Keep etcd registration leases alive across faults by Zerpet · Pull Request #17404 · rabbitmq/rabbitmq-server · GitHub
Skip to content

Keep etcd registration leases alive across faults - #17404

Open
Zerpet wants to merge 4 commits into
mainfrom
etcd-peer-discovery-lock-lease-keepalive
Open

Zerpet wants to merge 4 commits into
mainfrom
etcd-peer-discovery-lock-lease-keepalive

Conversation

@Zerpet

@Zerpet Zerpet commented Sep 11, 2026

Copy link
Copy Markdown
Member

Proposed Changes

The etcd v3 peer discovery client granted a lease for the node's registration key and for the peer discovery lock, but never started or maintained a keep-alive for either. Both leases would lapse at their TTL regardless of whether the node was still up, so a node could silently drop out of discovery, or the registration lock could be held by a client that no longer needed it, until the TTL expired.

Reconnects made this worse: eetcd_lease renews the node key lease on its own across a reconnect, but nothing re-PUT the node key under a freshly granted lease when the old one had actually lapsed, so a node recovering from an outage longer than the lease TTL stayed missing from discovery even though it had reconnected.

This starts and tracks a keep-alive for both leases, revokes a lease once it is no longer needed (a released lock, an unregistered node, or a fresh lease discarded because the key PUT under it failed), and re-PUTs the node key on reconnect when its lease had actually lapsed. Call timeouts for lock/1, unlock/1 and register/1 are widened to bound the extra work this now does before replying.

Types of Changes

What types of changes does your code introduce to this project?
Put an x in the boxes that apply

  • Bug fix (non-breaking change which fixes issue #NNNN)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause an observable behavior change in existing systems)
  • Documentation improvements (corrections, new content, etc)
  • Cosmetic change (whitespace, formatting, etc)
  • Build system and/or CI

Checklist

Put an x in the boxes that apply.
You can also fill these out after creating the PR.
This is simply a reminder of what we are going to look for before merging your code.

  • Mandatory: I (or my employer/client) have have signed the CA (see https://github.com/rabbitmq/cla)
  • I have read the CONTRIBUTING.md document
  • I have added tests that prove my fix is effective or that my feature works
  • All tests pass locally with my changes
  • If relevant, I have added necessary documentation to https://github.com/rabbitmq/rabbitmq-website
  • If relevant, I have added this change to the first version(s) in release-notes that I expect to introduce it

Further Comments

If this is a relatively large or complex change, kick off the discussion by explaining why you chose the solution
you did and what alternatives you considered, etc.

@Zerpet
Zerpet requested a balanced review from Copilot September 11, 2026 12:04
@mergify

mergify Bot commented Sep 11, 2026

Copy link
Copy Markdown

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Lease failures lack reliable retry and ownership handling, which can remove nodes from discovery or leave cluster joins improperly locked.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR adds lease keep-alive and recovery handling to the etcd v3 peer-discovery client.

Changes:

  • Tracks and revokes node and lock leases
  • Re-registers node keys after expired leases
  • Extends call timeouts and adds unit coverage
File summaries
File Description
rabbitmq_peer_discovery_etcd_v3_client.erl Implements lease lifecycle and recovery
rabbit_peer_discovery_etcd.hrl Adds lease-tracking state
unit_SUITE.erl Tests lease handling and failures
Review details
  • Files reviewed: 3/3 changed files
  • Comments generated: 5
  • Review effort level: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread deps/rabbitmq_peer_discovery_etcd/src/rabbitmq_peer_discovery_etcd_v3_client.erl Outdated
Comment thread deps/rabbitmq_peer_discovery_etcd/src/rabbitmq_peer_discovery_etcd_v3_client.erl Outdated
@Zerpet
Zerpet marked this pull request as draft September 11, 2026 15:29
@Zerpet
Zerpet requested a balanced review from Copilot September 14, 2026 11:07

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Lease workers and ownership state are not safely handled across disconnections, registration failures, and client restarts.

Get a fresh assessment by requesting another Copilot review.

Review details
  • Files reviewed: 4/4 changed files
  • Comments generated: 7
  • Review effort level: Balanced

Comment thread deps/rabbitmq_peer_discovery_etcd/include/rabbit_peer_discovery_etcd.hrl Outdated
Comment thread deps/rabbitmq_peer_discovery_etcd/src/rabbitmq_peer_discovery_etcd_v3_client.erl Outdated
@Zerpet Zerpet linked an issue Sep 14, 2026 that may be closed by this pull request
@Zerpet
Zerpet force-pushed the etcd-peer-discovery-lock-lease-keepalive branch 2 times, most recently from d085043 to 2ed95e6 Compare September 14, 2026 15:46
The etcd v3 peer discovery client granted a lease for the node's
registration key and for the peer discovery lock, but never started
or maintained a keep-alive for either. Both leases would lapse at
their TTL regardless of whether the node was still up, so a node
could silently drop out of discovery, or the registration lock could
be held by a client that no longer needed it, until the TTL expired.

Reconnects made this worse: eetcd_lease renews the node key lease on
its own across a reconnect, but nothing re-PUT the node key under a
freshly granted lease when the old one had actually lapsed, so a node
recovering from an outage longer than the lease TTL stayed missing
from discovery even though it had reconnected.

This starts and tracks a keep-alive for both leases, revokes a lease
once it is no longer needed (a released lock, an unregistered node,
or a fresh lease discarded because the key PUT under it failed), and
re-PUTs the node key on reconnect when its lease had actually lapsed.
Call timeouts for lock/1, unlock/1 and register/1 are widened to
bound the extra work this now does before replying.
The test asserted that granting a lease against the unregistered
?MODULE connection name raises, but that only held when the test ran
in isolation. Running the full test target starts system_SUITE first
in the same VM, which registers a real connection under the same
name and leaves eetcd's connection registry in a state where the
same grant call returns {error, eetcd_conn_unavailable} instead of
raising, failing the assertion.

Mock eetcd_lease as the sibling regression tests already do, and
assert on the regrant's actual effect (a new lease id and keep-alive
pid) instead of on an environment-dependent exception.
@Zerpet
Zerpet force-pushed the etcd-peer-discovery-lock-lease-keepalive branch from 2ed95e6 to 984fd25 Compare September 17, 2026 11:32
@Zerpet
Zerpet marked this pull request as ready for review September 17, 2026 11:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Improve etcd peer discovery lease and locking mechanism

2 participants