kedacore/keda

TLS CertPool Monotonic Growth

Fechada

#7.691 aberto em 26 de abr. de 2026

 (3 comentários) (0 reação) (0 responsável)Go (1.457 forks)auto 404
bughelp wantedperformancestale

Métricas do repositório

Stars
 (10.372 estrelas)
Métricas de merge de PR
 (Métricas PR pendentes)

Description

A performance degradation issue exists in the KEDA gRPC Metrics Server mTLS certificate rotation logic. When loading TLS credentials, KEDA creates an x509.CertPool once and appends the CA bundle from ca.crt. An fsnotify watcher is started, and on every Kubernetes Secret rotation event (e.g., a ..data change), ca.crt is re-read and certPool.AppendCertsFromPEM(pemClientCA) is called again.

Because the tls.Config created by this function pins ClientCAs and RootCAs to the same long-lived certPool, the CA pool can grow over time for the lifetime of the operator pod when rotations occur.

Recommended Mitigation:

  • Rebuild CA Pool: It is recommended to rebuild the CA pool on update rather than continuously appending to the existing pool.
  • Safe Swapping: A new CertPool should be recreated from scratch using the latest CA bundle on every rotation event. The active pool should then be safely swapped into the TLS configuration (e.g., via a dynamic callback such as GetConfigForClient or an atomic/mutex-protected pointer), similar in spirit to how the leaf certificate is dynamically rotated.

Guia do colaborador