smolnar82 commented on code in PR #826:
URL: https://github.com/apache/knox/pull/826#discussion_r1473959716
##########
gateway-server/src/main/java/org/apache/knox/gateway/services/token/impl/JDBCTokenStateService.java:
##########
@@ -65,12 +76,33 @@ public void init(GatewayConfig config, Map<String, String>
options) throws Servi
} catch (Exception e) {
throw new ServiceLifecycleException("Error while initiating
JDBCTokenStateService: " + e, e);
}
+
+ this.skipTokenMigration = config.skipTokenMigration();
+ this.archiveMigratedTokens = config.archiveMigratedTokens();
+ this.migrateExpiredTokens = config.migrateExpiredTokens();
+ this.verboseTokenMigration =
config.printVerboseTokenMigrationMessages();
+ this.tokenMigrationProgressCount =
config.getTokenMigrationProgressCount();
} finally {
initLock.unlock();
}
}
}
+ @Override
+ public void start() throws ServiceLifecycleException {
+ super.start();
+ if (skipTokenMigration) {
+ log.skipTokenMigration();
+ } else {
+ final TokenMigrationTool tokenMigrationTool = new
TokenMigrationTool(aliasService, this, null);
Review Comment:
Yes, that was the final agreement with @lmccay on the
[[DISCUSS]](https://lists.apache.org/thread/fs9nkl6l45o330ttvgvqxj3jnxt63bcs)
thread about this change:
```
- the migration tool will be run automatically when the Knox Gateway starts,
and it will run on the main thread (i.e. not in the background).
- there will be a config to control this step: in case of an error/bug, this
automated migration could be turned off
```
In the 2.1.0 release, we will add proper documentation on best practices
about this change: the recommended way of upgrading to that version is to run
the new KnoxCLI code before the upgraded Knox Gateway starts. If admins do
that, this implicit step will finish in a matter of (milli)seconds during Knox
Gateway startup. However, if they failed to do that before, we agreed that it's
better to have tokens auto-migrated than leave them in the dark and guess why
token authentication isn't working. I believe the detailed entries in
`gateway.log` (see above in the description) make it crystal clear why the KG
startup takes such time for the first time.
Sample startup after token migration executed before:
```
2024-02-01 10:36:46,854 INFO token.state
(TokenMigrationTool.java:log(115)) - Loading token aliases from the __gateway
credential store. This could take a while.
2024-02-01 10:36:46,960 INFO token.state
(TokenMigrationTool.java:log(115)) - Token aliases loaded in 107 milliseconds
2024-02-01 10:36:46,962 INFO token.state
(TokenMigrationTool.java:log(115)) - Processed 0 tokens in 1 milliseconds
2024-02-01 10:36:46,962 INFO token.state
(TokenMigrationTool.java:log(115)) - Removing token aliases from the __gateway
credential store...
2024-02-01 10:36:46,964 INFO token.state
(TokenMigrationTool.java:log(115)) - Removed token related aliases from the
__gateway credential store in 2 milliseconds
```
It took only 110 milliseconds.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
