gpg_cache memory behavior different than disk
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 15.7k
- Forks
- 5.6k
- Avg merge
- 2d 44m
- Merged PRs (30d)
- 80
Description
Description
gpg_cache is used to decrease gpg_render time. With disk type cache the per-render state is persisted between render calls and master workers. With the memory type the expectation is a memory backed cache that is persisted between render calls and limited to a single master worker (not a global cache). These expectations are based on the pillar cache documentation and experience.
In testing I see the memory cache is instantiated per gpg-render call, so the memory cache does not reduce render times. Repeating the same tests with the disk backed cache shows reduction in gpg-render time.
Setup
Normal classic-package master setup with gpg setup per salt docs. gpg_cache setup per config below
Please be as specific as possible and give set-up details.
- on-prem machine
- VM (Virtualbox, KVM, etc. please specify)
- VM running on a cloud service, please be explicit and add details
- classic packaging
Steps to Reproduce the behavior
- Setup a gpg key and encrypt a value per https://docs.saltproject.io/en/latest/ref/renderers/all/salt.renderers.gpg.html
- Setup master to use GPG_cache
gpg_cache: True
gpg_cache_ttl: 3600
gpg_cache_backend: memory
- Enable profile logging
- Observe gpg performance between multiple runs
Expected behavior
The memory cache will reduce gpg render times by caching the result (per-worker is fine). When adding extra tracing statements to the _decrypt_ciphertext function in renderers/gpg.py we see cache is empty at the start of the render even if in the previous run we added the value.
Versions Report
salt --versions-report
(Provided by running salt --versions-report. Please also mention any differences in master/minion versions.)Salt Version:
Salt: 3005.1
Dependency Versions:
cffi: Not Installed
cherrypy: Not Installed
dateutil: 2.8.1
docker-py: Not Installed
gitdb: 4.0.5
gitpython: 3.1.14
Jinja2: 2.11.3
libgit2: Not Installed
M2Crypto: Not Installed
Mako: Not Installed
msgpack: 1.0.0
msgpack-pure: Not Installed
mysql-python: 1.4.4
pycparser: Not Installed
pycrypto: Not Installed
pycryptodome: 3.9.7
pygit2: Not Installed
Python: 3.9.2 (default, Feb 28 2021, 17:03:44)
python-gnupg: Not Installed
PyYAML: 5.3.1
PyZMQ: 20.0.0
smmap: 4.0.0
timelib: Not Installed
Tornado: 4.5.3
ZMQ: 4.3.4
System Versions:
dist: debian 11 bullseye
locale: utf-8
machine: x86_64
release: 5.10.0-18-amd64
system: Linux
version: Debian GNU/Linux 11 bullseye```
</details>
**Additional context**
After the additional DEBUG statements I observe that the cache is not persisted across renders even within the same highstate.
`
2023-06-08 15:54:55,796 [salt.loaded.int.render.gpg:346 ][DEBUG ][960181] GPG_CACHE NOT EXIST
2023-06-08 15:54:55,796 [salt.loaded.int.render.gpg:370 ][DEBUG ][960181] Current pillar cache: {'minion_cache_path': '/var/cache/salt/master/gpg_cache'}
2023-06-08 15:54:55,796 [salt.loaded.int.render.gpg:371 ][DEBUG ][960181] gpg-cache-open
2023-06-08 15:54:55,822 [salt.loaded.int.render.gpg:403 ][DEBUG ][960181] gpg-cache-write
2023-06-08 15:54:55,823 [salt.loaded.int.render.gpg:370 ][DEBUG ][960181] Current pillar cache: {'minion_cache_path': '/var/cache/salt/master/gpg_cache', XXXXXXXXXX}
2023-06-08 15:54:55,823 [salt.loaded.int.render.gpg:371 ][DEBUG ][960181] gpg-cache-open
2023-06-08 15:54:55,848 [salt.loaded.int.render.gpg:403 ][DEBUG ][960181] gpg-cache-write
2023-06-08 15:54:55,849 [salt.template :23 ][PROFILE ][960181] Time (in seconds) to render ':string:' using 'gpg' renderer: 0.05351614952087402
2023-06-08 15:54:55,855 [salt.utils.lazy :99 ][DEBUG ][960181] LazyLoaded gpg.render
2023-06-08 15:54:55,856 [salt.loaded.int.render.gpg:346 ][DEBUG ][960181] GPG_CACHE NOT EXIST
2023-06-08 15:54:55,856 [salt.loaded.int.render.gpg:370 ][DEBUG ][960181] Current pillar cache: {'minion_cache_path': '/var/cache/salt/master/gpg_cache'}
2023-06-08 15:54:55,856 [salt.loaded.int.render.gpg:371 ][DEBUG ][960181] gpg-cache-open
2023-06-08 15:54:55,880 [salt.loaded.int.render.gpg:403 ][DEBUG ][960181] gpg-cache-write
2023-06-08 15:54:55,880 [salt.loaded.int.render.gpg:370 ][DEBUG ][960181] Current pillar cache: {'minion_cache_path': '/var/cache/salt/master/gpg_cache', XXXXXXXXXX}`
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in renderers/gpg.py, especially _decrypt_ciphertext and the cache initialization and write paths shown in the report. Reproduce repeated gpg renders with the memory backend and compare them with disk caching. Done means the memory cache persists between render calls within a master worker and reduces repeated render time as expected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend, performance, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100