fix: Lazy refresh should refresh tokens 4 minutes before expiration. #2063
Conversation
hessjcg
force-pushed
the
gh-2059-fix-token-refresh
branch
from
67856b9
to
cb64a3a
Compare
We don't know for sure that this will fix the above issue right? We should probably mark this as "Related to #2509" and have it tested in the wild first before marking as fixed. Thoughts? |
hessjcg
force-pushed
the
gh-2059-fix-token-refresh
branch
from
cb64a3a
to
67a3226
Compare
Good point. I set this as "related to." |
hessjcg
force-pushed
the
gh-2059-fix-token-refresh
branch
from
67a3226
to
62dbf7d
Compare
| .getAccessToken() | ||
| .getExpirationTime() | ||
| .toInstant() | ||
| .minus(4, ChronoUnit.MINUTES) |
There was a problem hiding this comment.
Do we have a constant for this value somewhere? I think we should use it to avoid future mistakes in buffering.
There was a problem hiding this comment.
Good idea, yes. RefreshCalculator.DEFAULT_REFRESH_BUFFER
core/src/main/java/com/google/cloud/sql/core/DefaultAccessTokenSupplier.java
Outdated
Show resolved
Hide resolved
core/src/main/java/com/google/cloud/sql/core/DefaultAccessTokenSupplier.java
Outdated
Show resolved
Hide resolved
hessjcg
force-pushed
the
gh-2059-fix-token-refresh
branch
from
62dbf7d
to
9decc4f
Compare
| || "".equals(credentials.getAccessToken().getTokenValue()); | ||
| } | ||
|
|
||
| private void refreshIfNearExpiration(GoogleCredentials credentials) throws IOException { |
There was a problem hiding this comment.
nit: Since we also refresh for reasons other than expiry maybe a better name is refreshIfRequired or refreshIfNecessary or something similar.
hessjcg
force-pushed
the
gh-2059-fix-token-refresh
branch
from
9decc4f
to
29ae338
Compare
Added a 4 minute buffer to refreshing tokens and certificates to avoid creating race condition that would allow the connector to create an ephemeral certificate with an expired auth token.
Now, IAM auth tokens are now refreshed 4 minutes before they token expire. Also, the Lazy Refresh Strategy will refresh the client certificate 4 minutes before the expiration of the certificate and the IAM auth token.
This should mitigate some of the strange certificate expiration errors commonly found in Cloud Run, see: #2059