etcdserver: fix cannot promote member from follower when auth is enabled#21504
etcdserver: fix cannot promote member from follower when auth is enabled#21504yashrajshuklaaa wants to merge 1 commit intoetcd-io:release-3.5from
Conversation
When auth is enabled and a promote request is sent to a follower, the follower forwards the request to the leader via the peer HTTP channel. However, the Authorization header from the original client request was not being propagated into the gRPC metadata context, causing the leader's auth check to fail with 'auth: user name is empty'. Fix this by extracting the Authorization token from the incoming HTTP header and injecting it into the context as gRPC metadata before calling PromoteMember. Fixes: etcd-io#20757 Signed-off-by: Yashraj Shukla <shuklayashraj68@gmail.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: yashrajshuklaaa The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @yashrajshuklaaa. Thanks for your PR. I'm waiting for a etcd-io member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
You didn't backport the test case in this PR. Another contributor already backported the whole PR in #21494 thx for your effort anyway. |
3 participants
Fixes #20757
What this PR does
When auth is enabled and a
member promoterequest is submitted to afollower node, the follower forwards the request to the leader via the
peer HTTP API. The
Authorizationheader from the original clientrequest was not being propagated into the gRPC metadata context of the
forwarded call. As a result, the leader's auth middleware rejected the
request with
auth: user name is empty, causing the operation to failand timeout.
This backports the fix from #20792 (merged to main and release-3.6
via #20874) to the
release-3.5branch.Changes
Authorizationheader into gRPC metadata context beforecalling
PromoteMemberinpeerMemberPromoteHandlerHow to reproduce the bug
member promoterequest to the follower endpointauth: user name is empty