Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(xds): only auth once per xds gRPC stream in kuma-cp (backport of #12788) #12842

Open
wants to merge 2 commits into
base: release-2.7
Choose a base branch
from
Open

fix(xds): only auth once per xds gRPC stream in kuma-cp (backport of #12788) #12842

wants to merge 2 commits into from

Conversation

jijiechen
Copy link
Member

@jijiechen jijiechen commented Feb 13, 2025 •
edited
Loading

Manual cherry-pick of #12788 to branch release-2.7

cherry-picked commit 0323e80

@jijiechen
fix(xds): only auth once per xds gRPC stream in kuma-cp (kumahq#12788)
d12240c 
Right now, we are authenticating the DP on every `OnStreamRequest` event
in `auth.Callback`, and [the authenticator has a
cache](https://github.com/kumahq/kuma/blob/5359d941bf6a7fab22cb177cd94de1112b9b4ad7/pkg/xds/auth/k8s/authenticator.go#L48-L64)
which caches the successful verification results. The Kubernetes API
Server is only called when it is not hitting the cache, and the cache
can last long: when the cache expires, the token is already expired from
Kube's point of view.

In a cluster with bound service account token enabled and
"extend-token-expiration" disabled, service account tokens expire once
an hour by default.

* Only auth once per gRPC stream.

* Remove auth cache as it's not required when it's only auth once during
a gRPC stream/connection.

<!-- Is there a MADR? An Issue? A related PR? -->

fixes kumahq#12784
fixes  kumahq#12785

replaces kumahq#12782

<!--
> Changelog: skip
-->
<!--
Uncomment the above section to explicitly set a [`> Changelog:` entry
here](https://github.com/kumahq/kuma/blob/master/CONTRIBUTING.md#submitting-a-patch)?
-->

---------

Signed-off-by: Jay Chen <[email protected]>
@github-actions GitHub Actions
Copy link
Contributor

Reviewer Checklist

🔍 Each of these sections need to be checked by the reviewer of the PR 🔍:
If something doesn't apply please check the box and add a justification if the reason is non obvious.

  • Is the PR title satisfactory? Is this part of a larger feature and should be grouped using > Changelog?
  • PR description is clear and complete. It Links to relevant issue as well as docs and UI issues
  • This will not break child repos: it doesn't hardcode values (.e.g "kumahq" as an image registry)
  • IPv6 is taken into account (.e.g: no string concatenation of host port)
  • Tests (Unit test, E2E tests, manual test on universal and k8s)
    • Don't forget ci/ labels to run additional/fewer tests
  • Does this contain a change that needs to be notified to users? In this case, UPGRADE.md should be updated.
  • Does it need to be backported according to the backporting policy? (this GH action will add "backport" label based on these file globs, if you want to prevent it from adding the "backport" label use no-backport-autolabel label)

@jijiechen
fix conflicts
0cefd6b 
Signed-off-by: Jay Chen <[email protected]>
@jijiechen jijiechen marked this pull request as ready for review February 19, 2025 09:28
@jijiechen jijiechen requested a review from a team as a code owner February 19, 2025 09:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Icarus9913 Icarus9913 Icarus9913 approved these changes

@lobkovilya lobkovilya Awaiting requested review from lobkovilya lobkovilya is a code owner automatically assigned from kumahq/kuma-maintainers

Assignees
No one assigned
Labels
release-2.7
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@jijiechen @Icarus9913