fix(azure): fence paginated membership reads - #10381
Merged
ReubenBond merged 8 commits intoAug 9, 2026
Merged
ReubenBond merged 8 commits into
ReubenBond merged 8 commits into
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
ReubenBond
force-pushed
the
reubenbond-fix-azure-membership-pagination
branch
from
August 9, 2026 06:02
4e5ce8a to
30d5c10
Compare
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4af578fd-af77-4035-9308-cebe5f5de307
Handle rolling upgrades with legacy writers, protect boundary rows from cleanup and gateway discovery, and reduce read-path allocations. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4af578fd-af77-4035-9308-cebe5f5de307
Rename boundary rows and pair conditional entities with their ETags in Azure table transactions. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4af578fd-af77-4035-9308-cebe5f5de307
Use one bounded loop for initial and retry reads while validating each result once. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4af578fd-af77-4035-9308-cebe5f5de307
Use one boolean acceptance check for fenced, legacy, and rolling-upgrade membership snapshots. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4af578fd-af77-4035-9308-cebe5f5de307
Move pagination, boundary inspection, rolling-upgrade handling, and retry exhaustion into CanAcceptSnapshot. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4af578fd-af77-4035-9308-cebe5f5de307
Keep retry exhaustion in FindAllSiloEntries and share boundary extraction for acceptance and diagnostics. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4af578fd-af77-4035-9308-cebe5f5de307
This was referenced Aug 28, 2026
Merged
Merged
This was referenced Sep 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Azure Table continuation pages are separate Query Entities requests, so flattening them can combine membership rows from different topology versions even though
IMembershipTable.ReadAllrequires an atomic result.This adds
!Startand~End, whose keys sort before and after all IPv4 and IPv6 membership row keys. Membership inserts and updates atomically write the changed silo row, the legacyVersionRow, and both boundary rows in one Azure entity group transaction.Paginated reads compare the boundary membership versions from the completed query. Matching values prove that no boundary-aware membership update committed while the pages were read, preserving the single-query non-conflict path. A mismatch retries the query up to a bounded limit before throwing
InconsistentStateException.During rolling upgrades, older silos update only
VersionRow. IfVersionRowis newer than both boundary versions, the reader accepts the potentially torn snapshot instead of retrying, preserving availability while the cluster transitions. Tables without boundary rows likewise retain legacy behavior and skip the atomicity check.UpdateIAmAliveand defunct-row cleanup remain intentionally outside the topology fence.References:
TableTransactionActionTypeMicrosoft Reviewers: Open in CodeFlow