canonical / canonical/sssd-operator

Race condition when integrating sssd and ldap provider before integrating sssd with principal charm

Open
#9 0 comments 0 reactions 0 assignees View on GitHub
C-idm needs triage P-high
Dominant language
Python
Stars
1
Forks
6
Avg merge
1d 5h
Merged PRs (30d)
8

Description

If the sssd charm is integrated with an ldap provider like glauth-k8s before sssd is integrated with a principal charm like slurmd, _sssd.conf_ will not be updated with the relevant ldap server configuration information. This means that sssd will successfully start, but it won't actually bind to the ldap server like we want SSSD to.

### Possible fix

The likely fix for this issue is to "query the state of the world" after a hook execution and check if any updates to the _sssd.conf_ file are required. We already have the `refresh` hook which inspects the state of the machine and ensuring necessary integrations are present, so we could use the decorator to determine an update is required to the _sssd.conf_ file and restart SSSD.

### Additional notes

Originally reported by @jedel1043

Contributor guide

Open the contributing guide

Research direction

Start with the refresh hook and its decorator, then trace how integrations update sssd.conf when LDAP and a principal charm are added in different orders. Reproduce the LDAP-first sequence and verify that the LDAP server configuration is present and SSSD is restarted after the state is reconciled.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
devops
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.