kvserver: Always treat restarted nodes as suspect #97263
Labels
A-kv-distribution
Relating to rebalancing and leasing.
C-enhancement
Solution expected to add code/behavior + preserve backward-compat (pg compat issues are exception)
Is your feature request related to a problem? Please describe.
As seen in #95159. A store that is offline for a greater than 5 minutes (
server.time_until_store_dead
) is immediately seen asAvailable
after its first gossip liveness update. Unfortunately, the store may not be fully healthy at this point as it is likely behind on Raft updates and should not be a target for "unnecessary" lease transfers.We already have a status
Suspect
that is used for stores that are down for less than 5 minutes and keeps lease and replica transfers away for 30s (server.time_after_store_suspect
). So for short store outages, the store becomes suspect, however, once a store is dead, it transitions immediately toAvailable
Describe the solution you'd like
Any store that is offline and rejoins should be treated as
Suspect
for the 30s window until it has had a chance to recover. Lease and replica transfers are not prohibited to suspect nodes, but they are only done in emergency cases. This will decrease the impact of a store being offline for an extended period.Describe alternatives you've considered
An alternative that was explored in #96980 was to start nodes in a different state and post a different liveness update until they are healthy enough. This is unnecessarily complex however as we already send both the IO overload status through gossip and could reasonably figure out whether Raft is healthy enough on the range using #96304
Additional context
Performance after restart is a complex issue requiring a number of moving parts to fully address. This change alone will be a strict improvement, however without some of the other issues mentioned it won't fully address all impacts of restarted nodes.
Jira issue: CRDB-24600
The text was updated successfully, but these errors were encountered: