Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix up case where subscription is terminated due to ACLs changing or a snapshot restore occurring #17566

Merged
merged 3 commits into from
Jun 5, 2023

Conversation

andrewstucki
Copy link
Contributor

@andrewstucki andrewstucki commented Jun 5, 2023

Description

Due to swallowing and only logging xDS errors here:

if IsTerminalError(u.Err) {
s.logger.Error("Data source in an irrecoverable state; exiting", "error", u.Err, "correlationID", u.CorrelationID)
s.Close(true)
return
}
if err := s.handler.handleUpdate(ctx, u, snap); err != nil {
s.logger.Error("Failed to handle update from watch",
"id", u.CorrelationID, "error", err,
)
continue
}

We were getting into a state where if ACLs were modified while connected to xDS, the stream wasn't properly being re-established and instead the Consul logs were filling up with error logs such as:

Failed to handle update from watch: kind=api-gateway proxy=default/default/gateway-d6b4d69c-krz5b service_id=default/default/gateway-d6b4d69c-krz5b id=gateway-config error="error filling agent cache: subscription closed by server, client must reset state and resubscribe"

Basically we were missing some casing for marking certain errors as TerminalErrors in proxycfg-glue, this fixes that.

Testing & Reproduction steps

Get a proxy and/or gateway to connect up to xDS and then modify the token ACLs that are associated with it, you should see a bunch of these in the logs.

PR Checklist

  • updated test coverage
  • external facing docs updated
  • appropriate backport labels added
  • not a security concern

@andrewstucki andrewstucki requested review from boxofrad and a team June 5, 2023 15:54
Copy link
Contributor

@boxofrad boxofrad left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks so much for fixing this! We should probably backport to 1.15 if it does affect snapshot restoration.

agent/proxycfg-glue/glue.go Outdated Show resolved Hide resolved
@andrewstucki andrewstucki added the backport/1.15 This release series is no longer active on CE. Use backport/ent/1.15. label Jun 5, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport/1.15 This release series is no longer active on CE. Use backport/ent/1.15.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants