Skip to content

fix(coderd/rbac): do not cache context cancellation errors #11840

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jan 26, 2024

Conversation

johnstcn
Copy link
Member

@johnstcn johnstcn commented Jan 26, 2024

Should hopefully un-break #11800

#7439 added global caching of RBAC results.
Calls are cached based on hash(subject, object, action).
We often use dbauthz.AsSystemRestricted to handle "internal" authz calls, and these are often repeated with similar arguments and are likely to get cached.
So a transient error doing an authz check on a system function will be cached for up to a minute.
I'm just starting off with excluding context.Canceled but there's likely a whole suite of different errors we want to also exclude from the global cache.

@johnstcn johnstcn self-assigned this Jan 26, 2024
@johnstcn johnstcn marked this pull request as ready for review January 26, 2024 15:01
@johnstcn johnstcn requested review from kylecarbs and Emyrk January 26, 2024 15:01
Copy link
Member

@Emyrk Emyrk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a great find 👍

@johnstcn johnstcn merged commit 42e997d into main Jan 26, 2024
@johnstcn johnstcn deleted the cj/rbac-do-not-cache-non-rbac-errors branch January 26, 2024 16:19
@github-actions github-actions bot locked and limited conversation to collaborators Jan 26, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants