Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

expired s3_auth token -- improve logging #10773

Open
mlibbey opened this issue Nov 14, 2023 · 0 comments
Open

expired s3_auth token -- improve logging #10773

mlibbey opened this issue Nov 14, 2023 · 0 comments

Comments

@mlibbey
Copy link
Contributor

mlibbey commented Nov 14, 2023

In the s3_auth plugin for v4 signatures, there is an undocumented feature that allows for an expiration configuration. The plugin goes through considerable effort to reload a nearly expired token (

// If the token has more than one hour to expire, reload is scheduled one hour before expiration.
), but is largely silent about doing so, which hampers operational ability to detect and remediate the issue. I'd suggest:

  • In the cases mentioned in code comments (1 hour before, 15min before, and at expiration) logging that the token is about to expire as more than debug level.
  • the log should have the token's name so that an operator can find the specific issue
  • there appears to be an error log printed ~10min after the token has expired. I think it would be appropriate to continue logging every 10 times -- eg,
    if (s3->incr_conf_reload_count() == 10) {
    instead of "==10", perhaps s3->incr_conf_reload_count() % 10 == 0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant