-
Notifications
You must be signed in to change notification settings - Fork 52
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support manually in-place authentication token update #65
Conversation
I think there are 3 ways to add the reauthentication API:
IMO the first one is better since it could makes the reauthenticate easier without affecting other running tasks. |
I preferred the second. Add to etcd_client::auth_client().update_token(name, password); |
The methods in Therefore, I prefer the first approach, where the method for updating the client token is placed in a separate handler. This ensures the correspondence between XxxClient and the corresponding RPC service |
There are no strict restrictions that require AuthClient and rpc to have a one-to-one correspondence, |
A more accurate description, in my opinion, would be that |
I don't think it's necessary to take the |
I have no idea why clippy fails 😅 |
Fixed in #80 |
As mentioned in #54, the lack of authentication token update mechenism may cause active
lease
andwatch
become unusable after the token expire. The solution gave in #45 (comment) does theoretically solved it. However, recreating the client means everyLeaseKeeper
&Watcher
needs to be rebuild. This makes the implementation quite complex.Since updating token automatically is somehow difficult due to tonic's design (#45), I think updating token manually may be a better solution.
The field
token
inAuthService
is changed to anArc<Mutex<Option<HeaderValue>>>
to support in-place modification and sharing between multiple services. The cost of theMutex
is acceptable since it only involves a clone of a smallHeaderValue
in every request.The token update method is temporarily
Client::update_auth
. I am not sure where to put it since it may not be correspond to any service abstraction.