-
Notifications
You must be signed in to change notification settings - Fork 1.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Remote Site should check version of Auth server not Proxy server #12010
Labels
Comments
rosstimothy
added a commit
that referenced
this issue
Apr 20, 2022
The cache policy used for a remote site is determined based on the response from a version request. However the version response was only returning the proxy version. If the remote site was not running the same version for both auth and proxy, then the cache policy chosen could be invalid. The reverse tunnel agent now pings its auth server and reports both the auth and proxy version in response to a version request. To maintain backward compatability the reverse tunnel server will fallback to using the proxy version if the response does not contain an auth version. Fixes #12010
rosstimothy
added a commit
that referenced
this issue
Apr 25, 2022
The cache policy used for a remote site is determined based on the response from a version request. However the version response was only returning the proxy version. If the remote site was not running the same version for both auth and proxy, then the cache policy chosen could be invalid. The reverse tunnel agent now pings its auth server and reports both the auth and proxy version in response to a version request. To maintain backward compatability the reverse tunnel server will fallback to using the proxy version if the response does not contain an auth version. Fixes #12010
rosstimothy
added a commit
that referenced
this issue
Apr 26, 2022
* Create remote site cache based on remote auth version The cache policy used for a remote site is determined based on the response from a version request. However the version response was only returning the proxy version. If the remote site was not running the same version for both auth and proxy, then the cache policy chosen could be invalid. The reverse tunnel agent now pings its auth server and reports both the auth version in response to a version request. Fixes #12010
rosstimothy
added a commit
that referenced
this issue
Apr 26, 2022
* Create remote site cache based on remote auth version The cache policy used for a remote site is determined based on the response from a version request. However the version response was only returning the proxy version. If the remote site was not running the same version for both auth and proxy, then the cache policy chosen could be invalid. The reverse tunnel agent now pings its auth server and reports both the auth version in response to a version request. Fixes #12010 (cherry picked from commit 4f2ad1f) # Conflicts: # lib/reversetunnel/srv.go
rosstimothy
added a commit
that referenced
this issue
Apr 26, 2022
* Create remote site cache based on remote auth version The cache policy used for a remote site is determined based on the response from a version request. However the version response was only returning the proxy version. If the remote site was not running the same version for both auth and proxy, then the cache policy chosen could be invalid. The reverse tunnel agent now pings its auth server and reports both the auth version in response to a version request. Fixes #12010 (cherry picked from commit 4f2ad1f)
rosstimothy
added a commit
that referenced
this issue
Apr 26, 2022
* Create remote site cache based on remote auth version The cache policy used for a remote site is determined based on the response from a version request. However the version response was only returning the proxy version. If the remote site was not running the same version for both auth and proxy, then the cache policy chosen could be invalid. The reverse tunnel agent now pings its auth server and reports both the auth version in response to a version request. Fixes #12010 (cherry picked from commit 4f2ad1f)
rosstimothy
added a commit
that referenced
this issue
Apr 27, 2022
* Create remote site cache based on remote auth version The cache policy used for a remote site is determined based on the response from a version request. However the version response was only returning the proxy version. If the remote site was not running the same version for both auth and proxy, then the cache policy chosen could be invalid. The reverse tunnel agent now pings its auth server and reports both the auth version in response to a version request. Fixes #12010 (cherry picked from commit 4f2ad1f) # Conflicts: # lib/reversetunnel/srv.go
rosstimothy
added a commit
that referenced
this issue
Apr 27, 2022
* Create remote site cache based on remote auth version The cache policy used for a remote site is determined based on the response from a version request. However the version response was only returning the proxy version. If the remote site was not running the same version for both auth and proxy, then the cache policy chosen could be invalid. The reverse tunnel agent now pings its auth server and reports both the auth version in response to a version request. Fixes #12010 (cherry picked from commit 4f2ad1f)
rosstimothy
added a commit
that referenced
this issue
Apr 28, 2022
* Create remote site cache based on remote auth version The cache policy used for a remote site is determined based on the response from a version request. However the version response was only returning the proxy version. If the remote site was not running the same version for both auth and proxy, then the cache policy chosen could be invalid. The reverse tunnel agent now pings its auth server and reports both the auth version in response to a version request. Fixes #12010 (cherry picked from commit 4f2ad1f)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
When creating a remote site we check the version of the remote cluster to determine how to initialize the cache to account for different resources being emitted based on different version. However the check is only checking the version of the proxy and not auth. This can lead to issue if the auth server and proxy server in the remote cluster are not on the same version. In such a scenario it is possible that the remote site cache will indefinitely be unhealthy.
teleport/lib/reversetunnel/srv.go
Lines 1152 to 1179 in 8c887bb
The text was updated successfully, but these errors were encountered: