70.58% <0%> (-13.4%) ⬇️
clientv3/leasing/util.go 91.66% <0%> (-6.67%) ⬇️
raft/tracker/inflights.go 91.83% <0%> (-4.09%) ⬇️
proxy/grpcproxy/watcher.go 89.79% <0%> (-4.09%) ⬇️
etcdserver/api/snap/snapshotter.go 66.93% <0%> (-3.24%) ⬇️
... and 25 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update ae98352...c031b27. Read the comment docs.

Copy link
Contributor

@YoyinZyc YoyinZyc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Clean implementation. Thanks Jingyi.


respsLen := len(resps)
for _, c := range cli.Endpoints() {
var lastErr error
for _, ep := range p.eps {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we rename the pps p eps? It is not easy to understand and remember. I think the naming way of getVersion() and getVersions() in cluster_util.go is much clear.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! I tried to make it clearer. I did keep eps as short for endpoints.

etcdserver/corrupt.go Outdated Show resolved Hide resolved
etcdserver/corrupt.go Outdated Show resolved Hide resolved
@jingyih jingyih force-pushed the corruption_check_tls branch from bc3f739 to 4ff7638 Compare February 14, 2020 09:24
During corruption check, get peer's hashKV via http call.
@jingyih jingyih force-pushed the corruption_check_tls branch from 4ff7638 to c031b27 Compare February 14, 2020 14:10
@jingyih jingyih merged commit d6a3c99 into etcd-io:master Feb 18, 2020
jingyih added a commit that referenced this pull request Feb 20, 2020
…21-upstream-release-3.4

Automated cherry pick of #11621 to release-3.4
spzala added a commit that referenced this pull request Mar 2, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

4 participants