fix: harden core memory session handling#12366
Conversation
|
Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d96c570ad3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if windowSeconds > 300 { | ||
| windowSeconds = 300 | ||
| } |
There was a problem hiding this comment.
RefreshIfNeeded is now the only place that extends session TTL in SessionAuth and proxy checks, but refreshWindow hard-caps refreshes to 300 seconds. With common values like SessionTimeout=86400, any user activity pattern that does not hit the last 5 minutes of each 24-hour window (for example, periodic requests every 10+ minutes) will still be logged out despite ongoing use, which regresses the previous sliding-expiration behavior that refreshed on every authenticated request.
Useful? React with 👍 / 👎.
| p.sessions[sessionID] = sessionItem{ | ||
| User: user, | ||
| ExpiredAt: expiredAt, |
There was a problem hiding this comment.
The new in-memory store inserts a session entry on every new login/session ID without any global size limit or eviction policy. Because entries live for ttlSeconds (default is long) and login creates fresh IDs, repeated successful logins (e.g., automated clients not reusing cookies) can grow p.sessions unbounded and drive memory pressure/OOM in the API process.
Useful? React with 👍 / 👎.
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: wanghe-fit2cloud The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
3 participants
No description provided.