Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
51 commits
Select commit Hold shift + click to select a range
0d37584
init
panh99 Apr 9, 2026
39d56b3
mv util
panh99 Apr 9, 2026
b35431b
tweak
panh99 Apr 9, 2026
6d43b39
tweak
panh99 Apr 9, 2026
cf0e4a8
Merge branch 'main' into rt-cert-for-apps
panh99 Apr 9, 2026
110869d
address comments
panh99 Apr 9, 2026
bc99645
Merge branch 'main' into rt-cert-for-apps
panh99 Apr 9, 2026
8b3fc32
Merge branch 'main' into rt-cert-for-apps
jafermarq Apr 9, 2026
059aaeb
post-merge format
jafermarq Apr 9, 2026
7f80179
Update framework/py/flwr/supercore/tls.py
jafermarq Apr 9, 2026
6852c8a
fix
jafermarq Apr 9, 2026
7367ebc
Merge branch 'main' into rt-cert-for-apps
jafermarq Apr 9, 2026
1137cd3
Merge remote-tracking branch 'origin/main' into rt-cert-for-apps
panh99 Apr 23, 2026
f19ee02
fix merge
panh99 Apr 23, 2026
42cd228
fix
panh99 Apr 23, 2026
f81c952
address comments
panh99 Apr 24, 2026
b99fd3e
rename
panh99 Apr 24, 2026
49da492
./dev/format.sh
panh99 Apr 24, 2026
acc1e95
Merge branch 'main' into rt-cert-for-apps
panh99 Apr 24, 2026
0dcb752
Merge branch 'main' into rt-cert-for-apps
msheller Apr 24, 2026
686b20a
Merge branch 'main' into rt-cert-for-apps
msheller Apr 24, 2026
4977afd
initial server-side TLS implementation
msheller Apr 24, 2026
543add2
second codex pass to tighten/simplify
msheller Apr 26, 2026
b6568dd
Merge branch 'main' into tls-for-appio-servicers
msheller Apr 26, 2026
1c1f758
Merge branch 'main' into rt-cert-for-apps
msheller Apr 26, 2026
3a74302
Merge branch 'rt-cert-for-apps' into tls-for-appio-servicers
msheller Apr 26, 2026
f5ce749
removed unneeded refactoring to minimize review delta
msheller Apr 26, 2026
69b749d
formatting and testing fixes
msheller Apr 27, 2026
21f4c8a
improved comments
msheller Apr 27, 2026
07b50ae
fix to use option 2 (seperate certs)
msheller Apr 27, 2026
eb3dcb7
added helpers for run_superlink to dramatically simplify tests
msheller Apr 27, 2026
223307a
expands cert paths before file check
msheller Apr 27, 2026
1cd6e4b
appio tls no longer required when fleet API tls is used
msheller Apr 28, 2026
6eda1e3
Merge branch 'main' into rt-cert-for-apps
panh99 Apr 28, 2026
3dc0346
Merge branch 'main' into tls-for-appio-servicers
msheller Apr 28, 2026
a61d303
Addressed comments from code reviewers
msheller Apr 29, 2026
92f0ac4
Merge remote-tracking branch 'origin/rt-cert-for-apps' into tls-for-a…
msheller Apr 29, 2026
e7f9c6a
ready for manual review
msheller Apr 29, 2026
f0e1c7d
Merge branch 'main' into tls-for-appio-servicers
msheller Apr 29, 2026
57b0f2f
docstrings updated to address latest codex review comment
msheller Apr 29, 2026
64eeabe
fixed merge conflict regression
msheller Apr 29, 2026
c7d2fcc
Merge branch 'tls-for-appio-servicers' into report-clientapp-appio-co…
msheller Apr 29, 2026
ded519d
Merge branch 'main' into report-clientapp-appio-communication-failure…
panh99 Apr 30, 2026
3cb6210
formatting fixes
msheller Apr 30, 2026
8414a66
Merge branch 'main' into report-clientapp-appio-communication-failure…
msheller Apr 30, 2026
aeac3c3
Error message text consistency improvement
msheller Apr 30, 2026
1594c93
Merge branch 'main' into report-clientapp-appio-communication-failure…
msheller May 4, 2026
e5b3597
Merge branch 'main' into report-clientapp-appio-communication-failure…
msheller May 5, 2026
9ab5cc2
updated exit code 250 docs
msheller May 5, 2026
15e5d9b
removed erroneous (edited) text in 250.rst
msheller May 5, 2026
8c7ae8c
Merge branch 'main' into report-clientapp-appio-communication-failure…
panh99 May 6, 2026
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions framework/docs/source/ref-exit-codes/250.rst
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The implementation looks good to me, but I think the new exit-code docs are a little too user-action-oriented for an internal process. In normal runtime usage, users do not start flwr-clientapp directly; it is launched by SuperExec with the AppIO address/token/TLS settings already derived from the SuperNode/SuperExec setup.

Could we adjust this page to say that this means the internal ClientApp process (flwr-clientapp) could not communicate with the SuperNode ClientAppIo API, and that users should check the surrounding SuperNode/ClientApp logs for the underlying gRPC error? A likely cause is that the ClientApp process took too long to start, for example on a very slow or overloaded system, causing the short-lived token/heartbeat window to expire. If the log message is not enough to diagnose it, users should contact the Flower team with the relevant logs. Wdyt?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated! LMK if you want further changes!

Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
#####################################
[250] CLIENTAPP_COMMUNICATION_ERROR
#####################################

*************
Description
*************

During a run, the internal ClientApp process could not communicate with the SuperNode
ClientAppIo API.

****************
How to Resolve
****************

Check the run output and the surrounding SuperNode and SuperExec process logs for the
underlying gRPC error. By default, these processes log to stdout/stderr; in
containerized deployments, inspect the relevant SuperNode and SuperExec pod/container
logs.

A likely cause is that the ClientApp process took too long to start, for example on a
very slow or overloaded system, causing a timeout error. If the logs are not enough to
diagnose the issue, contact the Flower team and include the relevant run, SuperNode, and
SuperExec/ClientApp logs.
11 changes: 9 additions & 2 deletions framework/py/flwr/common/exit/exit_code.py
Original file line number Diff line number Diff line change
Expand Up @@ -35,12 +35,15 @@ class ExitCode:
SUPERLINK_INVALID_ARGS = 104
SUPERLINK_DATABASE_SCHEMA_MISMATCH = 105

# ServerApp-specific exit codes (200-299)
# ServerApp-specific exit codes (200-249)
SERVERAPP_STRATEGY_PRECONDITION_UNMET = 200
SERVERAPP_EXCEPTION = 201
SERVERAPP_STRATEGY_AGGREGATION_ERROR = 202
SERVERAPP_RUN_START_REJECTED = 203

# ClientApp-specific exit codes (250-299)
CLIENTAPP_COMMUNICATION_ERROR = 250

# SuperNode-specific exit codes (300-399)
SUPERNODE_REST_ADDRESS_INVALID = 300
# SUPERNODE_NODE_AUTH_KEYS_REQUIRED = 301 --- DELETED ---
Expand Down Expand Up @@ -102,7 +105,7 @@ def __new__(cls) -> ExitCode:
"SuperLink. Please refer to the documentation for guidance on how to resolve "
"this issue."
),
# ServerApp-specific exit codes (200-299)
# ServerApp-specific exit codes (200-249)
ExitCode.SERVERAPP_STRATEGY_PRECONDITION_UNMET: (
"The strategy received replies that cannot be aggregated. Please ensure all "
"replies returned by ClientApps have one `ArrayRecord` (none when replies are "
Expand All @@ -122,6 +125,10 @@ def __new__(cls) -> ExitCode:
"run has been stopped, the run ID or FAB is invalid, or the run failed to "
"start within the allowed time."
),
# ClientApp-specific exit codes (250-299)
ExitCode.CLIENTAPP_COMMUNICATION_ERROR: (
"The ClientApp could not communicate with the ClientAppIo API."
),
# SuperNode-specific exit codes (300-399)
ExitCode.SUPERNODE_REST_ADDRESS_INVALID: (
"When using the REST API, please provide `https://` or "
Expand Down
6 changes: 4 additions & 2 deletions framework/py/flwr/supernode/runtime/run_clientapp.py
Original file line number Diff line number Diff line change
Expand Up @@ -98,6 +98,7 @@ def run_clientapp( # pylint: disable=R0913, R0914, R0915, R0917
channel.subscribe(on_channel_state_change)
heartbeat_sender = None
runtime_env_dir = None
exit_code = ExitCode.SUCCESS

def on_exit() -> None:
if heartbeat_sender is not None and heartbeat_sender.is_running:
Expand Down Expand Up @@ -207,10 +208,11 @@ def on_exit() -> None:
)

except grpc.RpcError as e:
log(ERROR, "GRPC error occurred: %s", str(e))
log(ERROR, "gRPC error occurred: %s", str(e))
exit_code = ExitCode.CLIENTAPP_COMMUNICATION_ERROR

flwr_exit(
code=ExitCode.SUCCESS,
code=exit_code,
event_type=EventType.FLWR_CLIENTAPP_RUN_LEAVE,
)

Expand Down
25 changes: 25 additions & 0 deletions framework/py/flwr/supernode/runtime/run_clientapp_test.py
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,9 @@
import unittest
from unittest.mock import patch

import grpc

from flwr.common.exit import ExitCode
from flwr.supercore.interceptors import AppIoTokenClientInterceptor

from .run_clientapp import run_clientapp
Expand All @@ -41,3 +44,25 @@ def test_run_clientapp_adds_token_client_interceptor(self) -> None:
assert interceptors is not None
self.assertEqual(len(interceptors), 1)
self.assertIsInstance(interceptors[0], AppIoTokenClientInterceptor)

def test_run_clientapp_exits_nonzero_on_grpc_error(self) -> None:
"""`run_clientapp` should not report success after AppIO gRPC failures."""
with (
patch("flwr.supernode.runtime.run_clientapp.create_channel") as channel,
patch("flwr.supernode.runtime.run_clientapp.HeartbeatSender"),
patch(
"flwr.supernode.runtime.run_clientapp.pull_appinputs",
side_effect=grpc.RpcError,
),
patch("flwr.supernode.runtime.run_clientapp.flwr_exit") as flwr_exit,
):
flwr_exit.side_effect = RuntimeError
with self.assertRaises(RuntimeError):
run_clientapp("127.0.0.1:9094", insecure=True, token="test-token")

channel.return_value.subscribe.assert_called_once()
flwr_exit.assert_called_once()
self.assertEqual(
flwr_exit.call_args.kwargs["code"],
ExitCode.CLIENTAPP_COMMUNICATION_ERROR,
)
Loading