Geo: LFS pull unexpectedly asks for credentials
Summary
While pulling a batch of LFS files, if someone else pushes to the project, then the LFS transfers will suddenly stop to ask for credentials.
Steps to reproduce
Original support problem description:
When trying to do
git lfs fetch
from secondary, authentication prompt appears. User doesn't need to input the credentials, but just hit the enter/return key for the process to continue. We verified that this happens when the primary is receiving writes during the lfs fetch operation from secondary and the fetch request is proxied (status: 302
). We tried with both secondary proxying disabled and enabled. Fetching in-sync replicas from secondary works (status: 200
).
Reproducing this may require a private project.
See https://gitlab.com/gitlab-com/geo-customers/-/issues/92#note_1216802360 (internal link)
Example Project
What is the current bug behavior?
What is the expected correct behavior?
Relevant logs and/or screenshots
Output of checks
Results of GitLab environment info
Expand for output related to GitLab environment info
(For installations with omnibus-gitlab package run and paste the output of: `sudo gitlab-rake gitlab:env:info`) (For installations from source run and paste the output of: `sudo -u git -H bundle exec rake gitlab:env:info RAILS_ENV=production`)
Results of GitLab application Check
Expand for output related to the GitLab application check
(For installations with omnibus-gitlab package run and paste the output of:
sudo gitlab-rake gitlab:check SANITIZE=true
)(For installations from source run and paste the output of:
sudo -u git -H bundle exec rake gitlab:check RAILS_ENV=production SANITIZE=true
)(we will only investigate if the tests are passing)
Possible fix
For LFS batch requests, revert the LFS redirect check to use "project repo is not yet replicated" instead of "project repo is out of date".
This should stop causing batch requests to be redirected, but I think the downside is that LFS files which are not yet replicated just fail to transfer. Which I assume is what happened before?
I think the proper behavior may be to redirect the LFS request if any LFS object in the batch are not yet replicated.