Comments (3)
IMO, the new policy becomes active, period. Probe() is simply a way to test the policy without executing the RPC in the Probe; ie: /gnmi.gNMI/Subscribe would be tested against policy but not executed.
from gnsi.
It sounds like the intention was:
"Rotate applies a new policy immediately, the rotator should test with probe() messages to see that their intended result is live, and finalize() when that's done"
Because 'live immediately', I expect that new rpcs between the start of Rotate() and Finalize() would be evaluated under the newly placed policy. If the policy failes Probe() tests (for instance) or there are signals to the rotator that: "Hey, half my RPCs are failing? wut?" the rotator may choose to not Finalize() and disconnect forcing the previous policy to take up the active role.
make sense?
from gnsi.
Got it @morrowc. This answers my questions
In summary:
In the intermittent state, all of them(Probe(), real RPC and Get()) behave as per the new policy even though Finalize is not yet issued. This is in line with the spec which mentions "active immediately".
from gnsi.
Related Issues (20)
- Certz does not have counters per-profile HOT 4
- gnsi.accounting.v1 SessionInfo.system_address HOT 2
- RecordResponse.ServiceStatus only applies to GrpcService
- Use of json for policy in authz without a protobuf alternative is obtuse HOT 2
- Clarity needed (in a comment) for acctz RecordRequest keepalives HOT 10
- certz default profiles HOT 3
- Inconsistency between documentation and protobuf definition for groups with members
- authz ProbeResponse action enum HOT 2
- pathz grpcurl reflection: included an unresolvable reference to ".gnmi.Path" HOT 1
- Certz should permit delivery of a certificate bundle as a PKCS#7 encoded string.
- Need clarity on trust_bundle structure in certz.proto HOT 1
- Need clarity on authentication-policy under certz.proto HOT 1
- Need clarity on credentialz.proto host certificate rotation
- Description of GrpcService.config_metadata is too vague HOT 8
- Description for gnsi.accounting.CommandService.cmd and cmd_args seem too vague HOT 2
- Add gnsi.accounting is_truncated flags? HOT 2
- gnsi.account missing telemetry HOT 1
- gnsi.accounting.SessionInfo is lacking in various ways HOT 3
- authz default behavior should not be vendor prerogative HOT 7
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from gnsi.