-
Notifications
You must be signed in to change notification settings - Fork 883
feat: add cache abstraction for fetching signing keys #14777
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
- Simplify naming by renaming `DBKeyCache` to `DBCache`. - Introduce `DBCacheOption` for flexible clock configuration. - Ensure consistent clock handling across the methods.
Refactored the CryptoKey handling logic to leverage the codersdk package. This enhances consistency and modularity by centralizing CryptoKey management and related operations. The refactoring also includes renaming functions to better reflect their functionality and using the db2sdk package for database to SDK conversions.
- Simplifies conversion and improves consistency by using a common package for translating database keys to SDK keys. - Improves test reliability and code maintainability by centralizing the conversion process.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
You don't have to convert all the times to UTC. Go handles timezones just fine without this.
Introduce a timer-based cache invalidation system in DBCache to enhance reliability. The new implementation minimizes cache invalidation race conditions during key fetching, ensuring consistent cache state management. Additions include a 'Close' method for releasing resources, such as timers, and test improvements for timer behavior validation.
Introduce `closed` state to the DBCache to ensure operations such as Verifying and Signing are safely terminated when the cache is closed. This update prevents resource access and ensures proper shutdown sequences, enhancing system reliability.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't need to review again, but you need to fix the re-checking of d.close
when you release the read lock and acquire the write lock.
This PR adds the database implementation for fetching and caching keys used for JWT signing. It's been merged into the
keyrotate
pkg and renamed tocryptokeys
since they're coupled concepts. Given the size of the PR, an additional PR will be added for the wsproxy implementation.