Validate agent token for duplicate IP addresses #3673
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3673 +/- ##
==========================================
+ Coverage 87.06% 87.08% +0.01%
==========================================
Files 127 127
Lines 15602 15594 -8
Branches 62 62
==========================================
- Hits 13584 13580 -4
+ Misses 1859 1856 -3
+ Partials 159 158 -1 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Problem: In some environments, Pods could share an IP address (for example when a Job completes and a new Pod grabs that IP). This would cause problems when the nginx data plane Pod would attempt to connect to the control plane. The control plane would try to validate the token provided by the nginx agent, by using the IP address in the request to lookup the associated Pod. If multiple Pods existed with that IP address, the control plane would error out. Solution: Fix the control plane logic to use more criteria when getting the proper Pod to verify the provided token.
bjee19
reviewed
Jul 31, 2025
Comment on lines
+165
to
+167
| LabelSelector: labels.Set(map[string]string{ | ||
| controller.AppNameLabel: usernameItems[3], | ||
| }).AsSelector(), |
There was a problem hiding this comment.
if, in this case, the job has the same labels, does that mean it would still error? is that just an edge case which we shouldn't need to worry about?
There was a problem hiding this comment.
We check the Pod phase to ensure that only one pod is running, even if the Job fits this same selector
|
@sjberman were you able to get in a situation like in the original issue and manually verify it works? |
|
@bjee19 Not quite, but I confirmed with the user what causes it, and the code avoids that scenario. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem: In some environments, Pods could share an IP address (for example when a Job completes and a new Pod grabs that IP). This would cause problems when the nginx data plane Pod would attempt to connect to the control plane. The control plane would try to validate the token provided by the nginx agent, by using the IP address in the request to lookup the associated Pod. If multiple Pods existed with that IP address, the control plane would error out.
Solution: Fix the control plane logic to use more criteria when getting the proper Pod to verify the provided token.
Closes #3657
Checklist
Before creating a PR, run through this checklist and mark each as complete.
Release notes
If this PR introduces a change that affects users and needs to be mentioned in the release notes,
please add a brief note that summarizes the change.