Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

identity/oidc: prevent key rotation on performance secondary clusters #14426

Merged
merged 3 commits into from
Mar 9, 2022

Conversation

austingebauer
Copy link
Contributor

Overview

This PR prevents the identity store's periodic func from running on performance secondary clusters. This fixes an issue where the key rotations were attempting to write to readonly storage.

Additionally, this adds some continue statements in a few places that I think are appropriate. This prevents some logging that didn't make sense (see delete logs below) and sets the didUpdate bool properly.

Example logs:

2022-03-08T15:09:41.745-0800 [DEBUG] secrets.identity.identity_2b8b62f2: rotating OIDC key: key=default
2022-03-08T15:09:41.862-0800 [WARN]  secrets.identity.identity_2b8b62f2: error rotating OIDC keys: err="cannot write to readonly storage"
2022-03-08T15:09:41.863-0800 [ERROR] secrets.identity.identity_2b8b62f2: error saving key: key="" error="cannot write to readonly storage"
2022-03-08T15:09:41.863-0800 [ERROR] secrets.identity.identity_2b8b62f2: error deleting OIDC public key: key_id=da41c8f4-0cac-f19c-16ad-b16f33a0d709 error="cannot write to readonly storage"
2022-03-08T15:09:41.863-0800 [DEBUG] secrets.identity.identity_2b8b62f2: deleted OIDC public key: key_id=da41c8f4-0cac-f19c-16ad-b16f33a0d709

Testing

I manually tested this change using a performance secondary cluster to confirm that the key rotations in the periodic func are skipped on the active instance.

@vercel vercel bot temporarily deployed to Preview – vault March 9, 2022 20:49 Inactive
@vercel vercel bot temporarily deployed to Preview – vault-storybook March 9, 2022 20:49 Inactive
@vercel vercel bot temporarily deployed to Preview – vault-storybook March 9, 2022 23:11 Inactive
@vercel vercel bot temporarily deployed to Preview – vault March 9, 2022 23:11 Inactive
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants