Skip to content

HDDS-15875. OM should validate software versions of peers before accepting finalize command#10777

Open
errose28 wants to merge 9 commits into
apache:HDDS-14496-zdufrom
errose28:worktree/om-finalize-version-validation
Open

HDDS-15875. OM should validate software versions of peers before accepting finalize command#10777
errose28 wants to merge 9 commits into
apache:HDDS-14496-zdufrom
errose28:worktree/om-finalize-version-validation

Conversation

@errose28

Copy link
Copy Markdown
Contributor

What changes were proposed in this pull request?

When the OM first receives a finalization command from the user (StartFinalizeupgradeRequest), it will contact each OM peer and validate that all their software versions match before proceeding with finalization. Otherwise it will reject the request back to the user.

To do this, a new RPC was added to OMAdminProtocol to retrieve the software version from an individual OM. The client facing QueryUpgradeStatus was not reused for this since the transport layer only supports sending that to the leader. Having a separate RPC also lets the two protocols evolve independently.

These checks are a best effort to catch obvious user error. Therefore some more complicated checks were intentionally skipped:

  • Validation is not rechecked when the background service submits the actual finalize request to OMs after SCM finalizes, since a failure here would be difficult to convey to the user.
  • Although the design document mentions extra validation happening in applyTransaction, this was not implemented due to extra complexity and incongruence with the leader execution project.

What is the link to the Apache JIRA

HDDS-15875

How was this patch tested?

Unit test simulating peers in different software versions added. Existing integration and acceptance tests should continue to pass since peers should already be reachable and in the same software version.

(cherry picked from commit c7d4e14)

Conflicts:
hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/protocolPB/OMAdminProtocolServerSideImpl.java
hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/request/upgrade/TestOMStartFinalizeUpgradeRequest.java
@errose28
errose28 requested a review from dombizita July 15, 2026 20:05
@errose28 errose28 added the zdu Pull requests for Zero Downtime Upgrade (ZDU) https://issues.apache.org/jira/browse/HDDS-14496 label Jul 15, 2026
@errose28

errose28 commented Jul 17, 2026

Copy link
Copy Markdown
Contributor Author

I added a hidden force flag to the CLI and RPC. ozone admin upgrade finalize --force will skip the version checks added by this PR. The flag will not show up in the CLI help message, will print a message to stdout when used, and will show up in the audit log.

Since the version checks also require all OMs (and later SCMs) to be up during finalize, the force flag allows finalizing even if some of these nodes are down indefinitely. In most cases the cluster should be restored to a healthy state before finishing the upgrade by finalizing it, but this provides a back door if any issues arise later.

This flag will be forwarded from OM to SCM as well in #10783, which makes that PR dependent on this one.

@errose28
errose28 marked this pull request as ready for review July 17, 2026 21:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

zdu Pull requests for Zero Downtime Upgrade (ZDU) https://issues.apache.org/jira/browse/HDDS-14496

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant