Comments (1)
From reading extensively, the system is using Group Replication, which means that each server is tuned to avoid using auto-indexed values that might be used elsewhere. This prevents the need to ensure that the same ID isn't issued in two different servers at the same time, as might occur when switching the primary write server.
In two servers, this would mean each generates ids with sequences that might resemble:
- server 1 - 1, 3, 5, 7, 9
- server 2 - 2, 4, 6, 8, 10
Under normal operations, only one server is generating IDs at a time, and to ensure better interoperability with programs that assume incrementing ids, on post-cutover most systems generate their "next" id higher than the last one they know was used.
So a sequence might look like 1, 3, 5, 7, 8, 10, 12 when a cutover occurs at the 7 to 8 transition. This means that there is no guaranteed skip pattern that can be followed to match the server, because there is no guarantee that the replication cluster didn't get a new primary write server after any specifically used ID.
The logic to ensure no ids are skipped will work without error as-is, so the concerns moving forward are about reducing resource consumption (the original goal of the entire effort). Without database replication, the logic will work very efficiently. With replication of this form, each added entry will suffer polling costs for 24 hours (the longest a transaction remains open on these platforms) and then will be efficient.
We are currently investigating suitable backoff algorithms that will still keep the main logic as-is with reduced polling for skipped ids that linger for longer than a few minutes. This should reduce the current cost of skipped ids for the first 24 hours, while preserving the zero maintenance performance costs of entries that are static beyond 24 hours.
from spire.
Related Issues (20)
- server, agent: Allow specifying CA when fetching bundles HOT 3
- Release SPIRE v1.10.1
- spire-agent health check report spire_agent_rpc_workload_api_fetch_x509_bundles{status="PermissionDenied"} metrics HOT 1
- [Event-based entry cache] replayMissedEvents queries DB in loop for every missed ID HOT 4
- [Event-based entry cache] New server config for `sql_transaction_timeout` is not propagated to endpoints config
- 929 SDS connections for stress testing, Spire agent experience memory leaks. HOT 5
- Filter cache update reads to only read each entry once, when an entry has two events in the same refresh cycle. HOT 1
- RFC: Hybrid Node Attestor
- Enable SyncAuthorizedEntries by default
- The spire-agent k8s workload attestor wont refresh kubelet ca if it changes on disk HOT 2
- Force rotation of intermediates using a tainted authority
- Feature to delete individual keys from trust bundle HOT 4
- Document SyncAuthorizedEntries experimental flag in agent
- Remove public key from stored slots
- Propagation of the tainted bit in bundleutil and server/api functions
- s3 bundlePublisher for other implementations
- Allow enabling the LocalAuthority API and related CLI commands through the `forced_rotation` feature flag
- Allow enabling the LocalAuthority API and related CLI commands through an experimental setting instead of a feature flag
- Lack of Automated Test for Batchx509SVID RPC Operation
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from spire.