Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
The FDP team is no longer accepting new bugs in Bugzilla. Please report your issues under FDP project in Jira. Thanks.

Bug 2090739

Summary: ovsdb-server: raft: Transaction double commit on leadership transfer
Product: Red Hat Enterprise Linux Fast Datapath Reporter: OvS team <ovs-bugzilla>
Component: openvswitch2.17Assignee: Ilya Maximets <i.maximets>
Status: CLOSED ERRATA QA Contact: Jianlin Shi <jishi>
Severity: high Docs Contact:
Priority: high    
Version: FDP 22.ACC: ctrautma, jhsiao, qding, ralongi
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: openvswitch2.17-2.17.0-21.el8fdp Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2022-09-06 18:49:03 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OvS team 2022-05-26 13:10:25 UTC
+++ This bug was initially created as a clone of Bug #2046340 +++

While forcefully transferring leadership, leader completes all the current
'in-flight' commands, so the higher layers can re-try corresponding transactions
when the new leader is elected.  However, most of these commands are already
sent to followers, hence they will actually be committed by the majority of
the cluster members, i.e. will be treated as committed by the new leader, unless
there is an actual network problem between servers.  However, the old leader
will decline append replies, since it's not the leader anymore and commands
are already completed with RAFT_CMD_LOST_LEADERSHIP status.

New leader will replicate the commit index back to the old leader.
Old leader, will re-try the previously completed transaction anyway, because
the "cluster error"s are temporary.  If transaction had some prerequisites
that doesn't allow double committing or there are other database
constraints (like indexes) that will not allow transaction to be committed
twice, the server will reply to the client with a false-negative transaction
result.  If there are no prerequisites or additional database constraints,
the server will execute the same transaction second time as a follower.
E.g. in the OVN case, this may result in creation of duplicated logical
switches / routers / load balancers.  I.e. resources with the same non-indexed
name.  That may cause issues later where ovn-nbctl will not be able to add
ports to these switches or some other unpleasant consequences.

This BZ is to investigate and, probably, fix the most common case, where the
leadership is transferred voluntarily under normal operation.  The idea is
to not complete all commands in case of of compaction-triggered leadership
transfer and let them timeout or be committed by advancing the commit index
after receiving messages from a new leader ("Command completed without reply").

Similar issue was fixed before for the transaction executed through the
follower during a leader failover:
  5a9b53a51ec9 ("ovsdb raft: Fix duplicated transaction execution when leader failover.")

There are sill, probably, rare cases where 'at-least-once' semantics might
still be a thing. E.g. in corner cases involving the client re-connection
and actual network / communication issues between raft servers.  But this
needs much deeper analysis.  The change, AFAIU, should eliminate duplicated
transaction commits and false-negatives in normal operation.

Comment 1 OvS team 2022-05-26 13:10:28 UTC
* Thu May 26 2022 Open vSwitch CI <ovs-ci> - 2.17.0-21
- Merging upstream branch-2.17 [RH git: 97205fb19a]
    Commit list:
    e07377bb49 ovsdb: raft: Fix transaction double commit due to lost leadership. (#2046340)
    5da86cb360 dynamic-string: Fix undefined behavior due to offsetting null pointer.
    369e688908 Revert "odp-util: Always report ODP_FIT_TOO_LITTLE for IGMP."
    18341166ed ofproto-dpif-xlate: Fix netdev native tunnel neigh discovery spa.
    748e4b2b5b ovs-router: Expose the ovs_router_get_netdev_source_address function.
    34390bb35c ofproto-dpif: Trigger revalidation if ct tp changes.

Comment 4 Jianlin Shi 2022-08-04 09:22:42 UTC
failed to reproduce on openvswitch2.17-4.el8, and the reproducer passed on openvswitch2.17-37:

[root@dell-per740-42 bz2090739]# rpm -qa | grep -E "openvswitch2.17|ovn"                              
ovn22.06-host-22.06.0-27.el8fdp.x86_64                                                                
ovn22.06-central-22.06.0-27.el8fdp.x86_64                                                             
ovn22.06-22.06.0-27.el8fdp.x86_64                                                                     
openvswitch2.17-2.17.0-37.el8fdp.x86_64

set VERIFIED + SanityOnly

Comment 6 errata-xmlrpc 2022-09-06 18:49:03 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (openvswitch2.17 bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:6368