ROX-33328: Avoid cache re-poisoning during coalesced fetches #19600
Draft
clickboo wants to merge 1 commit intoboo-adm-cntrl-targeted-invalidation-foundationfrom
Draft
ROX-33328: Avoid cache re-poisoning during coalesced fetches #19600clickboo wants to merge 1 commit intoboo-adm-cntrl-targeted-invalidation-foundationfrom
clickboo wants to merge 1 commit intoboo-adm-cntrl-targeted-invalidation-foundationfrom
Conversation
Contributor
Author
|
This change is part of the following stack: Change managed by git-spice. |
|
Skipping CI for Draft Pull Request. |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Contributor
|
Images are ready for the commit at e994f13. To use with deploy scripts, first |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## boo-adm-cntrl-targeted-invalidation-foundation #19600 +/- ##
===============================================================================
Coverage 49.28% 49.28%
===============================================================================
Files 2735 2735
Lines 206215 206265 +50
===============================================================================
+ Hits 101636 101666 +30
- Misses 97038 97058 +20
Partials 7541 7541
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
6836bf6 to
4d98322
Compare
4031ed6 to
348220e
Compare
4d98322 to
e994f13
Compare
9 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds support for targeted image cache invalidation in the admission controller. Admission controller can now process
AdmCtrlImageCacheInvalidationmessages that remove only the required entries.Problem: Today, any image change (re-enrichment, vulnerability deferral, deletion) and reprocessing triggers a full cache purge in the admission controller via the
CacheVersionmechanism. This evicts all cached scan results, causing a burst of redundant image fetch calls until the cache repopulates.Solution: The admission controller now accepts targeted invalidation messages via a new
image_cache_invalidationfield inMsgToAdmissionControl. For each image key, it removes the specific entry fromimageCache, clears the corresponding name mapping inimageNameToImageCacheKey, and resets any in-flight coalesced fetch viaForget.Generation counter for stale-write prevention: A targeted invalidation can race with an in-flight fetch: the fetch starts before the invalidation, the invalidation clears the cache, then the fetch completes and writes stale data back. To prevent this, a per-key generation counter (
imageGenTracker) is incremented on invalidation. In-flight fetches capture a generation snapshot before the fetch call and compare it after — if the generation changed, the result is not cached. This ensures invalidation takes effect immediately rather than being masked for up to 30 minutes (the cache TTL). It is noteworthy that after all the cache optimizations the goal is to increase the TTL to 2 hours.Stacked on the proto PR #19597 that introduces the
AdmCtrlImageCacheInvalidationmessage type.AI-assisted.
User-facing documentation
Testing and quality
Automated testing
How I validated my change