kubeguard / guard

🔑 Kubernetes Authentication & Authorization WebHook Server

Home Page:https://kubeguard.dev

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

authz/azure: data race on username

bcho opened this issue · comments

commented

In our production logs, we detected a mismatched role assignment & username in the log line:

AccessAllowedVerboseVerdict = "Access allowed by Azure RBAC Role Assignment %s of Role %s to user %s"

This is due to this log line is referencing a global variable username:

When the server is serving multiple requests at the same time, the access to this variable will cause data race. We have reproduced this issue in unit test with -race enabled.