perf: name upstream CA SDS secrets after their source object by zhaohuabing · Pull Request #10127 · envoyproxy/gateway

zhaohuabing · 2026-09-28T03:53:54Z

An upstream CA SDS secret was named after the policy reading it, so several BackendTLSPolicies referencing one ConfigMap each emitted a secret holding identical bytes. This PR names the secret after the source object instead, so one Kubernetes object yields one SDS secret and the xDS snapshot stops carrying the duplicates.

A single caCertificateRefs entry gives <kind>/<namespace>/<name>, for example configmap/ns1/ca-cmap.
Several refs join with commas in declared order.
ClusterTrustBundle is cluster-scoped, so it has no namespace segment.

Because the name now identifies the content, the digest added in #10072 is redundant. Xds.CACertificates is keyed by name and TLSCACertificate.Digest is gone.

This is a breaking change for EnvoyPatchPolicies and extension servers matching the old names, and several policies can now share one secret, so a patch against it reaches all of them.

netlify · 2026-09-28T03:54:03Z

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	`133e3a3`
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6abc6e4487b26e0008299907
😎 Deploy Preview	https://deploy-preview-10127--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

codecov · 2026-09-28T04:06:52Z

Codecov Report

❌ Patch coverage is 98.38710% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 81.42%. Comparing base (a6a58d0) to head (133e3a3).

Files with missing lines	Patch %	Lines
internal/gatewayapi/backendtlspolicy.go	97.56%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #10127      +/-   ##
==========================================
- Coverage   81.42%   81.42%   -0.01%     
==========================================
  Files         266      266              
  Lines       41300    41305       +5     
==========================================
+ Hits        33630    33634       +4     
- Misses       7669     7670       +1     
  Partials        1        1

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

zhaohuabing · 2026-09-28T16:46:54Z

/retest

zhaohuabing · 2026-09-29T04:46:34Z

/retest

zhaohuabing · 2026-09-29T09:09:09Z

-// once per subscriber. Many destinations validating against one CA is the shape that
-// dominates the control-plane heap, so it compares the bundle carried per destination
-// against a single shared entry in Xds.CACertificates that destinations name.
-func BenchmarkXdsIRDeepCopy(b *testing.B) {


We don't need a separate benchmark test for this.

zhaohuabing · 2026-09-29T09:14:51Z

      - path: /dev/stdout
    caCertificates:
    - certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
-      digest: sha256-57dbd4ac94f613100dbef91c32f552ed648325104e44de707cee1a0cae69eaed


This PR deduplicates CA bundles by source-object name instead of content digest and also deduplicates the emitted SDS secrets. Compared with digest-based deduplication, it may save less control-plane memory when different objects from different namespaces contain identical CA data. The tradeoff is simpler lookup and registration logic.

zhaohuabing · 2026-09-29T16:46:22Z

/retest

Extract the truncate-and-hash primitives behind sdsClusterNameFromURL into internal/utils/naming so other xDS name builders can reuse them. Bounded hashes only when the name exceeds the budget. sdsClusterNameFromURL keeps hashing unconditionally, because rewriting "/" to "_" already collapses distinct socket addresses, so its readable part cannot carry the identity. Its output is unchanged. Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io>

An upstream CA SDS secret was named after the policy reading it, so N BackendTLSPolicies referencing one ConfigMap produced N secrets holding identical bytes. Name it after the source object instead — "<kind>/<namespace>/<name>", joined by "," for multiple refs in declared order — so one Kubernetes object yields one SDS secret. The name now identifies the content, so the digest envoyproxy#10072 added is redundant: Xds.CACertificates is keyed by name and TLSCACertificate.Digest is gone. The registry also subsumes ResolvedCAMap, and does it better, since it skips re-reading refs across different policies sharing a source rather than only repeats of one policy. Renaming alone collapses nothing: the emit site in addXdsCluster bypassed the name dedupe in addXdsSecret and is guarded only by cluster name, so it re-added the secret once per cluster. It now goes through addXdsSecret. TLSCACertificate.Certificate stays. Downstream validation and the in-process TLS paths — ToTLSConfig for the OIDC discovery client, proxy metrics, and the two applyBackendTLSSetting callers with no gateway IR in scope — read those inline bytes directly. The kind prefix is load-bearing: a Secret and a ConfigMap of the same name in one namespace hold different bytes and would otherwise share a name. caRefNameSegment and the byte loop share one supportedCAKind predicate so a name can never identify a bundle it was not built from. Fixes envoyproxy#10100 Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io>

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io>

TruncateToBytes looped forever on a negative budget: once the string is empty DecodeLastRuneInString returns size 0, so the slice never shrinks and the length test never fails. Bounded reached that whenever the name was over budget and maxBytes was below the 17-byte suffix, hanging the caller's goroutine rather than panicking. Unreachable at the 512-byte budget this PR uses, but these are exported helpers, so clamp the budget and keep the hash when there is no room for a readable head — the hash is what makes the name unique. Also correct the release notes: envoyproxy#10072's still described referencing bundles by a content digest, which this PR removes, and the breaking note omitted that a cluster-scoped ClusterTrustBundle has no namespace segment. Record why sharing cannot lose an SDS config, and why the upstream CA secret must stay content-only now that addXdsSecret dedupes on name without comparing what it already holds. Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io>

Clarify CA reference lookup and bundle registration, and skip already registered names without comparing certificate bytes. Remove the helper test file and shorten source-based CA secret names to 128 bytes. Trim explanatory comments and the release note, and remove the superseded release note for envoyproxy#10072. Remove the CA benchmarks introduced by envoyproxy#10072 and their updates in this branch. Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io>

Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io>

zhaohuabing · 2026-09-30T04:46:59Z

/retest

zhaohuabing added this to the v1.10.0-rc.1 Release milestone Sep 29, 2026

zhaohuabing requested review from arkodg and guydc September 29, 2026 06:58

zhaohuabing marked this pull request as ready for review September 29, 2026 08:50

zhaohuabing requested a review from a team as a code owner September 29, 2026 08:50

zhaohuabing force-pushed the ca-secret-source-naming branch from 961fd99 to 8ff0165 Compare September 29, 2026 09:04

zhaohuabing commented Sep 29, 2026

View reviewed changes

zhaohuabing force-pushed the ca-secret-source-naming branch from 8ff0165 to 268896a Compare September 29, 2026 09:09

zhaohuabing commented Sep 29, 2026

View reviewed changes

zhaohuabing and others added 8 commits September 30, 2026 02:00

docs: name release note fragments after the PR

63390b0

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com> Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io>

fix: namespace upstream CA SDS secret names

4129115

Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io>

fix: distinguish shortened CA names from literal names

de6e57a

Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io>

refactor: simplify upstream CA secret naming

133e3a3

Signed-off-by: Huabing (Robin) Zhao <huabing@tetrate.io>

zhaohuabing force-pushed the ca-secret-source-naming branch from b214e9f to 133e3a3 Compare September 30, 2026 02:04

Navigation Menu

perf: name upstream CA SDS secrets after their source object - #10127

perf: name upstream CA SDS secrets after their source object#10127
zhaohuabing wants to merge 8 commits into
envoyproxy:mainfrom
zhaohuabing:ca-secret-source-naming

zhaohuabing commented Sep 28, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Sep 28, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Sep 28, 2026 •

edited

Loading

Uh oh!

zhaohuabing commented Sep 28, 2026

Uh oh!

zhaohuabing commented Sep 29, 2026

Uh oh!

zhaohuabing Sep 29, 2026

Uh oh!

zhaohuabing Sep 29, 2026

Uh oh!

zhaohuabing commented Sep 29, 2026

Uh oh!

zhaohuabing commented Sep 30, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

zhaohuabing commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify Bot commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Uh oh!

codecov Bot commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

zhaohuabing commented Sep 28, 2026

Uh oh!

zhaohuabing commented Sep 29, 2026

Uh oh!

zhaohuabing Sep 29, 2026

Choose a reason for hiding this comment

Uh oh!

zhaohuabing Sep 29, 2026

Choose a reason for hiding this comment

Uh oh!

zhaohuabing commented Sep 29, 2026

Uh oh!

zhaohuabing commented Sep 30, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

zhaohuabing commented Sep 28, 2026 •

edited

Loading

netlify Bot commented Sep 28, 2026 •

edited

Loading

codecov Bot commented Sep 28, 2026 •

edited

Loading