Skip to content

CASSANDRA-21674 CEP-46: update witness replication validation restrictions - #5155

Open
bdeggleston wants to merge 7 commits into
apache:cep-45-mutation-trackingfrom
bdeggleston:C21674-witness-validation
Open

CASSANDRA-21674 CEP-46: update witness replication validation restrictions#5155
bdeggleston wants to merge 7 commits into
apache:cep-45-mutation-trackingfrom
bdeggleston:C21674-witness-validation

Conversation

@bdeggleston

Copy link
Copy Markdown
Member

Thanks for sending a pull request! Here are some tips if you're new here:

  • Ensure you have added or run the appropriate tests for your PR.
  • Be sure to keep the PR description updated to reflect all changes.
  • Write your PR title to summarize what this PR proposes.
  • If possible, provide a concise example to reproduce the issue for a faster review.
  • Read our contributor guidelines
  • If you're making a documentation change, see our guide to documentation contribution

Commit messages should follow the following format:

<One sentence description, usually Jira title or CHANGES.txt summary>

<Optional lengthier description (context on patch)>

patch by <Authors>; reviewed by <Reviewers> for CASSANDRA-#####

Co-authored-by: Name1 <email1>
Co-authored-by: Name2 <email2>

The Cassandra Jira

Witness replicas require mutation tracking, and tracked reads never build a
repairing ReadRepair, so the read_repair table option cannot affect a read that
reaches a witness. CASSANDRA-20930 disabled this check in CreateTableStatement but
left the AlterTableStatement and CopyTableStatement copies in place.
Reads for a range still pending migration take the untracked path, which refuses
transient replicas, and those ranges rely on blocking read repair that a witness
cannot serve. Two conditions are needed because AlterSchema starts the migration
after the statement validates, so a statement that both enables tracking and adds
witnesses cannot be seen in the migration state.
A promoted witness holds no data for the range it witnessed and quorum reads would
count it, so promotion needs cassandra.allow_unsafe_witness_promotion, which is
settable over JMX because QA performs it deliberately. The comparison is per
datacenter, since NetworkTopologyStrategy sums its per-datacenter factors and
aggregates hide a promotion offset by a reduction elsewhere. Dropping a witness
stays legal: replica ordering removes it from the replica set rather than promoting
it, and the remaining full replicas already hold the data.
Witnesses never serve data reads, since TrackedRead picks a full replica and
summaries are built from the mutation tracking log, so an index on a witness is
never consulted. The restriction was also asymmetric: CREATE INDEX on an existing
witness keyspace was already accepted. Also drops a constant in CreateIndexStatement
that was declared and referenced nowhere.
A counter leader resolves the increment against its local data, which a witness
does not have for the range it witnesses, so it would write a value discarding
every prior increment. findCounterLeaderReplica now considers only full replicas,
and TrackedWriteRequest forwards rather than leading when the local replica is a
witness.
A tracked prepare sends its data request to one participant and summary requests to
the rest, so a witness votes without being asked for data it does not have.
Extracts the selection into PaxosPrepare#selectDataNode so the test drives
production code rather than a copy of it. No behaviour change.
The list of unsupported features was inherited from 4.0 and most of it no longer
holds: lightweight transactions, secondary indexes and counters all work. Records
what is actually enforced, why materialized views remain rejected, and the
sequences for adopting and removing witnesses.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant