[
https://issues.apache.org/jira/browse/KNOX-3513?focusedWorklogId=1047332&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1047332
]
ASF GitHub Bot logged work on KNOX-3513:
----------------------------------------
Author: ASF GitHub Bot
Created on: 13/Oct/26 23:20
Start Date: 13/Oct/26 23:20
Worklog Time Spent: 10m
Work Description: github-actions[bot] commented on PR #1453:
URL: https://github.com/apache/knox/pull/1453#issuecomment-6157278530
## Test Results
4 files 4 suites 42s ⏱️
134 tests 134 ✅ 0 💤 0 ❌
152 runs 152 ✅ 0 💤 0 ❌
Results for commit d31857bf.
[test-results]:data:application/gzip;base64,H4sIANO8zmoC/13MSw7CIBSF4a00jB14gavVzRi4lITYFsNjZNy7lFREh99/kvNk1s1TZNdBHgYWs0sNJgeVnF838uKypG0DIT+6xUz0n+7uUdKxBavc/BOmEHzYS8hr/US+o1125ftY3R1W93/kl8WlAmYEjHjWFtDAqE+WNBKCRhD8oiySQgUoULLXG0AO9UgEAQAA
Issue Time Tracking
-------------------
Worklog Id: (was: 1047332)
Time Spent: 0.5h (was: 20m)
> Retry unresolved credential-store aliases for LDAP proxy backend passwords
> --------------------------------------------------------------------------
>
> Key: KNOX-3513
> URL: https://issues.apache.org/jira/browse/KNOX-3513
> Project: Apache Knox
> Issue Type: Improvement
> Components: Server
> Affects Versions: 3.1.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> Since KNOX-3497, {{KnoxLDAPServerManager#resolveBackendPasswordAliases}}
> resolves {{S\{ALIAS=…} / ${ALIAS=…}}} in {{{}bindPassword{}}},
> {{systemPassword}} and {{trustStorePassword}} exactly once, when the
> interceptors are built. If the alias isn't in the gateway credential store
> yet, Knox logs "{{{}No value found in the gateway credential store for alias
> …",{}}} keeps the raw reference, and backend binds fail with
> {{INVALID_CREDENTIALS}} until something triggers a reload.
> This happens in Kubernetes when the Secret and the CR are created together
> and Knox is already running. Knox reloads the CR 1–10s after it's synced, but
> the operator persists the alias about 4–5s after the Secret is created. So
> Knox often looks up the alias before it exists, and nothing makes it look
> again.
> *Proposal*
> When an alias lookup returns null, retry it with a cap instead of giving up
> after the first attempt:
> * Configurable in {{gateway-site.xml.}} Suggested defaults: 5 attempts, 2s
> delay.
> * Each retry must read the current credential store, not a cached negative
> result.
> * Log each retry at {{{}WARN{}}}. Log {{ERROR}} only after the last attempt
> fails, then fall back to today's behaviour.
> * Retries *must not block* gateway startup or reloads of other interceptors.
> * Literal (non-alias) values are unchanged.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
