rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Make Grafana/Metabase/Tailscale name errors terminal

Browse Source 
The source-name worker keeps a generic name and marks the source
synced only when a resolver reports ErrTerminalNameResolution. The
Grafana and Metabase name resolvers, plus Tailscale via its shared
fetchUsers, returned a plain error on any non-2xx, so a revoked
credential (401/403) never reached the terminal path and the worker
re-claimed the row every drain cycle with no delay.

Route their non-2xx through nameStatusError so permanent 4xx wrap
ErrTerminalNameResolution while 5xx stay retryable. The sentinel is
inert on the ListAccounts sync path, which does not inspect it.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
This commit is contained in:
Aurélien Sibiril
2026-07-22 14:36:36 +02:00
parent aeb7a1c8e6
commit 94552dbf11
4 changed files with 45 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
pkg/accessreview/drivers/tailscale.go
View File

@@ -150,8 +150,12 @@ func (d *TailscaleDriver) fetchUsers(ctx context.Context) ([]tailscaleUser, erro
_ = httpResp.Body.Close()
}()
// Classify the status so the source-name worker (which reuses this via
// tailscaleNameResolver) treats a 4xx as terminal instead of hot-looping.
// The sentinel is inert on the ListAccounts sync path, which does not
// inspect it.
if httpResp.StatusCode < 200 || httpResp.StatusCode >= 300 {
return nil, fmt.Errorf("cannot fetch tailscale users: unexpected status %d", httpResp.StatusCode)
return nil, nameStatusError("tailscale users", httpResp.StatusCode)
}
var resp tailscaleUsersResponse