Transient SSL factory renewal failures are logged at INFO instead of WARN in RenewableTlsUtils
- Dominant language
- Java
- Stars
- 6.1k
- Forks
- 1.5k
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 189
Description
While reading through `RenewableTlsUtils`, it was observed that transient failures during SSL factory reload are logged at the `INFO` level, which appears inappropriate for a failure path.
### Where
`pinot-common/src/main/java/org/apache/pinot/common/utils/tls/RenewableTlsUtils.java`,
inside `reloadSslFactory`, around line 304:
```java
} catch (Exception e) {
LOGGER.info(
"reloadSslFactory :: Encountered issues when renewing SSLFactory "
+ "{} (built from key store {} and "
+ "truststore {}) on ", baseSslFactory, keyStorePath, trustStorePath, e);
return false;
}
### Bug
This catch block runs inside a 3-attempt retry loop. It's the only
place each individual retry failure gets logged, and it's at `INFO`
level. The final exhausted-retries log a few lines down is at `ERROR`,
which is correct.
Contributor guide
Research direction
Open pinot-common/src/main/java/org/apache/pinot/common/utils/tls/RenewableTlsUtils.java and inspect reloadSslFactory around line 304, including the retry loop and the exhausted-retries log. Confirm that each transient renewal failure is reported at the intended severity while the final failure remains distinct. Done means the per-retry log uses WARN and the surrounding Java checks pass.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 88/100