GitLab VCS token expired and not renewed

[jiin995]

Bug description 🐞

Hi team,
I noticed that the GitLab OAuth tokens were not refreshed as expected. The tokens had expired while my cluster was undergoing maintenance, and no automatic refresh was triggered afterwards.
When i made plan on workspace connected to VCS i have plan without commitID and investigating we found problem with expire of GitLab access Token.

To resolve the issue, I had to manually update the status of the tokens to PENDING directly in the database. After that, the reconnection worked without needing to change the access or secret tokens.

It seems like the system didn't retry the refresh once the cluster came back online.
Would it be possible to implement a retry mechanism or a check for expired tokens after downtime?

Let me know if you need any additional logs or details.

Thanks!

Steps to reproduce

Configure GitLab as VCS and try to change expire in database.

Expected behavior

When use vps if token it's expired refresh it, or allow to disconnect and reconnect to vpc from Web-UI

Example repository

No response

Anything else?

No response

[alfespa17]

Hello @jiin995

Gitlab token expires after 2 hours

there is a internal job that updates the token every 1 hour

terrakube/api/src/main/java/org/terrakube/api/plugin/vcs/TokenService.java

Line 88 in 06eef0a

// Refresh token every hour, GitLab Token expire after 2 hours (7200 seconds)

Not really sure why the token was not refresh after the job was executed

[jiin995]

I find the same problem in all organizations, perhaps it's related to shutdown of k8s cluster?
It's possible to add check before job start that eventually refresh gitlab token?

[alfespa17]

I find the same problem in all organizations, perhaps it's related to shutdown of k8s cluster? It's possible to add check before job start that eventually refresh gitlab token?

Yes, I guess is related to the cluster shutdown because the schedule job did not run to renew the gitlab token but the job to renew it is scheduled every hour so it should have run once you started the cluster again in the next 60 minutes, so I am not really sure what happen there.

I will have to think what could be the best approach in this case to manage token refresh if the cluster is shutdown in some moment