OCPBUGS-50507: Intermittent authentication issues when accessing OpenShift registry #365
Conversation
sanchezl
changed the title
openshift-ci-robot
added
jira/severity-important
|
@sanchezl: This pull request references Jira Issue OCPBUGS-50507, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. In response to this: Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
bot
added
the
approved
|
/jira refresh |
openshift-ci-robot
added
jira/valid-bug
|
@sanchezl: This pull request references Jira Issue OCPBUGS-50507, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira ([email protected]), skipping review request. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
| func refreshThresholdTime(nbf, exp time.Time) time.Time { | ||
| // calculate the time at which only 40% of the valid duration would be left | ||
| validDuration := exp.Sub(nbf) | ||
| return exp.Add(-time.Duration(int64(float64(validDuration) * 0.4))) |
There was a problem hiding this comment.
Are we guaranteed to always get exp > nbf here ?
There was a problem hiding this comment.
It would be very unlikely, it means k8s would have issued an invalid token. I added a check anyway.
| } | ||
|
|
||
| func (c *imagePullSecretController) registryAuthenticationFileValid(imagePullSecret *corev1.Secret, urls, kids []string) (bool, time.Time) { | ||
| func (c *imagePullSecretController) registryAuthenticationFileValid(imagePullSecret *corev1.Secret, urls, kids []string, now time.Time) (bool, *time.Time) { |
There was a problem hiding this comment.
Wouldn't it be a good idea moving parts of this function to isSecretRefreshNeeded() instead ? I mean, this function does some validations (if the secret is of the right Type for instance) while also validates if the tokens in a valid secret haven't expired. I see this as two distinct things: in one the secret is invalid while in the other the tokens are invalid. It is up to you but I believe that splitting would make things easier to reason about.
The way things are here the only purpose of isSecretRefreshNeeded() is to invert the value of valid.
There was a problem hiding this comment.
Can we have some unit tests to test the logic as well?
|
@sanchezl: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: sanchezl, vrutkovs The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/label acknowledge-critical-fixes-only |
openshift-ci
bot
added
the
acknowledge-critical-fixes-only
openshift-merge-bot
bot
merged commit 49eb6f8
into
openshift:master
|
@sanchezl: Jira Issue OCPBUGS-50507: All pull requests linked via external trackers have merged: Jira Issue OCPBUGS-50507 has been moved to the MODIFIED state. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[ART PR BUILD NOTIFIER] Distgit: ose-openshift-controller-manager |
|
/cherry-pick release-4.18 |
|
@sanchezl: new pull request created: #369 In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
7 participants
In some instances, the controller would re-queue an image pull secret in such a way that the check for an expiring token would only occur after the token had expired. This would result in a gap of time in which the pull secret contents would be invalid.