Invalid JWT token happens randomly when using Snowflake+DBT
Asked Answered
M

1

7

We've been using Snowflake+DBT with key pair authentication for a long time now, and we've never had any issues.

Recently, we started getting random connection errors on some models:

250001 (08001): Failed to connect to DB: account.region.snowflakecomputing.com:443. JWT token is invalid.

Most of the models will work, but some of them might fail. This can happen to any model, and it's never the same one -- sometimes it's the very first one, sometimes it's the very last one, and sometimes it's a bunch of them. It happens in runs with lots of models, or in runs with a single model.

It's very inconsistent, and there doesn't seems to be any kind of pattern to it. Sometimes it works, and sometimes it doesn't.

We've also tried with 1, 4, or 8 threads, and it happens regardless.

Obviously, there's nothing wrong with the credentials or configurations — otherwise, nothing would run at all. So I assume there must be something wrong with how DBT is handling the connection(s).

Interestingly, the errors only happens locally (so far). We haven't seen it in DBT Cloud runs.

DBT version is 0.20.2 in both cases. We tried with other versions (0.21.0, 0.20.0 & 0.19.1), and the issue persists. I don't know why we're just encountering this, as we've used these other versions previously without any issues.

It's similar to this question, except in our case it doesn't happen consistently at all. We tried connecting "without a region" (using Snowflake Organizations), but it doesn't make any difference:

250001 (08001): Failed to connect to DB: organization-account.snowflakecomputing.com:443. JWT token is invalid.

Is there anything we can do to resolve this?

EDIT: When the error happens, the model hangs for 60 seconds until the error appears.

EDIT 2: I think the error might have started happening when we started using the DBT-provided Docker images. Not sure exactly what might be wrong with them, but we'll try going back to our own custom images and see if that works.

Manche answered 19/10, 2021 at 22:14 Comment(4)
Have you checked cause number 1 and 2 from this article ?Pontianak
No! Never saw that article while researching the error. I'll try a few more things now. Thank you!Manche
Did you manage to find solution to this?Night
This has since stopped happening. 🤷‍♂️ Possibly because of this change from Snowflake: "An improvement has been added to Snowflake's Cloud Services layer to relax the validity restrictions." Also, we are now using different Docker containers, so that might have something to do with it as well.Manche
M
1

This has since stopped happening. 🤷‍♂️

Possibly because of this change from Snowflake:

"An improvement has been added to Snowflake's Cloud Services layer to relax the validity restrictions."

Also, we are now using different Docker containers, so that might have something to do with it as well:

  • First, we switched to xemuliam/dbt, from Docker Hub.
  • But since that is no longer maintained, we are now using the official DBT Docker images from GitHub (which were not available at the time the question was posted):
Manche answered 29/9, 2022 at 21:58 Comment(0)

© 2022 - 2024 — McMap. All rights reserved.