rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Trim access-review connector comments

Browse Source 
Cut verbose inline comments across the access-review connector changes:
the mechanical fact stays at the read site, while incident backstory
("millions of error logs in prod") and provider-specific rationale (why
Clerk reviews the wrong population) move to the commit history where they
belong. Also tighten a loose "a 4xx" to "an auth/not-found 4xx" so the
terminal-classification contract is not overstated. No behavior change.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
This commit is contained in:
Aurélien Sibiril
2026-07-22 17:19:08 +02:00
parent a7bcbbcd85
commit a0ead155db
7 changed files with 28 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
pkg/accessreview/drivers/name_resolver.go
View File

@@ -41,14 +41,10 @@ type NameResolver interface {
ResolveInstanceName(ctx context.Context) (string, error)
}
// ErrTerminalNameResolution marks a name-resolution failure as permanent:
// an auth or bad-request response that retrying cannot fix. The
// source-name worker treats it as terminal — it keeps the generic source
// name and marks the source synced instead of re-claiming it every poll.
// Transient failures (5xx, network errors) are returned as plain errors so
// they keep retrying. Name resolution is best-effort display metadata, so a
// permanent failure must never wedge the worker in a retry loop (a single
// unauthorized source otherwise produced millions of error logs in prod).
// ErrTerminalNameResolution marks a permanent name-resolution failure
// (auth/bad-request) that retrying cannot fix: the source-name worker keeps
// the generic name and marks the source synced instead of re-claiming it.
// Transient failures (5xx, network) stay plain errors so they keep retrying.
var ErrTerminalNameResolution = errors.New("terminal name resolution failure")
// nameStatusError classifies a non-2xx response from a name-resolution

6
pkg/accessreview/drivers/tailscale.go
View File

@@ -151,9 +151,9 @@ func (d *TailscaleDriver) fetchUsers(ctx context.Context) ([]tailscaleUser, erro
}()
// Classify the status so the source-name worker (which reuses this via
// tailscaleNameResolver) treats a 4xx as terminal instead of hot-looping.
// The sentinel is inert on the ListAccounts sync path, which does not
// inspect it.
// tailscaleNameResolver) treats an auth/not-found 4xx as terminal instead
// of hot-looping. The sentinel is inert on the ListAccounts sync path,
// which does not inspect it.
if httpResp.StatusCode < 200 || httpResp.StatusCode >= 300 {
return nil, nameStatusError("tailscale users", httpResp.StatusCode)
}