apache / apache/pinot

Transient SSL factory renewal failures are logged at INFO instead of WARN in RenewableTlsUtils

Open Beginner friendly
#18,402 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
6.1k
Forks
1.5k
Avg merge
1d 21h
Merged PRs (30d)
189

Description

While reading through `RenewableTlsUtils`, it was observed that transient failures during SSL factory reload are logged at the `INFO` level, which appears inappropriate for a failure path.

### Where

`pinot-common/src/main/java/org/apache/pinot/common/utils/tls/RenewableTlsUtils.java`,
inside `reloadSslFactory`, around line 304:

```java
} catch (Exception e) {
LOGGER.info(
"reloadSslFactory :: Encountered issues when renewing SSLFactory "
+ "{} (built from key store {} and "
+ "truststore {}) on ", baseSslFactory, keyStorePath, trustStorePath, e);
return false;
}

### Bug

This catch block runs inside a 3-attempt retry loop. It's the only
place each individual retry failure gets logged, and it's at `INFO`
level. The final exhausted-retries log a few lines down is at `ERROR`,
which is correct.

Contributor guide

Open the contributing guide

Research direction

Open pinot-common/src/main/java/org/apache/pinot/common/utils/tls/RenewableTlsUtils.java and inspect reloadSslFactory around line 304, including the retry loop and the exhausted-retries log. Confirm that each transient renewal failure is reported at the intended severity while the final failure remains distinct. Done means the per-retry log uses WARN and the surrounding Java checks pass.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
security
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
88/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.