@databricks/lakebase: pool drops maxLifetimeSeconds and other pg options, so connections never recycle and Unity Catalog claims access fails after 4 hours

未关闭
  • 哪里不对？
#718 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 3 天内回复

@billmcmillin 已经在做这个了。

开始于 2026年11月6日。

  • #719 来自 @billmcmillin —— 未关闭

评估

难度
4/5
预计耗时
3-5 天
新手友好度
20/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
停滞
技术栈
node.js, typescript
领域
backend, databases

调研方向

Read packages/lakebase/src/pool-config.ts and inspect getLakebasePgConfig() to see which PoolConfig options reach pg.Pool. Check the pool tests for coverage of forwarded options and the default connection lifetime. Done means caller options are preserved, connections recycle at the intended default, and the warning behavior covers unsafe lifetime settings; linked PR #719 is already open.

由索引模型根据 Issue 内容生成。

描述

Summary

createLakebasePool() passes only 11 options to pg.Pool and silently drops the rest, including maxLifetimeSeconds. Pool connections are therefore never recycled.

Lakebase checks the OAuth token only at login, so most queries keep working on old connections. Access granted through Unity Catalog claims in the token doesn't: it stops 4 hours after the token is minted, while the connection stays open. A busy pool keeps its connections past that point. From then on, every query that relies on that access fails with 42501 permission denied, until the app restarts.

The same bug drops application_name, keepAlive, query_timeout and options. LakebasePoolConfig extends pg's PoolConfig, so all of these type-check and are then ignored.

Affected: every published @databricks/lakebase version, up to and including 0.7.0, and AppKit's createLakebasePool, which wraps it.

Reproduction

The dropped options show without a database. pg.Pool doesn't connect until first use:

import { createLakebasePool } from "@databricks/lakebase";

const pool = createLakebasePool({
  host: "localhost",
  database: "test",
  user: "test",
  password: "test-only",
  sslMode: "disable",
  maxLifetimeSeconds: 900,
  application_name: "my-app",
  query_timeout: 15_000,
});

console.log(pool.options.maxLifetimeSeconds); // 0 (pg-pool's "never recycle"), not 900
console.log(pool.options.application_name);   // undefined
console.log(pool.options.query_timeout);      // undefined
await pool.end();

The access lapse, on a live Lakebase Autoscaling endpoint:

  1. Use a service principal with an OAuth Postgres role and no native GRANTs. Give it SELECT on a synced table through Unity Catalog only.
  2. Create a pool whose password callback returns a token minted with claims: [{ permission_set: "READ_ONLY", resources: [{ table_name: "<catalog.schema.table>" }] }].
  3. Keep a few connections busy, reading the table every 30 seconds, for more than 4 hours.
  4. At about 240 minutes after the token was minted, every read fails with 42501 permission denied for schema …. Liveness queries on the same connections keep succeeding, and the pool never recovers.

In our run, connections were 4.3 hours old by the end, and the lapse came at 240.5 minutes on every connection. With 1-hour tokens, reads kept working for 15 minutes past the token's expiry, and with 5-minute tokens for 29 minutes. So the lapse follows the token's age (4 hours from mint), not its expiry.

Expected

  • Options a caller passes reach pg.Pool.
  • Connections are recycled by default, early enough that no connection outlives its token's Unity Catalog claims.

Root cause

getLakebasePgConfig() in packages/lakebase/src/pool-config.ts builds the pool config from a fixed list:

return {
  host, port, user, database, password, ssl, max,
  idleTimeoutMillis, connectionTimeoutMillis,
  statement_timeout, idle_in_transaction_session_timeout,
};

There's no maxLifetimeSeconds, so pg-pool uses its default of 0, which means connections are never closed for age.

Proposed fix

  • Pass maxLifetimeSeconds, application_name, keepAlive, query_timeout and options through.
  • Default maxLifetimeSeconds to 30 minutes.
  • Log a warning when it's 0 or long enough for a connection to outlive its token's claims. A token can be up to an hour old at login, so with a 30-minute margin the safe maximum is 2.5 hours.

A PR follows.

Notes

  • createLakebasePool doesn't request claims itself, so this hits apps that mint claims tokens (generateDatabaseCredential accepts claims) and pass them as the pool password. Access through native Postgres grants isn't affected.
  • pg-pool recycles only idle connections. A client that's checked out and held for hours isn't closed until it's released, so the fix can't protect it.
主要语言
TypeScript
星标
119
派生
36
平均合并
4 天 16 小时
30 天内合并 PR
37

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

databricks/appkit 的其他 Issue

查看 databricks/appkit 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。