Envoys do not use previous secret discovery provider when fetch timeout is changed
- Dominant language
- C++
- Stars
- 28.9k
- Forks
- 5.6k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 428
Description
*Title*: *Envoys do not use previous secret discovery provider when fetch timeout is changed*
*Description*:
This is an identical issue to https://github.com/envoyproxy/envoy/issues/32283 but for SDS instead. A change in the fetch timeout on the SDS config provider causes the SDS secrets to be discarded and request new SDS secrets. However the control plane does not receive the fetch timeout as part of the secret request so it does not send the secrets again.
This causes the secret discovery provider to stop until the fetch timeout occurs and the listener finally warms. At that point new connections are rejected until either the envoy is restarted or the secret is changed.
*Repro steps*:
I have a PR with a repro and fix in https://github.com/envoyproxy/envoy/pull/46154
Contributor guide
Research direction
Start with the reproduction and proposed fix in pull request #46154, then compare the SDS behavior with the identical issue in #32283. Verify that changing the fetch timeout no longer discards the usable secret discovery state and that the listener and subsequent connections recover as expected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100