{"action":"created","issue":{"url":"https://api.github.com/repos/lyft/metadataproxy/issues/1","repository_url":"https://api.github.com/repos/lyft/metadataproxy","labels_url":"https://api.github.com/repos/lyft/metadataproxy/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/lyft/metadataproxy/issues/1/comments","events_url":"https://api.github.com/repos/lyft/metadataproxy/issues/1/events","html_url":"https://github.com/lyft/metadataproxy/issues/1","id":138018209,"number":1,"title":"Add a gevent pool for refreshing STS assumed credentials","user":{"login":"ryan-lane","id":1538354,"avatar_url":"https://avatars.githubusercontent.com/u/1538354?v=3","gravatar_id":"","url":"https://api.github.com/users/ryan-lane","html_url":"https://github.com/ryan-lane","followers_url":"https://api.github.com/users/ryan-lane/followers","following_url":"https://api.github.com/users/ryan-lane/following{/other_user}","gists_url":"https://api.github.com/users/ryan-lane/gists{/gist_id}","starred_url":"https://api.github.com/users/ryan-lane/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ryan-lane/subscriptions","organizations_url":"https://api.github.com/users/ryan-lane/orgs","repos_url":"https://api.github.com/users/ryan-lane/repos","events_url":"https://api.github.com/users/ryan-lane/events{/privacy}","received_events_url":"https://api.github.com/users/ryan-lane/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/lyft/metadataproxy/labels/medium","name":"medium","color":"fef2c0"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-03-02T22:53:00Z","updated_at":"2016-06-27T18:17:56Z","closed_at":null,"body":"The metadata proxy can know when IAM credentials are about to expire. We should add a gevent pool that runs occasionally, checks to see if any credentials need to be renewed, and renew them before they expire. The goal is to remove the STS assume from the critical path of the application, as the STS assume can be a bit slow."},"comment":{"url":"https://api.github.com/repos/lyft/metadataproxy/issues/comments/228829838","html_url":"https://github.com/lyft/metadataproxy/issues/1#issuecomment-228829838","issue_url":"https://api.github.com/repos/lyft/metadataproxy/issues/1","id":228829838,"user":{"login":"ryan-lane","id":1538354,"avatar_url":"https://avatars.githubusercontent.com/u/1538354?v=3","gravatar_id":"","url":"https://api.github.com/users/ryan-lane","html_url":"https://github.com/ryan-lane","followers_url":"https://api.github.com/users/ryan-lane/followers","following_url":"https://api.github.com/users/ryan-lane/following{/other_user}","gists_url":"https://api.github.com/users/ryan-lane/gists{/gist_id}","starred_url":"https://api.github.com/users/ryan-lane/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ryan-lane/subscriptions","organizations_url":"https://api.github.com/users/ryan-lane/orgs","repos_url":"https://api.github.com/users/ryan-lane/repos","events_url":"https://api.github.com/users/ryan-lane/events{/privacy}","received_events_url":"https://api.github.com/users/ryan-lane/received_events","type":"User","site_admin":false},"created_at":"2016-06-27T18:17:56Z","updated_at":"2016-06-27T18:17:56Z","body":"The code does currently cache credentials, so once a role is fetched via STS it'll return well within 1s. This issue is describing what you describe otherwise. When credentials are about to expire, the proxy itself should renew so that containers don't need to refetch.\r\n\r\nprefetching is... difficult, because you don't know what roles you'll need to fetch. If you know which roles are going to be ahead of time it's definitely possible as an end-user to prewarm the cache by running a few containers that just curl the IAM endpoints before starting any other containers."}}
{"actor":{"display_login":"ryan-lane"}}