Code Monkey home page Code Monkey logo

maru's Introduction

Maru - Temporal Load Simulator

Tool to generate load for Temporal workflows. Named after Kobayashi Maru.

⚠️ WARNING

This repository is a load generator for Temporal and does not represent suggested Go SDK practices or worker settings. Please reference the Go SDK documentation, or the Go SDK samples for better guidance.

How It Works

This repository defines a Temporal workflow which serves as a driver for load tests. Given the definition of a target load profile, the bench workflow would drive the target load and collect the workflow execution statistics.

Run the Bench Locally

The driver application reads the following environment variables to connect to a Temporal Server:

NAMESPACE=default
FRONTEND_ADDRESS=127.0.0.1:7233
PROMETHEUS_URL=http://prometheus-server

You will need to run the bench application, which also acts as a Temporal worker. Use the makefile to do so:

cd worker
make run

Deploy the Bench

The Bench workflow can be deployed to your target Temporal cluster, next to the workflows-to-be-benchmarked. You can choose to benchmark your own workflows or use the included basic workflow for starters.

The provided Helm chart can help you deploy the Bench application to your existing Kubernetes cluster.

Start a basic test using an input file

Once the bench worker and target workflows are running, you can start a quick test with the following command

  • Note: make sure you run this command in the base directory of your cloned maru repository (not the worker directory where you started the worker earlier).
tctl --namespace benchtest wf start --tq temporal-bench --wt bench-workflow --wtt 5 --et 1800 --if ./scenarios/basic-test.json --wid 1

This command starts a basic Bench workflow which in turns runs the Basic workflow six times. If everything is configured correctly, you should be able to see those workflows in Web UI:

Result of the Execution

Inspect the Bench Result

The Bench workflow returns the statistics of the workflow execution. You can query the workflow to retrieve execution statistics with the following command

$ tctl --namespace benchtest wf query --qt histogram --wid 1
Query result:
[[{"started":6,"closed":6,"backlog":0}]]

The workflow completed almost instantaneously, so there is just one data point. Let's try a more sophisticated scenario.

Start a longer load test using an input file

Here is a sample test that runs a steady workload of 20 workflows per second for 10 minutes:

tctl --namespace benchtest wf start --tq temporal-bench --wt bench-workflow --wtt 5 --et 1800 --if ./scenarios/basic-const12k.json --wid 2

It runs 12,000 workflows in total. The scenario also sets the reporting interval to 10 seconds, which means that the resulting report will have data points for every 10-second interval.

Retrieve the statistics of processing

Execute the histogram query to retrieve the execution statistics

$ tctl --namespace benchtest wf query --qt histogram --wid 2
Query result:
[[{"started":200,"closed":200,"backlog":0},{"started":200,"closed":200,"backlog":0},
{"started":200,"closed":200,"backlog":0},{"started":200,"closed":200,"backlog":0},
{"started":200,"closed":200,"backlog":0},{"started":200...

The result is a JSON array of execution statistics, where each array item represents a single time interval.

You can also retrieve the same information printed as a CSV file with the histrogram_csv query

$ tctl --namespace benchtest wf query --qt histogram_csv --wid 2
Query result:
[Time (seconds);Workflows Started;Workflows Started Rate;Workflow Closed;Workflow Closed Rate;Backlog
10;200;20.000000;200;20.000000;0
20;200;20.000000;200;20.000000;0
30;200;20.000000;200;20.000000;0
40;200;20.000000;200;20.000000;0
50;200;20.000000;200;20.000000;0
...

You can convert the workflow result to a chart using charting software of your choice. For example, save the CSV to a file, upload it to from Google Spreadsheets, and build a chart from columns 1, 3, 5, and 6:

Execution Chart

Retrieve the metrics

If you have Prometheus installed and configured, you can pass its URL via PROMETHEUS_URL environment variable (default: http://prometheus-server), you can use an additional query to retrieve the metrics of storage and History service utilization:

tctl --namespace benchtest wf query --qt metrics_csv --wid 2
Query result:
[Time (seconds);Persistence Latency (ms);History Service Latency (ms);Persistence CPU (mcores);History Service CPU (mcores);History Service Memory Working Set (MB)
60;8;456;494;418;27
120;9;479;1733;970;72
180;9;481;2537;996;80
240;9;481;3623;978;85
300;9;482;3652;949;87
360;9;477;3462;973;92
420;9;470;2522;636;91]

Variable load

You can define a load profile consisting of multiple steps. For example, you can start and finish the test with low number of executions per second but have a spike of high load in the middle.

Execution Chart

The above chart shows statistics from a sample run of ./scenarios/basic-spike.json.

Configure your own scenario

You can tweak the parameters of the benchmark scenario by adjusting the JSON file. Let's take the basic-const12k.json scenario as a starting point:

{
    "steps": [{
        "count": 12000,
        "ratePerSecond": 20,
        "concurrency": 5
    }],
    "workflow": {
        "name": "basic-workflow",
        "taskQueue": "temporal-basic",
        "args": {
            "sequenceCount": 3,
            "parallelCount": 1
        }
    },
    "report": {
        "intervalInSeconds": 10
    }
}

Here are all the parameters you may configure:

  • steps - An array that defines one or more steps of the load test.
  • steps[i].count - The total number of target worflow executions for a bench run.
  • steps[i].ratePerSecond - The maximum number of workflow executions to start per second (rate limiting). By default, no rate limiting applies.
  • steps[i].concurrency - The number of parallel activities that bench will use to start target workflows. Can be useful when ratePerSecond is too high for a single activity to keep up. Defaults to ratePerSecond divided by 10.
  • workflow.name - The name of a workflow to be used as the testing target. The bench will start step[*].count of these workflows.
  • workflow.taskQueue - The name of the task queue to use when starting the target workflow.
  • workflow.args - Arguments to send to the target workflows. This must match the shape of the target workflow's inputs.
  • report.intervalInSeconds - The resolution of execution statistics in the resulting report. Defaults to 1 minute.

Random inputs and outputs for the target workflow

The size of input and output data of workflows and activities may influence the performance characteristics.

The benchmark comes with a simple way to generate random payloads for your target workflows. Here is the definition of the workflow in ./scenarios/basic-payload.json:

"workflow": {
    "name": "basic-workflow",
    "taskQueue": "temporal-basic",
    "args": {
        "sequenceCount": 3,
        "payload": "$RANDOM(100)",
        "resultPayload": "$RANDOM_NORM(80,10)"
    }
}

Note how the args parameter contains two fields with "formulas" in them:

  • $RANDOM(<length>) generates a random string of the given length.
  • $RANDOM_NORM(<mean>,<stdvar>) generates a random string of a random length from the given normal distribution.

The formulas are replaced with random values by the benchmark workflow, so each target workflow execution receives its own value.

maru's People

Contributors

cretz avatar feedmeapples avatar greyteardrop avatar jasstkn avatar jhecking avatar mikhailshilkov avatar robholland avatar sagikazarmark avatar tsurdilo avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

maru's Issues

github.com/temporalio/sdk-go-v1.7.0: 3 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - github.com/temporalio/sdk-go-v1.7.0

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in Remediation Available
CVE-2019-0205 High 7.5 github.com/uber-go/tally-v3.3.17 Transitive N/A
CVE-2021-38561 High 7.5 github.com/golang/text-v0.3.6 Transitive N/A
CVE-2019-0210 High 7.5 github.com/uber-go/tally-v3.3.17 Transitive N/A

Details

CVE-2019-0205

Vulnerable Library - github.com/uber-go/tally-v3.3.17

A Go metrics interface with fast buffered metrics and third party reporters

Dependency Hierarchy:

  • github.com/temporalio/sdk-go-v1.7.0 (Root Library)
    • github.com/uber-go/tally-v3.3.17 (Vulnerable Library)

Found in base branch: master

Vulnerability Details

In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings.

Publish Date: 2019-10-29

URL: CVE-2019-0205

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0205

Release Date: 2019-10-29

Fix Resolution: org.apache.thrift:libthrift:0.13.0

CVE-2021-38561

Vulnerable Library - github.com/golang/text-v0.3.6

[mirror] Go text processing support

Dependency Hierarchy:

  • github.com/temporalio/sdk-go-v1.7.0 (Root Library)
    • github.com/grpc/grpc-go-v1.37.0
      • golang.org/x/net-e915ea6b2b7d7f3955e2d6d432eaebd7cf5921e7
        • github.com/golang/text-v0.3.6 (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Due to improper index calculation, an incorrectly formatted language tag can cause Parse
to panic, due to an out of bounds read. If Parse is used to process untrusted user inputs,
this may be used as a vector for a denial of service attack.

Publish Date: 2021-08-12

URL: CVE-2021-38561

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://osv.dev/vulnerability/GO-2021-0113

Release Date: 2021-08-12

Fix Resolution: v0.3.7

CVE-2019-0210

Vulnerable Library - github.com/uber-go/tally-v3.3.17

A Go metrics interface with fast buffered metrics and third party reporters

Dependency Hierarchy:

  • github.com/temporalio/sdk-go-v1.7.0 (Root Library)
    • github.com/uber-go/tally-v3.3.17 (Vulnerable Library)

Found in base branch: master

Vulnerability Details

In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data.

Publish Date: 2019-10-29

URL: CVE-2019-0210

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://mail-archives.apache.org/mod_mbox/thrift-dev/201910.mbox/%3C277A46CA87494176B1BBCF5D72624A2A%40HAGGIS%3E

Release Date: 2019-10-29

Fix Resolution: 0.13.0

[Feature Request] Target task queue should be configurable as part of the scenario definition

Is your feature request related to a problem? Please describe.

I would like to run benchmarks using my own target workflows, running on separate workers. But since the targetTaskQueue name used by the maru worker is hard-coded to temporal-basic at https://github.com/temporalio/maru/blob/master/worker/bench/activities.go#L41, the maru worker will attempt to execute any workflows send to that task queue:

2022-06-29T12:27:15.676Z    WARN    internal/internal_task_pollers.go:310    Failed to process w
orkflow task.    {"Namespace": "benchtest", "TaskQueue": "temporal-basic", "WorkerID": "1@maru-t
emporal-bench-6c65c74fb5-4rh95@", "WorkflowType": "example", "WorkflowID": "hw", "RunID": "8abab
ece-dc85-4f7f-b994-9a724dff3d54", "Attempt": 6, "Error": "unable to find workflow type: example.
 Supported types: [basic-workflow]"}

(example is the name of the "hello world" workflow I was trying to run is this first trial.)

Describe the solution you'd like

When specifying the workflow in the benchmark scenario, it should be possible to specify the task queue name to use when executing that workflow.

Additional context

None.

Benchmarking of workflows written in languages other than Go

Hi Team,

I have this general question on using Maru for bench marking my workflows, specially referring to the below from the README.

The Bench workflow can be deployed to your target Temporal cluster, next to the workflows-to-be-benchmarked. You can choose to benchmark your own workflows or use the included basic workflow for starters.

Our workflows are written in Java and I am wondering how can I use Maru for bench marking those workflows. Do I need to write the workflow starter code in Maru to do so?

Any help / pointers will be highly appreciated.

Thanks.

github.com/prometheus/client_goLang-v1.11.0: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - github.com/prometheus/client_goLang-v1.11.0

Prometheus instrumentation library for Go applications

Library home page: https://proxy.golang.org/github.com/prometheus/client_golang/@v/v1.11.0.zip

Found in HEAD commit: 21068b7f052867355beeab5072eccb334f46ecdd

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (github.com/prometheus/client_goLang-v1.11.0 version) Remediation Available
CVE-2022-21698 High 7.5 github.com/prometheus/client_goLang-v1.11.0 Direct v1.11.1

Details

CVE-2022-21698

Vulnerable Library - github.com/prometheus/client_goLang-v1.11.0

Prometheus instrumentation library for Go applications

Library home page: https://proxy.golang.org/github.com/prometheus/client_golang/@v/v1.11.0.zip

Dependency Hierarchy:

  • github.com/prometheus/client_goLang-v1.11.0 (Vulnerable Library)

Found in HEAD commit: 21068b7f052867355beeab5072eccb334f46ecdd

Found in base branch: master

Vulnerability Details

client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of promhttp.InstrumentHandler* middleware except RequestsInFlight; not filter any specific methods (e.g GET) before middleware; pass metric with method label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown method. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the method label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods.

Publish Date: 2022-02-15

URL: CVE-2022-21698

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cg3q-j54f-5p7p

Release Date: 2022-02-15

Fix Resolution: v1.11.1

[Bug] Maru Spike Test Corrupts AWS RDS Postgresql DB

What are you really trying to do?

I'm trying to benchmark different AWS RDS database types to choose the best one for my workflows based on cost and efficiency.

Describe the bug

When running the example basic-spike test scenario, the first hundred or so are completed successfully but part way through the test the rest of the workflows fail. The worker produces the error: Unable to complete Workflow context deadline exceeded.

I completed and ran the basic-test scenario with no issues. However, once receiving the "workflow context deadline exceeded" error after the spike test, temporal can no longer run any workflows. The only fix I have is to destroy the database and rebuild it again.

The worker produces the following error:
2022-07-21T16:22:51.873Z ERROR bench/driver_activity.go:44 failed to start workflow {"Namespace": "default", "TaskQueue": "temporal-bench", "WorkerID": "17118@ip-10-1-0-243@", "ActivityID":"18", "ActivityType": "bench-DriverActivity", "Attempt": 1, "WorkflowType": "bench-workflow", "WorkflowID": "3", "RunID": "832874bc-8eb1-4cde-b592-04f621767bc6", "Error": "context deadline exceeded", "ID": "basic-workflow-3-1-7-76"} [github.com/temporalio/maru/bench.(*Activities).DriverActivity](http://github.com/temporalio/maru/bench.(*Activities).DriverActivity) /home/ec2-user/maru/worker/bench/driver_activity.go:44 reflect.Value.call /usr/local/go/src/reflect/value.go:556 reflect.Value.Call /usr/local/go/src/reflect/value.go:339 [go.temporal.io/sdk/internal.(*activityExecutor).Execute](http://go.temporal.io/sdk/internal.(*activityExecutor).Execute) /home/ec2-user/go/pkg/mod/go.temporal.io/[email protected]/internal/internal_worker.go:777 [go.temporal.io/sdk/internal.(*activityTaskHandlerImpl).Execute](http://go.temporal.io/sdk/internal.(*activityTaskHandlerImpl).Execute) /home/ec2-user/go/pkg/mod/go.temporal.io/[email protected]/internal/internal_task_handlers.go:1816 [go.temporal.io/sdk/internal.(*activityTaskPoller).ProcessTask](http://go.temporal.io/sdk/internal.(*activityTaskPoller).ProcessTask) /home/ec2-user/go/pkg/mod/go.temporal.io/[email protected]/internal/internal_task_pollers.go:875 [go.temporal.io/sdk/internal.(*baseWorker).processTask](http://go.temporal.io/sdk/internal.(*baseWorker).processTask) /home/ec2-user/go/pkg/mod/go.temporal.io/[email protected]/internal/internal_worker_base.go:343

The worker pod produces:
error starting temporal-sys-tq-scanner-workflow workflow","service":"worker","error":"context deadline exceeded

The frontend pod log has this message:
history client encountered error","service":"frontend","error":"Not enough hosts to serve the request"

The history pod has these messages:
Operation failed with internal error.","error":"GetWorkflowExecution: failed to get activity info. Error: Failed to get activity info. Error: context deadline exceeded"
{"level":"error","ts":"2022-07-21T14:30:42.102Z","msg":"Persistent fetch operation Failure","shard-id":110,"address":"10.1.1.61:7234","wf-namespace-id":"88830a6d-8ab6-4a0a-984c-e0065eb5b491","wf-id":"basic-workflow-3-1-6-47","wf-run-id":"dde13770-a4c5-45f3-af29-9317be21f78a","store-operation":"get-wf-execution","error":"context deadline exceeded","logging-call-at":"transaction_impl.go:489","stacktrace":"[go.temporal.io/server/common/log.(*zapLogger).Error](http://go.temporal.io/server/common/log.(*zapLogger).Error)\n\t/home/builder/temporal/common/log/zap_logger.go:142\[ngo.temporal.io/server/service/history/workflow.getWorkflowExecutionWithRetry](http://ngo.temporal.io/server/service/history/workflow.getWorkflowExecutionWithRetry)\n\t/home/builder/temporal/service/history/workflow/transaction_impl.go:489\[ngo.temporal.io/server/service/history/workflow.(*ContextImpl).LoadWorkflowExecution](http://ngo.temporal.io/server/service/history/workflow.(*ContextImpl).LoadWorkflowExecution)\n\t/home/builder/temporal/service/history/workflow/context.go:274\[ngo.temporal.io/server/service/history.LoadMutableStateForTask](http://ngo.temporal.io/server/service/history.LoadMutableStateForTask)\n\t/home/builder/temporal/service/history/nDCTaskUtil.go:142\[ngo.temporal.io/server/service/history.loadMutableStateForTransferTask](http://ngo.temporal.io/server/service/history.loadMutableStateForTransferTask)\n\t/home/builder/temporal/service/history/nDCTaskUtil.go:79\[ngo.temporal.io/server/service/history.(*transferQueueActiveTaskExecutor).processWorkflowTask](http://ngo.temporal.io/server/service/history.(*transferQueueActiveTaskExecutor).processWorkflowTask)\n\t/home/builder/temporal/service/history/transferQueueActiveTaskExecutor.go:199\[ngo.temporal.io/server/service/history.(*transferQueueActiveTaskExecutor).Execute](http://ngo.temporal.io/server/service/history.(*transferQueueActiveTaskExecutor).Execute)\n\t/home/builder/temporal/service/history/transferQueueActiveTaskExecutor.go:129\[ngo.temporal.io/server/service/history/queues.(*executorWrapper).Execute](http://ngo.temporal.io/server/service/history/queues.(*executorWrapper).Execute)\n\t/home/builder/temporal/service/history/queues/executor_wrapper.go:67\[ngo.temporal.io/server/service/history/queues.(*executableImpl).Execute](http://ngo.temporal.io/server/service/history/queues.(*executableImpl).Execute)\n\t/home/builder/temporal/service/history/queues/executable.go:161\[ngo.temporal.io/server/common/tasks.(*ParallelProcessor).executeTask.func1](http://ngo.temporal.io/server/common/tasks.(*ParallelProcessor).executeTask.func1)\n\t/home/builder/temporal/common/tasks/parallel_processor.go:207\[ngo.temporal.io/server/common/backoff.ThrottleRetry.func1](http://ngo.temporal.io/server/common/backoff.ThrottleRetry.func1)\n\t/home/builder/temporal/common/backoff/retry.go:166\[ngo.temporal.io/server/common/backoff.ThrottleRetryContext](http://ngo.temporal.io/server/common/backoff.ThrottleRetryContext)\n\t/home/builder/temporal/common/backoff/retry.go:190\[ngo.temporal.io/server/common/backoff.ThrottleRetry](http://ngo.temporal.io/server/common/backoff.ThrottleRetry)\n\t/home/builder/temporal/common/backoff/retry.go:167\[ngo.temporal.io/server/common/tasks.(*ParallelProcessor).executeTask](http://ngo.temporal.io/server/common/tasks.(*ParallelProcessor).executeTask)\n\t/home/builder/temporal/common/tasks/parallel_processor.go:217\[ngo.temporal.io/server/common/tasks.(*ParallelProcessor).processTask](http://ngo.temporal.io/server/common/tasks.(*ParallelProcessor).processTask)\n\t/home/builder/temporal/common/tasks/parallel_processor.go:195"} {"level":"error","ts":"2022-07-21T14:30:42.102Z","msg":"Fail to process task","shard-id":110,"address":"10.1.1.61:7234","component":"transfer-queue-processor","cluster-name":"active","wf-namespace-id":"88830a6d-8ab6-4a0a-984c-e0065eb5b491","wf-id":"basic-workflow-3-1-6-47","wf-run-id":"dde13770-a4c5-45f3-af29-9317be21f78a","queue-task-id":1048588,"queue-task-visibility-timestamp":"2022-07-21T11:38:25.376Z","queue-task-type":"TransferWorkflowTask","queue-task":{"NamespaceID":"88830a6d-8ab6-4a0a-984c-e0065eb5b491","WorkflowID":"basic-workflow-3-1-6-47","RunID":"dde13770-a4c5-45f3-af29-9317be21f78a","VisibilityTimestamp":"2022-07-21T11:38:25.376757699Z","TaskID":1048588,"TaskQueue":"temporal-basic","ScheduledEventID":2,"Version":0},"wf-history-event-id":2,"error":"context deadline exceeded","lifecycle":"ProcessingFailed","logging-call-at":"lazy_logger.go:68","stacktrace":"[go.temporal.io/server/common/log.(*zapLogger).Error](http://go.temporal.io/server/common/log.(*zapLogger).Error)\n\t/home/builder/temporal/common/log/zap_logger.go:142\[ngo.temporal.io/server/common/log.(*lazyLogger).Error](http://ngo.temporal.io/server/common/log.(*lazyLogger).Error)\n\t/home/builder/temporal/common/log/lazy_logger.go:68\[ngo.temporal.io/server/service/history/queues.(*executableImpl).HandleErr](http://ngo.temporal.io/server/service/history/queues.(*executableImpl).HandleErr)\n\t/home/builder/temporal/service/history/queues/executable.go:231\[ngo.temporal.io/server/common/tasks.(*ParallelProcessor).executeTask.func1](http://ngo.temporal.io/server/common/tasks.(*ParallelProcessor).executeTask.func1)\n\t/home/builder/temporal/common/tasks/parallel_processor.go:208\[ngo.temporal.io/server/common/backoff.ThrottleRetry.func1](http://ngo.temporal.io/server/common/backoff.ThrottleRetry.func1)\n\t/home/builder/temporal/common/backoff/retry.go:166\[ngo.temporal.io/server/common/backoff.ThrottleRetryContext](http://ngo.temporal.io/server/common/backoff.ThrottleRetryContext)\n\t/home/builder/temporal/common/backoff/retry.go:190\[ngo.temporal.io/server/common/backoff.ThrottleRetry](http://ngo.temporal.io/server/common/backoff.ThrottleRetry)\n\t/home/builder/temporal/common/backoff/retry.go:167\[ngo.temporal.io/server/common/tasks.(*ParallelProcessor).executeTask](http://ngo.temporal.io/server/common/tasks.(*ParallelProcessor).executeTask)\n\t/home/builder/temporal/common/tasks/parallel_processor.go:217\[ngo.temporal.io/server/common/tasks.(*ParallelProcessor).processTask](http://ngo.temporal.io/server/common/tasks.(*ParallelProcessor).processTask)\n\t/home/builder/temporal/common/tasks/parallel_processor.go:195"}

The RDS log is here:
2022-07-21 16:07:51 UTC::@:[9698]:LOG: received SIGHUP, reloading configuration files 2022-07-21 16:07:51 UTC::@:[9698]:LOG: skipping missing configuration file "/rdsdbdata/config/recovery.conf" 2022-07-21 16:07:51 UTC::@:[9698]:LOG: skipping missing configuration file "/rdsdbdata/db/postgresql.auto.conf" 2022-07-21 16:07:51 UTC::@:[9698]:LOG: parameter "unix_socket_permissions" cannot be changed without restarting the server 2022-07-21 16:07:51 UTC::@:[9698]:LOG: configuration file "/rdsdbdata/config/postgresql.conf" contains errors; unaffected changes were applied 2022-07-21 16:07:51 UTC::@:[9708]:LOG: skipping missing configuration file "/rdsdbdata/config/recovery.conf" 2022-07-21 16:07:51 UTC::@:[9708]:LOG: skipping missing configuration file "/rdsdbdata/db/postgresql.auto.conf" 2022-07-21 16:07:51 UTC::@:[9754]:LOG: skipping missing configuration file "/rdsdbdata/config/recovery.conf" 2022-07-21 16:07:51 UTC::@:[9754]:LOG: skipping missing configuration file "/rdsdbdata/db/postgresql.auto.conf" 2022-07-21 16:07:51 UTC::@:[9759]:LOG: skipping missing configuration file "/rdsdbdata/config/recovery.conf" 2022-07-21 16:07:51 UTC::@:[9759]:LOG: skipping missing configuration file "/rdsdbdata/db/postgresql.auto.conf" 2022-07-21 16:07:51 UTC::@:[9756]:LOG: skipping missing configuration file "/rdsdbdata/config/recovery.conf" 2022-07-21 16:07:51 UTC::@:[9756]:LOG: skipping missing configuration file "/rdsdbdata/db/postgresql.auto.conf" 2022-07-21 16:07:51 UTC::@:[9755]:LOG: skipping missing configuration file "/rdsdbdata/config/recovery.conf" 2022-07-21 16:07:51 UTC::@:[9755]:LOG: skipping missing configuration file "/rdsdbdata/db/postgresql.auto.conf" 2022-07-21 16:07:51 UTC::@:[9758]:LOG: skipping missing configuration file "/rdsdbdata/config/recovery.conf" 2022-07-21 16:07:51 UTC::@:[9758]:LOG: skipping missing configuration file "/rdsdbdata/db/postgresql.auto.conf" 2022-07-21 16:07:51 UTC::@:[9699]:LOG: skipping missing configuration file "/rdsdbdata/config/recovery.conf" 2022-07-21 16:07:51 UTC::@:[9699]:LOG: skipping missing configuration file "/rdsdbdata/db/postgresql.auto.conf" 2022-07-21 16:07:51 UTC::@:[9757]:LOG: skipping missing configuration file "/rdsdbdata/config/recovery.conf" 2022-07-21 16:07:51 UTC::@:[9757]:LOG: skipping missing configuration file "/rdsdbdata/db/postgresql.auto.conf" 2022-07-21 16:07:51 UTC::@:[9760]:LOG: skipping missing configuration file "/rdsdbdata/config/recovery.conf" 2022-07-21 16:07:51 UTC::@:[9760]:LOG: skipping missing configuration file "/rdsdbdata/db/postgresql.auto.conf" 2022-07-21 16:08:32 UTC:postgres@temporal:[1842]:ERROR: duplicate key value violates unique constraint "namespaces_pkey" 2022-07-21 16:08:32 UTC:postgres@temporal:[1842]:DETAIL: Key (partition_id, id)=(54321, \x32049b68787240948e63d0dd59896a83) already exists. 2022-07-21 16:08:32 UTC:postgres@temporal:[1842]:STATEMENT: INSERT INTO namespaces (partition_id, id, name, is_global, data, data_encoding, notification_version) VALUES($1, $2, $3, $4, $5, $6, $7) 2022-07-21 16:08:53 UTC:postgres@temporal:[2929]:ERROR: duplicate key value violates unique constraint "namespaces_pkey" 2022-07-21 16:08:53 UTC:postgres@temporal:[2929]:DETAIL: Key (partition_id, id)=(54321, \x32049b68787240948e63d0dd59896a83) already exists. 2022-07-21 16:08:53 UTC:postgres@temporal:[2929]:STATEMENT: INSERT INTO namespaces (partition_id, id, name, is_global, data, data_encoding, notification_version) VALUES($1, $2, $3, $4, $5, $6, $7) 2022-07-21 16:09:24 UTC:postgres@temporal:[4183]:ERROR: duplicate key value violates unique constraint "namespaces_pkey" 2022-07-21 16:09:24 UTC:postgres@temporal:[4183]:DETAIL: Key (partition_id, id)=(54321, \x32049b68787240948e63d0dd59896a83) already exists. 2022-07-21 16:09:24 UTC:postgres@temporal:[4183]:STATEMENT: INSERT INTO namespaces (partition_id, id, name, is_global, data, data_encoding, notification_version) VALUES($1, $2, $3, $4, $5, $6, $7) 2022-07-21 16:22:13 UTC::[unknown]@[unknown]:[5084]:LOG: PID 4778 in cancel request did not match any process 2022-07-21 16:30:44 UTC:[unknown]@[unknown]:[26778]:LOG: PID 26721 in cancel request did not match any process 2022-07-21 16:32:14 UTC:postgres@temporal:[4598]:LOG: unexpected EOF on client connection with an open transaction 2022-07-21 16:32:14 UTC:postgres@temporal:[26725]:LOG: unexpected EOF on client connection with an open transaction

Note the incident ran at 2022-07-21T16:22:51

Minimal Reproduction

In an EC2 instance, run the maru worker. In another session start the spike scenario with default values for the workflow type and count: tctl wf start --tq temporal-bench --wt bench-workflow --wtt 5 --et 1800 --if ./scenarios/basic-test.json --wid 1

Environment/Versions

  • Temporal Version: 1.17.1
  • Using AWS private EKS cluster (version 1.22) to deploy Temporal using the helm chart: helm install -f values/values.postgresql.yaml temporal --set elasticsearch.enabled=false . --timeout 900s
    The cluster has 5 t3.large nodes and can scale to 10
  • RDS Postgres version 13.4

Happy to provide any more information if needed :)

github.com/Prometheus/client_golang-v1.10.0: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - github.com/Prometheus/client_golang-v1.10.0

Prometheus instrumentation library for Go applications

Library home page: https://proxy.golang.org/github.com/prometheus/client_golang/@v/v1.10.0.zip

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (github.com/Prometheus/client_golang-v1.10.0 version) Remediation Available
CVE-2022-21698 High 7.5 github.com/Prometheus/client_golang-v1.10.0 Direct v1.11.1

Details

CVE-2022-21698

Vulnerable Library - github.com/Prometheus/client_golang-v1.10.0

Prometheus instrumentation library for Go applications

Library home page: https://proxy.golang.org/github.com/prometheus/client_golang/@v/v1.10.0.zip

Dependency Hierarchy:

  • github.com/Prometheus/client_golang-v1.10.0 (Vulnerable Library)

Found in base branch: master

Vulnerability Details

client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of promhttp.InstrumentHandler* middleware except RequestsInFlight; not filter any specific methods (e.g GET) before middleware; pass metric with method label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown method. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the method label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods.

Publish Date: 2022-02-15

URL: CVE-2022-21698

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cg3q-j54f-5p7p

Release Date: 2022-02-15

Fix Resolution: v1.11.1

github.com/uber-go/tally/v4-v4.1.4: 2 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - github.com/uber-go/tally/v4-v4.1.4

Library home page: https://proxy.golang.org/github.com/uber-go/tally/v4/@v/v4.1.4.zip

Found in HEAD commit: 21068b7f052867355beeab5072eccb334f46ecdd

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (github.com/uber-go/tally/v4-v4.1.4 version) Remediation Available
CVE-2019-0205 High 7.5 github.com/uber-go/tally/v4-v4.1.4 Direct org.apache.thrift:libthrift:0.13.0
CVE-2019-0210 High 7.5 github.com/uber-go/tally/v4-v4.1.4 Direct 0.13.0

Details

CVE-2019-0205

Vulnerable Library - github.com/uber-go/tally/v4-v4.1.4

Library home page: https://proxy.golang.org/github.com/uber-go/tally/v4/@v/v4.1.4.zip

Dependency Hierarchy:

  • github.com/uber-go/tally/v4-v4.1.4 (Vulnerable Library)

Found in HEAD commit: 21068b7f052867355beeab5072eccb334f46ecdd

Found in base branch: master

Vulnerability Details

In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings.

Publish Date: 2019-10-29

URL: CVE-2019-0205

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0205

Release Date: 2019-10-29

Fix Resolution: org.apache.thrift:libthrift:0.13.0

CVE-2019-0210

Vulnerable Library - github.com/uber-go/tally/v4-v4.1.4

Library home page: https://proxy.golang.org/github.com/uber-go/tally/v4/@v/v4.1.4.zip

Dependency Hierarchy:

  • github.com/uber-go/tally/v4-v4.1.4 (Vulnerable Library)

Found in HEAD commit: 21068b7f052867355beeab5072eccb334f46ecdd

Found in base branch: master

Vulnerability Details

In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data.

Publish Date: 2019-10-29

URL: CVE-2019-0210

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://mail-archives.apache.org/mod_mbox/thrift-dev/201910.mbox/%3C277A46CA87494176B1BBCF5D72624A2A%40HAGGIS%3E

Release Date: 2019-10-29

Fix Resolution: 0.13.0

Cron benchmarks

Implement a scenario to test cron-based workflows. Potentially, compare to existing benchmarks of other products (Kafka?).

kubernetes-3.1.0.tgz: 3 vulnerabilities (highest severity is: 9.8) - autoclosed

Vulnerable Library - kubernetes-3.1.0.tgz

Path to dependency file: /pulumi/bench/package.json

Path to vulnerable library: /pulumi/bench/node_modules/node-fetch/package.json,/pulumi/k8s/node_modules/node-fetch/package.json,/pulumi/temporal/node_modules/node-fetch/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (kubernetes version) Remediation Available
CVE-2021-42740 High 9.8 shell-quote-1.7.2.tgz Transitive 3.1.1
CVE-2022-3517 High 7.5 minimatch-3.0.4.tgz Transitive N/A*
CVE-2022-0235 Medium 6.1 node-fetch-2.6.1.tgz Transitive 3.12.2

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2021-42740

Vulnerable Library - shell-quote-1.7.2.tgz

quote and parse shell commands

Library home page: https://registry.npmjs.org/shell-quote/-/shell-quote-1.7.2.tgz

Path to dependency file: /pulumi/k8s/package.json

Path to vulnerable library: /pulumi/k8s/node_modules/shell-quote/package.json,/pulumi/bench/node_modules/shell-quote/package.json,/pulumi/temporal/node_modules/shell-quote/package.json

Dependency Hierarchy:

  • kubernetes-3.1.0.tgz (Root Library)
    • shell-quote-1.7.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.

Publish Date: 2021-10-21

URL: CVE-2021-42740

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42740

Release Date: 2021-10-21

Fix Resolution (shell-quote): 1.7.3

Direct dependency fix Resolution (@pulumi/kubernetes): 3.1.1

⛑️ Automatic Remediation is available for this issue

CVE-2022-3517

Vulnerable Library - minimatch-3.0.4.tgz

a glob matcher in javascript

Library home page: https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz

Path to dependency file: /pulumi/k8s/package.json

Path to vulnerable library: /pulumi/k8s/node_modules/minimatch/package.json,/pulumi/temporal/node_modules/minimatch/package.json,/pulumi/bench/node_modules/minimatch/package.json

Dependency Hierarchy:

  • kubernetes-3.1.0.tgz (Root Library)
    • glob-7.1.6.tgz
      • minimatch-3.0.4.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

Publish Date: 2022-10-17

URL: CVE-2022-3517

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-10-17

Fix Resolution: minimatch - 3.0.5

CVE-2022-0235

Vulnerable Library - node-fetch-2.6.1.tgz

A light-weight module that brings window.fetch to node.js

Library home page: https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.1.tgz

Path to dependency file: /pulumi/bench/package.json

Path to vulnerable library: /pulumi/bench/node_modules/node-fetch/package.json,/pulumi/k8s/node_modules/node-fetch/package.json,/pulumi/temporal/node_modules/node-fetch/package.json

Dependency Hierarchy:

  • kubernetes-3.1.0.tgz (Root Library)
    • node-fetch-2.6.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Publish Date: 2022-01-16

URL: CVE-2022-0235

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r683-j2x4-v87g

Release Date: 2022-01-16

Fix Resolution (node-fetch): 2.6.7

Direct dependency fix Resolution (@pulumi/kubernetes): 3.12.2

⛑️ Automatic Remediation is available for this issue


⛑️ Automatic Remediation is available for this issue.

github.com/prometheus/client_goLang-v1.10.0: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - github.com/prometheus/client_goLang-v1.10.0

Prometheus instrumentation library for Go applications

Library home page: https://proxy.golang.org/github.com/prometheus/client_golang/@v/v1.10.0.zip

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (github.com/prometheus/client_goLang-v1.10.0 version) Remediation Available
CVE-2022-21698 High 7.5 github.com/prometheus/client_goLang-v1.10.0 Direct v1.11.1

Details

CVE-2022-21698

Vulnerable Library - github.com/prometheus/client_goLang-v1.10.0

Prometheus instrumentation library for Go applications

Library home page: https://proxy.golang.org/github.com/prometheus/client_golang/@v/v1.10.0.zip

Dependency Hierarchy:

  • github.com/prometheus/client_goLang-v1.10.0 (Vulnerable Library)

Found in base branch: master

Vulnerability Details

client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of promhttp.InstrumentHandler* middleware except RequestsInFlight; not filter any specific methods (e.g GET) before middleware; pass metric with method label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown method. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the method label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods.

Publish Date: 2022-02-15

URL: CVE-2022-21698

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cg3q-j54f-5p7p

Release Date: 2022-02-15

Fix Resolution: v1.11.1

Advise on bottlenecks

Can the tool, based on the histogram stats or any other stats it may collect, tell us if we are underprovisioned on workers vs. the server is hitting resource limits?

Calculate concurrency automatically

Ideally, the user should just care about ratePerSecond and count (or duration).

Can we either eliminate the need to specify this, or give a crisp/clear definition of when this is set, what it means, and why it wasn't set on the previous example?

github.com/prometheus/Client_golang-v1.11.0: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - github.com/prometheus/Client_golang-v1.11.0

Prometheus instrumentation library for Go applications

Library home page: https://proxy.golang.org/github.com/prometheus/client_golang/@v/v1.11.0.zip

Found in HEAD commit: 21068b7f052867355beeab5072eccb334f46ecdd

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (github.com/prometheus/Client_golang-v1.11.0 version) Remediation Available
CVE-2022-21698 High 7.5 github.com/prometheus/Client_golang-v1.11.0 Direct v1.11.1

Details

CVE-2022-21698

Vulnerable Library - github.com/prometheus/Client_golang-v1.11.0

Prometheus instrumentation library for Go applications

Library home page: https://proxy.golang.org/github.com/prometheus/client_golang/@v/v1.11.0.zip

Dependency Hierarchy:

  • github.com/prometheus/Client_golang-v1.11.0 (Vulnerable Library)

Found in HEAD commit: 21068b7f052867355beeab5072eccb334f46ecdd

Found in base branch: master

Vulnerability Details

client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of promhttp.InstrumentHandler* middleware except RequestsInFlight; not filter any specific methods (e.g GET) before middleware; pass metric with method label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown method. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the method label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods.

Publish Date: 2022-02-15

URL: CVE-2022-21698

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cg3q-j54f-5p7p

Release Date: 2022-02-15

Fix Resolution: v1.11.1

go.temporal.io/sdk-v1.7.0: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - go.temporal.io/sdk-v1.7.0

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (go.temporal.io/sdk-v1.7.0 version) Remediation Available
CVE-2021-38561 High 7.5 github.com/golang/text-v0.3.6 Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2021-38561

Vulnerable Library - github.com/golang/text-v0.3.6

[mirror] Go text processing support

Library home page: https://proxy.golang.org/github.com/golang/text/@v/v0.3.6.zip

Dependency Hierarchy:

  • go.temporal.io/sdk-v1.7.0 (Root Library)
    • github.com/grpc/grpc-Go-v1.37.0
      • github.com/golang/net-v0.1.0
        • github.com/golang/text-v0.3.6 (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Due to improper index calculation, an incorrectly formatted language tag can cause Parse
to panic, due to an out of bounds read. If Parse is used to process untrusted user inputs,
this may be used as a vector for a denial of service attack.

Publish Date: 2021-08-12

URL: CVE-2021-38561

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://osv.dev/vulnerability/GO-2021-0113

Release Date: 2021-08-12

Fix Resolution: v0.3.7

Specify the test duration instead of count

It might be easier to change the scenario JSON definition to take in a specified duration instead of a count? (Or to take one or the other)? It's easier to say "run this for 5 minutes" than to have to do the math and figure out how many executions I need for a specific run.

Report "scheduled" time for Workflows

Are we also able to record "scheduled" time for Workflows too? That way we can also track the delay between scheduling a workflow and starting a workflow explicitly.

github.com/stretchr/testify-v1.7.0: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - github.com/stretchr/testify-v1.7.0

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in Remediation Available
CVE-2022-28948 High 7.5 github.com/go-yaml/yaml-496545a6307b2a7d7a710fd516e5e16e8ab62dbc Transitive N/A

Details

CVE-2022-28948

Vulnerable Library - github.com/go-yaml/yaml-496545a6307b2a7d7a710fd516e5e16e8ab62dbc

YAML support for the Go language.

Dependency Hierarchy:

  • github.com/stretchr/testify-v1.7.0 (Root Library)
    • github.com/go-yaml/yaml-496545a6307b2a7d7a710fd516e5e16e8ab62dbc (Vulnerable Library)

Found in base branch: master

Vulnerability Details

An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.

Publish Date: 2022-05-19

URL: CVE-2022-28948

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hp87-p4gw-j4gq

Release Date: 2022-05-19

Fix Resolution: 3.0.0

[Feature Request] Supply docker compose

Took me quite a while to setup this repo with docker-compose. Would be great if this was already present. Especially for the setup with Prometheus.

Not sure if the resources to run all this locally are quite high, so this is actually a valid option to run.

github.com/prometheus/client_golang-v1.10.0: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - github.com/prometheus/client_golang-v1.10.0

Prometheus instrumentation library for Go applications

Library home page: https://proxy.golang.org/github.com/prometheus/client_golang/@v/v1.10.0.zip

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in Remediation Available
CVE-2022-21698 High 7.5 github.com/prometheus/client_golang-v1.10.0 Direct v1.11.1

Details

CVE-2022-21698

Vulnerable Library - github.com/prometheus/client_golang-v1.10.0

Prometheus instrumentation library for Go applications

Library home page: https://proxy.golang.org/github.com/prometheus/client_golang/@v/v1.10.0.zip

Dependency Hierarchy:

  • github.com/prometheus/client_golang-v1.10.0 (Vulnerable Library)

Found in base branch: master

Vulnerability Details

client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of promhttp.InstrumentHandler* middleware except RequestsInFlight; not filter any specific methods (e.g GET) before middleware; pass metric with method label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown method. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the method label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods.

Publish Date: 2022-02-15

URL: CVE-2022-21698

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cg3q-j54f-5p7p

Release Date: 2022-02-15

Fix Resolution: v1.11.1

Speed up stats calculation for large runs

If it is a super-long running workflow, calculating the histogram stats could take quite a while. We might want to parallelize collecting stats as the test is running so that we don't wait until the end to collect everything, which could take a while if there are millions of workflows. However, we need to be sure not to affect the performance of the system under test.

[Bug] Helm chart refers to non-existent temporalio/maru image

Describe the bug
Maru's Helm chart refers to the temporalio/maru container image. However, that image does not exist.

Expected behavior
I would expect either for that image to exist, or to be replaced with a "stub" image name that obviously does not exist if it's expected that every consumer should build their own image.

Report state transitions

Might be worth also indicating how many "state transitions" completed when we are calculating the stats and then outputting it to the result.

Temporal server should add this counting feature to the history service. Tracked in temporalio/temporal#1352

[Bug] Does not work for workflow with multiple args

What are you really trying to do?

Trying to run a TS workflow driven by the test bench. The TS workflow has multiple arguments.

Describe the bug

I looked into the code and it uses interface{} while in the executeWorkflow function it assumes ...interface{}
When you make a config with args: [{"test":123}, {"test":123}] the workflow will be ran with 1 argument containing this array instead of the array. The args should be unpacked when input is an array.

I am not a Go developer so I don't know how to modify this best.

(Probably I will just port this code to TS anyway for easier construction / extension of the bench tests)

go.temporal.io/sdk-v1.19.0: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - go.temporal.io/sdk-v1.19.0

Found in HEAD commit: 21068b7f052867355beeab5072eccb334f46ecdd

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (go.temporal.io/sdk-v1.19.0 version) Remediation Available
CVE-2022-41721 High 7.5 golang.org/x/net-v0.1.0 Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2022-41721

Vulnerable Library - golang.org/x/net-v0.1.0

[mirror] Go supplementary network libraries

Library home page: https://proxy.golang.org/golang.org/x/net/@v/v0.1.0.zip

Dependency Hierarchy:

  • go.temporal.io/sdk-v1.19.0 (Root Library)
    • google.golang.org/grpc-v1.50.1
      • golang.org/x/net-v0.1.0 (Vulnerable Library)

Found in HEAD commit: 21068b7f052867355beeab5072eccb334f46ecdd

Found in base branch: master

Vulnerability Details

A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.

Publish Date: 2023-01-13

URL: CVE-2022-41721

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-01-13

Fix Resolution: v0.2.0

pulumi-3.1.0.tgz: 9 vulnerabilities (highest severity is: 9.8) - autoclosed

Vulnerable Library - pulumi-3.1.0.tgz

Path to dependency file: /pulumi/bench/package.json

Path to vulnerable library: /pulumi/k8s/node_modules/path-parse/package.json,/pulumi/bench/node_modules/path-parse/package.json,/pulumi/temporal/node_modules/path-parse/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (pulumi version) Remediation Available
CVE-2021-44906 High 9.8 minimist-1.2.5.tgz Transitive 3.35.3
CVE-2022-25878 High 7.5 protobufjs-6.10.1.tgz Transitive 3.2.0
CVE-2022-24772 High 7.5 node-forge-0.10.0.tgz Transitive 3.2.0
CVE-2022-24771 High 7.5 node-forge-0.10.0.tgz Transitive 3.2.0
CVE-2021-23343 High 7.5 path-parse-1.0.6.tgz Transitive 3.2.0
WS-2022-0008 Medium 6.6 node-forge-0.10.0.tgz Transitive 3.2.0
CVE-2022-0122 Medium 6.1 node-forge-0.10.0.tgz Transitive 3.2.0
CVE-2021-23362 Medium 5.3 hosted-git-info-2.8.8.tgz Transitive 3.2.0
CVE-2022-24773 Medium 5.3 node-forge-0.10.0.tgz Transitive 3.2.0

Details

CVE-2021-44906

Vulnerable Library - minimist-1.2.5.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz

Path to dependency file: /pulumi/k8s/package.json

Path to vulnerable library: /pulumi/k8s/node_modules/minimist/package.json,/pulumi/bench/node_modules/minimist/package.json,/pulumi/temporal/node_modules/minimist/package.json

Dependency Hierarchy:

  • pulumi-3.1.0.tgz (Root Library)
    • minimist-1.2.5.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Publish Date: 2022-03-17

URL: CVE-2021-44906

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-03-17

Fix Resolution (minimist): 1.2.6

Direct dependency fix Resolution (@pulumi/pulumi): 3.35.3

⛑️ Automatic Remediation is available for this issue

CVE-2022-25878

Vulnerable Library - protobufjs-6.10.1.tgz

Protocol Buffers for JavaScript (& TypeScript).

Library home page: https://registry.npmjs.org/protobufjs/-/protobufjs-6.10.1.tgz

Path to dependency file: /pulumi/temporal/package.json

Path to vulnerable library: /pulumi/temporal/node_modules/protobufjs/package.json,/pulumi/bench/node_modules/protobufjs/package.json,/pulumi/k8s/node_modules/protobufjs/package.json

Dependency Hierarchy:

  • pulumi-3.1.0.tgz (Root Library)
    • protobufjs-6.10.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by parsing/loading .proto files

Publish Date: 2022-05-27

URL: CVE-2022-25878

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25878

Release Date: 2022-05-27

Fix Resolution (protobufjs): 6.10.3

Direct dependency fix Resolution (@pulumi/pulumi): 3.2.0

⛑️ Automatic Remediation is available for this issue

CVE-2022-24772

Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /pulumi/k8s/package.json

Path to vulnerable library: /pulumi/k8s/node_modules/node-forge/package.json,/pulumi/bench/node_modules/node-forge/package.json,/pulumi/temporal/node_modules/node-forge/package.json

Dependency Hierarchy:

  • pulumi-3.1.0.tgz (Root Library)
    • grpc-js-1.2.8.tgz
      • google-auth-library-6.1.6.tgz
        • gtoken-5.2.1.tgz
          • google-p12-pem-3.0.3.tgz
            • node-forge-0.10.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24772

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24772

Release Date: 2022-03-18

Fix Resolution (node-forge): 1.3.0

Direct dependency fix Resolution (@pulumi/pulumi): 3.2.0

⛑️ Automatic Remediation is available for this issue

CVE-2022-24771

Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /pulumi/k8s/package.json

Path to vulnerable library: /pulumi/k8s/node_modules/node-forge/package.json,/pulumi/bench/node_modules/node-forge/package.json,/pulumi/temporal/node_modules/node-forge/package.json

Dependency Hierarchy:

  • pulumi-3.1.0.tgz (Root Library)
    • grpc-js-1.2.8.tgz
      • google-auth-library-6.1.6.tgz
        • gtoken-5.2.1.tgz
          • google-p12-pem-3.0.3.tgz
            • node-forge-0.10.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24771

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24771

Release Date: 2022-03-18

Fix Resolution (node-forge): 1.3.0

Direct dependency fix Resolution (@pulumi/pulumi): 3.2.0

⛑️ Automatic Remediation is available for this issue

CVE-2021-23343

Vulnerable Library - path-parse-1.0.6.tgz

Node.js path.parse() ponyfill

Library home page: https://registry.npmjs.org/path-parse/-/path-parse-1.0.6.tgz

Path to dependency file: /pulumi/k8s/package.json

Path to vulnerable library: /pulumi/k8s/node_modules/path-parse/package.json,/pulumi/bench/node_modules/path-parse/package.json,/pulumi/temporal/node_modules/path-parse/package.json

Dependency Hierarchy:

  • pulumi-3.1.0.tgz (Root Library)
    • normalize-package-data-2.5.0.tgz
      • resolve-1.18.1.tgz
        • path-parse-1.0.6.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

Publish Date: 2021-05-04

URL: CVE-2021-23343

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-05-04

Fix Resolution (path-parse): 1.0.7

Direct dependency fix Resolution (@pulumi/pulumi): 3.2.0

⛑️ Automatic Remediation is available for this issue

WS-2022-0008

Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /pulumi/k8s/package.json

Path to vulnerable library: /pulumi/k8s/node_modules/node-forge/package.json,/pulumi/bench/node_modules/node-forge/package.json,/pulumi/temporal/node_modules/node-forge/package.json

Dependency Hierarchy:

  • pulumi-3.1.0.tgz (Root Library)
    • grpc-js-1.2.8.tgz
      • google-auth-library-6.1.6.tgz
        • gtoken-5.2.1.tgz
          • google-p12-pem-3.0.3.tgz
            • node-forge-0.10.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The forge.debug API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs in a vulnerable way.

Publish Date: 2022-01-08

URL: WS-2022-0008

CVSS 3 Score Details (6.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5rrq-pxf6-6jx5

Release Date: 2022-01-08

Fix Resolution (node-forge): 1.0.0

Direct dependency fix Resolution (@pulumi/pulumi): 3.2.0

⛑️ Automatic Remediation is available for this issue

CVE-2022-0122

Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /pulumi/k8s/package.json

Path to vulnerable library: /pulumi/k8s/node_modules/node-forge/package.json,/pulumi/bench/node_modules/node-forge/package.json,/pulumi/temporal/node_modules/node-forge/package.json

Dependency Hierarchy:

  • pulumi-3.1.0.tgz (Root Library)
    • grpc-js-1.2.8.tgz
      • google-auth-library-6.1.6.tgz
        • gtoken-5.2.1.tgz
          • google-p12-pem-3.0.3.tgz
            • node-forge-0.10.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

forge is vulnerable to URL Redirection to Untrusted Site

Publish Date: 2022-01-06

URL: CVE-2022-0122

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gf8q-jrpm-jvxq

Release Date: 2022-01-06

Fix Resolution (node-forge): 1.0.0

Direct dependency fix Resolution (@pulumi/pulumi): 3.2.0

⛑️ Automatic Remediation is available for this issue

CVE-2021-23362

Vulnerable Library - hosted-git-info-2.8.8.tgz

Provides metadata and conversions from repository urls for Github, Bitbucket and Gitlab

Library home page: https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-2.8.8.tgz

Path to dependency file: /pulumi/bench/package.json

Path to vulnerable library: /pulumi/bench/node_modules/hosted-git-info/package.json,/pulumi/temporal/node_modules/hosted-git-info/package.json,/pulumi/k8s/node_modules/hosted-git-info/package.json

Dependency Hierarchy:

  • pulumi-3.1.0.tgz (Root Library)
    • normalize-package-data-2.5.0.tgz
      • hosted-git-info-2.8.8.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

Publish Date: 2021-03-23

URL: CVE-2021-23362

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-43f8-2h32-f4cj

Release Date: 2021-03-23

Fix Resolution (hosted-git-info): 2.8.9

Direct dependency fix Resolution (@pulumi/pulumi): 3.2.0

⛑️ Automatic Remediation is available for this issue

CVE-2022-24773

Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /pulumi/k8s/package.json

Path to vulnerable library: /pulumi/k8s/node_modules/node-forge/package.json,/pulumi/bench/node_modules/node-forge/package.json,/pulumi/temporal/node_modules/node-forge/package.json

Dependency Hierarchy:

  • pulumi-3.1.0.tgz (Root Library)
    • grpc-js-1.2.8.tgz
      • google-auth-library-6.1.6.tgz
        • gtoken-5.2.1.tgz
          • google-p12-pem-3.0.3.tgz
            • node-forge-0.10.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check DigestInfo for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24773

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24773

Release Date: 2022-03-18

Fix Resolution (node-forge): 1.3.0

Direct dependency fix Resolution (@pulumi/pulumi): 3.2.0

⛑️ Automatic Remediation is available for this issue


⛑️ Automatic Remediation is available for this issue.

Configure input and output data size

Both target activities and workflows should have configurable input and output sizes.

It would be great to support payload size distribution: something like average size 10k with 0.1% up to 1 MB.

Implement non-constant load profiles

We should be able to test with a spike load, e.g. have some constant low load and the spike to higher values for a while, then back to low again

[Bug] helm chart - No activities registered. Skipping activity worker start

Describe the bug

Deploying the helm chart to the same kubernetes namespace as my temporal installation produces the following error:

No workflows registered. Skipping workflow worker start

INFO	cmd/main.go:57	Zap logger created
INFO	cmd/main.go:131	'NAMESPACE' env variable read as 'benchtest'
INFO	cmd/main.go:131	'FRONTEND_ADDRESS' env variable read as 'temporal-frontend:7233'
INFO	cmd/main.go:144	'SKIP_NAMESPACE_CREATION' env variable set to 'false'
INFO	cmd/main.go:128	'TLS_CA_CERT_DATA' env variable not set, defaulting to ''
INFO	cmd/main.go:128	'TLS_CLIENT_CERT_DATA' env variable not set, defaulting to ''
INFO	cmd/main.go:128	'TLS_CLIENT_CERT_PRIVATE_KEY_DATA' env variable not set, defaulting to ''
INFO	cmd/main.go:128	'TLS_CA_CERT_FILE' env variable not set, defaulting to ''
INFO	cmd/main.go:128	'TLS_CLIENT_CERT_FILE' env variable not set, defaulting to ''
INFO	cmd/main.go:128	'TLS_CLIENT_CERT_PRIVATE_KEY_FILE' env variable not set, defaulting to ''
INFO	cmd/main.go:144	'TLS_ENABLE_HOST_VERIFICATION' env variable set to 'false'
INFO	cmd/main.go:159	'STICKY_CACHE_SIZE' env variable not set, defaulting to '2048'
INFO	cmd/main.go:78	Creating namespace	{"namespace": "benchtest", "hostPort": "temporal-frontend:7233"}
INFO	cmd/main.go:104	Namespace created
INFO	cmd/main.go:131	'RUN_WORKERS' env variable read as 'bench,basic,basic-act'
INFO	cmd/main.go:240	Using env config for NUM_DECISION_POLLERS	{"NUM_DECISION_POLLERS": 50}
INFO	cmd/main.go:212	Started Worker	{"Namespace": "benchtest", "TaskQueue": "temporal-bench", "WorkerID": "1@temporal-bench-7dbbd6855c-xc4jx@"}
INFO	cmd/main.go:240	Using env config for NUM_DECISION_POLLERS	{"NUM_DECISION_POLLERS": 50}
DEBUG	cmd/main.go:212	No activities registered. Skipping activity worker start	{"Namespace": "benchtest", "TaskQueue": "temporal-basic", "WorkerID": "1@temporal-bench-7dbbd6855c-xc4jx@"}
INFO	cmd/main.go:212	Started Worker	{"Namespace": "benchtest", "TaskQueue": "temporal-basic", "WorkerID": "1@temporal-bench-7dbbd6855c-xc4jx@"}
INFO	cmd/main.go:240	Using env config for NUM_DECISION_POLLERS	{"NUM_DECISION_POLLERS": 50}
DEBUG	cmd/main.go:212	No workflows registered. Skipping workflow worker start	{"Namespace": "benchtest", "TaskQueue": "temporal-basic-act", "WorkerID": "1@temporal-bench-7dbbd6855c-xc4jx@"}
INFO	cmd/main.go:212	Started Worker	{"Namespace": "benchtest", "TaskQueue": "temporal-basic-act", "WorkerID": "1@temporal-bench-7dbbd6855c-xc4jx@"}

To Reproduce

  1. Clone repo
  2. Run helm install temporal-bench helm-chart/
  3. Check Logs

Expected behavior

I would expect each activity to run given it is registered in the constructXXXWorker functions

func constructBenchWorker(ctx context.Context, serviceClient client.Client, logger *zap.Logger, taskQueue string) worker.Worker {
	w := worker.New(serviceClient, taskQueue, buildWorkerOptions(ctx, logger))
	w.RegisterWorkflowWithOptions(bench.Workflow, workflow.RegisterOptions{Name: "bench-workflow"})
	w.RegisterActivityWithOptions(bench.NewActivities(serviceClient), activity.RegisterOptions{Name: "bench-"})
	return w
}

Document TLS support

Document how to configure the bench to use TLS to connect to a Temporal cluster

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.