rptest: fail fast on crashed kgo-verifier worker with cause#30973
rptest: fail fast on crashed kgo-verifier worker with cause#30973sjust-redpanda wants to merge 1 commit into
rptest: fail fast on crashed kgo-verifier worker with cause#30973Conversation
ClusterLinkingProgressVerifier.validate_progress waited out the full
progress_timeout and raised an opaque "Workload stalled" whenever a
worker stopped advancing -- including when a kgo-verifier process had
crashed outright (e.g. a franz-go produce-path panic), which can never
recover. That conflated a client-side worker crash with a genuine
shadow-link replication stall and forced a needless progress_timeout
wait before failing.
Each worker's StatusThread.errored flips when its process dies and stops
answering status polls. Check it every iteration and fail fast with a
distinct, classified error. The class only tells us the worker became
unreachable, not why, so tail its log on the node to label the cause: a
Go "panic" => an unexpected internal client crash; a fatal/error line
logged before exit => a fatal error propagated through the Kafka
protocol. The reason is appended to the raised error and the full tail
is logged for diagnosis.
Example log tails per type:
internal client crash (panic):
panic: runtime error: index out of range [-1]
fatal error propagated through the protocol (produce failure):
level=error msg="Produce failed: UNKNOWN_TOPIC_OR_PARTITION: ..."
fatal error propagated through the protocol (data loss):
level=fatal msg="Unexpected data loss detected: ..."
Best-effort: log reads are tolerant of failure and fall back to
"cause unknown" so classification never masks the underlying crash. A
plain "Workload stalled" then reliably means a real replication stall
rather than a crashed client.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Retry command for Build#86548please wait until all jobs are finished before running the slash command |
CI test resultstest results on build#86548
|
There was a problem hiding this comment.
This can be done much better.
- Don't reach into services internals from the test (i.e. accessing 'private' fields
svc._status_thread) - Don't inspect service internals (like logs) from external services.
You can call svc.status_thread.raise_on_error() I reckon. On crash it will raise. Crash exceptions look even better starting with #30943.
I have avoided parsing logs and including them in exception messages as I was afraid the error messages are used as-is with some exception for grouping ci failures. If that's not the case (message used verbatim in signature) and you want logs included in the failure message then I suggest extending code at https://github.com/redpanda-data/redpanda/pull/30943/changes#diff-205d055201eb5b8c927e7b298891fa345b803a7f00663ce444744ac2e5948e2eR290-R292 to augment it with log contents.
Also, all tests will benefit from this.
ClusterLinkingProgressVerifier.validate_progresswaited out the fullprogress_timeoutand raised an opaque"Workload stalled"whenever a worker stopped advancing — including when a kgo-verifier process had crashed outright (e.g. a franz-go produce-path panic), which can never recover. That conflated a client-side worker crash with a genuine shadow-link replication stall, and forced a needlessprogress_timeoutwait before failing.This PR checks each worker's
StatusThread.erroredevery iteration and fails fast with a distinct, classified error. Sinceerroredonly tells us the worker became unreachable (process died) and not why, it tails the worker's log on the node to label the cause:panic: runtime error: index out of range [-1]internal client crash (panic)util.Die→os.Exit)level=error msg="Produce failed: UNKNOWN_TOPIC_OR_PARTITION: ..."fatal error propagated through the protocollog.Fatalf)level=fatal msg="Unexpected data loss detected: ..."fatal error propagated through the protocolThe reason is appended to the raised error (e.g.
kgo-verifier worker crashed: producer (internal client crash (panic))) and the full tail is logged. After this, a plain"Workload stalled"reliably means a real replication stall rather than a crashed client.Log reads are best-effort and fall back to
"cause unknown"so classification never masks the underlying crash. A worker that surfaces a fatal error in-status while staying alive (e.g.--tolerate-failed-produce) is intentionally not treated as a crash.Validated against the real kgo-verifier binary: the panic path matches a captured production crash log, and the produce-failure path was reproduced live (delete topic mid-produce →
level=error … Produce failed: UNKNOWN_TOPIC_OR_PARTITION→os.Exit(1)).Motivating context: CORE-16624, where the franz-go producer-crash and a real target-side replication stall both surfaced as the same
"Workload stalled"assertion.Backports Required
Release Notes