Optimize storage call for secondary unused issuer in loadCertResourceAnyIssuer - #407
Open
mbardelmeijer wants to merge 2 commits into
Open
Optimize storage call for secondary unused issuer in loadCertResourceAnyIssuer#407mbardelmeijer wants to merge 2 commits into
mbardelmeijer wants to merge 2 commits into
Conversation
By default, loading a certificate reads every configured issuer and serves the newest resource. That costs a storage round-trip per issuer on every load, including for issuers that have never issued for that name — the usual case for a failover CA. When LoadFirstUsableCert is set, a load stops once a preferred issuer has a certificate that does not need renewal. Issuers with no cert, or with one due for renewal, are still read so failover certificates are found and the newest still wins when none is usable.
Resolve loadCertResourceAnyIssuer conflict by keeping LocalCache's storage parameter alongside LoadFirstUsableCert early-exit logic.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Open to suggestions on this!
The primary goal is to avoid touching the second issuer on certificate load if the first issuer's certificate is sufficient.
This was discovered with #402, where the local cache was serving the 3 files, but then a ground truth storage call was made (1 extra storage call), for the second issuer.
Made it opt-in now, but we can also rework it so it's always applied.
Summary
Config.LoadFirstUsableCert. When set, loading a certificate stops reading further issuers once a preferred one has a usable certificate (one that does not need renewal), avoiding storage round-trips for unused failover issuers.renewalInfohelper used by the early-exit check andmanagedCertNeedsRenewal.