fix: propagate configuration profile to eagerly-created topology monitor (#2020)#2021
Open
sergiyvamz wants to merge 1 commit into
Open
fix: propagate configuration profile to eagerly-created topology monitor (#2020)#2021sergiyvamz wants to merge 1 commit into
sergiyvamz wants to merge 1 commit into
Conversation
…tor (#2020) When plugins are configured via a class-based ConfigurationProfile (withPluginFactories) and a dialect is supplied (so isDialectConfirmed() is true up front, as with Global Aurora), createStandardServiceContainer's refreshHostList() can eagerly create and cache the cluster topology monitor before setConfigurationProfile() runs on the container. The monitor's minimal service container then reads a null profile and falls back to the default plugin list (no iam), so its connections to IAM-only databases fail once the cached IAM token expires. Fix: set the configuration profile on the services container before initializing the host list provider and refreshing the host list. Adds a ServiceUtilityTest unit regression test and an AwsIamIntegrationTest integration test that reproduces the IAM-only topology monitor scenario.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #2020 (a reopening of #1800).
When the plugin list is configured through a class-based
ConfigurationProfile(ConfigurationProfileBuilder.withPluginFactories(...)) rather than thewrapperPluginsstring, the cluster topology monitor could still lose the profile-configured plugins (notablyiam). Its background connections then authenticate without IAM and fail once the cached IAM token expires (~15 min), e.g.:Root cause
PR #1802 and PR #1919 wired the configuration profile through the monitor's minimal service container, so in the common case the monitor inherits the profile correctly. The remaining gap is an ordering problem in
ServiceUtility.createStandardServiceContainer:PluginServiceImplmarks the dialect as confirmed immediately when a dialect is supplied via the profile (orwrapperDialect), and Global Aurora (GDB) deployments are confirmed up front automatically.pluginService.refreshHostList()insidecreateStandardServiceContainereagerly creates and caches theClusterTopologyMonitorImpl.servicesContainer.setConfigurationProfile(configurationProfile)was called, so the monitor's minimal container read anullprofile and fell back toDEFAULT_PLUGINS(initialConnection,auroraConnectionTracker,failover2,efm2) - noiam.This matches the reporter's observation that adding
iamto thewrapperPluginsstring works around it: the string path (PATH B) is only reached when the profile is missing.Fix
Set the configuration profile on the services container before creating the host list provider and refreshing the host list, so any eagerly-created topology monitor inherits it. This is a semantics-preserving move of a field setter to an earlier point in the same method; the container's final state is unchanged.
Tests
ServiceUtilityTest(unit): drives the realcreateStandardServiceContainerwith a profile-supplied dialect and a host list provider that records the container's configuration profile atrefresh()time (the exact point the monitor would be created). Verified it fails without the fix (expected: <profile> but was: <null>) and passes with it.AwsIamIntegrationTest#test_AwsIam_TopologyMonitorInheritsProfilePlugins(integration): configures plugins viawithPluginFactories(iam, auroraConnectionTracker, failover2), confirms the dialect up front, connects IAM-only (no password) to an Aurora cluster, then forces a verified topology refresh. This drives the monitor to open its own connections through its plugin chain, which only succeeds if it inherited theiamplugin. Gated with@EnableOnTestFeature(IAM)+@EnableOnDatabaseEngineDeployment(AURORA)+@DisableOnTestDriver(MARIADB).