Machine ID: Warn when returned cert TTL is less than expected #52833
Conversation
This adds a warning when the returned certificate TTL is lower than requested, which can happen if `max_session_ttl` is set in a bot role. Fixes #29579
| l.WarnContext(ctx, "The server returned an identity shorter than "+ | ||
| "the requested TTL, probably due to a `max_session_ttl` "+ | ||
| "configured on a server-side role. It may not remain valid as "+ | ||
| "long as expected.") |
There was a problem hiding this comment.
I did some experimenting and found that bots can always fetch their own roles, so technically we could make some queries and log exactly which role caused the shortened TTL. Any thoughts on whether or not that would be worth the effort?
There was a problem hiding this comment.
That'd be a really nice touch, but I think it depends on how many roles bots have in the common case. My hunch is that it's low enough that it wouldn't take users long to figure out which is the problematic role.
There was a problem hiding this comment.
Yeah, and adds network calls on what's already a semi-error path, which isn't ideal. I think I'll stick with the simpler implementation for now, and maybe add a note to indicate we could improve this in the future if we see users having trouble.
| l.WarnContext(ctx, "The server returned an identity shorter than "+ | ||
| "the requested TTL, probably due to a `max_session_ttl` "+ | ||
| "configured on a server-side role. It may not remain valid as "+ | ||
| "long as expected.") |
There was a problem hiding this comment.
That'd be a really nice touch, but I think it depends on how many roles bots have in the common case. My hunch is that it's low enough that it wouldn't take users long to figure out which is the problematic role.
|
@timothyb89 See the table below for backport results.
|
This adds a warning when the returned certificate TTL is lower than requested, which can happen if
max_session_ttlis set in a bot role.changelog: Machine ID: Added warning when generated certificates will not last as long as expected
Fixes #29579