[DO NOT REVIEW] MSI V2 #5001
[DO NOT REVIEW] MSI V2 #5001
Conversation
| /// <summary> | ||
| /// Resets the cached managed identity source. Used only for testing purposes. | ||
| /// </summary> | ||
| internal static void ResetManagedIdentitySourceCache() |
There was a problem hiding this comment.
I think this will need to be made public for Azure SDK to test. And it'd be better to have a "ResetStaticCaches" general API, like our tests currently do, which reset everything.
There was a problem hiding this comment.
i.e. see the logic in TestCommon.ResetInternalStaticCaches();
| @@ -30,6 +30,9 @@ public class ServiceFabricTests | |||
| public void TestInitialize() | |||
| { | |||
| TestCommon.ResetInternalStaticCaches(); | |||
There was a problem hiding this comment.
The TestBase class already calls TestCommon.ResetInternalStaticCaches();
| @@ -37,6 +37,13 @@ public class ManagedIdentityTests : TestBase | |||
| internal const string ExpectedErrorCode = "ErrorCode"; | |||
| internal const string ExpectedCorrelationId = "Some GUID"; | |||
|
|
|||
| [TestInitialize] | |||
There was a problem hiding this comment.
See TestCommon.ResetInternalStaticCaches() - just include it it there.
src/client/Microsoft.Identity.Client/ManagedIdentity/ImdsCredentialProbeManager.cs
Outdated
Show resolved
Hide resolved
src/client/Microsoft.Identity.Client/ManagedIdentity/ImdsCredentialProbeManager.cs
Outdated
Show resolved
Hide resolved
src/client/Microsoft.Identity.Client/ManagedIdentity/ImdsCredentialProbeManager.cs
Outdated
Show resolved
Hide resolved
| private const string ProbeBody = "."; | ||
| private const string ImdsHeader = "IMDS/"; | ||
| private static readonly SemaphoreSlim s_lock = new(1); | ||
| private static ProbeResult s_cachedResult; |
There was a problem hiding this comment.
We had a lot of problems with static region auto-discovery, which uses a similar concept.
- Should the HTTP call fail after some time? (it does in region ... 2 seconds)
- Are you sure that probe failure really means endpoint not available? Could the probe fail for other reasons?
- should the probe (HTTP call) be retried? How often / for how long?
- should we "default" to credential endpoint? it seems more widespread?
There was a problem hiding this comment.
we use the MSI httpmanager logic with the same retries and error conditions.
We cannot default to credential endpoint because there are still RPs that use IMDS like AKS etc. So we need to check if credential endpoint exist first and then fallback to IMDS
[DO NOT REVIEW] MSI V2