Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Exit if validator/signer can't be created #897

Open
jessdwitch opened this issue Jul 3, 2024 · 0 comments
Open

Exit if validator/signer can't be created #897

jessdwitch opened this issue Jul 3, 2024 · 0 comments

Comments

@jessdwitch
Copy link

Version of KrakenD you are using
2.3.3

Is your feature request related to a problem? Please describe.
When using a validator / signer key, if the key cannot be found on startup, KrakenD will continue running with no retry. This can be very annoying, since it means I need to be intentional about the order my k8s workloads spin up, and in one case has led to a weird-to-debug issue where one signed endpoint was working but the other wasn't (the host for the signer key came up in between KrakenD building the two).

Describe the solution you'd like
I'd like a configuration setting for each, where if the key can't be found, KrakenD immediately exits with an error stating why it couldn't obtain the key and for which endpoint. In a k8s env this would trigger CrashLoopBackoff, and in any scenario where multiple deployments might have race conditions, eventually solve itself. Outside of k8s, the behavior of a validator just allowing all traffic if the key can't be found feels like a pretty nasty gotcha with severe security implications.

Describe alternatives you've considered
Since I'm using GKE, I have a monitoring alert for the "Unable to create the signer" message and the validator one as well. That solution is specific to my setup and it's still a manual process to bounce the pod (hypothetically, I could set up pubsub to bounce the pod I guess but that feels like overkill).

Additional context
None that I can think of.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant