saltstack / saltstack/salt

gpg_cache memory behavior different than disk

Open
#64,464 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug needs-triage Performance Renderers
Dominant language
Python
Stars
15.7k
Forks
5.6k
Avg merge
2d 44m
Merged PRs (30d)
80

Description

Description
gpg_cache is used to decrease gpg_render time. With disk type cache the per-render state is persisted between render calls and master workers. With the memory type the expectation is a memory backed cache that is persisted between render calls and limited to a single master worker (not a global cache). These expectations are based on the pillar cache documentation and experience.
In testing I see the memory cache is instantiated per gpg-render call, so the memory cache does not reduce render times. Repeating the same tests with the disk backed cache shows reduction in gpg-render time.

Setup
Normal classic-package master setup with gpg setup per salt docs. gpg_cache setup per config below

Please be as specific as possible and give set-up details.

  • on-prem machine
  • VM (Virtualbox, KVM, etc. please specify)
  • VM running on a cloud service, please be explicit and add details
  • classic packaging

Steps to Reproduce the behavior

  1. Setup a gpg key and encrypt a value per https://docs.saltproject.io/en/latest/ref/renderers/all/salt.renderers.gpg.html
  2. Setup master to use GPG_cache
gpg_cache: True
gpg_cache_ttl: 3600
gpg_cache_backend: memory
  1. Enable profile logging
  2. Observe gpg performance between multiple runs

Expected behavior
The memory cache will reduce gpg render times by caching the result (per-worker is fine). When adding extra tracing statements to the _decrypt_ciphertext function in renderers/gpg.py we see cache is empty at the start of the render even if in the previous run we added the value.

Versions Report

salt --versions-report (Provided by running salt --versions-report. Please also mention any differences in master/minion versions.)
Salt Version:
          Salt: 3005.1

Dependency Versions:
          cffi: Not Installed
      cherrypy: Not Installed
      dateutil: 2.8.1
     docker-py: Not Installed
         gitdb: 4.0.5
     gitpython: 3.1.14
        Jinja2: 2.11.3
       libgit2: Not Installed
      M2Crypto: Not Installed
          Mako: Not Installed
       msgpack: 1.0.0
  msgpack-pure: Not Installed
  mysql-python: 1.4.4
     pycparser: Not Installed
      pycrypto: Not Installed
  pycryptodome: 3.9.7
        pygit2: Not Installed
        Python: 3.9.2 (default, Feb 28 2021, 17:03:44)
  python-gnupg: Not Installed
        PyYAML: 5.3.1
         PyZMQ: 20.0.0
         smmap: 4.0.0
       timelib: Not Installed
       Tornado: 4.5.3
           ZMQ: 4.3.4

System Versions:
          dist: debian 11 bullseye
        locale: utf-8
       machine: x86_64
       release: 5.10.0-18-amd64
        system: Linux
       version: Debian GNU/Linux 11 bullseye```
</details>

**Additional context**

After the additional DEBUG statements I observe that the cache is not persisted across renders even within the same highstate.
`
2023-06-08 15:54:55,796 [salt.loaded.int.render.gpg:346 ][DEBUG   ][960181] GPG_CACHE NOT EXIST
2023-06-08 15:54:55,796 [salt.loaded.int.render.gpg:370 ][DEBUG   ][960181] Current pillar cache: {'minion_cache_path': '/var/cache/salt/master/gpg_cache'}
2023-06-08 15:54:55,796 [salt.loaded.int.render.gpg:371 ][DEBUG ][960181] gpg-cache-open
2023-06-08 15:54:55,822 [salt.loaded.int.render.gpg:403 ][DEBUG ][960181] gpg-cache-write
2023-06-08 15:54:55,823 [salt.loaded.int.render.gpg:370 ][DEBUG   ][960181] Current pillar cache: {'minion_cache_path': '/var/cache/salt/master/gpg_cache', XXXXXXXXXX}
2023-06-08 15:54:55,823 [salt.loaded.int.render.gpg:371 ][DEBUG ][960181] gpg-cache-open
2023-06-08 15:54:55,848 [salt.loaded.int.render.gpg:403 ][DEBUG ][960181] gpg-cache-write
2023-06-08 15:54:55,849 [salt.template    :23  ][PROFILE ][960181] Time (in seconds) to render ':string:' using 'gpg' renderer: 0.05351614952087402
2023-06-08 15:54:55,855 [salt.utils.lazy  :99  ][DEBUG   ][960181] LazyLoaded gpg.render
2023-06-08 15:54:55,856 [salt.loaded.int.render.gpg:346 ][DEBUG   ][960181] GPG_CACHE NOT EXIST
2023-06-08 15:54:55,856 [salt.loaded.int.render.gpg:370 ][DEBUG   ][960181] Current pillar cache: {'minion_cache_path': '/var/cache/salt/master/gpg_cache'}
2023-06-08 15:54:55,856 [salt.loaded.int.render.gpg:371 ][DEBUG ][960181] gpg-cache-open
2023-06-08 15:54:55,880 [salt.loaded.int.render.gpg:403 ][DEBUG ][960181] gpg-cache-write
2023-06-08 15:54:55,880 [salt.loaded.int.render.gpg:370 ][DEBUG   ][960181] Current pillar cache: {'minion_cache_path': '/var/cache/salt/master/gpg_cache', XXXXXXXXXX}`

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in renderers/gpg.py, especially _decrypt_ciphertext and the cache initialization and write paths shown in the report. Reproduce repeated gpg renders with the memory backend and compare them with disk caching. Done means the memory cache persists between render calls within a master worker and reduces repeated render time as expected.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend, performance, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.