-
Notifications
You must be signed in to change notification settings - Fork 75
remove the cache key with pdc bytes and check the expiry instead #1438
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
beejeebus
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
there's a bug in the Equals implementation, otherwise looks good to me.
beejeebus
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🚢
njvrzm
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This will cause a memory leak in on-prem installs as is. We either need to be more optimistic with certificate expiration or (my preference) fix this in at the source in cloudconfig.
| return true | ||
| } | ||
|
|
||
| block, _ := pem.Decode([]byte(p.clientCfg.ClientKeyVal)) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This will actually cause on-prem the same problem we're trying to eliminate in cloud. For on-prem configuration the secure_socks_proxy config values go into clientCfg.ClientKey and clientCfg.ClientCert instead of ClientKeyval and ClientCertVal. On-prem customers may also be using these through environment variables.
The pem.Decode will thus fail and we'll mark the certificate as expiring every time, so a new instance will be created for every request.
What this PR does / why we need it:
In core datasources at least we have a memory leak where we are always creating a new datasource instance. Currently we are using the ProxyHash() which takes the last 4 characters from the pdc key and uses it as a hash.
However, this is not working because each time we do a request we fetch the config from Cloud config, and then if the config is not cached get the new config, from the hosted grafana instance. The hosted grafana instance always generates a new key / cert so the new config is always different so the cache key is never consistent.
I checked the caches on cloud config and they only cache for 5 seconds as a way to reducing the load on hosted grafana, not as a reliable cache. If we put this cache too high it will take at least the expiry time of the cache for new datasource configurations to trickle through without some other way to invalidate it.
We could also cache the keys / value in the hosted grafana instance but It seems like a less attractive option considering the whole MT migration.
Which issue(s) this PR fixes:
fixes
Fixes #
Special notes for your reviewer:
Here is my exculidraw if its useful:
