search

spiffe / spiffe-helper

The SPIFFE Helper is a tool that can be used to retrieve and manage SVIDs on behalf of a workload
Apache License 2.0
47 stars 41 forks source link

exec race #209

Open kfox1111 opened 2 weeks ago

kfox1111 commented 2 weeks ago

If you have a second update come in too close to the first exec, you can get two exec's happening at once. seen on v0.8.0.

faisal-memon commented 1 week ago

This line is happening twice? https://github.com/spiffe/spiffe-helper/blob/main/pkg/sidecar/sidecar.go#L209

kfox1111 commented 1 week ago

Yeah, pretty sure I saw output of two execs interleaved with each other in the journal. Not sure of any other way to have seen output like that. I was testing some stuff out with the spire-ha-agent, which can sometimes trigger two cert returns in short order (spire itself can do this too, just more rare) at the time.

faisal-memon commented 5 days ago

Is go spiffe multi threaded? If so that could cause this problem.

If not I see a small window where something like this may happen. We start a go routine here that sets a boolean indicating exec has been run successfully. Before the go routine starts, the function that started go routine exits and another cert update comes in and gets past the check here.