HBASE-30220: A replica cluster can have read-only mode disabled even when another active cluster already exists

[kgeisz]

https://issues.apache.org/jira/browse/HBASE-30220

AI Usage

These changes were generated using Claude Opus 4.6 and then modified by hand.

Summary

In a Read-Replica cluster setup, the active cluster allows both reads and writes, while the replica clusters only allow reads. In this type of setup, only one cluster should be an active cluster at a time. Although the current code prevents starting an active cluster while another one exists, it is still possible to simple turn a running replica into an active cluster despite another active cluster already existing. The changes in this pull request prevent this behavior.

A cluster is promoted from replica to active by changing the hbase.global.readonly.enabled variable from true to false in hbase-site.xml and then running update_all_config in the HBase shell. The current active cluster is tracked by having the cluster's ID in a file called active.cluster.suffix.id. This file does not exist when all clusters are replicas.

Key Changes

1. Adds a volatile boolean flag called readOnlyTransitionBlocked to HBaseServerBase. This is used to track whether a cluster was prevented from becoming an active cluster due to another active cluster already existing.
   • If another active cluster exists when changing read-only from false to true, then readOnlyTransitionBlocked is set to true, and a new exception called ReadOnlyTransitionException is thrown in the HBase shell.
2. Adds a static method to AbstractReadOnlyController called isAnotherClusterActive(). This returns true when the cluster ID in active.cluster.suffix.id does not match the current cluster.
3. Adds logic to onConfigurationChange() in HMaster, HRegionServer, and HRegion to prevent the replica cluster from being promoted to an active cluster when another active cluster exists.
   • These methods does not return early when the read-only transition is blocked in case other coprocessors or variables need to be dynamically loaded.
4. Read-only mode is still active and the ReadOnlyController coprocessors are still loaded if a cluster is blocked from becoming an active cluster.