volume/csi: Cache CA certificate pool in CSI TLS verification - #1344
Draft
hajiler wants to merge 1 commit into
Draft
volume/csi: Cache CA certificate pool in CSI TLS verification#1344hajiler wants to merge 1 commit into
hajiler wants to merge 1 commit into
Conversation
Previously, resolveTLSConfig configured VerifyConnection to re-read the CA trust bundle from disk and rebuild the *x509.CertPool on every TLS handshake. This caused unnecessary filesystem I/O and PEM decoding overhead on repeated connections. This change introduces a thread-safe caPoolCache that caches the parsed cert pool in memory and checks file metadata (stat matching) and certificate expiration (earliest NotAfter) to avoid redundant disk reads while preserving automatic CA rotation pickup. TAG=agy CONV=08b81b20-9977-45df-b98e-9e340bc55e2d
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1182
Description
In
resolveTLSConfig, TLS verification was configured to dynamically read and parse the CA trust bundle on every handshake to support zero-downtime CA rotation. However, reading and parsing PEM certificates from disk on every connection causes unnecessary disk I/O and CPU overhead.This PR introduces an in-memory caching mechanism for the CA certificate pool:
caPoolCachethat caches the parsed*x509.CertPoolin memory.os.SameFile, modtime, size) and earliestNotAfterexpiration tracking to determine when a reload is needed.Verification
go test -v -race ./internal/volume/csi/...go test ./...make fmt