Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cleaning of stale leases #2452

Merged
merged 47 commits into from
May 5, 2017
Merged
Changes from 1 commit
Commits
Show all changes
47 commits
Select commit Hold shift + click to select a range
1e5d6e3
Added sys/tidy-leases endpoint
vishalnayak Mar 7, 2017
239bd1c
Add locking where possible while doing auth/token/tidy
vishalnayak Mar 7, 2017
14aaa0a
Merge branch 'oss' into clean-stale-leases
vishalnayak Apr 26, 2017
3477038
Added atomic lock to ensure a single tidy operation is in progress
vishalnayak Apr 26, 2017
e52625d
Revoke lease that has empty token; added logs
vishalnayak Apr 26, 2017
dca0d70
Added logger to token store and logs to tidy function
vishalnayak Apr 26, 2017
de1a2a0
Added caching of looked up tokens
vishalnayak Apr 26, 2017
65c63b4
Fix the log statements
vishalnayak Apr 26, 2017
b036478
Fix logging levels
vishalnayak Apr 26, 2017
711153d
Fix logging suggestions; put the policyStore nil check back in
vishalnayak Apr 27, 2017
0d629ff
Cache only valid tokens
vishalnayak Apr 27, 2017
0c65cd4
Some more logging updates
vishalnayak Apr 27, 2017
785177a
Merge branch 'oss' into sys-tidy-leases
vishalnayak Apr 27, 2017
3fdf38a
Distinguish valid and invalid tokens using bool value in cache
vishalnayak Apr 27, 2017
98cdb68
Use an atomic lock for tidy operation in token store
vishalnayak Apr 27, 2017
2ef62fe
refactor lock handling in token tidy function
vishalnayak Apr 27, 2017
a8ef2c0
Refactor locking code in lease tidy; add ending debug statements
vishalnayak Apr 27, 2017
0892102
Merge branch 'oss' into sys-tidy-leases
vishalnayak May 1, 2017
8c7b175
Skip checking the validity of an empty client token
vishalnayak May 2, 2017
853233a
Added a test for tidying of empty token
vishalnayak May 2, 2017
d07d3cb
Added steps to check if invalid token is properly cleaned up
vishalnayak May 2, 2017
79fc0d8
Check if multiple leases with same invalid token is getting cleaned up
vishalnayak May 2, 2017
497bebe
Do not duplicate log lines for invalid leases
vishalnayak May 2, 2017
aa08e5c
Added test to check the atomicity of the lease tidy operation
vishalnayak May 2, 2017
a3c2a42
Test to check that leases with valid tokens are not being cleaned up
vishalnayak May 2, 2017
b6843ec
Added summary logs to help better understand the consequence
vishalnayak May 3, 2017
0c02540
Less scary debugging
jefferai May 3, 2017
b3c6a56
change some logging output
jefferai May 3, 2017
415b0a2
Two things:
jefferai May 3, 2017
0bda5a7
Adhere to tainted status in salted accessor lookup
jefferai May 3, 2017
8d35f92
consistent logging
vishalnayak May 3, 2017
a2e431b
Added logs when deletion fails so we can rely on server logs
vishalnayak May 3, 2017
2d21bf6
logging updates
vishalnayak May 3, 2017
5bc47b0
Add taint flag for looking up by accessor
jefferai May 3, 2017
b0c4a7e
Add more cleanup if a lease fails to register and revoke tokens if re…
jefferai May 3, 2017
265b4cd
Merge remote-tracking branch 'oss/master' into sys-tidy-leases
jefferai May 3, 2017
2f6e924
Fix substitution of index/child in delete call
jefferai May 3, 2017
f1d2fc3
Merge branch 'master-oss' into sys-tidy-leases
jefferai May 4, 2017
5320da0
Move tidy-leases to leases/tidy
jefferai May 4, 2017
cacf072
Update commenting
jefferai May 4, 2017
4de09fb
Update Tidy function comment
vishalnayak May 4, 2017
106f08a
Fix up the tests
vishalnayak May 4, 2017
7829107
Update comments
jefferai May 4, 2017
1378dd5
Move client token check in exp register to top
jefferai May 4, 2017
5dde45d
Address feedback
jefferai May 5, 2017
e61298e
Update debugging around tidy
jefferai May 5, 2017
0e10477
Merge branch 'master-oss' into sys-tidy-leases
jefferai May 5, 2017
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Fix logging levels
  • Loading branch information
vishalnayak committed Apr 26, 2017
commit b036478ac21288bc8bc7357f06c26d5e32b3c2b5
2 changes: 1 addition & 1 deletion vault/expiration.go
Original file line number Diff line number Diff line change
@@ -174,7 +174,7 @@ func (m *ExpirationManager) Tidy() error {
}

if revokeLease {
m.logger.Debug("expiration: lease is being revoked", "lease_id", leaseID)
m.logger.Debug("expiration: invalid lease is being revoked", "lease_id", leaseID)
// Force the revocation and skip going through the token store
// again
err = m.revokeCommon(leaseID, true, true)
8 changes: 4 additions & 4 deletions vault/token_store.go
Original file line number Diff line number Diff line change
@@ -1148,7 +1148,7 @@ func (ts *TokenStore) handleTidy(req *logical.Request, data *framework.FieldData
// a valid one. If not, delete the leases associated with that token
// and delete the accessor as well.
for _, saltedAccessor := range saltedAccessorList {
ts.logger.Trace("token_store: checking if salted accessor is valid", "salted_accessor", saltedAccessor)
ts.logger.Trace("token_store: checking if accessor contains valid token", "salted_accessor", saltedAccessor)
accessorEntry, err := ts.lookupBySaltedAccessor(saltedAccessor)
if err != nil {
tidyErrors = multierror.Append(tidyErrors, fmt.Errorf("failed to read the accessor entry: %v", err))
@@ -1159,7 +1159,7 @@ func (ts *TokenStore) handleTidy(req *logical.Request, data *framework.FieldData
// in it. If not, it is an invalid accessor entry and needs to
// be deleted.
if accessorEntry.TokenID == "" {
ts.logger.Trace("token_store: deleting accessor with invalid token ID", "salted_accessor", saltedAccessor)
ts.logger.Debug("token_store: deleting accessor with invalid token ID", "salted_accessor", saltedAccessor)
// If deletion of accessor fails, move on to the next
// item since this is just a best-effort operation
err = ts.view.Delete(accessorPrefix + saltedAccessor)
@@ -1182,7 +1182,7 @@ func (ts *TokenStore) handleTidy(req *logical.Request, data *framework.FieldData
// more and conclude that accessor, leases, and secondary index entries
// for this token should not exist as well.
if te == nil {
ts.logger.Trace("token_store: deleting token with nil entry", "salted_token", saltedId)
ts.logger.Debug("token_store: deleting token with nil entry", "salted_token", saltedId)
// RevokeByToken expects a '*TokenEntry'. For the
// purposes of tidying, it is sufficient if the token
// entry only has ID set.
@@ -1198,7 +1198,7 @@ func (ts *TokenStore) handleTidy(req *logical.Request, data *framework.FieldData
continue
}

ts.logger.Trace("token_store: deleting accessor of the token with nil entry", "salted_accessor", saltedAccessor)
ts.logger.Debug("token_store: deleting accessor of the token with nil entry", "salted_accessor", saltedAccessor)
// If deletion of accessor fails, move on to the next item since
// this is just a best-effort operation. We do this last so that on
// next run if something above failed we still have the accessor