Skip to content

Conversation

@Multimo
Copy link

@Multimo Multimo commented Nov 26, 2025

What this PR does / why we need it:

In core datasources at least we have a memory leak where we are always creating a new datasource instance. Currently we are using the ProxyHash() which takes the last 4 characters from the pdc key and uses it as a hash.

However, this is not working because each time we do a request we fetch the config from Cloud config, and then if the config is not cached get the new config, from the hosted grafana instance. The hosted grafana instance always generates a new key / cert so the new config is always different so the cache key is never consistent.

I checked the caches on cloud config and they only cache for 5 seconds as a way to reducing the load on hosted grafana, not as a reliable cache. If we put this cache too high it will take at least the expiry time of the cache for new datasource configurations to trickle through without some other way to invalidate it.

We could also cache the keys / value in the hosted grafana instance but It seems like a less attractive option considering the whole MT migration.

Which issue(s) this PR fixes:

fixes

Fixes #

Special notes for your reviewer:

Here is my exculidraw if its useful:
image

@grafana-plugins-platform-bot grafana-plugins-platform-bot bot moved this from 📬 Triage to 🔬 In review in Plugins Platform / Grafana Community Nov 26, 2025
@Multimo Multimo marked this pull request as ready for review November 27, 2025 10:26
@Multimo Multimo requested a review from a team as a code owner November 27, 2025 10:26
Copy link
Contributor

@beejeebus beejeebus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

there's a bug in the Equals implementation, otherwise looks good to me.

@github-project-automation github-project-automation bot moved this from 🔬 In review to 🧑‍💻 In development in Plugins Platform / Grafana Community Dec 1, 2025
@beejeebus beejeebus self-requested a review December 4, 2025 23:17
Copy link
Contributor

@beejeebus beejeebus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚢

Copy link
Contributor

@njvrzm njvrzm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will cause a memory leak in on-prem installs as is. We either need to be more optimistic with certificate expiration or (my preference) fix this in at the source in cloudconfig.

return true
}

block, _ := pem.Decode([]byte(p.clientCfg.ClientKeyVal))
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will actually cause on-prem the same problem we're trying to eliminate in cloud. For on-prem configuration the secure_socks_proxy config values go into clientCfg.ClientKey and clientCfg.ClientCert instead of ClientKeyval and ClientCertVal. On-prem customers may also be using these through environment variables.

The pem.Decode will thus fail and we'll mark the certificate as expiring every time, so a new instance will be created for every request.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: 🧑‍💻 In development

Development

Successfully merging this pull request may close these issues.

3 participants