{"action":"created","comment":{"url":"https://api.github.com/repos/istio/istio/pulls/comments/184174565","pull_request_review_id":115315774,"id":184174565,"diff_hunk":"@@ -42,20 +44,76 @@ const (\n \t// JwksURI Cache eviction time duration, cache eviction is done on a periodic basis,\n \t// jwksURICacheEviction specifies the frequency at which eviction activities take place.\n \tjwksURICacheEviction = time.Minute * 30\n+\n+\t// JwtPubKeyExpireDuration is the expire duration for JWT public key in the cache.\n+\t// After this duration expire, refresher job will fetch key for the cached item again.\n+\tJwtPubKeyExpireDuration = time.Hour\n+\n+\t// JwtPubKeyEvictionDuration is the life duration for cached item.\n+\t// Cached item will be removed from the cache if it hasn't been used longer than JwtPubKeyEvictionDuration.\n+\tJwtPubKeyEvictionDuration = 24 * 7 * time.Hour\n+\n+\t// JwtPubKeyRefreshInterval is the running interval of JWT pubKey refresh job.\n+\tJwtPubKeyRefreshInterval = time.Minute * 20\n )\n \n-// jwksURIResolver is wrapper of expiringCache for jwksUri.\n-type jwksURIResolver struct {\n-\tcache cache.ExpiringCache\n+// jwtPubKeyEntry is a single cached entry for jwt public key.\n+type jwtPubKeyEntry struct {\n+\tpubKey string\n+\n+\t// Cached item will be fetched again by refresher job if (time.now >= expireTime).\n+\texpireTime time.Time\n+\n+\t// Cached item's last used time, which is set in GetPublicKey.\n+\tlastUsedTime time.Time\n }\n \n-// newJwksURIResolver creates new instance of jwksURIResolver.\n-func newJwksURIResolver() jwksURIResolver {\n-\treturn jwksURIResolver{cache.NewTTL(jwksURICacheExpiration, jwksURICacheEviction)}\n+// jwksResolver is resolver for jwksURI and jwt public key.\n+type jwksResolver struct {\n+\t// cache for jwksURI.\n+\tJwksURICache cache.ExpiringCache\n+\n+\t// cache for JWT public key.\n+\t// map key is jwksURI, map value is jwtPubKeyEntry.\n+\tkeyEntries sync.Map\n+\n+\tclient        *http.Client\n+\tclosing       chan bool\n+\trefreshTicker *time.Ticker\n+\n+\texpireDuration time.Duration\n+\n+\t// Cached key will be removed from cache if (time.now - cachedItem.lastUsedTime >= evictionDuration), this prevents key cache growing indefinitely.\n+\tevictionDuration time.Duration\n+\n+\t// Refresher job running interval.\n+\trefreshInterval time.Duration\n+\n+\t// How may times refresh job has detected JWT public key change happened, used in unit test.\n+\tkeyChangedCount uint64","path":"pilot/pkg/model/jwks_resolver.go","position":74,"original_position":74,"commit_id":"561ebcdcc874c3cfa72bcfe5e5ec0789e808cb67","original_commit_id":"561ebcdcc874c3cfa72bcfe5e5ec0789e808cb67","user":{"login":"costinm","id":84202,"avatar_url":"https://avatars1.githubusercontent.com/u/84202?v=4","gravatar_id":"","url":"https://api.github.com/users/costinm","html_url":"https://github.com/costinm","followers_url":"https://api.github.com/users/costinm/followers","following_url":"https://api.github.com/users/costinm/following{/other_user}","gists_url":"https://api.github.com/users/costinm/gists{/gist_id}","starred_url":"https://api.github.com/users/costinm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/costinm/subscriptions","organizations_url":"https://api.github.com/users/costinm/orgs","repos_url":"https://api.github.com/users/costinm/repos","events_url":"https://api.github.com/users/costinm/events{/privacy}","received_events_url":"https://api.github.com/users/costinm/received_events","type":"User","site_admin":false},"body":"If you really care about keyChangeCount - please add a prometheus.Counter here. \r\n\r\nYou can add prom for other things as well - cache size, number of requests, error codes, etc.\r\n\r\n","created_at":"2018-04-25T19:09:05Z","updated_at":"2018-04-25T19:09:05Z","html_url":"https://github.com/istio/istio/pull/5061#discussion_r184174565","pull_request_url":"https://api.github.com/repos/istio/istio/pulls/5061","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/istio/istio/pulls/comments/184174565"},"html":{"href":"https://github.com/istio/istio/pull/5061#discussion_r184174565"},"pull_request":{"href":"https://api.github.com/repos/istio/istio/pulls/5061"}}},"pull_request":{"url":"https://api.github.com/repos/istio/istio/pulls/5061","id":182636156,"html_url":"https://github.com/istio/istio/pull/5061","diff_url":"https://github.com/istio/istio/pull/5061.diff","patch_url":"https://github.com/istio/istio/pull/5061.patch","issue_url":"https://api.github.com/repos/istio/istio/issues/5061","number":5061,"state":"open","locked":false,"title":"Fetch/cache/refresh JWT public key, construct localJwks in sidecar filter config","user":{"login":"quanjielin","id":32855694,"avatar_url":"https://avatars0.githubusercontent.com/u/32855694?v=4","gravatar_id":"","url":"https://api.github.com/users/quanjielin","html_url":"https://github.com/quanjielin","followers_url":"https://api.github.com/users/quanjielin/followers","following_url":"https://api.github.com/users/quanjielin/following{/other_user}","gists_url":"https://api.github.com/users/quanjielin/gists{/gist_id}","starred_url":"https://api.github.com/users/quanjielin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/quanjielin/subscriptions","organizations_url":"https://api.github.com/users/quanjielin/orgs","repos_url":"https://api.github.com/users/quanjielin/repos","events_url":"https://api.github.com/users/quanjielin/events{/privacy}","received_events_url":"https://api.github.com/users/quanjielin/received_events","type":"User","site_admin":false},"body":"https://github.com/istio/istio/issues/4917\r\n\r\nThis PR includes \r\n1. fetch JWT public key, and cache the key.\r\n2. key rotation - a refresher job refresh key periodically.\r\n3. use the key to construct localJwks in sidecar filter config.","created_at":"2018-04-19T00:19:36Z","updated_at":"2018-04-25T19:09:05Z","closed_at":null,"merged_at":null,"merge_commit_sha":"2673f9b1a56858513afc6b68421bf2f50acaf212","assignee":{"login":"costinm","id":84202,"avatar_url":"https://avatars1.githubusercontent.com/u/84202?v=4","gravatar_id":"","url":"https://api.github.com/users/costinm","html_url":"https://github.com/costinm","followers_url":"https://api.github.com/users/costinm/followers","following_url":"https://api.github.com/users/costinm/following{/other_user}","gists_url":"https://api.github.com/users/costinm/gists{/gist_id}","starred_url":"https://api.github.com/users/costinm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/costinm/subscriptions","organizations_url":"https://api.github.com/users/costinm/orgs","repos_url":"https://api.github.com/users/costinm/repos","events_url":"https://api.github.com/users/costinm/events{/privacy}","received_events_url":"https://api.github.com/users/costinm/received_events","type":"User","site_admin":false},"assignees":[{"login":"costinm","id":84202,"avatar_url":"https://avatars1.githubusercontent.com/u/84202?v=4","gravatar_id":"","url":"https://api.github.com/users/costinm","html_url":"https://github.com/costinm","followers_url":"https://api.github.com/users/costinm/followers","following_url":"https://api.github.com/users/costinm/following{/other_user}","gists_url":"https://api.github.com/users/costinm/gists{/gist_id}","starred_url":"https://api.github.com/users/costinm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/costinm/subscriptions","organizations_url":"https://api.github.com/users/costinm/orgs","repos_url":"https://api.github.com/users/costinm/repos","events_url":"https://api.github.com/users/costinm/events{/privacy}","received_events_url":"https://api.github.com/users/costinm/received_events","type":"User","site_admin":false}],"requested_reviewers":[],"requested_teams":[],"labels":[{"id":491318011,"url":"https://api.github.com/repos/istio/istio/labels/cla:%20yes","name":"cla: yes","color":"bfdadc","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/istio/istio/pulls/5061/commits","review_comments_url":"https://api.github.com/repos/istio/istio/pulls/5061/comments","review_comment_url":"https://api.github.com/repos/istio/istio/pulls/comments{/number}","comments_url":"https://api.github.com/repos/istio/istio/issues/5061/comments","statuses_url":"https://api.github.com/repos/istio/istio/statuses/561ebcdcc874c3cfa72bcfe5e5ec0789e808cb67","head":{"label":"quanjielin:quanlinpk1","ref":"quanlinpk1","sha":"561ebcdcc874c3cfa72bcfe5e5ec0789e808cb67","user":{"login":"quanjielin","id":32855694,"avatar_url":"https://avatars0.githubusercontent.com/u/32855694?v=4","gravatar_id":"","url":"https://api.github.com/users/quanjielin","html_url":"https://github.com/quanjielin","followers_url":"https://api.github.com/users/quanjielin/followers","following_url":"https://api.github.com/users/quanjielin/following{/other_user}","gists_url":"https://api.github.com/users/quanjielin/gists{/gist_id}","starred_url":"https://api.github.com/users/quanjielin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/quanjielin/subscriptions","organizations_url":"https://api.github.com/users/quanjielin/orgs","repos_url":"https://api.github.com/users/quanjielin/repos","events_url":"https://api.github.com/users/quanjielin/events{/privacy}","received_events_url":"https://api.github.com/users/quanjielin/received_events","type":"User","site_admin":false},"repo":{"id":116906556,"name":"istio","full_name":"quanjielin/istio","owner":{"login":"quanjielin","id":32855694,"avatar_url":"https://avatars0.githubusercontent.com/u/32855694?v=4","gravatar_id":"","url":"https://api.github.com/users/quanjielin","html_url":"https://github.com/quanjielin","followers_url":"https://api.github.com/users/quanjielin/followers","following_url":"https://api.github.com/users/quanjielin/following{/other_user}","gists_url":"https://api.github.com/users/quanjielin/gists{/gist_id}","starred_url":"https://api.github.com/users/quanjielin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/quanjielin/subscriptions","organizations_url":"https://api.github.com/users/quanjielin/orgs","repos_url":"https://api.github.com/users/quanjielin/repos","events_url":"https://api.github.com/users/quanjielin/events{/privacy}","received_events_url":"https://api.github.com/users/quanjielin/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/quanjielin/istio","description":"An open platform to connect, manage, and secure microservices.","fork":true,"url":"https://api.github.com/repos/quanjielin/istio","forks_url":"https://api.github.com/repos/quanjielin/istio/forks","keys_url":"https://api.github.com/repos/quanjielin/istio/keys{/key_id}","collaborators_url":"https://api.github.com/repos/quanjielin/istio/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/quanjielin/istio/teams","hooks_url":"https://api.github.com/repos/quanjielin/istio/hooks","issue_events_url":"https://api.github.com/repos/quanjielin/istio/issues/events{/number}","events_url":"https://api.github.com/repos/quanjielin/istio/events","assignees_url":"https://api.github.com/repos/quanjielin/istio/assignees{/user}","branches_url":"https://api.github.com/repos/quanjielin/istio/branches{/branch}","tags_url":"https://api.github.com/repos/quanjielin/istio/tags","blobs_url":"https://api.github.com/repos/quanjielin/istio/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/quanjielin/istio/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/quanjielin/istio/git/refs{/sha}","trees_url":"https://api.github.com/repos/quanjielin/istio/git/trees{/sha}","statuses_url":"https://api.github.com/repos/quanjielin/istio/statuses/{sha}","languages_url":"https://api.github.com/repos/quanjielin/istio/languages","stargazers_url":"https://api.github.com/repos/quanjielin/istio/stargazers","contributors_url":"https://api.github.com/repos/quanjielin/istio/contributors","subscribers_url":"https://api.github.com/repos/quanjielin/istio/subscribers","subscription_url":"https://api.github.com/repos/quanjielin/istio/subscription","commits_url":"https://api.github.com/repos/quanjielin/istio/commits{/sha}","git_commits_url":"https://api.github.com/repos/quanjielin/istio/git/commits{/sha}","comments_url":"https://api.github.com/repos/quanjielin/istio/comments{/number}","issue_comment_url":"https://api.github.com/repos/quanjielin/istio/issues/comments{/number}","contents_url":"https://api.github.com/repos/quanjielin/istio/contents/{+path}","compare_url":"https://api.github.com/repos/quanjielin/istio/compare/{base}...{head}","merges_url":"https://api.github.com/repos/quanjielin/istio/merges","archive_url":"https://api.github.com/repos/quanjielin/istio/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/quanjielin/istio/downloads","issues_url":"https://api.github.com/repos/quanjielin/istio/issues{/number}","pulls_url":"https://api.github.com/repos/quanjielin/istio/pulls{/number}","milestones_url":"https://api.github.com/repos/quanjielin/istio/milestones{/number}","notifications_url":"https://api.github.com/repos/quanjielin/istio/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/quanjielin/istio/labels{/name}","releases_url":"https://api.github.com/repos/quanjielin/istio/releases{/id}","deployments_url":"https://api.github.com/repos/quanjielin/istio/deployments","created_at":"2018-01-10T04:07:27Z","updated_at":"2018-04-25T15:44:51Z","pushed_at":"2018-04-25T17:41:57Z","git_url":"git://github.com/quanjielin/istio.git","ssh_url":"git@github.com:quanjielin/istio.git","clone_url":"https://github.com/quanjielin/istio.git","svn_url":"https://github.com/quanjielin/istio","homepage":"https://istio.io","size":51458,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"istio:master","ref":"master","sha":"b32661e470232e391f524479ca572c6559f352e2","user":{"login":"istio","id":23534644,"avatar_url":"https://avatars1.githubusercontent.com/u/23534644?v=4","gravatar_id":"","url":"https://api.github.com/users/istio","html_url":"https://github.com/istio","followers_url":"https://api.github.com/users/istio/followers","following_url":"https://api.github.com/users/istio/following{/other_user}","gists_url":"https://api.github.com/users/istio/gists{/gist_id}","starred_url":"https://api.github.com/users/istio/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/istio/subscriptions","organizations_url":"https://api.github.com/users/istio/orgs","repos_url":"https://api.github.com/users/istio/repos","events_url":"https://api.github.com/users/istio/events{/privacy}","received_events_url":"https://api.github.com/users/istio/received_events","type":"Organization","site_admin":false},"repo":{"id":74175805,"name":"istio","full_name":"istio/istio","owner":{"login":"istio","id":23534644,"avatar_url":"https://avatars1.githubusercontent.com/u/23534644?v=4","gravatar_id":"","url":"https://api.github.com/users/istio","html_url":"https://github.com/istio","followers_url":"https://api.github.com/users/istio/followers","following_url":"https://api.github.com/users/istio/following{/other_user}","gists_url":"https://api.github.com/users/istio/gists{/gist_id}","starred_url":"https://api.github.com/users/istio/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/istio/subscriptions","organizations_url":"https://api.github.com/users/istio/orgs","repos_url":"https://api.github.com/users/istio/repos","events_url":"https://api.github.com/users/istio/events{/privacy}","received_events_url":"https://api.github.com/users/istio/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/istio/istio","description":"An open platform to connect, manage, and secure microservices.","fork":false,"url":"https://api.github.com/repos/istio/istio","forks_url":"https://api.github.com/repos/istio/istio/forks","keys_url":"https://api.github.com/repos/istio/istio/keys{/key_id}","collaborators_url":"https://api.github.com/repos/istio/istio/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/istio/istio/teams","hooks_url":"https://api.github.com/repos/istio/istio/hooks","issue_events_url":"https://api.github.com/repos/istio/istio/issues/events{/number}","events_url":"https://api.github.com/repos/istio/istio/events","assignees_url":"https://api.github.com/repos/istio/istio/assignees{/user}","branches_url":"https://api.github.com/repos/istio/istio/branches{/branch}","tags_url":"https://api.github.com/repos/istio/istio/tags","blobs_url":"https://api.github.com/repos/istio/istio/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/istio/istio/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/istio/istio/git/refs{/sha}","trees_url":"https://api.github.com/repos/istio/istio/git/trees{/sha}","statuses_url":"https://api.github.com/repos/istio/istio/statuses/{sha}","languages_url":"https://api.github.com/repos/istio/istio/languages","stargazers_url":"https://api.github.com/repos/istio/istio/stargazers","contributors_url":"https://api.github.com/repos/istio/istio/contributors","subscribers_url":"https://api.github.com/repos/istio/istio/subscribers","subscription_url":"https://api.github.com/repos/istio/istio/subscription","commits_url":"https://api.github.com/repos/istio/istio/commits{/sha}","git_commits_url":"https://api.github.com/repos/istio/istio/git/commits{/sha}","comments_url":"https://api.github.com/repos/istio/istio/comments{/number}","issue_comment_url":"https://api.github.com/repos/istio/istio/issues/comments{/number}","contents_url":"https://api.github.com/repos/istio/istio/contents/{+path}","compare_url":"https://api.github.com/repos/istio/istio/compare/{base}...{head}","merges_url":"https://api.github.com/repos/istio/istio/merges","archive_url":"https://api.github.com/repos/istio/istio/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/istio/istio/downloads","issues_url":"https://api.github.com/repos/istio/istio/issues{/number}","pulls_url":"https://api.github.com/repos/istio/istio/pulls{/number}","milestones_url":"https://api.github.com/repos/istio/istio/milestones{/number}","notifications_url":"https://api.github.com/repos/istio/istio/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/istio/istio/labels{/name}","releases_url":"https://api.github.com/repos/istio/istio/releases{/id}","deployments_url":"https://api.github.com/repos/istio/istio/deployments","created_at":"2016-11-18T23:57:21Z","updated_at":"2018-04-25T19:06:55Z","pushed_at":"2018-04-25T19:06:38Z","git_url":"git://github.com/istio/istio.git","ssh_url":"git@github.com:istio/istio.git","clone_url":"https://github.com/istio/istio.git","svn_url":"https://github.com/istio/istio","homepage":"https://istio.io","size":106861,"stargazers_count":7527,"watchers_count":7527,"language":"Go","has_issues":true,"has_projects":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":993,"mirror_url":null,"archived":false,"open_issues_count":800,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"forks":993,"open_issues":800,"watchers":7527,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/istio/istio/pulls/5061"},"html":{"href":"https://github.com/istio/istio/pull/5061"},"issue":{"href":"https://api.github.com/repos/istio/istio/issues/5061"},"comments":{"href":"https://api.github.com/repos/istio/istio/issues/5061/comments"},"review_comments":{"href":"https://api.github.com/repos/istio/istio/pulls/5061/comments"},"review_comment":{"href":"https://api.github.com/repos/istio/istio/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/istio/istio/pulls/5061/commits"},"statuses":{"href":"https://api.github.com/repos/istio/istio/statuses/561ebcdcc874c3cfa72bcfe5e5ec0789e808cb67"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"costinm"}}