bughelp wantedperformancestale
仓库指标
- 星标
- (10,372 个星标)
- PR 合并指标
- (平均合并 8天 8小时) (30 天内合并 94 个 PR)
描述
A performance degradation issue exists in the KEDA gRPC Metrics Server mTLS certificate rotation logic. When loading TLS credentials, KEDA creates an x509.CertPool once and appends the CA bundle from ca.crt. An fsnotify watcher is started, and on every Kubernetes Secret rotation event (e.g., a ..data change), ca.crt is re-read and certPool.AppendCertsFromPEM(pemClientCA) is called again.
Because the tls.Config created by this function pins ClientCAs and RootCAs to the same long-lived certPool, the CA pool can grow over time for the lifetime of the operator pod when rotations occur.
Recommended Mitigation:
- Rebuild CA Pool: It is recommended to rebuild the CA pool on update rather than continuously appending to the existing pool.
- Safe Swapping: A new CertPool should be recreated from scratch using the latest CA bundle on every rotation event. The active pool should then be safely swapped into the TLS configuration (e.g., via a dynamic callback such as GetConfigForClient or an atomic/mutex-protected pointer), similar in spirit to how the leaf certificate is dynamically rotated.