[ZOOKEEPER-4276] Serving only with secureClientPort fails

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.7.0, 3.5.8, 3.6.2, 3.8.0
• Fix Version/s: 3.10.0
• Component/s: server
• Labels: pull-request-available
• Assignee: Abhilash Kishore
• Reporter: Kei Kori
• Created: 07/Apr/21 05:58
• Updated: 16/Mar/24 04:25
• Resolved: 09/Mar/24 03:47

Description

clientPort in zoo.cfg is forcefully complemented from client address by QuorumPeerConfig#setupClientPort even though secureClientPort is set and matches with client address' port.
Because of this behavior, in case rolling update with replacing clientPort to secureClientPort in the same port number following Upgrading existing non-TLS cluster with no downtime conflicts and gets errors below.

2021-03-29 23:21:58,638 - INFO  [main:NettyServerCnxnFactory@590] - binding to port /0.0.0.0:2281
2021-03-29 23:21:58,748 - INFO  [main:NettyServerCnxnFactory@595] - bound to port 2281
2021-03-29 23:21:58,749 - INFO  [main:NettyServerCnxnFactory@590] - binding to port 0.0.0.0/0.0.0.0:2281
2021-03-29 23:21:58,753 - ERROR [main:QuorumPeerMain@101] - Unexpected exception, exiting abnormally
java.net.BindException: Address already in use

QuorumPeerConfig#setupClientPort should complement only when both clientPort and secureClientPort are empty, and allow serving zookeeper server only with secure client port.

Issue Links

• links to: GitHub Pull Request #1674
• links to: GitHub Pull Request #2117
• links to: Support TLS-only ZK server