envoyproxy / envoyproxy/envoy

Envoys do not use previous secret discovery provider when fetch timeout is changed

Open
#46,155 1 comment 0 reactions 0 assignees View on GitHub
area/sds area/xds bug help wanted
Dominant language
C++
Stars
28.9k
Forks
5.6k
Avg merge
1d 20h
Merged PRs (30d)
428

Description

*Title*: *Envoys do not use previous secret discovery provider when fetch timeout is changed*

*Description*:
This is an identical issue to https://github.com/envoyproxy/envoy/issues/32283 but for SDS instead. A change in the fetch timeout on the SDS config provider causes the SDS secrets to be discarded and request new SDS secrets. However the control plane does not receive the fetch timeout as part of the secret request so it does not send the secrets again.

This causes the secret discovery provider to stop until the fetch timeout occurs and the listener finally warms. At that point new connections are rejected until either the envoy is restarted or the secret is changed.

*Repro steps*:
I have a PR with a repro and fix in https://github.com/envoyproxy/envoy/pull/46154

Contributor guide

Open the contributing guide

Research direction

Start with the reproduction and proposed fix in pull request #46154, then compare the SDS behavior with the identical issue in #32283. Verify that changing the fetch timeout no longer discards the usable secret discovery state and that the listener and subsequent connections recover as expected.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
networking, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.