Mirroristas/etcd
2
0
Fork 0
mirror of https://github.com/etcd-io/etcd.git synced 2024-09-27 06:25:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #13577 from sayap/auth-graceful-disable

Browse Source 
Disable auth gracefully without impacting existing watchers
This commit is contained in:
Sahdev Zala 2022-01-03 20:02:21 -05:00 committed by GitHub
commit a96f5ee8a1
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 50 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
client/v3/client.go
View File

@ -263,6 +263,7 @@ func (c *Client) getToken(ctx context.Context) error {
resp, err := c.Auth.Authenticate(ctx, c.Username, c.Password)
if err != nil {
if err == rpctypes.ErrAuthNotEnabled {
c.authTokenBundle.UpdateAuthToken("")
return nil
}
return err

4
server/auth/store.go
View File

@ -1026,6 +1026,10 @@ func (as *authStore) AuthInfoFromTLS(ctx context.Context) (ai *AuthInfo) {
}
func (as *authStore) AuthInfoFromCtx(ctx context.Context) (*AuthInfo, error) {
if !as.IsAuthEnabled() {
return nil, nil
}
md, ok := metadata.FromIncomingContext(ctx)
if !ok {
return nil, nil

45
tests/e2e/ctl_v3_auth_test.go
View File

@ -30,6 +30,7 @@ func TestCtlV3AuthEnable(t *testing.T) {
testCtl(t, authEnableTest)
}
func TestCtlV3AuthDisable(t *testing.T) { testCtl(t, authDisableTest) }
func TestCtlV3AuthGracefulDisable(t *testing.T) { testCtl(t, authGracefulDisableTest) }
func TestCtlV3AuthStatus(t *testing.T) { testCtl(t, authStatusTest) }
func TestCtlV3AuthWriteKey(t *testing.T) { testCtl(t, authCredWriteKeyTest) }
func TestCtlV3AuthRoleUpdate(t *testing.T) { testCtl(t, authRoleUpdateTest) }
@ -142,6 +143,50 @@ func authDisableTest(cx ctlCtx) {
}
}
func authGracefulDisableTest(cx ctlCtx) {
if err := authEnable(cx); err != nil {
cx.t.Fatal(err)
}
cx.user, cx.pass = "root", "root"
donec := make(chan struct{})
go func() {
defer close(donec)
// sleep a bit to let the watcher connects while auth is still enabled
time.Sleep(1000 * time.Millisecond)
// now disable auth...
if err := ctlV3AuthDisable(cx); err != nil {
cx.t.Fatalf("authGracefulDisableTest ctlV3AuthDisable error (%v)", err)
}
// ...and restart the node
node0 := cx.epc.Procs[0]
node0.WithStopSignal(syscall.SIGINT)
if rerr := node0.Restart(); rerr != nil {
cx.t.Fatal(rerr)
}
// the watcher should still work after reconnecting
if perr := ctlV3Put(cx, "key", "value", ""); perr != nil {
cx.t.Errorf("authGracefulDisableTest ctlV3Put error (%v)", perr)
}
}()
err := ctlV3Watch(cx, []string{"key"}, kvExec{key: "key", val: "value"})
if err != nil {
if cx.dialTimeout > 0 && !isGRPCTimedout(err) {
cx.t.Errorf("authGracefulDisableTest ctlV3Watch error (%v)", err)
}
}
<-donec
}
func ctlV3AuthDisable(cx ctlCtx) error {
cmdArgs := append(cx.PrefixArgs(), "auth", "disable")
return e2e.SpawnWithExpectWithEnv(cmdArgs, cx.envMap, "Authentication Disabled")