search

kubeguard / guard

🔑 Kubernetes Authentication & Authorization WebHook Server
https://kubeguard.dev
Apache License 2.0
593 stars 81 forks source link

authz/azure: data race on username #384

Closed bcho closed 7 months ago

bcho commented 7 months ago

In our production logs, we detected a mismatched role assignment & username in the log line:

https://github.com/kubeguard/guard/blob/28c225879ee593277a7a42adfd5d350009450c39/authz/providers/azure/rbac/checkaccessreqhelper.go#L39

This is due to this log line is referencing a global variable username:

https://github.com/kubeguard/guard/blob/28c225879ee593277a7a42adfd5d350009450c39/authz/providers/azure/rbac/checkaccessreqhelper.go#L51

When the server is serving multiple requests at the same time, the access to this variable will cause data race. We have reproduced this issue in unit test with -race enabled.