mariadb netns: the certificate ask over the members' channel is single-shot #131

New issue

Open

opened 2026-10-09 14:29:45 -03:00 by marcos-mendez · 0 comments

marcos-mendez commented

2026-10-09 14:29:45 -03:00

(Migrated from github.com)

Evidence from 2026-10-09, same signature on three branches in one afternoon (16:4x, 17:07, 17:21): PR #125 (MTU), PR #130 (tests-only, off main — the product code there is main's), and a rerun of #125's job. Main itself passed at 09:09 and again at 17:24+. Same class as keel#94: a single-shot call on a lossy link, so the test driver should retry the apply while that is the only failure (a failed apply changed nothing past the certificate step, so re-applying is safe), like vip_netns.promote_when_etcd_answers.

The boot apply of the replica asks the root CA's holder for the database certificate with one message (keel/system/dbtls.py _asked, over etcdmsg ISSUE). On the lossy link of decision 0050's design case (250 ms, 2% loss) that ask can die: the step fails with "the root CA's holder ... did not sign the database certificate (... did not answer: Remote end closed connection without response)" and every dependent step is skipped. Evidence from 2026-10-09, same signature on three branches in one afternoon (16:4x, 17:07, 17:21): PR #125 (MTU), PR #130 (tests-only, off main — the product code there is main's), and a rerun of #125's job. Main itself passed at 09:09 and again at 17:24+. Same class as keel#94: a single-shot call on a lossy link, so the test driver should retry the apply while that is the only failure (a failed apply changed nothing past the certificate step, so re-applying is safe), like vip_netns.promote_when_etcd_answers.