Conversation
The timeout for daemon-side session auth round-trips with the buildx client session (resolving credentials, fetching auth tokens, verifying token authority) was hardcoded to 60 seconds. Turn the package-level const into an exported var, SessionAuthTimeout, and make it configurable from buildkitd.toml via [system].sessionAuthTimeout, applied at daemon start in the existing [system] block, following the same pattern as [system].platformsCacheMaxAge. The value accepts a duration string (e.g. "48h") or a bare integer treated as seconds, reusing the existing config.Duration type. If unset, the default of 60s is kept, so existing deployments see no behavior change. A configured value of zero or less disables the deadline entirely: the withTimeout helper skips the context.WithTimeoutCause call for non-positive values, because a zero-duration context would expire immediately and fail every auth round-trip. Signed-off-by: Paul Schroeder <paul.schroeder@pingidentity.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
The timeout for daemon-side session auth round-trips with the buildx client session (resolving credentials, fetching auth tokens, verifying token authority) is hardcoded to 60 seconds (
session/auth/auth.go). In clusters where the buildx client, a load balancer, or the registry credential chain is slow, the daemon-side auth deadline can expire before the round-trip completes, surfacing asDeadlineExceedederrors on pushes even though the daemon and client are healthy.Description
Turn the package-level
const sessionAuthTimeoutinto an exported var,SessionAuthTimeout, and make it configurable frombuildkitd.tomlvia[system].sessionAuthTimeout, applied at daemon start in the existing[system]block, following the same pattern as[system].platformsCacheMaxAge(and thearchutil.CacheMaxAgeconst→var precedent).The value accepts a duration string (e.g.
"48h") or a bare integer treated as seconds, reusing the existingconfig.Durationtype. If unset, the default of 60s is kept, so existing deployments see no behavior change. A configured value of zero or less disables the deadline entirely: the newwithTimeouthelper skips thecontext.WithTimeoutCausecall for non-positive values, because a zero-duration context would expire immediately and fail every auth round-trip. The deadline being skipped is still parent-cancellable.Exported function signatures in the package are unchanged.
Testing
go test -count=1 ./cmd/buildkitd/config/... ./session/... ./util/resolver/...— all pass (includes newTestLoadSessionAuthTimeoutcovering unset /0/300/"48h"forms)go build ./...,go vet,gofmt— cleandocker buildx bake lint-default—0 issues.DeadlineExceeded; negative and"-30s"values disable; parent cancellation still aborts when the deadline is skipped.