Update LDAP Binding and Fix Failed Mirror Segments

Products

• VMware Tanzu Data Suite
• VMware Tanzu Greenplum
• VMware Tanzu Greenplum / Gemfire

Issue/Introduction

You want to change the LDAP binding information. Below 2 files needed for this change:

/etc/openldap/ldap.conf

/gpdata1/master/gpseg-1/pg_hba.conf.

but there are DOWN Mirrors in the cluster and restarting the cluster to apply the new binding might cause the recovery of mirror segments in unexpected state.

Environment

All Greenplum versions.

Cause

Not Applicable.

Resolution

You can start the incremental recovery (or full recovery if required ) for the down mirrors after reviewing and validating the below info - 

1. Auth config changes in pg_hba.conf don't generally need a restart.
2. LDAP auth config changes should not impact recovery, especially since no changes were made to any segments.
3. But if those hba changes aren't trustworthy or haven't yet been tested (like say it impacts connection establishment for gpadmin for any connections made during gprecoverseg etc.), it is best to revert those pg_hba changes as follows:     If you have a backup of the hba.conf (from before ldap changes),  revert to that backup. This revert of pg_hba.conf can be done without a restart: Run 

    psql postgres -c "select pg_reload_conf();" 

     (to reload the hba changes on the coordinator) after reverting the file. Then run gprecoverseg. And then apply the hba conf with the changes after successful recovery and run psql postgres -c "select pg_reload_conf();".
4. If ldap based changes are working fine right now and gpadmin session establishment is functional, it is just fine to run gprecoverseg.