Description
Current behavior is that the HAadmin -transitionToActive command will complete the transition to Active even if the other namenode is already in Active state. This is not an allowed condition and should be handled by fencing, however setting both namenode's active can happen accidentally with relative ease, especially in a production environment when performing manual maintenance operations.
If this situation does occur it is very serious and will likely cause data loss, or best case, require a difficult recovery to avoid data loss.
This is requesting an enhancement to haadmin's -transitionToActive command, to have HAadmin check the Active state of the other namenode before completing the transition. If the other namenode is Active, then fail the request due to other nn already-active.
Not sure if there is a scenario where both namenode's being Active is valid or desired, but to maintain functional compatibility a 'force' parameter could be added to override this check and allow previous behavior.
Attachments
Issue Links
- is duplicated by
-
HDFS-2949 HA: Add check to active state transition to prevent operator-induced split brain
-
- Closed
-