[fix][broker]If there is a deadlock in the service, the probe should return a failure because the service may be unavailable

[yyj8]

Fixes #23635

Main Issue: #xyz

PIP: #xyz

Motivation

In some special scenarios, when the broker service has a deadlock, it needs to be able to automatically recover instead of requiring manual intervention. For example, when the service is deployed in a customer environment, we cannot directly manage it. If the service has a deadlock, the probe should return a failure because the service may be unavailable. The probe failure triggers a node restart to resolve the deadlock.

Modifications

Add deadlock detection in the probe. If a deadlock exists, print the thread stack and return a service unavailable exception.

Verifying this change

• Make sure that the change passes the CI checks.

(Please pick either of the following options)

This change is a trivial rework / code cleanup without any test coverage.

(or)

This change is already covered by existing tests, such as (please describe tests).

(or)

This change added tests and can be verified as follows:

(example:)

• Added integration tests for end-to-end deployment with large payloads (10MB)
• Extended integration test for recovery after broker failure

Does this pull request potentially affect one of the following parts:

If the box was checked, please highlight the changes

• Dependencies (add or upgrade a dependency)
• The public API
• The schema
• The default values of configurations
• The threading model
• The binary protocol
• The REST endpoints
• The admin CLI options
• The metrics
• Anything that affects deployment

Documentation

• doc
• doc-required
• doc-not-needed
• doc-complete

Matching PR in forked repository

PR in forked repository:
yyj8#10

[github-actions]

@yyj8 Please add the following content to your PR description and select a checkbox:

- [ ] `doc` <!-- Your PR contains doc changes -->
- [ ] `doc-required` <!-- Your PR changes impact docs and you will update later -->
- [ ] `doc-not-needed` <!-- Your PR changes do not impact docs -->
- [ ] `doc-complete` <!-- Docs have been already added -->

[lhotari]

There's already a deadlock check in the health check:

pulsar/pulsar-broker/src/main/java/org/apache/pulsar/broker/admin/impl/BrokersBase.java

Lines 366 to 408 in c9de1bb

	@GET
	@Path("/health")
	@ApiOperation(value = "Run a healthCheck against the broker")
	@ApiResponses(value = {
	@ApiResponse(code = 200, message = "Everything is OK"),
	@ApiResponse(code = 403, message = "Don't have admin permission"),
	@ApiResponse(code = 404, message = "Cluster doesn't exist"),
	@ApiResponse(code = 500, message = "Internal server error")})
	public void healthCheck(@Suspended AsyncResponse asyncResponse,
	@ApiParam(value = "Topic Version")
	@QueryParam("topicVersion") TopicVersion topicVersion) {
	validateSuperUserAccessAsync()
	.thenAccept(__ -> checkDeadlockedThreads())
	.thenCompose(__ -> internalRunHealthCheck(topicVersion))
	.thenAccept(__ -> {
	LOG.info("[{}] Successfully run health check.", clientAppId());
	asyncResponse.resume(Response.ok("ok").build());
	}).exceptionally(ex -> {
	LOG.error("[{}] Fail to run health check.", clientAppId(), ex);
	resumeAsyncResponseExceptionally(asyncResponse, ex);
	return null;
	});
	}
	private void checkDeadlockedThreads() {
	ThreadMXBean threadBean = ManagementFactory.getThreadMXBean();
	long[] threadIds = threadBean.findDeadlockedThreads();
	if (threadIds != null && threadIds.length > 0) {
	ThreadInfo[] threadInfos = threadBean.getThreadInfo(threadIds, false, false);
	String threadNames = Arrays.stream(threadInfos)
	.map(threadInfo -> threadInfo.getThreadName() + "(tid=" + threadInfo.getThreadId() + ")").collect(
	Collectors.joining(", "));
	if (System.currentTimeMillis() - threadDumpLoggedTimestamp
	> LOG_THREADDUMP_INTERVAL_WHEN_DEADLOCK_DETECTED) {
	threadDumpLoggedTimestamp = System.currentTimeMillis();
	LOG.error("Deadlocked threads detected. {}\n{}", threadNames,
	ThreadDumpUtil.buildThreadDiagnosticString());
	} else {
	LOG.error("Deadlocked threads detected. {}", threadNames);
	}
	throw new IllegalStateException("Deadlocked threads detected. " + threadNames);
	}
	}

It also contains an example of how to check deadlocks.

[lhotari]

ThreadDumpUtil.buildThreadDiagnosticString will alway return a non-blank String.
There's an example of detecting a deadlock using JMX API in

pulsar/pulsar-broker/src/main/java/org/apache/pulsar/broker/admin/impl/BrokersBase.java

Lines 390 to 408 in c9de1bb

	private void checkDeadlockedThreads() {
	ThreadMXBean threadBean = ManagementFactory.getThreadMXBean();
	long[] threadIds = threadBean.findDeadlockedThreads();
	if (threadIds != null && threadIds.length > 0) {
	ThreadInfo[] threadInfos = threadBean.getThreadInfo(threadIds, false, false);
	String threadNames = Arrays.stream(threadInfos)
	.map(threadInfo -> threadInfo.getThreadName() + "(tid=" + threadInfo.getThreadId() + ")").collect(
	Collectors.joining(", "));
	if (System.currentTimeMillis() - threadDumpLoggedTimestamp
	> LOG_THREADDUMP_INTERVAL_WHEN_DEADLOCK_DETECTED) {
	threadDumpLoggedTimestamp = System.currentTimeMillis();
	LOG.error("Deadlocked threads detected. {}\n{}", threadNames,
	ThreadDumpUtil.buildThreadDiagnosticString());
	} else {
	LOG.error("Deadlocked threads detected. {}", threadNames);
	}
	throw new IllegalStateException("Deadlocked threads detected. " + threadNames);
	}
	}

.
If we were to add the deadlock check to the status check, it should be possible to configure the interval for running the check since there's a cost for running the deadlock check. It should also be possible to disable the deadlock check completely.