trafficserver
trafficserver copied to clipboard
expired s3_auth token -- improve logging
In the s3_auth plugin for v4 signatures, there is an undocumented feature that allows for an expiration configuration. The plugin goes through considerable effort to reload a nearly expired token (https://github.com/apache/trafficserver/blob/6e00344df420db067e2b3cddbe8a7a48b7559700/plugins/s3_auth/s3_auth.cc#L1037), but is largely silent about doing so, which hampers operational ability to detect and remediate the issue. I'd suggest:
- In the cases mentioned in code comments (1 hour before, 15min before, and at expiration) logging that the token is about to expire as more than debug level.
- the log should have the token's name so that an operator can find the specific issue
- there appears to be an error log printed ~10min after the token has expired. I think it would be appropriate to continue logging every 10 times -- eg, https://github.com/apache/trafficserver/blob/6e00344df420db067e2b3cddbe8a7a48b7559700/plugins/s3_auth/s3_auth.cc#L1084 instead of "==10", perhaps s3->incr_conf_reload_count() % 10 == 0