[
https://issues.apache.org/jira/browse/KNOX-3513?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Sandor Molnar updated KNOX-3513:
--------------------------------
Status: Patch Available (was: Open)
> Retry unresolved credential-store aliases for LDAP proxy backend passwords
> --------------------------------------------------------------------------
>
> Key: KNOX-3513
> URL: https://issues.apache.org/jira/browse/KNOX-3513
> Project: Apache Knox
> Issue Type: Improvement
> Components: Server
> Affects Versions: 3.1.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> Since KNOX-3497, {{KnoxLDAPServerManager#resolveBackendPasswordAliases}}
> resolves {{S\{ALIAS=…} / ${ALIAS=…}}} in {{{}bindPassword{}}},
> {{systemPassword}} and {{trustStorePassword}} exactly once, when the
> interceptors are built. If the alias isn't in the gateway credential store
> yet, Knox logs "{{{}No value found in the gateway credential store for alias
> …",{}}} keeps the raw reference, and backend binds fail with
> {{INVALID_CREDENTIALS}} until something triggers a reload.
> This happens in Kubernetes when the Secret and the CR are created together
> and Knox is already running. Knox reloads the CR 1–10s after it's synced, but
> the operator persists the alias about 4–5s after the Secret is created. So
> Knox often looks up the alias before it exists, and nothing makes it look
> again.
> *Proposal*
> When an alias lookup returns null, retry it with a cap instead of giving up
> after the first attempt:
> * Configurable in {{gateway-site.xml.}} Suggested defaults: 5 attempts, 2s
> delay.
> * Each retry must read the current credential store, not a cached negative
> result.
> * Log each retry at {{{}WARN{}}}. Log {{ERROR}} only after the last attempt
> fails, then fall back to today's behaviour.
> * Retries *must not block* gateway startup or reloads of other interceptors.
> * Literal (non-alias) values are unchanged.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
