authz: Clarity needed for few operations DURING Rotate() in progress about gnsi HOT 3 CLOSED

IMO, the new policy becomes active, period. Probe() is simply a way to test the policy without executing the RPC in the Probe; ie: /gnmi.gNMI/Subscribe would be tested against policy but not executed.

from gnsi.

It sounds like the intention was:
"Rotate applies a new policy immediately, the rotator should test with probe() messages to see that their intended result is live, and finalize() when that's done"

Because 'live immediately', I expect that new rpcs between the start of Rotate() and Finalize() would be evaluated under the newly placed policy. If the policy failes Probe() tests (for instance) or there are signals to the rotator that: "Hey, half my RPCs are failing? wut?" the rotator may choose to not Finalize() and disconnect forcing the previous policy to take up the active role.

make sense?

from gnsi.

Got it @morrowc. This answers my questions

In summary:
In the intermittent state, all of them(Probe(), real RPC and Get()) behave as per the new policy even though Finalize is not yet issued. This is in line with the spec which mentions "active immediately".

from gnsi.