RBACSync should not remove rolebindings when G Suite API fails about rbacsync HOT 6 CLOSED

I think the proposed solution is a good trade-off of security for reliability. There will certainly be blips in availability of the API in the future. There is definitely lower hanging fruit than the update+DOS attack.

from rbacsync.

Thanks for the report!

Another possibility for a fix would be a cache to protect against momentary upstream unavailability. We can have it stay operational for a period then eventually timeout the cache.

I also feel like we should report the recency of group updates on the status field of the config objects so that it can be monitored.

from rbacsync.

For discoverability, the error that was reported by RBACSync pod:

Event(v1.ObjectReference{Kind:"RBACSyncConfig", Namespace:"default", Name:"namespace-bindings", UID:"b76e9626-0255-11e9-bfd1", APIVersion:"rbacsync.example.com/v1alpha", ResourceVersion:"37596907", FieldPath:""}): type: 'Warning' reason: 'BindingError' group [email protected] lookup failed: unknown error fetching group members: googleapi: Error 403: Not Authorized to access this resource/api, forbidden

from rbacsync.

Do we have a proposed error behavior for the set of error codes? We need to differentiate permanent errors from temporary access errors. For example, what would be the behavior of a 404 vs a 403? Are there are cases where the upstream wants to remove access to the group information and have that reflected in rbacsync? We don't want to create cases where we can't control the behavior.

from rbacsync.

Note that we saw this behavior under timeouts, as well:

Event(v1.ObjectReference{Kind:"RBACSyncConfig", Namespace:"default", Name:"namespace-bindings", UID:"ff3f6641-0253-11e9-9985-42010ad4000b", APIVersion:"rbacsync.getcruise.com/v1alpha", ResourceVersion:"34555077", FieldPath:""}): type: 'Warning' reason: 'BindingError' group [email protected] lookup failed: unknown error fetching group members: context deadline exceeded

from rbacsync.

Closed by #14.

from rbacsync.