Timeout SDK Go for AKV when trying an inexisting AKV

[Rikonimo]

We use the Azure SDK for GO to call the Azure Rest API for the key-vault to help us in getting the secrets and sync them into the K8s secrets in our namespaces.

However we found that incase of a non-existing Keyvault (for Example due to a wrong configuration by the user ) , the API keeps on trying to reach this wrong address until it times out after quite long time (7-8 minutes) giving a DNS error :

-- Original Error: Get "https://test-sync-time-dummy.vault.azure.net/secrets/hello/?api-version=2016-10-01\": dial tcp: lookup test-sync-time-dummy.vault.azure.net on 10.224.0.10:53: no such host"

The error makes sense however we were looking for a way to configure the timeout threshold needed to get this response . the API Parameters does not contain such parameter . The problem is that the API call keeps the operator process busy and doesn’t release it to continue processing the other secrets defined in the Custom resources , causing them to pile up waiting for their turn in the queue which can cause huge delays in the synchronization process between key-vault and k8s secrets.

Is there a way to tune such timeout property from the Azure DNS , or can we raise such request to our Microsoft partners to find a way if we can add such timeout parameter to our API call to the key-vault ?

[RickWinter]

@Rikonimo Can you clarify which SDK you are using. Is it azsecrets ?

[seankane-msft]

Assuming you are using the new libraries (azkeys and azsecrets here) you can use the context.Context parameter to set a timeout. Here is a code snippet that shows how to set a 10 second timeout:

func Example() {
	fakeKVUrl := "https://test-sync-time-dummy.vault.azure.net/"
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	handle(err)

	client, err := NewClient(fakeKVUrl, cred, nil)
	handle(err)

	c := context.Background()
	c, cancelFunc := context.WithTimeout(c, 10*time.Second)
	defer cancelFunc()

	_, err = client.GetSecret(c, "nonexistentsecret", nil)
	handle(err)
}

[ghost]

Hi, we're sending this friendly reminder because we haven't heard back from you in a while. We need more information about this issue to help address it. Please be sure to give us your input within the next 7 days. If we don't hear back from you within 14 days of this comment the issue will be automatically closed. Thank you!

[magodo]

This issue still remains, reopening it.

[ghost]

Hi, we're sending this friendly reminder because we haven't heard back from you in a while. We need more information about this issue to help address it. Please be sure to give us your input within the next 7 days. If we don't hear back from you within 14 days of this comment the issue will be automatically closed. Thank you!