Bot Detection Signing Key Rotation triggers synchronous WASM reload causing CPU spikes every 5 minutes

Abierto
  • ¿Algo no está bien?
#4,795 2 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 2 días

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
38/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
go, wasm
Área
backend, security

Línea de trabajo

Start by tracing the AppSec engine’s Bot Detection signing-key rotation timer and the synchronous WASM reload it triggers; the issue does not name specific files or tests. Confirm the reload’s timing and CPU impact, then determine which proposed direction fits the project. Done means rotation no longer causes the reported recurring CPU spike while preserving key rotation behavior.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

needs/kind needs/triage

Description

When CrowdSec AppSec Bot Detection is enabled, the Signing Key Rotation mechanism triggers a synchronous WASM module reload every 5 minutes (default rotation_interval=5m0s). This causes a predictable CPU spike lasting 4-5 seconds on small-instance deployments, during which the WASM runtime consumes 100% of a single core. On 2-core machines under concurrent load, this can cause request latency degradation or brief service unavailability.

The CPU spike is traffic-independent — it occurs at fixed intervals regardless of request volume, confirming it is an internal timer-driven operation rather than a response to incoming traffic.

Cause Analysis

The CPU spike is caused by the Bot Detection Signing Key Rotation timer (rotation_interval=5m0s), which triggers a synchronous WASM module reload in the AppSec engine. Key evidence:

  1. Spike timing aligns exactly with rotation_interval (not with traffic patterns or cron jobs)
  2. CrowdSec log shows: WAF challenge runtime initialized ... rotation_interval=5m0s
  3. Memory profile shows full WASM module deallocation + reallocation cycle
  4. The operation is single-threaded and blocks the AppSec runner during reload
  5. Multiple signing keys would make this WORSE (more frequent reloads), not better

Suggested Improvements

  1. Async WASM hot-reload: Perform signing key rotation and WASM module swap in a background goroutine, swapping the active module atomically after preparation completes
  2. Configurable rotation interval: Allow users to tune rotation_interval based on their security/performance tradeoff (e.g., 15m or 30m for small instances)
  3. Lazy rotation: Only rotate when the current key has been used for N challenges, rather than on a fixed timer
  4. WASM module pooling: Pre-allocate the new WASM instance before tearing down the old one to reduce memory allocation pressure
Lenguaje dominante
Go
Estrellas
15.1k
Forks
726
Merge medio
2 d 51 min
PR fusionados (30 d)
18

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de crowdsecurity/crowdsec

Todos los issues de crowdsecurity/crowdsec

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.