spiffe / spire

The SPIFFE Runtime Environment
https://spiffe.io
Apache License 2.0
1.81k stars 478 forks source link

Use timestamp to invalidate Kubelet response cache #5620

Closed azdagron closed 3 weeks ago

azdagron commented 3 weeks ago

Changes the K8s workload attestor to invalidate the cache response based on a timestamp instead of kicking off a goroutine.

While this means that the plugin will always have a cached response in memory, it simplifies the code for both the plugin and tests. In practice, only an idle agent would waste memory holding onto the response.

Also fixes a bug wherein the plugin was reading from p.config outside of the config lock (to calculate how long the response should be cached for).