mattrobinsonsre/terrapod v1.6.2

on GitHub

A bug-fix patch for the 1.6 line, restoring AWS IAM authentication to Redis.

Bug Fixes

• AWS IAM auth to Redis worked once and then failed permanently (#1509). With redis.auth_mode: aws_iam, the API authenticated on its first connection and failed on every one after it, so the pod never became ready:

  Redis health check failed  error="Authentication required."
  Redis health check failed  error="weakly-referenced object no longer exists"
  

  The cached botocore RequestSigner outlived the session that produced it. RequestSigner holds the event emitter as a weak reference and the session is what holds it strongly, so once the session was collected every subsequent token mint raised ReferenceError. The first connection succeeded only because it beat the collector — which is what made a deterministic lifetime bug look like an intermittent auth fault.

  The Authentication required. line is downstream noise: minting raised, the credential provider yielded nothing, and redis-py then opened a connection with no AUTH at all. A genuinely bad token reports invalid username-password pair instead.

Who is affected. Only redis.auth_mode: aws_iam. The default password mode, and the gcp_iam and azure_ad modes, are unaffected — they hold their credential objects strongly and involve no weak reference.

Upgrading

A drop-in change: no API, wire-protocol, configuration, Helm-value or database-schema change, and nothing to do but take the new images.

Status

Stable. 1.6 is the current line; 1.5 receives the same fix as v1.5.7.

Full Changelog: v1.6.1...v1.6.2