Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

etcdctl 2.2.2 sometimes fail to get information #3964

Closed
gzliudan opened this issue Dec 7, 2015 · 8 comments
Closed

etcdctl 2.2.2 sometimes fail to get information #3964

gzliudan opened this issue Dec 7, 2015 · 8 comments

Comments

@gzliudan
Copy link

gzliudan commented Dec 7, 2015

[root@mongo1 ~]# etcdctl -u liudan:daniel role get guest
Insufficient credentials
[root@mongo1 ~]# etcdctl -u liudan:daniel role get guest
Role: guest
KV Read:
/*
KV Write:
/*
[root@mongo1 ~]# etcdctl -u liudan:daniel role get guest
Insufficient credentials
[root@mongo1 ~]# etcdctl -u liudan:daniel role get guest
Insufficient credentials
[root@mongo1 ~]# etcdctl -u liudan:daniel role get guest
Insufficient credentials
[root@mongo1 ~]# etcdctl -u liudan:daniel role get guest
Role: guest
KV Read:
/*
KV Write:
/*
@mitake
Copy link
Contributor

mitake commented Dec 7, 2015

Hi @gzliudan , it seems to be an interesting problem. Current etcd doesn't turn quorum flag on in its authentication requests and it would produce such results. I made a change in a branch of my own fork, could you try it? https://github.com/mitake/etcd/tree/auth-quorum

I still cannot reproduce your problem and am not fully sure the branch is effective

@gzliudan
Copy link
Author

gzliudan commented Dec 7, 2015

After I reboot all servers, the results becomes:
[root@mongo1 ~]# etcdctl -u liudan:daniel role get guest
Insufficient credentials
[root@mongo1 ~]# etcdctl -u liudan:daniel role get guest
Insufficient credentials
[root@mongo1 ~]# etcdctl -u liudan:daniel role get guest
Insufficient credentials
[root@mongo1 ~]# etcdctl -u liudan:daniel role get guest
Insufficient credentials
[root@mongo1 ~]# etcdctl -u liudan:daniel role get guest
Insufficient credentials
[root@mongo1 ~]# etcdctl -u liudan:daniel role get guest
Insufficient credentials
[root@mongo1 ~]# etcdctl -u liudan:daniel role get guest
Insufficient credentials
[root@mongo1 ~]# etcdctl -u liudan:daniel role get guest
Insufficient credentials
[root@mongo1 ~]# etcdctl -u liudan:daniel role get guest
Insufficient credentials
[root@mongo1 ~]# etcdctl -u liudan:daniel role get guest
Insufficient credentials
[root@mongo1 ~]# etcdctl -u liudan:daniel role get guest
Insufficient credentials

@gzliudan
Copy link
Author

gzliudan commented Dec 7, 2015

maybe you can reproduce problem according to below steps:

  1. setup a new etcd cluster
  2. add a new user
  3. add role guest
  4. at this time the user can get guest role information
  5. etcdctl auth enable, but don't restart etcd
  6. test get guest role information again

@mitake
Copy link
Contributor

mitake commented Dec 14, 2015

@gzliudan thanks for your instruction. Now I can produce the problem. I'll dig this problem.

mitake added a commit to mitake/etcd that referenced this issue Dec 15, 2015
@mitake
etcdserver, auth: invalidate a cache of auth enabling flag when the f…
9a4bccc 
…lag is updated

Current etcd doesn't invalidate a cache of auth enabling flag even if
the flag is updated via PUT request to /2/enabled. Therefore, even one
server enables or disables auth, other servers don't follow the
change.

This commit adds a mechanism for invalidating the flag. For
simplicity, the mechanism is based on a new hook functionality based
on path and request. It reduces an adhoc branch in the log update
path.

Fixes etcd-io#3964
@mitake mitake mentioned this issue Dec 15, 2015
Closed
mitake added a commit to mitake/etcd that referenced this issue Jan 19, 2016
@mitake
etcdserver, auth: invalidate a cache of auth enabling flag when the f…
a756fb0 
…lag is updated

Current etcd doesn't invalidate a cache of auth enabling flag even if
the flag is updated via PUT request to /2/enabled. Therefore, even one
server enables or disables auth, other servers don't follow the
change.

This commit adds a mechanism for invalidating the flag. For
simplicity, the mechanism is based on a new hook functionality based
on path and request. It reduces an adhoc branch in the log update
path.

Fixes etcd-io#3964
mitake added a commit to mitake/etcd that referenced this issue Jan 26, 2016
@mitake
etcdserver, auth: not cache a flag of auth status
74938a6 
This commit removes a flag that indicates auth is enabled or disabled
because it doesn't have an invalidation mechanism.

Fixes etcd-io#3601 and etcd-io#3964
mitake added a commit to mitake/etcd that referenced this issue Jan 26, 2016
@mitake
etcdserver, auth: not cache a flag of auth status
753b136 
This commit removes a flag that indicates auth is enabled or disabled
because it doesn't have an invalidation mechanism.

Fixes etcd-io#3601 and etcd-io#3964
@mitake mitake mentioned this issue Jan 26, 2016
Merged
mitake added a commit to mitake/etcd that referenced this issue Jan 26, 2016
@mitake
etcdserver, auth: not cache a flag of auth status
0ca3ca5 
This commit removes a flag that indicates auth is enabled or disabled
because it doesn't have an invalidation mechanism.

Fixes etcd-io#3601 and etcd-io#3964
mitake added a commit to mitake/etcd that referenced this issue Jan 26, 2016
@mitake
etcdserver, auth: not cache a flag of auth status
b2d2c79 
This commit removes a flag that indicates auth is enabled or disabled
because it doesn't have an invalidation mechanism.

Fixes etcd-io#3601 and etcd-io#3964
@mitake
Copy link
Contributor

mitake commented Jan 26, 2016

@xiang90 this one can also be closed because of #4281.
cc @gzliudan

@xiang90
Copy link
Contributor

xiang90 commented Jan 27, 2016

@mitake Have you tried to reproduce @gzliudan's issue with/without the patch?

@mitake
Copy link
Contributor

mitake commented Jan 27, 2016

@xiang90 yes, I tested the patch with the way provided by @gzliudan .

@xiang90
Copy link
Contributor

xiang90 commented Jan 27, 2016

@mitake OK. Thanks!

@xiang90 xiang90 closed this as completed Jan 27, 2016
gyuho pushed a commit to gyuho/etcd that referenced this issue Jan 27, 2016
@mitake @gyuho
etcdserver, auth: not cache a flag of auth status
f7314e6 
This commit removes a flag that indicates auth is enabled or disabled
because it doesn't have an invalidation mechanism.

Fixes etcd-io#3601 and etcd-io#3964

Conflicts:
	etcdserver/auth/auth.go
gyuho pushed a commit to gyuho/etcd that referenced this issue Jan 27, 2016
@mitake @gyuho
etcdserver, auth: not cache a flag of auth status
dc7c9eb 
This commit removes a flag that indicates auth is enabled or disabled
because it doesn't have an invalidation mechanism.

Fixes etcd-io#3601 and etcd-io#3964

Conflicts:
	etcdserver/auth/auth.go
gyuho pushed a commit that referenced this issue Jan 27, 2016
@mitake @gyuho
etcdserver, auth: not cache a flag of auth status
259f89d 
This commit removes a flag that indicates auth is enabled or disabled
because it doesn't have an invalidation mechanism.

Fixes #3601 and #3964

Conflicts (Resolved):
	etcdserver/auth/auth.go
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@mitake @xiang90 @gzliudan