search

GoogleCloudPlatform / docker-credential-gcr

A Docker credential helper for GCR users
https://gcr.io
Apache License 2.0
294 stars 92 forks source link

Not thread safe? #54

Closed jonjohnsonjr closed 4 years ago

jonjohnsonjr commented 5 years ago

While trying to speed something up, I noticed concurrent invocations can cause failures with this error:

docker-credential-gcr/helper: could not retrieve GCR's access token: google: could not find default credentials. See https://developers.google.com/accounts/docs/application-default-credentials for more information.

Repro:

for i in {1..100}; do (echo -n gcr.io | docker-credential-gcr get &); done

I suspect this is more likely an issue with https://github.com/golang/oauth2 (or how we're using it?).

Any ideas?

dekkagaijin commented 5 years ago

Can't repro on my desktop, but I believe you. Error's here: https://github.com/golang/oauth2/blob/master/google/default.go#L118 It's most likely that none of the token sources returned anything, and only the last error is being returned. Trying to access gcloud's access_token in parallel can cause some of the requests to fail, which I assume is the root cause here:

#!/bin/bash

foo () {
  gcloud config config-helper --force-auth-refresh --format="value(credential.access_token)"
}

for i in {1..100}; do foo & done
jonjohnsonjr commented 4 years ago

This got fixed internally recently (in gcloud). Anecdotally, all my tools are now ~4x faster because getting access tokens from gcloud is much faster. Going to close this, please reopen if you still see it after updating gcloud.