try fetch token again when token timeouts #8388
Conversation
|
Hi @cardyok. Thanks for your PR. I'm waiting for a containerd member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
when max_concurrent_download is specified, get requests are not sent immediately for all layers. Token might timeout and we need to try to fetch it again. Signed-off-by: Cardy.Tang <zuniorone@gmail.com>
847b62d to
296d67e
Compare
| return err | ||
| } | ||
|
|
||
| if c.Parameters["error"] == "invalid_token" { |
There was a problem hiding this comment.
is it from special platform?
Not sure if this is the generic err message protocol for all platforms, but I verified dockerhub and alibaba container registry both gave this errcode when invalid or expired token is provided in header.
There was a problem hiding this comment.
invalid_token is defined in RFC 6750, as one of the three error codes that could be returned by the server.
But just wonder why invalidAuthorization didn't return an error for this case?
There was a problem hiding this comment.
Seems like this could be slotted into invlaidAuthorization here:
containerd/remotes/docker/authorizer.go
Line 341 in 296d67e
|
PR needs rebase. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
This PR is stale because it has been open 90 days with no activity. This PR will be closed in 7 days unless new comments are made or the stale label is removed. |
|
closed by #8735 |
when max_concurrent_download is specified, get requests are not sent immediately for all layers. Token might timeout and we need to try to fetch it again.
eg. max_concurrent_download = 3, fooimg:latest has 4 blob layers, network is poor and first 3 layers took 2hr to finish downloading. when 4th layer begins, it tries to reused the token in host(which has already expired), invalid_token err is thrown.