THREESCALE-8006 fix(oidc): set request timeout for OIDC query

[tkan145]

What

Fix https://redhat.atlassian.net/browse/THREESCALE-8006

Verification steps

• Checkout this branch
• Build new runtime image

make runtime-image IMAGE_NAME=apicast-test 

• Get inside dev-env

cd dev-environments/keycloak-env/

• Modify docker-compose.yml as follow

diff --git a/dev-environments/keycloak-env/docker-compose.yml b/dev-environments/keycloak-env/docker-compose.yml
index 3af7e33f..7083fc81 100644
--- a/dev-environments/keycloak-env/docker-compose.yml
+++ b/dev-environments/keycloak-env/docker-compose.yml
@@ -9,13 +9,15 @@ services:
     - example.com
     - two.upstream
     - keycloak
+    - keycloak.upstream
     environment:
       THREESCALE_CONFIG_FILE: /tmp/config.json
       THREESCALE_DEPLOYMENT_ENV: staging
-      APICAST_CONFIGURATION_LOADER: lazy
+      APICAST_CONFIGURATION_LOADER: boot
       APICAST_WORKERS: 1
       APICAST_LOG_LEVEL: debug
-      APICAST_CONFIGURATION_CACHE: "0"
+      APICAST_CONFIGURATION_CACHE: "300"
     expose:
       - "8080"
       - "8090"
@@ -36,8 +38,19 @@ services:
     expose:
       - "8080"
   keycloak:
-    image: quay.io/keycloak/keycloak:23.0.4
+    image: quay.io/openshift-logging/alpine-socat:1.8.0.0
     container_name: keycloak
+    command:
+      - "-d"
+      - "-v"
+      - "-d"
+      - "TCP-LISTEN:8080,reuseaddr,fork"
+      - 'SYSTEM:sleep 30 && exec socat - TCP\:keycloak.upstream\:8080'
+    expose:
+      - "8080"
+    restart: unless-stopped
+  keycloak.upstream:
+    image: quay.io/keycloak/keycloak:23.0.4
     command: "start-dev"
     expose:
       - "8080"

• Start the gateway

make gateway IMAGE_NAME=apicast-test

You should see the gateway hang for 5s then start as normal

• Stop the gateway

CTRL-L

• Add APICAST_OIDC_CONNECT_TIMEOUT: "20" to docker-compose file
• Start the gateway again, this time it should wait for 20s

[borisurbanik]

There is one gotcha here that needs a fix. Because remote_v2 is loading oidc on its own, the oidc loader is only used when local-file configuration is provided. The remote_v2 loader bypasses resty/oidc/discovery.new (see the custom client here

APIcast/gateway/src/apicast/configuration_loader/remote_v2.lua

Lines 35 to 41 in 1b0032e

	local http_client = http_ng.new{
	backend = opts.client,
	options = {
	headers = { ['User-Agent'] = user_agent() },
	ssl = { verify = resty_env.enabled('OPENSSL_VERIFY') }
	}
	}

).

[borisurbanik]

in the error log message - the discovery method returns nil on error, I think you meant to log err here instead of result

[tkan145]

fixed

[borisurbanik]

There is no functionality implemented to leave or check that there was a timeout error during configuration loading. Once it times out here that service will simply fail on JWT verification later.

I'm assuming that's intentional? Or should we make sure there will be some lazy loading for the failing services later? The JIRA was open to address an oidc service that never loads so it's probably intentional, just wanted to confirm.

[tkan145]

It's designed this way; there's no need to retry the OIDC configuration on every request, which would only add unnecessary latency. APIcast will reload the configuration every 5 minutes or so, and then reload the entire OIDC anyway.

[tkan145]

There is one gotcha here that needs a fix. Because remote_v2 is loading oidc on its own, the oidc loader is only used when local-file configuration is provided. The remote_v2 loader bypasses resty/oidc/discovery.new (see the custom client here

Good catch, fixed. Thanks