Commit Graph

6 Commits

Author SHA1 Message Date
inosato
27de641f75 Remove ioutil from client-go
Signed-off-by: inosato <si17_21@yahoo.co.jp>

Kubernetes-commit: 88dfa51b6003c90e8f0a0508939a1d79950a40df
2022-07-30 20:54:41 +09:00
Nic Cope
761f55c9e0 Use SHA256 sums to verify discovery cache integrity
This is a little more computationally expensive but reduces the
likelihood of a potentially malicious cache collision.

Signed-off-by: Nic Cope <nicc@rk0n.org>

Kubernetes-commit: c5957c284e1d23bdadc98fbbe2bb481fc1f345d4
2022-07-26 23:51:01 -07:00
Nic Cope
1ea239faa5 Use checksums instead of fsyncs to manage discovery cache corruption
Part of the API discovery cache uses an HTTP RoundTripper that
transparently caches responses to disk. The upstream implementation of
the disk cache is hard coded to call Sync() on every file it writes.
This has noticably poor performance on modern Macs, which ask their disk
controllers to flush all the way to persistant storage because Go uses
the `F_FULLFSYNC` fnctl. Apple recommends minimizing this behaviour in
order to avoid degrading performance and increasing disk wear.

The content of the discovery cache is not critical; it is indeed just a
cache and can be recreated by hitting the API servers' discovery
endpoints. This commit replaces upstream httpcache's diskcache
implementation with a similar implementation that can use CRC-32
checksums to detect corrupted cache entries at read-time. When such an
entry is detected (e.g. because it was only partially flushed to
permanent storage before the host lost power) the cache will report a
miss. This causes httpcache to fall back to its underlying HTTP
transport (i.e. the real API server) and re-cache the resulting value.

Apart from adding CRC-32 checksums and avoiding calling fsync this
implementation differs from upstream httpcache's diskcache package in
that it uses FNV-32a hashes rather than MD5 hashes of cache keys in
order to generate filenames.

Signed-off-by: Nic Cope <nicc@rk0n.org>

Kubernetes-commit: 7a2c6a432f9e8db8b84abe5607843429f8bff417
2022-06-28 19:15:49 -07:00
Nic Cope
76fccca0ea Add a benchmark for the discovery cache RoundTripper
This benchmark is intended to demonstrate a performance improvement
gained by removing fsyncs. Refer to the below issue for more detail.

https://github.com/kubernetes/kubernetes/issues/110753

Signed-off-by: Nic Cope <nicc@rk0n.org>

Kubernetes-commit: eace46906512b99c23ad9635edc2ea055363a602
2022-06-28 19:40:58 -07:00
Yucheng Wu
790a4f6363 fix CVE-2019-11244: kubectl --http-cache=<world-accessible dir> creates world-writeable cached schema files
Kubernetes-commit: f228ae3364729caed59087e23c42868454bc3ff4
2019-05-14 14:49:38 +08:00
Chao Xu
9e44a08cb1 Moved memory-cached and disk-cached discovery to their own packages
Kubernetes-commit: 6666049898f93932655fef24f807bc4d6e439fc6
2018-12-19 13:32:56 -08:00