Skip to content

Commit

Permalink
fix: remove the default retry policy for jwks fetch (#4802)
Browse files Browse the repository at this point in the history 
* remove the default retry policy for jwks fetch

Signed-off-by: Huabing Zhao <[email protected]>

* fix gen

Signed-off-by: Huabing Zhao <[email protected]>

* Update release-notes/current.yaml

Co-authored-by: Arko Dasgupta <[email protected]>
Signed-off-by: Huabing Zhao <[email protected]>

---------

Signed-off-by: Huabing Zhao <[email protected]>
Co-authored-by: Arko Dasgupta <[email protected]>
  • Loading branch information
@zhaohuabing @arkodg
zhaohuabing and arkodg authored Nov 29, 2024
1 parent 36939dc commit 526a05f
Show file tree
Hide file tree
Showing 15 changed files with 2 additions and 23 deletions.
3 changes: 1 addition & 2 deletions internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -515,8 +515,7 @@
"cluster": "raw_githubusercontent_com_443",
"timeout": "10s",
"uri": "https://raw.githubusercontent.com/envoyproxy/gateway/main/examples/kubernetes/jwt/jwks.json"
},
"retryPolicy": {}
}
}
}
},
Expand Down
1 change: 0 additions & 1 deletion internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -307,7 +307,6 @@ xds:
cluster: raw_githubusercontent_com_443
timeout: 10s
uri: https://raw.githubusercontent.com/envoyproxy/gateway/main/examples/kubernetes/jwt/jwks.json
retryPolicy: {}
requirementMap:
httproute/envoy-gateway-system/backend/rule/0/match/0/www_example_com:
providerName: httproute/envoy-gateway-system/backend/rule/0/match/0/www_example_com/example
Expand Down
1 change: 0 additions & 1 deletion internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.listener.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,6 @@ xds:
cluster: raw_githubusercontent_com_443
timeout: 10s
uri: https://raw.githubusercontent.com/envoyproxy/gateway/main/examples/kubernetes/jwt/jwks.json
retryPolicy: {}
requirementMap:
httproute/envoy-gateway-system/backend/rule/0/match/0/www_example_com:
providerName: httproute/envoy-gateway-system/backend/rule/0/match/0/www_example_com/example
Expand Down
1 change: 0 additions & 1 deletion internal/xds/translator/jwt.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -120,7 +120,6 @@ func buildJWTAuthn(irListener *ir.HTTPListener) (*jwtauthnv3.JwtAuthentication,
},
CacheDuration: &durationpb.Duration{Seconds: 5 * 60},
AsyncFetch: &jwtauthnv3.JwksAsyncFetch{},
RetryPolicy: &corev3.RetryPolicy{},
},
}

Expand Down
2 changes: 0 additions & 2 deletions internal/xds/translator/testdata/out/xds-ir/authorization-jwt-claim.listeners.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,6 @@
cluster: two_example_com_443
timeout: 10s
uri: https://two.example.com/jwt/public-key/jwks.json
retryPolicy: {}
httproute/default/httproute-2/rule/0/match/0/www_example_com/example1:
audiences:
- one.foo.com
Expand All @@ -52,7 +51,6 @@
cluster: one_example_com_443
timeout: 10s
uri: https://one.example.com/jwt/public-key/jwks.json
retryPolicy: {}
requirementMap:
httproute/default/httproute-1/rule/0/match/0/www_example_com:
providerName: httproute/default/httproute-1/rule/0/match/0/www_example_com/example1
Expand Down
2 changes: 0 additions & 2 deletions internal/xds/translator/testdata/out/xds-ir/authorization-jwt-scope.listeners.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,6 @@
cluster: two_example_com_443
timeout: 10s
uri: https://two.example.com/jwt/public-key/jwks.json
retryPolicy: {}
httproute/default/httproute-2/rule/0/match/0/www_example_com/example1:
audiences:
- one.foo.com
Expand All @@ -52,7 +51,6 @@
cluster: one_example_com_443
timeout: 10s
uri: https://one.example.com/jwt/public-key/jwks.json
retryPolicy: {}
requirementMap:
httproute/default/httproute-1/rule/0/match/0/www_example_com:
providerName: httproute/default/httproute-1/rule/0/match/0/www_example_com/example1
Expand Down
2 changes: 0 additions & 2 deletions internal/xds/translator/testdata/out/xds-ir/custom-filter-order.listeners.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -85,7 +85,6 @@
cluster: one_example_com_443
timeout: 10s
uri: https://one.example.com/jwt/public-key/jwks.json
retryPolicy: {}
httproute/envoy-gateway/httproute-1/rule/0/match/0/www_example_com/example2:
audiences:
- two.foo.com
Expand All @@ -105,7 +104,6 @@
cluster: two_example_com_80
timeout: 10s
uri: http://two.example.com/jwt/public-key/jwks.json
retryPolicy: {}
requirementMap:
httproute/envoy-gateway/httproute-1/rule/0/match/0/www_example_com:
requiresAny:
Expand Down
1 change: 0 additions & 1 deletion internal/xds/translator/testdata/out/xds-ir/jwt-custom-extractor.listeners.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,6 @@
cluster: localhost_443
timeout: 10s
uri: https://localhost/jwt/public-key/jwks.json
retryPolicy: {}
requirementMap:
first-route:
providerName: first-route/example
Expand Down
4 changes: 0 additions & 4 deletions internal/xds/translator/testdata/out/xds-ir/jwt-multi-route-multi-provider.listeners.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,6 @@
cluster: localhost_80
timeout: 10s
uri: http://localhost/jwt/public-key/jwks.json
retryPolicy: {}
first-route-www.test.com/example2:
audiences:
- one.foo.com
Expand All @@ -62,7 +61,6 @@
cluster: "192_168_1_250_8080"
timeout: 10s
uri: https://192.168.1.250:8080/jwt/public-key/jwks.json
retryPolicy: {}
second-route-www.test.com/example:
audiences:
- foo.com
Expand All @@ -82,7 +80,6 @@
cluster: localhost_80
timeout: 10s
uri: http://localhost/jwt/public-key/jwks.json
retryPolicy: {}
second-route-www.test.com/example2:
audiences:
- one.foo.com
Expand All @@ -100,7 +97,6 @@
cluster: "192_168_1_250_8080"
timeout: 10s
uri: https://192.168.1.250:8080/jwt/public-key/jwks.json
retryPolicy: {}
requirementMap:
first-route-www.test.com:
requiresAny:
Expand Down
2 changes: 0 additions & 2 deletions internal/xds/translator/testdata/out/xds-ir/jwt-multi-route-single-provider.listeners.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,6 @@
cluster: localhost_443
timeout: 10s
uri: https://localhost/jwt/public-key/jwks.json
retryPolicy: {}
second-route/example:
audiences:
- foo.com
Expand All @@ -77,7 +76,6 @@
cluster: localhost_443
timeout: 10s
uri: https://localhost/jwt/public-key/jwks.json
retryPolicy: {}
requirementMap:
first-route:
providerName: first-route/example
Expand Down
1 change: 0 additions & 1 deletion internal/xds/translator/testdata/out/xds-ir/jwt-optional.listeners.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,6 @@
cluster: localhost_443
timeout: 10s
uri: https://localhost/jwt/public-key/jwks.json
retryPolicy: {}
requirementMap:
first-route:
requiresAny:
Expand Down
1 change: 0 additions & 1 deletion internal/xds/translator/testdata/out/xds-ir/jwt-ratelimit.listeners.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,6 @@
cluster: "192_168_1_250_443"
timeout: 10s
uri: https://192.168.1.250/jwt/public-key/jwks.json
retryPolicy: {}
requirementMap:
first-route:
providerName: first-route/example
Expand Down
1 change: 0 additions & 1 deletion internal/xds/translator/testdata/out/xds-ir/jwt-single-route-single-match.listeners.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,6 @@
cluster: localhost_443
timeout: 10s
uri: https://localhost/jwt/public-key/jwks.json
retryPolicy: {}
requirementMap:
first-route:
providerName: first-route/example
Expand Down
1 change: 0 additions & 1 deletion ...rnal/xds/translator/testdata/out/xds-ir/securitypolicy-with-oidc-jwt-authz.listeners.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -81,7 +81,6 @@
cluster: oidc_example_com_443
timeout: 10s
uri: https://oidc.example.com/auth/realms/example/protocol/openid-connect/certs
retryPolicy: {}
requirementMap:
httproute/default/httproute-1/rule/0/match/0/www_example_com:
providerName: httproute/default/httproute-1/rule/0/match/0/www_example_com/exjwt
Expand Down
2 changes: 1 addition & 1 deletion release-notes/current.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ new features: |
# Fixes for bugs identified in previous versions.
bug fixes: |
Add a bug fix here
Disabled the retry policy for the JWT provider to reduce requests sent to the JWKS endpoint. Failed async fetches will retry every 1s.
# Enhancements that improve performance.
performance improvements: |
Expand Down

0 comments on commit 526a05f

Please sign in to comment.