perf: cache required keys in secrets and configmaps by rudrakhp · Pull Request #8045 · envoyproxy/gateway

rudrakhp · 2026-01-25T19:59:02Z

What type of PR is this?
perf: cache required keys in secrets and configmaps

What this PR does / why we need it:
Including only needed keys in Secret and ConfigMap data to reduce memory usage.

Release Notes: Yes

netlify · 2026-01-25T19:59:10Z

✅ Deploy Preview for cerulean-figolla-1f9435 canceled.

Name	Link
🔨 Latest commit	`97cbc2b`
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/697762af9468f400084e89a5

codecov · 2026-01-25T20:09:15Z

Codecov Report

❌ Patch coverage is 87.23404% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 73.78%. Comparing base (fa32a93) to head (97cbc2b).
⚠️ Report is 17 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/provider/kubernetes/helpers.go	87.50%	2 Missing and 2 partials ⚠️
internal/gatewayapi/securitypolicy.go	33.33%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8045      +/-   ##
==========================================
+ Coverage   73.70%   73.78%   +0.08%     
==========================================
  Files         237      237              
  Lines       35703    35744      +41     
==========================================
+ Hits        26314    26374      +60     
+ Misses       7529     7513      -16     
+ Partials     1860     1857       -3

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

arkodg · 2026-01-25T20:09:47Z

internal/provider/kubernetes/kubernetes.go

 )

+var (
+	// cachedConfigMapKeys defines the keys to keep in ConfigMap data cache


for some of these cases we pick the first key if we cant find the desired key, we'll need to make sure we dont include those
cc @zirain

expectedAndFirstFallbackFilter is supposed to handle this (moved it to helpers just now)

zirain · 2026-01-26T10:14:57Z

it would be good to have a test case for fallback to first key of the configmap, maybe change an existing one.

rudrakhp · 2026-01-26T10:31:48Z

Added unit tests for the transform functions, also changed the key in Lua configmap in E2E so it picks first key.

Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

rudrakhp · 2026-01-26T14:06:48Z

internal/provider/kubernetes/helpers.go

+var (
+	// cachedConfigMapKeys defines the keys to keep in ConfigMap data cache
+	cachedConfigMapKeys = map[string]bool{
+		gatewayapi.JWKSConfigMapKey:         true,
+		gatewayapi.LuaConfigMapKey:          true,
+		gatewayapi.ResponseBodyConfigMapKey: true,
+		gatewayapi.CACertKey:                true,
+		gatewayapi.CRLKey:                   true,
+	}
+
+	// cachedSecretKeys defines the keys to keep in Secret data cache
+	cachedSecretKeys = map[string]bool{
+		corev1.TLSCertKey:              true,
+		corev1.TLSPrivateKeyKey:        true,
+		egv1a1.TLSOCSPKey:              true,
+		egv1a1.OIDCClientIDKey:         true,
+		egv1a1.OIDCClientSecretKey:     true,
+		egv1a1.BasicAuthUsersSecretKey: true,
+		egv1a1.InjectedCredentialKey:   true,
+		egv1a1.APIKeysSecretKey:        true,
+		corev1.DockerConfigJsonKey:     true,
+		gatewayapi.CACertKey:           true,
+		gatewayapi.CRLKey:              true,
+		hmacSecretKey:                  true,
+	}
+)
+


Do we need to define an unified list instead of different ones for configmap vs secret? I have seen cases where we use secrets and configmaps interchangeably using SecretObjectReference.

this is fine, we can add comments to remind devs to add to both places

zhaohuabing · 2026-01-28T05:31:31Z

This looks good - just curious, are people putting other keys in the Secret/ConfigMaps that aren't required?

arkodg

LGTM thanks

rudrakhp · 2026-01-28T06:51:02Z

This looks good - just curious, are people putting other keys in the Secret/ConfigMaps that aren't required?

Might be sharing configmap for multiple purposes @zhaohuabing

Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Signed-off-by: Sadmi Bouhafs <sadmibouhafs@gmail.com>

nobbs · 2026-02-09T20:26:46Z

This PR introduced a regression for API key authentication when secrets contain multiple client IDs.

Issue: The expectedAndFirstFallbackFilter logic keeps only predefined keys plus the first key alphabetically. For API key secrets, client IDs are arbitrary keys (e.g., client1, client2, client3), not the predefined credentials key (that's at least the documentation and implementation). This results in all clients except the lexicographically first one being dropped from the cache.

Example:

apiVersion: v1
kind: Secret
metadata:
  name: apikey-secret
data:
  client1: a2V5MQ==  # cached ✓
  client2: a2V5Mg==  # dropped ✗
  client3: a2V5Mw==  # dropped ✗

Impact: Authentication fails for all API keys except the first client ID alphabetically.

Affected: v1.7.0 and main branch

Tracking issue: #8227

Fixes API key authentication bug where secrets with multiple client IDs were incorrectly filtered, keeping only the first client ID alphabetically. The filter now detects when NO predefined keys exist in the data and preserves all keys in that case. This handles API key secrets where each key represents a client ID, as well as any other similar use cases. Changes: - Modified expectedAndFirstFallbackFilter to check if any predefined keys exist before filtering - If no predefined keys found, all keys are preserved - Updated tests to reflect new expected behavior Fixes envoyproxy#8227 Related to envoyproxy#8045

Fixes API key authentication bug where secrets with multiple client IDs were incorrectly filtered, keeping only the first client ID alphabetically. The filter now detects when NO predefined keys exist in the data and preserves all keys in that case. This handles API key secrets where each key represents a client ID, as well as any other similar use cases. Changes: - Modified expectedAndFirstFallbackFilter to check if any predefined keys exist before filtering - If no predefined keys found, all keys are preserved - Updated tests to reflect new expected behavior Fixes envoyproxy#8227 Related to envoyproxy#8045 Signed-off-by: Alexej Disterhoft <alexej@disterhoft.de>

rudrakhp requested a review from a team as a code owner January 25, 2026 19:59

rudrakhp force-pushed the perf_cm_secret_cache branch from 0a572e5 to 641eb3d Compare January 25, 2026 19:59

arkodg reviewed Jan 25, 2026

View reviewed changes

rudrakhp force-pushed the perf_cm_secret_cache branch 4 times, most recently from 7606860 to d36bcdb Compare January 26, 2026 08:58

rudrakhp force-pushed the perf_cm_secret_cache branch from d36bcdb to 0e2495e Compare January 26, 2026 10:21

rudrakhp force-pushed the perf_cm_secret_cache branch 2 times, most recently from 1ffdf7e to a1b45b0 Compare January 26, 2026 11:08

rudrakhp requested review from arkodg and zirain January 26, 2026 11:31

zirain previously approved these changes Jan 26, 2026

View reviewed changes

perf: cache required keys in secrets and configmaps

97cbc2b

Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

rudrakhp dismissed zirain’s stale review via 97cbc2b January 26, 2026 12:48

rudrakhp force-pushed the perf_cm_secret_cache branch from a1b45b0 to 97cbc2b Compare January 26, 2026 12:48

zirain approved these changes Jan 26, 2026

View reviewed changes

rudrakhp commented Jan 26, 2026

View reviewed changes

cnvergence added this to the v1.7.0-rc.1 Release milestone Jan 27, 2026

arkodg approved these changes Jan 28, 2026

View reviewed changes

arkodg merged commit 3e91fdf into envoyproxy:main Jan 28, 2026
36 checks passed

SadmiB pushed a commit to SadmiB/gateway that referenced this pull request Jan 30, 2026

perf: cache required keys in secrets and configmaps (envoyproxy#8045)

3a5b4a6

Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Signed-off-by: Sadmi Bouhafs <sadmibouhafs@gmail.com>

nobbs mentioned this pull request Feb 9, 2026

API key authentication fails when secrets contain multiple client IDs #8227

Closed

nobbs mentioned this pull request Feb 9, 2026

test: demonstrate API key filtering bug with multiple clients nobbs/gateway#1

Closed

zhaohuabing mentioned this pull request Feb 13, 2026

fix: API key auth #8267

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

perf: cache required keys in secrets and configmaps#8045

perf: cache required keys in secrets and configmaps#8045
arkodg merged 1 commit intoenvoyproxy:mainfrom
rudrakhp:perf_cm_secret_cache

rudrakhp commented Jan 25, 2026

Uh oh!

netlify bot commented Jan 25, 2026 •

edited

Loading

Uh oh!

codecov bot commented Jan 25, 2026 •

edited

Loading

Uh oh!

arkodg Jan 25, 2026

Uh oh!

rudrakhp Jan 25, 2026

Uh oh!

zirain commented Jan 26, 2026

Uh oh!

rudrakhp commented Jan 26, 2026 •

edited

Loading

Uh oh!

rudrakhp Jan 26, 2026

Uh oh!

arkodg Jan 28, 2026

Uh oh!

zhaohuabing commented Jan 28, 2026 •

edited

Loading

Uh oh!

arkodg left a comment

Uh oh!

Uh oh!

rudrakhp commented Jan 28, 2026 •

edited

Loading

Uh oh!

nobbs commented Feb 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

rudrakhp commented Jan 25, 2026

Uh oh!

netlify bot commented Jan 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cerulean-figolla-1f9435 canceled.

Uh oh!

codecov bot commented Jan 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

arkodg Jan 25, 2026

Choose a reason for hiding this comment

Uh oh!

rudrakhp Jan 25, 2026

Choose a reason for hiding this comment

Uh oh!

zirain commented Jan 26, 2026

Uh oh!

rudrakhp commented Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rudrakhp Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

arkodg Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

zhaohuabing commented Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

arkodg left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

rudrakhp commented Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nobbs commented Feb 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

netlify bot commented Jan 25, 2026 •

edited

Loading

codecov bot commented Jan 25, 2026 •

edited

Loading

rudrakhp commented Jan 26, 2026 •

edited

Loading

zhaohuabing commented Jan 28, 2026 •

edited

Loading

rudrakhp commented Jan 28, 2026 •

edited

Loading