Uh oh!
There was an error while loading. Please reload this page.
branch-4.0: [feat](be) Enhance CA cert troubleshooting in Azure object storage client #61102 - #61214
Merged
Merged
Conversation
…ient (#61102) ### Problem Summary: 1. Azure Blob requests can fail with TLS/CA verification errors, but current error messages do not provide enough CA-related debug context. 2. Azure client creation does not explicitly bind Doris-selected CA file to curl transport, which can make CA source ambiguous across environments. ### What is changed 1. In Azure client factory, resolve CA file from `config::ca_cert_file_paths` and set `CurlTransportOptions::CAInfo`. 2. Build a `tls_debug(...)` context at client creation time, including: - configured CA paths, - selected CA file, - whether selected CA exists/readable, - SSL-related env vars (`SSL_CERT_FILE`, `CURL_CA_BUNDLE`, `SSL_CERT_DIR`). 3. Pass TLS debug context into `AzureObjStorageClient`. 4. Append TLS debug suffix only when error message matches TLS CA failure patterns. 5. Add unit tests for helper logic in `azure_obj_storage_client_test.cpp`: - `detects_tls_ca_error` - `appends_debug_suffix_only_for_tls_ca_error` ``` W20260306 16:38:44.997861 86429 file_reader.cpp:36] [INTERNAL_ERROR]Azure request failed because Fail to get a new connection for: https://<azure-storage-endpoint>.blob.core.windows.net. Problem with the SSL CA cert (path? access rights?), error msg , http code 0, path msg bucket <conta iner-name>, key <object-key>, prefix , path , tls_debug(ca_cert_file_paths='<ca-cert-path>', selected_ca_file='<ca-cert-path>', selected_ca_exists=true, sel ected_ca_readable=true, SSL_CERT_FILE='', CURL_CA_BUNDLE='', SSL_CERT_DIR='')failed to read W20260306 16:38:44.997881 86429 internal_service.cpp:888] failed to init reader, errmsg=``` [INTERNAL_ERROR]Azure request failed because Fail to get a new conne ction for: https://<azure-storage-endpoint>.blob.core.windows.net. Problem with the SSL CA cert (path? access rights?), error msg , http code 0, path msg bu cket <container-name>, key <object-key>, prefix , path , tls_debug(ca_cert_file_paths='<ca-cert-path>', selected_ca_file='<ca-cert-path>', selected_ca_exist s=true, selected_ca_readable=true, SSL_CERT_FILE='', CURL_CA_BUNDLE='', SSL_CERT_DIR='')failed to read W20260306 16:38:51.028247 85476 pipeline_fragment_context.cpp:1813] Failed to send report for query <query-id>, fragment 0: [E-241] ERROR 1105 (HY000): errCode = 2, detailMessage = Can not build FunctionGenTable 's3'. error: errCode = 2, detailMessage = (<backend-ip>)[INTERNAL_ERROR]Azure request failed because Fail to get a new connection for: https://<azure-storage-endpoint>.blob.core.windows.net. Problem with the SSL CA cert (path? access rights?), error msg , http code 0, path msg bucket <container-name>, key <object-key>, prefix , path , tls_debug(ca_cert_file_paths='<ca-cert-path>', select ed_ca_file='<ca-cert-path>', selected_ca_exists=true, selected_ca_readable=true, SSL_CERT_FILE='', CURL_CA_BUNDLE='', SSL_CERT_DIR='')failed to read `
Thearas
commented
Mar 11, 2026
Contributor
Thank you for your contribution to Apache Doris. Please clearly describe your PR:
|
Thearas
commented
Mar 11, 2026
Contributor
run buildall |
doris-robot
commented
Mar 11, 2026
BE UT Coverage ReportIncrement line coverage Increment coverage report
|
yiguolei
approved these changes
Mar 12, 2026
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cherry-picked from #61102