Merge pull request #141 from tnthornton/client-cache-memory-leak

Fix excess memory consumption

cmd/xgql/main.go

@@ -119,7 +119,7 @@ func main() { //nolint:gocyclo
 		agent           = app.Flag("trace-agent", "Address of the Jaeger trace agent as [host]:[port]").TCP()
 		health          = app.Flag("health", "Enable health endpoints.").Default("true").Bool()
 		healthPort      = app.Flag("health-port", "Port used for readyz and livez requests.").Default("8088").Int()
-		cacheExpiry     = app.Flag("cache-expiry", "The duration since last activity by a user until that users client expires.").Default("336h").Duration()
+		cacheExpiry     = app.Flag("cache-expiry", "The duration since last activity by a user until that users client expires.").Default("30m").Duration()
 		profiling       = app.Flag("profiling", "Enable profiling via web interface host:port/debug/pprof/.").Default("true").Bool()
 		cacheFile       = app.Flag("cache-file", "Path to the file used to persist client caches, set to reduce memory usage.").Default("").String()
 		noApolloTracing = app.Flag("disable-apollo-tracing", "Disable apollo tracing.").Bool()

internal/auth/auth.go

@@ -22,6 +22,7 @@ import (
 	"strings"
 
 	"github.com/99designs/gqlgen/graphql/handler/transport"
+	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/client-go/rest"
 )
 
@@ -79,20 +80,17 @@ func (c Credentials) Inject(cfg *rest.Config) *rest.Config {
 //
 //nolint:errcheck // Writing to a hash never returns an error.
 func (c Credentials) Hash(extra []byte) string {
+	// Groups are unordered which will result in different hashes for the same
+	// set of groups.
+	gset := sets.New[string]()
+	gset.Insert(c.Impersonate.Groups...)
+	sortedGroups := sets.List(gset)
+
 	h := sha256.New()
-	h.Write([]byte(c.BearerToken))
-	h.Write([]byte(c.BasicUsername))
-	h.Write([]byte(c.BasicPassword))
 	h.Write([]byte(c.Impersonate.Username))
-	for _, g := range c.Impersonate.Groups {
+	for _, g := range sortedGroups {
 		h.Write([]byte(g))
 	}
-	for k, vs := range c.Impersonate.Extra {
-		h.Write([]byte(k))
-		for _, v := range vs {
-			h.Write([]byte(v))
-		}
-	}
 
 	h.Write(extra)
 	return fmt.Sprintf("%x", h.Sum(nil))

internal/auth/auth_test.go

@@ -92,14 +92,14 @@ func TestCredentialsHash(t *testing.T) {
 					Extra:    map[string][]string{"coolness": {"very"}},
 				},
 			},
-			want: "3a891076971c12916e6e52149563cba9b165017460c3fb7164f07f5bb5d94f18",
+			want: "077ae566a720ee75c24fe72441962d258909a380d0f1bf9da576e88ca8f871cd",
 		},
 		"Extra": {
 			creds: Credentials{
 				BearerToken: "toke-one",
 			},
 			extra: []byte("coolness"),
-			want:  "3a9957abe9a6091449e9a1facbde080fe01a291f62e88f9276a4d39d18be8393",
+			want:  "2d0c7f73540de525665793bb7a8c970ecaaf4c8f9a08920327819803648e4006",
 		},
 	}