Skip to content

Conversation

benashz
Copy link
Collaborator

@benashz benashz commented May 24, 2024

Previously, invalidated Clients were removed from the Client cache without calling any of the registered ClientCallbacks. Now any callbacks registered with ClientCallbackOnCacheRemoval be invoked when a client is removed from cache.

This PR extends #717

@benashz benashz requested a review from a team as a code owner May 24, 2024 20:58
Previously, invalidated Clients were removed from the Client cache
without calling any of the registered ClientCallbacks. Now any callbacks
registered with ClientCallbackOnCacheRemoval be invoked when a client is
removed from cache.
@benashz benashz force-pushed the VAULT-26576/callback-on-invalid-client branch from 455911c to 31e667e Compare May 24, 2024 21:07
@benashz benashz requested a review from thyton May 24, 2024 21:08
Copy link
Collaborator

@thyton thyton left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking good to me. I have some comments.

@benashz benashz requested a review from thyton May 27, 2024 14:09
Copy link
Collaborator

@thyton thyton left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@benashz benashz merged commit b081a60 into VAULT-26576/client-factory-support-client-taints May 28, 2024
@benashz benashz deleted the VAULT-26576/callback-on-invalid-client branch May 28, 2024 16:18
@benashz benashz added this to the v0.8.0 milestone May 28, 2024
benashz added a commit that referenced this pull request May 28, 2024
* CachingClientFactory: support client taints

The secret reconcilers have no way of advising the CachingClientFactory
that a Client might be invalid. Now a reconciler can taint the Client if
a Vault operation fails for some reason. The common case is where a
Vault request resulted in a 403 (forbidden) status code. In this case
the reconciler can taint the client so that the next call to factory for
the tainted client will have the factory validate that the client's
token is still valid by performing reaching out to Vault's lookup lookup
API. Client taints should be used sparingly, since they can increase the
number of requests to Vault.

* Test lease error responses.

* Core: call callbacks on invalidated Client (#769)

Previously, invalidated Clients were removed from the Client cache
without calling any of the registered ClientCallbacks. Now any callbacks
registered with ClientCallbackOnCacheRemoval be invoked when a client is
removed from cache.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants