apiserver: allow all controller logins #8120

Merged
merged 3 commits into from Nov 23, 2017

Conversation

Projects
None yet
3 participants
Member

axw commented Nov 22, 2017

Description of change

Do not restrict any controller agents from
logging in during a maintenance event.
API root restriction has been moved to after
rate limiting and authentication.

Incidentally fixes an issue where we inform
login observers that a login to the controller
model is not from a controller agent when it is.

QA steps

  1. juju bootstrap localhost
  2. juju enable-ha
    (wait)
  3. juju upgrade-model -m controller --build-agent
    (juju debug-log -m controller; there should be no login errors)

Documentation changes

None.

Bug reference

Fixes https://bugs.launchpad.net/juju/+bug/1733259

I think I misunderstood slightly. I thought this was not rate limiting controller logins, but looks more like its just allowing controllers to login to each other.
LGTM I believe. With one section that looks like a copy & paste error.

- result.userLogin = !result.anonymousLogin
+ tag, err := names.ParseTag(req.AuthTag)
+ if err == nil {
+ result.tag = tag
@jameinel

jameinel Nov 22, 2017

Owner

Isn't this just a duplicate of the above tag req.AuthTag check?

@axw

axw Nov 22, 2017

Member

Heh, yeah :)

I wrote the one above first, then realised we should rate-limit if the tag is bad -- per the old code -- to prevent faulty clients from hammering on the server. Fixed, thanks.

+ // Either the tag is invalid, or
+ // it's not a user; rate limit it.
+ atomic.AddInt64(&a.srv.loginAttempts, 1)
+ defer atomic.AddInt64(&a.srv.loginAttempts, -1)
@jameinel

jameinel Nov 22, 2017

Owner

How does this avoid rate limiting Controller logins. Anything that isn't a User is being limited here.

I suppose the idea is that we still rate limit them, but we just let the Login succeed?

@axw

axw Nov 22, 2017

Member

Yep, this is just to keep the rate of logins steady. The controllers will still be able to login, they'll just be slowed down. Nothing's changed in this regard (maybe it should later, but I'd rather consider that separately).

+ if machine.Tag() != a.srv.tag {
+ // We don't want to run pingers for other
+ // controller machines; they run their own.
+ startPinger = false
@jameinel

jameinel Nov 22, 2017

Owner

This part looks good.

Member

axw commented Nov 22, 2017

$$merge$$

Contributor

jujubot commented Nov 22, 2017

Status: merge request accepted. Url: http://ci.jujucharms.com/job/github-merge-juju

Contributor

jujubot commented Nov 22, 2017

Build failed: Tests failed
build url: http://ci.jujucharms.com/job/github-merge-juju/572

axw added some commits Nov 22, 2017

apiserver: tidy up API root restrictions
Move around code to tidy up the server-side
authentication procedures. Move the API root
restriction after authentication and rate-limiting,
which will enable us (in a proceeding commit)
to permit all controller machines to log in
during maintenance.
apiserver: allow all controllers logins
Do not restrict any controller agents from
logging in during a maintenance event.

Incidentally fixes an issue where we inform
login observers that a login to the controller
model is not from a controller agent when it is.

Fixes https://bugs.launchpad.net/juju/+bug/1733259
Member

axw commented Nov 22, 2017

$$merge$$

Contributor

jujubot commented Nov 22, 2017

Status: merge request accepted. Url: http://ci.jujucharms.com/job/github-merge-juju

@jujubot jujubot merged commit 495a150 into juju:develop Nov 23, 2017

1 check passed

continuous-integration/jenkins/pr-merge This commit looks good
Details
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment