Files
datastore/tests/integration/compose/docker_compose_zookeeper_secure.yml
Alexey MilovidovandClaude Opus 4.5 6cbd04dace Fix sporadic test failures in test_keeper_auth with genuine ZooKeeper
The integration tests using genuine ZooKeeper (as opposed to ClickHouse
Keeper) were failing sporadically, especially in TSAN builds.

Root cause: ZooKeeper's default `maxClientCnxns` setting limits connections
to 60 per IP address. When ClickHouse connects to ZooKeeper for internal
coordination, it can create many connections. Under TSAN, ClickHouse runs
slower and connections accumulate faster than they are cleaned up, causing
the limit to be exceeded.

When this happens, ZooKeeper rejects new connections with the error:
"Too many connections from /172.16.3.1 - max is 60"

This caused the kazoo client in the test to fail with "Connection dropped:
socket connection broken" when trying to connect to genuine ZooKeeper.

The fix sets `ZOO_MAX_CLIENT_CNXNS: 0` (unlimited) in the ZooKeeper Docker
Compose configuration for all ZooKeeper nodes, both regular and secure.

Co-Authored-By: Claude Opus 4.5 <[email protected]>
2026-02-04 19:42:18 +01:00

84 lines
3.0 KiB
YAML

services:
zoo1:
image: zookeeper:3.6.2
stop_grace_period: 5s
restart: always
environment:
ZOO_TICK_TIME: 500
ZOO_MAX_CLIENT_CNXNS: 0
ZOO_SERVERS: server.1=zoo1:2888:3888;2181 server.2=zoo2:2888:3888;2181 server.3=zoo3:2888:3888;2181
ZOO_MY_ID: 1
JVMFLAGS: -Dzookeeper.forceSync=no
ZOO_SECURE_CLIENT_PORT: $ZOO_SECURE_CLIENT_PORT
command: ["zkServer.sh", "start-foreground"]
entrypoint: /zookeeper-ssl-entrypoint.sh
volumes:
- type: bind
source: /misc/zookeeper-ssl-entrypoint.sh
target: /zookeeper-ssl-entrypoint.sh
- type: bind
source: /misc/client.crt
target: /clickhouse-config/client.crt
- type: ${ZK_FS:-tmpfs}
source: ${ZK_DATA1:-}
target: /data
- type: ${ZK_FS:-tmpfs}
source: ${ZK_DATA_LOG1:-}
target: /datalog
cpus: 3
zoo2:
image: zookeeper:3.6.2
stop_grace_period: 5s
restart: always
environment:
ZOO_TICK_TIME: 500
ZOO_MAX_CLIENT_CNXNS: 0
ZOO_SERVERS: server.1=zoo1:2888:3888;2181 server.2=zoo2:2888:3888;2181 server.3=zoo3:2888:3888
ZOO_MY_ID: 2
JVMFLAGS: -Dzookeeper.forceSync=no
ZOO_SECURE_CLIENT_PORT: $ZOO_SECURE_CLIENT_PORT
command: ["zkServer.sh", "start-foreground"]
entrypoint: /zookeeper-ssl-entrypoint.sh
volumes:
- type: bind
source: /misc/zookeeper-ssl-entrypoint.sh
target: /zookeeper-ssl-entrypoint.sh
- type: bind
source: /misc/client.crt
target: /clickhouse-config/client.crt
- type: ${ZK_FS:-tmpfs}
source: ${ZK_DATA2:-}
target: /data
- type: ${ZK_FS:-tmpfs}
source: ${ZK_DATA_LOG2:-}
target: /datalog
cpus: 3
zoo3:
image: zookeeper:3.6.2
stop_grace_period: 5s
restart: always
environment:
ZOO_TICK_TIME: 500
ZOO_MAX_CLIENT_CNXNS: 0
ZOO_SERVERS: server.1=zoo1:2888:3888;2181 server.2=zoo2:2888:3888;2181 server.3=zoo3:2888:3888;2181
ZOO_MY_ID: 3
JVMFLAGS: -Dzookeeper.forceSync=no
ZOO_SECURE_CLIENT_PORT: $ZOO_SECURE_CLIENT_PORT
command: ["zkServer.sh", "start-foreground"]
entrypoint: /zookeeper-ssl-entrypoint.sh
volumes:
- type: bind
source: /misc/zookeeper-ssl-entrypoint.sh
target: /zookeeper-ssl-entrypoint.sh
- type: bind
source: /misc/client.crt
target: /clickhouse-config/client.crt
- type: ${ZK_FS:-tmpfs}
source: ${ZK_DATA3:-}
target: /data
- type: ${ZK_FS:-tmpfs}
source: ${ZK_DATA_LOG3:-}
target: /datalog
cpus: 3