From 9269ef70668196261116e068dc4204923a518e2c Mon Sep 17 00:00:00 2001 From: Matt Keeler Date: Mon, 20 Jul 2020 16:09:20 -0400 Subject: [PATCH] Disable background cache refresh for Connect Leaf Certs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The rationale behind removing them is that all of our own code (xDS, builtin connect proxy) use the cache notification mechanism. This ensures that the blocking fetch behind the scenes is always executing. Therefore the only way you might go to get a certificate and have to wait is when 1) the request has never been made for that cert before or 2) you are using the v1/agent/connect/ca/leaf API for retrieving the cert yourself. In the first case, the refresh change doesn’t alter the behavior. In the second case, it can be mitigated by using blocking queries with that API which just like normal cache notification mechanism will cause the blocking fetch to be initiated and to get leaf certs as soon as needed. If you are not using blocking queries, or Envoy/xDS, or the builtin connect proxy but are retrieving the certs yourself then the HTTP endpoint might take a little longer to respond. --- agent/cache-types/connect_ca_leaf.go | 2 +- agent/cache-types/options.go | 9 +++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/agent/cache-types/connect_ca_leaf.go b/agent/cache-types/connect_ca_leaf.go index c177804893a6..325423bec67b 100644 --- a/agent/cache-types/connect_ca_leaf.go +++ b/agent/cache-types/connect_ca_leaf.go @@ -50,7 +50,7 @@ const caChangeJitterWindow = 30 * time.Second // ConnectCALeaf supports fetching and generating Connect leaf // certificates. type ConnectCALeaf struct { - RegisterOptionsBlockingRefresh + RegisterOptionsBlockingNoRefresh caIndex uint64 // Current index for CA roots // rootWatchMu protects access to the rootWatchSubscribers map and diff --git a/agent/cache-types/options.go b/agent/cache-types/options.go index 6864258e8e33..22cdaccfbc99 100644 --- a/agent/cache-types/options.go +++ b/agent/cache-types/options.go @@ -22,6 +22,15 @@ func (r RegisterOptionsBlockingRefresh) RegisterOptions() cache.RegisterOptions } } +type RegisterOptionsBlockingNoRefresh struct{} + +func (r RegisterOptionsBlockingNoRefresh) RegisterOptions() cache.RegisterOptions { + return cache.RegisterOptions{ + Refresh: false, + SupportsBlocking: true, + } +} + // RegisterOptionsNoRefresh can be embedded into a struct to implement // part of the agent/cache.Type interface. // When embedded into a struct it identifies the cache type as one which