Work around an azure HTTP/2 bug #183
Conversation
|
Unfortunately this can't be unit tested. It relies on HTTP/2 connections being dropped on the Azure side, which HCP has observed very intermittently. The rest of the change is covered by the acceptance tests that existed already. FWIW: |
sgmiller
dismissed
jimlambrt’s stale review
Responded, but proceeding due to the time sensitive nature of next weeks release.
go mod tidy, so the tests stop failing
This change allows us to write some unit tests that use a self-signed cert using httptest.
|
I'm a bit skeptical that the existing vault unit tests asserted anything about the custom transport you've added. I've pushed some unit tests which do some minimal assertions about the fix. |
|
Unfortunately no. I might be able to do it with iptables but not great for unit testing. |
Okay, that's a useful thing to verify. Thanks. |
Backport of the Azure HTTP/2 workaround to vault 1.12.x maintenance branch. --------- Co-authored-by: Jim <jlambert@hashicorp.com>
* Work around an azure HTTP/2 butg * fix/chore (azurevault): simple fix for go.sum go mod tidy, so the tests stop failing * test (azurevault): add withCertPool to getKeyVaultClient(...) This change allows us to write some unit tests that use a self-signed cert using httptest. * test (azurevault): add unit tests for getKeyVaultClient(...) --------- Co-authored-by: Jim <jlambert@hashicorp.com>
* Add support for azure workload identity authentication Use the Azure Workload Identity federated identity magic when it is available to authenticate against Azure keyvault. This allows vault to run in an AKS cluster with service accounts federated to service principals or managed identites. This also requires the azure libraries to be migrated to the newest version as the autorest libraries are being depricated. * use passed context in setup * Add Work around an azure HTTP/2 bug (#183)
Azure's client by default doesn't health check HTTP/2 keepalive conns, and instead lets the os close them after inactivity if they become unhealthy or are closed unexpectedly. This can take 15 minutes. If too many idle conns get hung in this state the client becomes unusable. This workaround was provided by Microsoft as they investigate the issue.
Issue: Azure/azure-sdk-for-go#21346
Workaround is frrom that issue but backported to the older Azure client.