Repository navigation
kafka-util: clear OpenSSL error queue after creating Kafka clients - #39362
Merged
antiguru merged 1 commit intoSep 30, 2026
Merged
Conversation
librdkafka reads `ssl.ca.pem` certificates until `PEM_read_bio_X509` fails and leaves the final `PEM routines:get_name:no start line` error on the calling thread's OpenSSL error queue. `SSL_get_error` treats any queued error as fatal, so the next TLS read on that tokio worker that would block fails with the stale error instead. This surfaced as spurious schema registry request failures in the Kafka auth tests. Route all rdkafka client creation through new `create` and `create_with_context` wrappers in `mz_kafka_util::client` that drain the queue, and forbid the direct `ClientConfig` methods via clippy. Closes: SS-115 Co-Authored-By: Claude Opus 5.5 <[email protected]>
Member
Author
|
Thanks for the review! |
This was referenced Oct 2, 2026
val-materialize
added a commit
that referenced
this pull request
Oct 9, 2026
Release notes for the v26.45 train, published as **v26.45.1**. v26.45.0 did not ship, so (as with v26.44) its notes are folded in here and [#39477](#39477) is closed unmerged. - **v26.45.0 content**: 8 Improvements, 2 Agent Skills, 8 Bug Fixes, copied verbatim from #39477 with anchors renamed to `{#v26.45.1-…}`. - **v26.45.1 content**: Alerting for Self-Managed and the external dependency monitoring Improvement (editor-added). The release's only PR, [#39659](#39659), is omitted. - **Dates**: Cloud 2026-10-08, Self-Managed 2026-10-09. The operator compatibility row is `v26.45.1`. `v26.45.md` (`patch: 1`, no `rc`) is already on `main`.⚠️ **Open questions** - **Group-sync bullet**: `oidc_group_role_sync_enabled` defaults to `false` at the tag. Is it on in Cloud? If not, cut the "Quieter logins" bullet. - **Certificate SAN requirements** ([#39316](#39316), [#39415](https://github.com/MaterializeInc/materialize/pull/39415)/[#39459](https://github.com/MaterializeInc/materialize/pull/39459)) need action at upgrade time but sit in Improvements. Should they be called out more loudly? Also, does [#39351](#39351) (S3 on rustls) impose the same SAN rule on custom S3 endpoints? - **[#39659](#39659) (omitted)**: is `enable_upsert_paged_spill` on in production? A draft bullet is in [omitted.md](https://github.com/MaterializeInc/mz-skills/blob/main/data/mz-release-notes/v26.45.1/final/omitted.md#borderline). - **`EXPLAIN ANALYZE ... CPU`**: [agent-skills#90](MaterializeInc/agent-skills#90) says it overstates joins, reductions, and TopK by 1.5x–3x before v26.46. Not published. Is that a known issue? - **Metric sinks**: [#39332](#39332), [#38910](#38910), and [#39337](#39337) are withheld because `enable_metric_sink` is `false`. #39337 fixes a panic any superuser can reach, so consider publishing it regardless. - **Possible cuts**: [#39362](#39362) was observed only in CI. The latency figures from [#39179](#39179) were measured on one noisy machine. - **Possible adds**: [#38894](https://github.com/MaterializeInc/materialize/pull/38894)–[#38896](https://github.com/MaterializeInc/materialize/pull/38896) (MV correction buffer) need an end-to-end number. [#39149](#39149) fixes the kind install guide, which crash-loops today. [#39549](#39549) (jemalloc page) is omitted because no released version had the regression. Snapshot drafts in mz-skills: [v26.45.0](https://github.com/MaterializeInc/mz-skills/tree/main/data/mz-release-notes/v26.45.0) (rc.1–rc.4, final), [v26.45.1](https://github.com/MaterializeInc/mz-skills/tree/main/data/mz-release-notes/v26.45.1/final). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude <[email protected]> Co-authored-by: Valerie Chiang <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Kafka auth tests flake with
PEM routines:get_name:no start line ... Expecting: CERTIFICATEon schema registry requests (SS-115). librdkafka readsssl.ca.pemcertificates untilPEM_read_bio_X509fails and leaves that final error on the calling thread's OpenSSL error queue. OpenSSL'sSSL_get_errorreports any queued error asSSL_ERROR_SSL, so the next TLS read on the same tokio worker that would block fails with the stale error. Whether a request fails depends on which worker thread it lands on, which makes the failure flaky. librdkafka v2.15.1 clears the queue itself (confluentinc/librdkafka#5561), but we are on 2.5.0.This PR routes all rdkafka client creation through new
mz_kafka_util::client::{create, create_with_context}wrappers that drain the queue, and forbids the directClientConfigmethods inclippy.toml. Testdrive creates Kafka clients next to its own schema registry client, so it goes through the wrappers too.Adds
test_create_with_context_clears_openssl_error_queue, which fails with the exact CI error string when the drain is removed.Closes: SS-115
Posted by Claude Code.
🤖 Generated with Claude Code