temporalio / temporalio/sdk-rust

[Bug] Panic when failing to start worker due to being unauthorized

Open
#692 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug Rust SDK
Dominant language
Rust
Stars
523
Forks
161
Avg merge
1d 7h
Merged PRs (30d)
67

Description

What are you really trying to do?

Trying to bring up a worker process for the first time in our production environment.

Describe the bug

There's a panic here. There probably shouldn't be? (It's probably not super important, but would be nice to handle in a better way.)

2024-02-23T16:29:13.189124Z ERROR temporal_sdk_core::worker::workflow::workflow_stream: Workflow processing encountered fatal error and must shut down TonicError(Status { code: PermissionDenied, message: "Request unauthorized.", details: b"\x08\x07\x12\x15Request unauthorized.\x1a\x8c\x01\nHtype.googleapis.com/temporal.api.errordetails.v1.PermissionDeniedFailure\x12@\n>caller does not have required permissions for namespace 'prod'", metadata: MetadataMap { headers: {"content-type": "application/grpc", "server": "temporal", "date": "Fri, 23 Feb 2024 16:29:12 GMT"} }, source: None })
2024-02-23T16:29:13.190812Z ERROR panic: shared::tracers: panic: panicked at /Users/djc/.cargo/git/checkouts/sdk-core-3d5ba50f52602518/42e2a94/core/src/worker/workflow/mod.rs:231:34:
Activation processor channel not dropped: SendError { .. } location="/Users/djc/.cargo/git/checkouts/sdk-core-3d5ba50f52602518/42e2a94/core/src/worker/workflow/mod.rs:231:34" payload="unknown"
thread 'workflow-processing' panicked at /Users/djc/.cargo/git/checkouts/sdk-core-3d5ba50f52602518/42e2a94/core/src/worker/workflow/mod.rs:231:34:
Activation processor channel not dropped: SendError { .. }
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
Error: Unhandled grpc error when activity polling: Status { code: PermissionDenied, message: "Request unauthorized.", details: b"\x08\x07\x12\x15Request unauthorized.\x1a\x8c\x01\nHtype.googleapis.com/temporal.api.errordetails.v1.PermissionDeniedFailure\x12@\n>caller does not have required permissions for namespace 'prod'", metadata: MetadataMap { headers: {"content-type": "application/grpc", "server": "temporal", "date": "Fri, 23 Feb 2024 16:29:12 GMT"} }, source: None }
Minimal Reproduction

Minimal Rust SDK worker setup along the lines of the example in the crate root, using mTLS to connect to Temporal Cloud.

Environment/Versions
  • OS and processor: M1 Mac
  • Temporal Version: sdk-core @ 42e2a94baad618ca352b9faad5879dfb59ff4a04
  • Are you using Docker or Kubernetes or building Temporal from source? See above.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at core/src/worker/workflow/mod.rs:231 and reproduce the unauthorized worker startup using the minimal Rust SDK setup with mTLS. Trace how the PermissionDenied error reaches workflow processing and activity polling; done means the unauthorized startup reports the error without the Activation processor channel panic.

Written by the indexing model from the issue text.

Assessment

Tech stack
grpc, rust
Domain
backend, distributed-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.