fix(apps): Clear resource provider caches to ensure up-to-date data (#…

…409)
spinnaker · May 22, 2019 · ed2db48 · ed2db48
1 parent 9ee2d58
commit ed2db48
Show file tree

Hide file tree

Showing 5 changed files with 19 additions and 0 deletions.
diff --git a/...oles/src/main/java/com/netflix/spinnaker/fiat/permissions/DefaultPermissionsResolver.java b/...oles/src/main/java/com/netflix/spinnaker/fiat/permissions/DefaultPermissionsResolver.java
@@ -91,6 +91,13 @@ public UserPermission resolveAndMerge(@NonNull ExternalUser user) {
     return getUserPermission(user.getId(), combo);
   }
 
+  @Override
+  public void clearCache() {
+    for (ResourceProvider provider : resourceProviders) {
+      provider.clearCache();
+    }
+  }
+
   private boolean resolveAdminRole(Set<Role> roles) {
     List<String> adminRoles = fiatAdminConfig.getAdmin().getRoles();
     return roles.stream().map(Role::getName).anyMatch(adminRoles::contains);

diff --git a/fiat-roles/src/main/java/com/netflix/spinnaker/fiat/permissions/PermissionsResolver.java b/fiat-roles/src/main/java/com/netflix/spinnaker/fiat/permissions/PermissionsResolver.java
@@ -36,4 +36,7 @@ public interface PermissionsResolver {
   /** Resolves multiple user's permissions. Returned map is keyed by userId. */
   Map<String, UserPermission> resolve(Collection<ExternalUser> users)
       throws PermissionResolutionException;
+
+  /** Clears resource cache: apps, service accounts,... */
+  void clearCache();
 }
diff --git a/fiat-roles/src/main/java/com/netflix/spinnaker/fiat/providers/BaseProvider.java b/fiat-roles/src/main/java/com/netflix/spinnaker/fiat/providers/BaseProvider.java
@@ -86,5 +86,9 @@ private Cache<Integer, Set<R>> buildCache(int expireAfterWrite) {
         .build();
   }
 
+  public void clearCache() {
+    cache.invalidate(CACHE_KEY);
+  }
+
   protected abstract Set<R> loadAll() throws ProviderException;
 }
diff --git a/fiat-roles/src/main/java/com/netflix/spinnaker/fiat/providers/ResourceProvider.java b/fiat-roles/src/main/java/com/netflix/spinnaker/fiat/providers/ResourceProvider.java
@@ -27,4 +27,6 @@ public interface ResourceProvider<R extends Resource> {
   Set<R> getAllRestricted(Set<Role> roles, boolean isAdmin) throws ProviderException;
 
   Set<R> getAllUnrestricted() throws ProviderException;
+
+  void clearCache();
 }
diff --git a/fiat-roles/src/main/java/com/netflix/spinnaker/fiat/roles/UserRolesSyncer.java b/fiat-roles/src/main/java/com/netflix/spinnaker/fiat/roles/UserRolesSyncer.java
@@ -157,6 +157,9 @@ public long syncAndReturn(List<String> roles) {
               + "resolution may not complete until this server becomes healthy again.");
     }
 
+    // Ensure we're going to reload app and service account definitions
+    permissionsResolver.clearCache();
+
     while (true) {
       try {
         Map<String, UserPermission> combo = new HashMap<>();