acl: use the presence of a management policy in the state store as a sign that we already migrated to v2 acls #9505
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…sign that we already migrated to v2 acls This way we only have to wait for the serf barrier to pass once before we can upgrade to v2 acls. Without this patch every restart needs to re-compute the change, and potentially if a stray older node joins after a migration it might regress back to v1 mode which would be problematic.
rboyer
commented
Jan 5, 2021
|
|
||
| // t.Parallel() | ||
|
|
||
| // We test this by having two datacenters with one server each. They |
There was a problem hiding this comment.
This scenario is actually the thing I was running into while trying to fix #9342. Without this fix, the patches on the other PR to prevent dialing the primary's gateway when the local is known to have a gateway were blocked waiting for the mesh gateway envoy to start in the secondary. That in turn was blocked on the "wtf? i can't handle non-legacy tokens yet until i talk to the primary" circular dependency.
mkeeler
approved these changes
Jan 5, 2021
|
🍒 If backport labels were added before merging, cherry-picking will start automatically. To retroactively trigger a backport after merging, add backport labels and re-run https://circleci.com/gh/hashicorp/consul/304944. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This way we only have to wait for the serf barrier to pass once before
we can upgrade to v2 acls. Without this patch every restart needs to
re-compute the change, and potentially if a stray older node joins after
a migration it might regress back to v1 mode which would be problematic.