Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Cache trigger secrets for the duration of request (with tests) #595

Merged
merged 1 commit into from
Jun 10, 2020
Merged

Cache trigger secrets for the duration of request (with tests) #595

merged 1 commit into from
Jun 10, 2020

Conversation

tragiclifestories
Copy link
Contributor

Changes

This is essentially an additional commit on top of #585 by my colleague @lawrencejones adding tests. From that summary:

This commit adds a request-local cache for interceptors to leverage
during the processing of triggers. It allows interceptors to avoid doing
expensive work more than once for each request, such as fetching a
Kubernetes secret for validating webhooks.

The implementation uses the request context to provide the cache. This
was the least disruptive method of providing a cache for use with
interceptors, and is appropriate if you consider the cache should live
only for the duration of each request.

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

See the contribution guide for more details.

Release Notes

Cache Kubernetes secret refs for each EventListener webhook, using the cached value to process each trigger

@tekton-robot tekton-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jun 3, 2020
@tekton-robot
Copy link

Hi @tragiclifestories. Thanks for your PR.

I'm waiting for a tektoncd member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@tragiclifestories tragiclifestories mentioned this pull request Jun 3, 2020
Closed
3 tasks
@dibyom
Copy link
Member

dibyom commented Jun 3, 2020

/ok-to-test

@tekton-robot tekton-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jun 3, 2020
@tekton-robot
Copy link

The following is the coverage report on the affected files.
Say /test pull-tekton-triggers-go-coverage to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/interceptors/interceptors.go Do not exist 80.0%

@tragiclifestories
Copy link
Contributor Author

/retest

@tekton-robot
Copy link

The following is the coverage report on the affected files.
Say /test pull-tekton-triggers-go-coverage to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/interceptors/interceptors.go Do not exist 80.0%
pkg/sink/sink.go 74.3% 74.5% 0.3

@tekton-robot
Copy link

The following is the coverage report on the affected files.
Say /test pull-tekton-triggers-go-coverage to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/interceptors/interceptors.go Do not exist 80.0%
pkg/sink/sink.go 74.3% 74.5% 0.3

dibyom
dibyom approved these changes Jun 8, 2020
View reviewed changes
Copy link
Member

@dibyom dibyom left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just one small nit. Otherwise LGTM!

pkg/interceptors/interceptors_test.go Outdated Show resolved Hide resolved
@tekton-robot
Copy link

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dibyom

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@tekton-robot tekton-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 8, 2020
@tekton-robot
Copy link

The following is the coverage report on the affected files.
Say /test pull-tekton-triggers-go-coverage to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/interceptors/interceptors.go Do not exist 80.0%
pkg/sink/sink.go 74.3% 74.5% 0.3

@dibyom
Copy link
Member

dibyom commented Jun 9, 2020

Just one last thing before merge -- could you squash the commits into one?

@lawrencejones
Cache trigger secrets for the duration of request
d145bd8 
This commit adds a request-local cache for interceptors to leverage
during the processing of triggers. It allows interceptors to avoid doing
expensive work more than once for each request, such as fetching a
Kubernetes secret for validating webhooks.

The implementation uses the request context to provide the cache. This
was the least disruptive method of providing a cache for use with
interceptors, and is appropriate if you consider the cache should live
only for the duration of each request.

Alternative implementations might have used the client-go informers to
extend the Kubernetes client to watch for secrets in the cluster. This
would cause the work required to fetch secrets to scale with the number
of secrets in the cluster, as opposed to making a fresh request per
webhook we process. That said, building caching clients seems like more
work than is necessary for fixing this simple problem, which is why I
went with a simple cache object.

The background for this change was finding Github webhooks timing out
once we exceeded ~40 triggers on our EventListener. While the CEL
filtering was super fast, the validation of Github webhook signatures
was being computed for every trigger, even though each trigger used the
same Github secret. Pulling the secret from Kubernetes was taking about
250ms, which meant 40 triggers exceeded the 10s Github timeout.
@tekton-robot
Copy link

The following is the coverage report on the affected files.
Say /test pull-tekton-triggers-go-coverage to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/interceptors/interceptors.go Do not exist 80.0%
pkg/sink/sink.go 74.3% 74.5% 0.3

@tragiclifestories
Copy link
Contributor Author

@dibyom Cheers - all done now.

@dibyom
Copy link
Member

dibyom commented Jun 10, 2020

/lgtm

@tekton-robot tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Jun 10, 2020
@tekton-robot tekton-robot merged commit fc41889 into tektoncd:master Jun 10, 2020
@dibyom dibyom mentioned this pull request Jun 16, 2020
Closed
@tragiclifestories tragiclifestories mentioned this pull request Jun 30, 2020
Closed
3 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@dibyom dibyom dibyom approved these changes

@bobcatfish bobcatfish Awaiting requested review from bobcatfish

@ncskier ncskier Awaiting requested review from ncskier

Assignees

@dibyom dibyom

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@tragiclifestories @tekton-robot @dibyom @lawrencejones