Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

agent/auto-auth: Add min_backoff to set first backoff value #15204

Merged
merged 11 commits into from
Apr 29, 2022

Conversation

jasonodonnell
Copy link
Contributor

This adds a new config to Agent's auto-auth.method's stanza: min_backoff.

Agent's auto-auth has an initial hardcoded retry duration of 1 second, which grows after each failed retry. I'm making this value configurable because there may be instances you want to retry faster/slower. While writing this feature I found that the SDK client used by auto-auth has it's own built in retry logic. I disabled that retry logic (set MaxRetries to 0) because the auto-auth code has its own backoff function and we were effectively doubling our retry attempts.

Templating also relies on auto-auth and has it's own retry logic. I found an instance where Vault failed to get a token but the templating server tried to fetch secrets. This resulted in yet another variation of retries and more requests to Vault. To combat this, I synced the Template server's initial backoff value to that of auto-auths.

Example config:

auto_auth = {
  method = {
    config = {
      role_id_file_path = "/tmp/agent/roleid"
      secret_id_file_path = "/tmp/agent/secretid"
    }

    type = "approle"
    min_backoff = "5s"
    max_backoff = "30s"
  }

  sink = {
    config = {
      path = "/tmp/file-foo"
    }
    type = "file"
  }
}

exit_after_auth = false

template = {
  contents = "{{ with secret \"secret/hashiconf\" }}{{ .Data | toJSONPretty }}{{ end }}"
  destination = "/tmp/agent/kv"
}

vault = {
  address = "http://127.0.0.1:8200"
}

command/agent/auth/auth.go Outdated Show resolved Hide resolved
command/agent/auth/auth.go Outdated Show resolved Hide resolved
command/agent/auth/auth.go Outdated Show resolved Hide resolved
command/agent/template/template.go Show resolved Hide resolved
website/content/docs/agent/autoauth/index.mdx Outdated Show resolved Hide resolved
website/content/docs/agent/autoauth/index.mdx Outdated Show resolved Hide resolved
@calvn calvn added this to the 1.11.0-rc1 milestone Apr 28, 2022
Copy link
Member

@calvn calvn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One last doc comment, otherwise looks like it's good to go!

website/content/docs/agent/autoauth/index.mdx Show resolved Hide resolved
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants