Repository navigation
fix(workloadapi): handle rejected JWT bundle updates in JWT sources - #482
Merged
maxlambrecht merged 2 commits intoOct 29, 2026
Merged
Conversation
maxlambrecht
left a comment
maxlambrecht
left a comment
Member
There was a problem hiding this comment.
The parser fix is correct, but #479 remains unresolved through DefaultJwtSource and CachedJwtSource: their onError() callbacks throw WatcherException, which escapes onNext() and permanently cancels the stream. Could you expand this PR so rejected updates preserve existing bundles and subsequent valid updates are applied? I’d prefer addressing this here since it’s part of the reported failure, but a follow-up PR would also work.
… parse
JwtBundle.parse documents JwtBundleException for bundles that cannot be
parsed. If the JWKS contained a key whose type is neither EC nor RSA
(for example an OKP/Ed25519 or an "oct" key),
JwtSignatureAlgorithm.Family.parse threw an IllegalArgumentException that
escaped unwrapped. JwtBundle.load already catches IllegalArgumentException
for the same input, so the two entry points disagreed.
The leak was most harmful on the Workload API watch path.
StreamObservers' JWT bundles observer only catches JwtBundleException
from GrpcConversionUtils.toJwtBundleSet, so the IllegalArgumentException
was thrown out of StreamObserver.onNext. gRPC reacts by cancelling the
call ("CANCELLED: Failed to read message."). CANCELLED is treated as
non-retryable, so the watch ended permanently and later bundle updates
(rotations) were never delivered. With the exception wrapped, the
observer reports "Error processing JWT bundles update" to the watcher
and keeps the stream open for the next update.
Catch IllegalArgumentException in JwtBundle.parse as load does, and
mention unsupported key types in the Javadoc. Tests cover JwtBundle.parse
and GrpcConversionUtils.toJwtBundleSet with a JWKS that contains an OKP
key.
Signed-off-by: NopeCharon <115794254+NopeCharon@users.noreply.github.com>
DefaultJwtSource and CachedJwtSource threw a WatcherException from the JWT bundles watcher's onError. When the error came from a rejected update, the exception escaped StreamObserver.onNext and gRPC cancelled the call, so the watch ended and later bundle rotations were never applied. Only treat errors before the first update as initialization failures: the watcher records the error and init throws it, which also makes newSource fail instead of returning a source without bundles when the first update is rejected asynchronously. After initialization, errors are logged and the current bundles are kept, so the stream stays open and the next valid update replaces them. Signed-off-by: NopeCharon <115794254+NopeCharon@users.noreply.github.com>
NopeCharon
force-pushed
the
fix/jwt-bundle-parse-unsupported-key
branch
from
October 29, 2026 17:39
f8042e5 to
d4133b0
Compare
Contributor
Author
|
@maxlambrecht Expanded it here in d4133b0: both sources now only fail on errors before the first update, and after that they log the error and keep the current bundles, so the stream stays open and the next valid update is applied. Added a test that streams an unsupported key update between two valid ones through the fake Workload API. |
maxlambrecht
changed the title
maxlambrecht
left a comment
maxlambrecht
left a comment
Member
There was a problem hiding this comment.
Thanks, this looks good!
maxlambrecht
approved these changes
Oct 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
JwtBundle.parsenow catches theIllegalArgumentExceptionraised for unsupported JWKS key types (anything other than EC/RSA) and wraps it inJwtBundleException, asJwtBundle.loadalready does. The Javadoc now lists unsupported key types under@throws.Fixes #479
Why
The unwrapped exception broke the documented contract of
parse. On the Workload API watch path it was also thrown out ofStreamObserver.onNext, because the JWT bundles observer only catchesJwtBundleException. gRPC then cancelled the call withCANCELLED: Failed to read message., which is non-retryable, so the watch ended permanently and later bundle updates were never delivered.How tested
JwtBundleTest.testParse_InvalidKeyType_ThrowsJwtBundleExceptionandGrpcConversionUtilsTest.test_toJwtBundleSet_unsupportedKeyType, both using the existingjwks_invalid_keytype.jsonfixture. Both fail without this change.watchJwtBundles. Before: the watcher only receivedCancelling JWT Bundles watch. After: the watcher receivedError processing JWT bundles updatefollowed by the valid update../gradlew :java-spiffe-core:buildon JDK 17.