Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Apollo 鉴权能否新增降级的参数(对所有的appid不再进行鉴权) #5255

Open
youngzil opened this issue Oct 21, 2024 · 3 comments
Labels

Comments

@youngzil
Copy link
Contributor

你的特性请求和某个问题有关吗?请描述

当Apollo服务出现问题,或者一些特殊情况下,可以一次性降级鉴权功能,对所有的请求都不再进行鉴权

比如有这么一个场景:因为某些原因被一个客户端请求过大,导致服务端CPU被打爆,影响了其他appid请求的RT,就会导致Apollo鉴权时间戳校验不过,打印大量的 Invalid timestamp日志,同时产生大量的告警信息,此时缺无法临时一键降级权限校验

清晰简洁地描述一下你希望的解决方案

比如新增 apollo.access-key.auth.enabled ,默认为true,当遇到服务端问题或者其他应急响应时,可以设置为False,临时降级鉴权功能,关闭Apollo 鉴权

清晰简洁地描述一下这个特性的备选方案

其它背景

在这里添加和这个特性请求有关的背景说明、截图

@nobodyiam
Copy link
Member

默认的时间区间是 60s(apollo.access-key.auth-time-diff-tolerance),应该不至于阻塞这么久,这个值也可以调整

@youngzil
Copy link
Contributor Author

youngzil commented Oct 26, 2024

默认的时间区间是 60s(apollo.access-key.auth-time-diff-tolerance),应该不至于阻塞这么久,这个值也可以调整

目前我们设置的是180s,但是在服务端资源被占用比较大或者其他情况导致的一些异常情况下,还是会偶发性出现 Invalid timestamp异常,这不是一个常规需求,是在异常情况下的应急动作,暂时性对鉴权功能进行降级操作

Copy link

stale bot commented Dec 20, 2024

This issue has been automatically marked as stale because it has not had activity in the last 30 days. It will be closed in 7 days unless it is tagged "help wanted" or other activity occurs. Thank you for your contributions.

@stale stale bot added the stale label Dec 20, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants