Uploaded image for project: 'Project Quay'
  1. Project Quay
  2. PROJQUAY-5117

Quay calls LDAP on robot account login

    XMLWordPrintable

Details

    • False
    • None
    • False
    • Quay Enterprise
    • 0

    Description

      If LDAP is set to be the auth backend, Quay will call it for both robot accounts and normal users. This was not hapenning before and it causes issues with LDAP setups that users have. For instance:

      ~/cases/inspect.local.8644177555356832513/namespaces/quay/pods# grep -i "incoming user" -rn jhb01-quay-app-78d4cfc89b-* |  cut -d "'" -f2 | sort | uniq -c
         1611 apps+mirror
      
      ~/cases/inspect.local.8644177555356832513/namespaces/quay/pods# grep -i "apps+mirror" -rn jhb01-quay-app-78d4cfc89b-* | grep "GET /v2/auth" | grep -i "skopeo" | wc -l
      3222
      

      3222 requests because we log both gunicorn-registry and nginx responses when debug logs are turned on which means exactly 1611 requests, as the previous log would suggest. This number of 1611 requests happened across a span of 3 minutes, which indicates that around 32k requests are made per hour.

      This causes disruptions in LDAP functioning. Please check!

      Attachments

        Activity

          People

            sleesinc Kenny Lee Sin Cheong
            rhn-support-ibazulic Ivan Bazulic
            Votes:
            0 Vote for this issue
            Watchers:
            8 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: