adding secret watcher to restart ptp4l process #111

gtannous-spec · 2025-11-24T16:44:07Z

Add sa_file Change Detection for Authentication Secret Updates

Summary

Implement automatic detection of PTP authentication file (sa_file) changes to enable ptp4l process restarts without pod restarts when authentication secrets are updated.

Motivation

When PTP authentication secrets are updated in Kubernetes, the mounted sa_file content changes but linuxptp-daemon had no mechanism to detect this, requiring manual intervention or pod restarts to apply new authentication keys.

Changes

New Components

saFileInfo struct: Tracks authentication file path and hash for each profile
saFileTracker map: Thread-safe tracking of all sa_file paths across profiles
5-second ticker: Periodic check for sa_file content changes

Modified Functions

Run(): Added sa_file monitoring ticker alongside existing ConfigMap change detection
applyNodePTPProfiles(): Calls updateSaFileTracking() after profiles are applied

New Functions

computeFileHash(): Generic SHA256 hash computation (works with any file content/format)
extractSaFileFromConf(): Parses sa_file path from ptp4lConf global section
checkSaFileChanges(): Compares current file hash with stored hash for all tracked files
updateSaFileTracking(): Initializes/updates tracking when profiles change

Behavior

Every 5 seconds, checks if tracked sa_file content changed (via SHA256 hash)
When change detected, triggers applyNodePTPProfiles() to restart ptp4l process
Uses same restart mechanism as ConfigMap changes (no pod restart)

Detection Timeline

Kubernetes kubelet sync: ~60 seconds (cluster setting)
Our check interval: 0-5 seconds (ticker polling)
Process restart: 3-5 seconds
Total delay: ~60-70 seconds for authentication changes to apply

Benefits

✅ No pod restarts for authentication secret updates
✅ Consistent with ConfigMap change handling
✅ Generic (works with any authentication format)
✅ Thread-safe for multiple profiles
✅ Simple ticker-based implementation

github-actions · 2025-11-24T16:44:15Z

Thanks for your PR,
Best regards.

josephdrichard · 2025-11-24T17:57:11Z

pkg/daemon/daemon.go

 	chronydProcessName, // there can be only one chronyd process in the system
 }

+// saFileInfo tracks authentication file information for a profile


What specifically is sa short for in this context?

security association, sa_file is an option inside the ptp4lconf's global section where we can add a filepath to mount a specific secret inside the linuxptp-daemon-container.
basically I converted some of the code from the ptpconfig_controller here because the file watcher forces a restart on the pods in case a change is detected on the mounted secret, so instead we're having a restart on the ptp4l process.

pkg/daemon/daemon.go

nocturnalastro · 2025-11-25T11:33:30Z

pkg/daemon/daemon.go

+		}
+	}
+
+	return changed


Perhaps you could return the new hash that way you don't have to recompute them again in the update function?

- Replace 5-second ticker with fsnotify event-driven monitoring - Add fsnotify watcher initialization with graceful degradation - Implement restart flood protection using atomic.Bool flag - Filter fsnotify events for Write/Create and ignore hidden files - Setup directory watches for Kubernetes symlink compatibility - Optimize hash computation by reusing hashes for unchanged file paths - Handle fsnotify channel closures and errors gracefully - Add watcher cleanup on daemon shutdown

nocturnalastro · 2025-11-26T11:18:40Z

pkg/daemon/daemon.go

+			}
+			// Filter for relevant events (Write, Create - Kubernetes atomic updates)
+			// Ignore events on temporary/hidden files
+			if event.Op&(fsnotify.Write|fsnotify.Create) == 0 {


Should delete also be handled as a change?

If you mean "deleting the sa_file" then the controller actually removes the volumeMount in case the user delete it from the ptp4lconf or manually from the file system of the container. which forces a restart on the daemonset.

nocturnalastro · 2025-11-26T11:26:28Z

pkg/daemon/daemon.go

+		case err, ok := <-watcherErrors:
+			// fsnotify watcher error
+			if !ok {
+				watcherErrors = nil


Should you recreate the watcher here?

we should keep recreate until watcher is not having error

nocturnalastro · 2025-11-26T11:31:30Z

pkg/daemon/daemon.go

+
+		// Setup fsnotify watch on directory (not file, due to Kubernetes symlinks)
+		if dn.saFileWatcher != nil {
+			dirPath := filepath.Dir(saFilePath)


There should be location where all sa_files are mounted. This path should controlled by the ptp-operator so is known ahead of time.

Instead of relying on the ptpconfig it should just recursively watch all dirs within that path.

That way theirs no need to have this late binding approach it can just be there from the start.

nocturnalastro · 2025-11-26T11:34:30Z

pkg/daemon/daemon.go

+			}
+			glog.Info("PtpConfig change detected, restarting PTP processes")
+			dn.restartInProgress.Store(true)
 			err := dn.applyNodePTPProfiles()


These are not run as goroutines so they are blocking meaning there is no need for this flag.

That's right, there is no concurrent access.. I will fix that

- Add PTP_SEC_FOLDER constant for /etc/ptp-secret-mount/ - Watch security mount folder from daemon startup instead of per-profile - Remove saFileTracker, saFileMutex, and saFileInfo (no longer needed) - Remove checkSaFileChanges, updateSaFileTracking, extractSaFileFromConf - Simplify fsnotify handler: any file change triggers PTP restart - Eliminates late binding complexity since mount path is known ahead of time

…profiles Add extractAuthSettingsForPhc2sys function to parse sa_file, spp, and active_key_id from ptp4lConf [global] section. For grandmaster clock types, automatically inject these authentication settings into the phc2sys configuration to ensure consistent TLV authentication across PTP processes.

josephdrichard reviewed Nov 24, 2025

View reviewed changes

nocturnalastro reviewed Nov 25, 2025

View reviewed changes

gtannous-spec added 2 commits November 25, 2025 15:41

adding secret watcher to restart ptp4l process

5573f2b

gtannous-spec force-pushed the auth-tlv branch from 98fdb45 to a3fcf96 Compare November 25, 2025 15:44

nocturnalastro added the ok-to-test ok to test label Nov 25, 2025

including go.mod file - can ignore this commit

e4f626c

github-actions bot removed the ok-to-test ok to test label Nov 26, 2025

nocturnalastro reviewed Nov 26, 2025

View reviewed changes

josephdrichard added the ok-to-test ok to test label Nov 26, 2025

github-actions bot removed the ok-to-test ok to test label Nov 26, 2025

added fsnotify.Remove to the event case

7cbf06b

gtannous-spec force-pushed the auth-tlv branch from d4bdb68 to 7cbf06b Compare November 27, 2025 00:19

gtannous-spec force-pushed the auth-tlv branch from 16ed150 to 915d95f Compare November 27, 2025 21:55

adding secret watcher to restart ptp4l process #111

Are you sure you want to change the base?

adding secret watcher to restart ptp4l process #111

Uh oh!

Conversation

gtannous-spec commented Nov 24, 2025

Add sa_file Change Detection for Authentication Secret Updates

Summary

Motivation

Changes

New Components

Modified Functions

New Functions

Behavior

Detection Timeline

Benefits

Uh oh!

github-actions bot commented Nov 24, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants