Race condition during token renew requests and AJAX polling #2856
Assignees
Labels
Comments
|
this issue is obsolete now |
github-merge-queue bot
pushed a commit
that referenced
this issue
Dec 8, 2023
* dronegen: enumerate linux tag build pipelines
Unroll the loops over architectures, fips and package type and just list
all the pipelines explicitly. This makes it a bit easier to understand
the combinations and to replace them with GitHub actions workflows.
Running `make dronegen` results in no changes to `.drone.yml`.
* dronegen: Convert some linux tag pipelines to GitHub Actions
Convert some of the linux-based tag build pipelines to run on GitHub
Actions. The following pipelines have been converted:
build-linux-amd64
build-linux-amd64-centos7
build-linux-amd64-centos7-fips
build-linux-386
build-linux-arm
build-linux-amd64-deb
build-linux-amd64-deb-fips
build-linux-amd64-centos7-rpm
build-linux-amd64-centos7-fips-rpm
build-linux-386-deb
build-linux-386-rpm
build-linux-arm-deb
build-linux-arm-rpm
The GHA workflows builds tarballs as well as deb/rpm packages in the one
workflow, so the `-deb` and `-rpm` pipelines will need to be manually
removed from `.drone.yml`. The amd64 centos7 and non-centos7 pipelines
have been combined as they were calling the same `make` target
duplicating work. The amd64 build is always done on centos7. As a
result, we do not name the pipeline with -centos7 any more, but we do
still specify it as the build.assets `Makefile` still has a centos7
target which is called, and we do still release an asset named with
"centos7".
Still remaining of the linux-based tag build pipelines are the arm64
pipelines which are already converted using a different workflow and the
non-native windows build.
* dronegen: Convert linux-arm64 pipeline to common pipeline
Convert the build-linux-arm64 and push-build-linux-arm64 pipelines to
use the common `release-linux` workflow instead of the arm64-specific
`release-linux-arm64` workflow. This aligns it with the other linux
build pipelines and allows us to get rid of the specific workflow.
The pipelines for building the arm64 rpm and deb packages have not been
generated by dronegen for some time now - since the arm64 build was
converted to GitHub Actions. The OS packages were still built as
dronegen does not remove pipelines, so the existing pipelines from
before the GHA migration remained in `.drone.yml` and continued to run.
These os packaging pipelines will be manually removed in a subsequent
commit.
* dronegen: Add pipeline for building legacy AMIs
Generate a pipeline for calling a GitHub Actions workflow to generate
the legacy AMIs. There were two existing manually added pipelines -
`build-oss-amis` and `build-ent-amis` - that are replaced by this.
The new pipeline needs to be manually added and the old ones manually
removed.
* dronegen: Replace oci build with GitHub Actions workflow
Replace the `teleport-container-images-branch-tag` workflow that builds
the legacy and operator OCI images with a call to the GitHub Actions
workflow that does the same on GitHub Actions.
This requires the manual addition of the `build-oci` pipeline and manual
removal of the `teleport-container-images-branch-tag` pipeline, followed
by running `make dronegen` to flesh out `build-oci` and sign .drone.yml.
* dronegen: Remove now-unused functions and vars
Remove the now-unused functions and vars after converting pipelines to
calling GitHub Actions instead of running stuff on Drone.
* drone: Update .drone.yml for GHA workflows
Update .drone.yml by running `make dronegen` to update the following
pipelines to call GitHub Actions to build instead of building on Drone:
build-linux-amd64
build-linux-amd64-fips
build-linux-386
build-linux-arm64
build-linux-arm
Add two new pipelines for building AMIs and OCIs on GHA:
build-legacy-amis
build-oci
Remove the following pipelines as the build of deb/rpm packages are done
within the above pipelines on GitHub Actions now and the ami/oci
pipelines have been replaced:
build-linux-amd64-deb
build-linux-amd64-fips-deb
build-linux-amd64-centos7-rpm
build-linux-amd64-centos7-fips-rpm
build-linux-386-deb
build-linux-386-rpm
build-linux-arm64-deb
build-linux-arm64-rpm
build-linux-arm-deb
build-linux-arm-rpm
build-oss-amis
build-ent-amis
teleport-container-images-branch-tag
Remove the following pipelines as AMD64 builds are always centos7 builds, but
we were just doing it twice. No need for these any more, as the GHA workflow
will build the release artifacts for these with the centos7 targets:
build-linux-amd64-centos7
build-linux-amd64-centos7-fips
The pipelines were added/removed using the following script, followed by
`make dronegen`:
AWK_SCRIPT='
/^---$/ { printf "%s", accumulator; accumulator = "" }
/^---$/ || accumulator { accumulator = accumulator $0 "\n" }
/^name: / {
drop = $2 == to_remove
if ($2 == before && to_add) {
printf "---\nname: %s\n", to_add
}
if (!drop) { printf "%s", accumulator }
accumulator = ""
next
}
!drop && !accumulator { print }
ENDFILE { printf "%s", accumulator }'
toremove=(
build-linux-amd64-{centos7,centos7-fips}
build-linux-amd64-{deb,fips-deb,centos7-rpm,centos7-fips-rpm}
build-linux-386-{deb,rpm}
build-linux-arm64-{deb,rpm}
build-linux-arm-{deb,rpm}
build-{oss,ent}-amis
teleport-container-images-branch-tag
)
add_before=build-buildboxes
toadd=(
build-legacy-amis
build-oci
)
for pipeline in "${toremove[@]}"; do
gawk -i inplace -v to_remove=$pipeline "$AWK_SCRIPT" .drone.yml
done
for pipeline in "${toadd[@]}"; do
gawk -i inplace -v to_add=$pipeline -v before=$add_before "$AWK_SCRIPT" .drone.yml
done
* Update e ref for updated workflows and Go update
Update e ref to bring in:
* [v12] ci: Remove 'v' from OCI version labels (#2821)
* [v12] chore: Bump Go to v1.20.12 (#2839)
* [v12] ci: Build single-arch images for legacy/operator OCI (#2856)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
The root problem is that we do not support multiple valid bearer tokens for the same web session. This is because bearer token should match the one present in the session cookies.
As we do a lot of polling on the web ui side, this may lead to a race condition when these 2 values do not match which causes 401.
The fix would be to get rid of polling on the client side (or at least provide a mechanism to suspend AJAX calls while token is being renewed).
We also can add a support for multiple bearer tokens for the same web session on the server side.
The text was updated successfully, but these errors were encountered: