chrisfu/prole
1
0
Fork 0
mirror of https://github.com/dredx/prole.git synced 2026-09-23 11:03:59 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix(knoe-users): fix KDC re-init pod selection and add readiness poll

Browse Source 
Two bugs in the EmptyDir auto-recovery path:

1. get_kdc_pod returned items[0] without a phase filter, so a Terminating
   pod from the previous rollout could be selected. Add
   --field-selector=status.phase=Running to always get a live pod.

2. The rollout completes (pod Running) before the in-container entrypoint
   finishes kdb5_util create (no readiness probe configured). The single
   immediate kadmin.local check raced against DB init and lost. Replace
   with a 120s poll loop (5s interval) that re-queries the pod each tick
   so it handles both the timing race and any remaining pod-selection lag.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
chrisfu 2026-05-03 16:10:39 -07:00
parent e25090e6e1
commit 9d7ef668b1
1 changed files with 18 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
etc/init_knoe_users.sh
View File

@ -155,9 +155,11 @@ get_secret_value() {
get_kdc_pod() {
# The kdc container lives inside the authority deployment pod selected by mode.
# Only return Running pods — Terminating pods from a prior rollout must be excluded.
local pod
pod=$(kubectl -n "$KNOE_KDC_NAMESPACE" get pods \
-l "app=${KNOE_AUTH_DEPLOYMENT}" \
--field-selector=status.phase=Running \
-o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
if [[ -n "$pod" ]]; then
printf '%s' "$pod"
@ -299,17 +301,24 @@ initialize() {
PROLE_KDC_MASTER_PASSWORD="$PROLE_KDC_MASTER_PASSWORD" \
PROLE_KDC_NAME="$KNOE_AUTH_DEPLOYMENT" \
bash "$init_kdc_script" initialize >&2
# Re-query pod after re-init — deployment rollout creates a new pod
kdc_pod=$(get_kdc_pod)
[[ -n "$kdc_pod" ]] || die "No KDC pod found after re-initialisation in namespace ${KNOE_KDC_NAMESPACE}."
log "KDC pod after re-init: $kdc_pod"
# Retry pre-flight on the new pod
if ! kubectl -n "$KNOE_KDC_NAMESPACE" exec "$kdc_pod" -c kdc -- \
sh -c 'kadmin.local -q listprincs' >/dev/null 2>&1; then
die "KDC database still not accessible after re-initialisation in pod ${kdc_pod}.
# Poll until the new pod's entrypoint finishes kdb5_util create.
# The rollout completes before the in-container DB init finishes (no readiness probe).
local _reinit_timeout=120 _reinit_interval=5 _reinit_elapsed=0
log "Waiting up to ${_reinit_timeout}s for KDC database to become accessible ..."
while (( _reinit_elapsed < _reinit_timeout )); do
kdc_pod=$(get_kdc_pod)
if [[ -n "$kdc_pod" ]] && kubectl -n "$KNOE_KDC_NAMESPACE" exec "$kdc_pod" -c kdc -- \
sh -c 'kadmin.local -q listprincs' >/dev/null 2>&1; then
log "KDC database re-initialised successfully (pod: $kdc_pod)"
break
fi
sleep "$_reinit_interval"
_reinit_elapsed=$(( _reinit_elapsed + _reinit_interval ))
done
if (( _reinit_elapsed >= _reinit_timeout )); then
die "KDC database still not accessible after ${_reinit_timeout}s (pod: ${kdc_pod:-<none>}).
Check init_kdc.sh logs above for errors."
fi
log "KDC database re-initialised successfully"
else
log "KDC database accessible"
fi