shreemaan-abhishek commented on code in PR #13668:
URL: https://github.com/apache/apisix/pull/13668#discussion_r3542453406
##########
apisix/secret.lua:
##########
@@ -233,7 +233,9 @@ local function fetch(uri, use_cache)
return val
end
- return secrets_cache(uri, "", fetch_by_uri, uri)
+ -- pass the secrets conf_version so the cache re-resolves when /secrets
changes
Review Comment:
> The design of this LRU Cache dictates that all changes take effect only
after the TTL expires.
while this is true, the version arg is also a invalidation mechanism here.
Every other cache (routes, services, consumers) passes its real conf_version
and picks up changes immediately. The secret cache passing "" was the odd one
out, which is why deleted/updated secrets are served stale until it expires.
This just makes secrets behave like everything else.
and about the the "storm", re-resolution is lazy (each entry only re-fetches
on its next access, not all at once), bounded by the number of distinct secret
refs, and only triggered by admin-plane changes, not request traffic. Same as
how one route edit rebuilds the router cache.
this is indeed a tradeoff but is serving a deleted secret forever doesn't
sound like a good tradeoff.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
