Fix/credential reset on 401#17
Open
etgraylog wants to merge 10 commits into
Open
Conversation
5 tasks
Removes the signing key, signing certificate, and encryption key files from the keys directory. Missing files are silently skipped so the function is safe to call even when only some credentials exist.
Removes the instance UID file from the persistence directory. Missing file is silently skipped so the call is safe even when the instance has never been persisted.
Opt-in flag that, when true, causes the supervisor to clear all persisted credentials and exit on a 401 rejection so the service manager can trigger fresh enrollment. Defaults to false so existing deployments are unaffected.
Delegates to persistence.ClearCredentials to remove key and cert files from disk, then clears the in-memory signing key and certificate so IsEnrolled returns false immediately after the call.
exitFn defaults to os.Exit and is overridable in tests. handleAuthRejection detects 401 errors from OnConnectFailed and, when the supervisor is already enrolled and reset_on_auth_rejection is enabled, clears all persisted credentials (keys, cert, instance UID, own_logs) before calling exitFn(1) so the service manager can trigger fresh enrollment.
Calls handleAuthRejection after logging each connect failure so that sustained 401 responses from an enrolled supervisor trigger the credential-reset-and-exit path when reset_on_auth_rejection is set.
TestHandleAuthRejection_GatedByConfig covers six gate scenarios: enabled/disabled flag × enrolled/not × 401/non-401 error and nil. TestHandleAuthRejection_ClearsPersistentState verifies that when all gates pass, signing.key, signing.crt, and identity.yaml are removed from disk and exitFn is called with code 1.
etgraylog
force-pushed
the
fix/credential-reset-on-401
branch
from
June 30, 2026 04:55
82d9506 to
030cf6e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Notes for Reviewers
This PR supercedes PR Graylog2/collector-sidecar#545 to resolve issue #14 .
Summary
auth.reset_on_auth_rejectionconfig flag (defaultfalse) toAuthConfighandleAuthRejectionmethod called fromOnConnectFaileddetects 401 on an already-enrolled supervisor and clears all persisted state before exiting with code 1, allowing the service manager to trigger a fresh enrollmentpersistence.ClearCredentials), instance UID (persistence.ClearInstanceUID), own-logs settings (ownLogsPersistence.Delete)false(the default), behavior is identical to stock — 401 is logged and polling continuesauth.Manager.ClearCredentials()added as a thin wrapper that removes the key/cert files and drops the in-memory cached credentials soIsEnrolled()returns false immediatelyTest plan
go test ./superv/supervisor/ -run TestHandleAuthRejectionpasses (6 gate scenarios + persistent-state cleanup test)Deploy with
reset_on_auth_rejection: true, delete the server-side collector record via the Graylog API, confirm the supervisor exits on the next 401 and re-enrolls with a fresh UID on restartDeploy with
reset_on_auth_rejection: false(default), confirm 401 is logged and the process keeps running without exitingThe commit history must be preserved - please use the rebase-merge or standard merge option instead of squash-merge
Sync up with the author before merging