mirror of
https://github.com/lukaszraczylo/traefikoidc.git
synced 2026-06-05 22:44:17 +00:00
1b6c8616fd
* fix(refresh): wire RefreshCoordinator into the live refresh path
The RefreshCoordinator existed but was never instantiated. The actual
refresh path used only session.refreshMutex, which is per-SessionData
instance - and SessionData is pulled from a sync.Pool per request -
so concurrent requests sharing a refresh token had ZERO coordination.
Symptom: when access_token expired (e.g. 5min Zitadel default), every
in-flight request from a polling client (Grafana panels) entered the
refresh path simultaneously and POSTed the same refresh_token to the
IdP. With refresh-token rotation enabled (Zitadel/Authentik default),
only one grant succeeded; the rest got invalid_grant and each cleared
the entire session. Subsequent requests then thrashed in re-auth loops.
This commit:
- adds refreshCoordinator field on TraefikOidc
- instantiates it in NewWithContext with DefaultRefreshCoordinatorConfig
- shuts it down in Close() under shutdownOnce
- routes refreshToken() through the coordinator via coordinatedTokenRefresh,
which collapses concurrent grants to a single upstream call per
refresh_token hash
- exports refreshCoordinatorSessionID for both internal hashing and the
middleware-level wireup so dedup keys stay aligned
Behavioural notes:
- nil-coordinator fallback preserves existing tests that build TraefikOidc
literals without going through the constructor
- followers receive the same TokenResponse/error as the leader, so no
per-instance code paths change
- existing TestGetNewTokenWithRefreshToken_Concurrency still passes
because it hits GetNewTokenWithRefreshToken directly, below the
coordinator boundary
Tests:
- refresh_coordinator_wireup_test.go: 50 concurrent refreshes coalesce
to <=2 upstream calls; distinct tokens still run in parallel; nil
coordinator falls back cleanly
* perf(cache): bound L1 backfill goroutines in HybridBackend
Get() and GetMany() previously spawned a goroutine per L2 hit to write
the value through to L1. Under sustained polling traffic (e.g. a Grafana
dashboard refreshing every 30s with N panels) this minted thousands of
goroutines, each running in Yaegi - directly contributing to the
~1000% CPU spike that pairs with the refresh-token herd.
Replace the per-hit goroutines with a single l1BackfillWorker fed by
l1BackfillBuffer, mirroring the existing asyncWriteBuffer/asyncWriteWorker
pattern for L2 writes. Buffer overflow drops the backfill (counted via
l1BackfillDrops) - a dropped backfill just means the next L2 hit for
that key re-queues it, which is safe.
Tests:
- TestHybridBackend_L1BackfillBounded: 1000 distinct L2 hits keep
goroutine count within +20 of baseline (pre-fix it grew by ~1000)
- TestHybridBackend_L1BackfillFullDrops: drops are accounted for when
the buffer is saturated and the worker is stopped
* feat(refresh): implement isRefreshTokenExpired heuristic
Replace the placeholder `return false` with a real check based on the
issued_at timestamp that SetRefreshToken already stamps into the session.
Gated by a new MaxRefreshTokenAgeSeconds config field (default 21600 =
6h, matching the existing comment). 0 disables the check.
This wires the previously-dead refreshTokenExpired branch in middleware.go,
which short-circuits AJAX requests with a 401 instead of letting them
hammer the IdP for a refresh token that's almost certainly stale - the
classic Grafana-after-long-pause failure mode.
Behaviour:
- maxRefreshTokenAge=0 disables the check (preserves prior behaviour)
- legacy sessions without issued_at still attempt one refresh; the IdP
remains the source of truth on first try
- nil-receiver and nil-session guards keep test code that builds
TraefikOidc literals safe
Tests:
- TestIsRefreshTokenExpired_DisabledWhenAgeZero
- TestIsRefreshTokenExpired_LegacySessionWithoutTimestamp
- TestIsRefreshTokenExpired_WithinWindow
- TestIsRefreshTokenExpired_BeyondWindow
- TestIsRefreshTokenExpired_NilGuards
* perf(token): skip parseJWT on cache hit in VerifyToken
The token cache fast-return existed but ran AFTER parseJWT, so every
validation paid for base64 + JSON unmarshal even on a hit. Under bursty
traffic (e.g. 10+ concurrent panel requests on every Grafana dashboard
refresh, each calling validateStandardTokens which verifies BOTH the
access token and the ID token), this is two redundant parses per
request multiplied by the panel count.
Move the cache lookup ahead of parseJWT. On a hit the function returns
nil immediately. On a miss the original flow runs unchanged.
Also nil-guard t.tokenCache to keep partial-literal test instances safe
(matches the same pattern we already use for tokenBlacklist).
Tests:
- TestVerifyToken_CacheHitSkipsParse: cache pre-populated with claims
for a token whose body would fail parseJWT - returns nil iff the
fast-path bypasses the parse
- TestVerifyToken_CacheMissStillParses: a syntactically valid but
unsigned token still errors past parseJWT on cache miss
* feat(refresh): cross-replica refresh-grant dedup via shared cache
The in-process RefreshCoordinator added in 9f96d8c already collapses
concurrent refresh-token grants on a single Traefik replica. With the
plugin's existing Redis (Dragonfly) cache infrastructure available, we
can extend that dedup across replicas: if pod A refreshes a token at
T+0 and pod B receives a request for the same session at T+1, pod B
should reuse pod A's result rather than POSTing the now-rotated refresh
token to the IdP.
Implementation:
- Add a refreshResultCache to UniversalCacheManager (memory-only when
Redis is disabled, Redis-backed in production via the existing
hybrid/Redis-only mode selection)
- Expose it through CacheManager.GetSharedRefreshResultCache and on the
TraefikOidc struct as refreshResultCache (CacheInterface)
- Inside the closure passed to RefreshCoordinator.CoordinateRefresh,
consult the cache first; on hit return immediately, on miss exchange
with the IdP and populate the cache for peers
- 5s TTL: long enough for siblings to observe, short enough that a
rotated refresh token cannot be re-supplied after the IdP has moved on
- Errors are intentionally NOT cached - peers must always be able to
retry on their own
Pragmatic choice: optimistic cache rather than a hard distributed lock.
- A hard lock (SET NX + poll) doubles Redis RTT and risks dead-locks
if a Traefik pod dies mid-grant.
- The user's BGP+Local externalTrafficPolicy already pins ingress for
a session to one node in steady state, so cross-pod racing is rare.
- This optimistic path catches the rare failover case without adding
failure modes.
Tests:
- TestCoordinatedTokenRefresh_CrossReplicaCacheHit: pre-populated cache
short-circuits the upstream call entirely (0 IdP calls)
- TestCoordinatedTokenRefresh_PopulatesCrossReplicaCache: leader stores
a successful result for peers to find
- TestCoordinatedTokenRefresh_ErrorIsNotCached: invalid_grant must not
poison the dedup cache - peers must retry independently
113 lines
3.4 KiB
Go
113 lines
3.4 KiB
Go
//go:build !yaegi
|
|
|
|
package backends
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"runtime"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// TestHybridBackend_L1BackfillBounded verifies that a burst of L2 hits does
|
|
// not detonate the goroutine count. Pre-fix the code spawned one goroutine
|
|
// per Get() L2 hit; post-fix all backfills funnel through a single worker.
|
|
func TestHybridBackend_L1BackfillBounded(t *testing.T) {
|
|
primary := newMockBackend()
|
|
secondary := newMockBackend()
|
|
|
|
hybrid, err := NewHybridBackend(&HybridConfig{
|
|
Primary: primary,
|
|
Secondary: secondary,
|
|
AsyncBufferSize: 256,
|
|
})
|
|
require.NoError(t, err)
|
|
defer hybrid.Close()
|
|
|
|
ctx := context.Background()
|
|
const burst = 1000
|
|
|
|
// Pre-populate L2 with `burst` distinct keys so each Get triggers a
|
|
// fresh L1 backfill enqueue.
|
|
for i := 0; i < burst; i++ {
|
|
require.NoError(t, secondary.Set(ctx, fmt.Sprintf("k:%d", i), []byte("v"), time.Minute))
|
|
}
|
|
|
|
baseline := runtime.NumGoroutine()
|
|
|
|
// Issue the burst as fast as possible; the backfill worker MUST be the
|
|
// only goroutine doing L1 writes. Allow brief slack for the test runtime
|
|
// scheduling but anything north of +20 means goroutine leakage.
|
|
peak := baseline
|
|
for i := 0; i < burst; i++ {
|
|
_, _, exists, err := hybrid.Get(ctx, fmt.Sprintf("k:%d", i))
|
|
require.NoError(t, err)
|
|
require.True(t, exists)
|
|
if g := runtime.NumGoroutine(); g > peak {
|
|
peak = g
|
|
}
|
|
}
|
|
|
|
delta := peak - baseline
|
|
if delta > 20 {
|
|
t.Fatalf("goroutine count grew by %d during burst (baseline=%d peak=%d); backfill worker not bounding goroutines",
|
|
delta, baseline, peak)
|
|
}
|
|
|
|
// L1 must eventually catch up via the worker. Worker drains serially so
|
|
// give it a generous window proportional to the burst size.
|
|
deadline := time.Now().Add(2 * time.Second)
|
|
for time.Now().Before(deadline) {
|
|
var populated int
|
|
for i := 0; i < burst; i++ {
|
|
if _, _, ok, _ := primary.Get(ctx, fmt.Sprintf("k:%d", i)); ok {
|
|
populated++
|
|
}
|
|
}
|
|
// Be lenient: drops are acceptable under buffer pressure, just want
|
|
// most of the keys to make it.
|
|
if populated >= burst-int(hybrid.l1BackfillDrops.Load()) {
|
|
return
|
|
}
|
|
time.Sleep(20 * time.Millisecond)
|
|
}
|
|
t.Fatalf("L1 not backfilled within deadline: l2Hits=%d l1Writes=%d drops=%d",
|
|
hybrid.l2Hits.Load(), hybrid.l1Writes.Load(), hybrid.l1BackfillDrops.Load())
|
|
}
|
|
|
|
// TestHybridBackend_L1BackfillFullDrops verifies the drop semantics when the
|
|
// buffer is saturated. Drops must be counted, never block, never spawn a
|
|
// goroutine.
|
|
func TestHybridBackend_L1BackfillFullDrops(t *testing.T) {
|
|
primary := newMockBackend()
|
|
secondary := newMockBackend()
|
|
|
|
// Tiny buffer + slow primary writes via failSet so the worker stays
|
|
// blocked enough to overflow the buffer.
|
|
hybrid, err := NewHybridBackend(&HybridConfig{
|
|
Primary: primary,
|
|
Secondary: secondary,
|
|
AsyncBufferSize: 4,
|
|
})
|
|
require.NoError(t, err)
|
|
defer hybrid.Close()
|
|
|
|
// Stop the worker from draining: cancel the underlying context so the
|
|
// worker bails out, leaving us with a cold buffer and the queue method
|
|
// itself responsible for drop accounting.
|
|
hybrid.cancel()
|
|
// Wait for worker to exit so it can't drain.
|
|
time.Sleep(50 * time.Millisecond)
|
|
|
|
for i := 0; i < 50; i++ {
|
|
hybrid.queueL1Backfill(fmt.Sprintf("k:%d", i), []byte("v"), time.Minute)
|
|
}
|
|
|
|
assert.Greater(t, hybrid.l1BackfillDrops.Load(), int64(0),
|
|
"expected some drops when buffer is saturated and worker is stopped")
|
|
}
|