You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@ignite.apache.org by "arimu1 (via GitHub)" <gi...@apache.org> on 2026/09/13 00:55:43 UTC

[PR] Fix #12771: remove KeystoreEncryptionSpi Cipher ThreadLocal on stop and after use [ignite]

arimu1 opened a new pull request, #13582:
URL: https://github.com/apache/ignite/pull/13582

   ## Summary
   - Clear `aesWithPadding` and `aesWithoutPadding` static `ThreadLocal<Cipher>` entries in `spiStop()` and after each encrypt/decrypt path so worker threads do not retain JCA `Cipher` instances (and associated providers) after use.
   - Add `KeystoreEncryptionSpiSelfTest.testCipherThreadLocalsRemovedAfterUse` to verify ThreadLocal entries are refreshed after crypto operations and SPI stop.
   
   ## Problem
   `KeystoreEncryptionSpi` caches `Cipher` instances in static `ThreadLocal`s but never called `remove()`. Long-lived threads (e.g. embedded Tomcat workers) could keep references to `Cipher`/provider classes and pin the webapp classloader, leading to metaspace OOM on redeploy.
   
   ## Test plan
   - [x] `./mvnw -pl modules/core test -Dtest=org.apache.ignite.spi.encryption.KeystoreEncryptionSpiSelfTest` (JBR 17, Maven `MAVEN_OPTS` with Ignite `--add-opens` flags from parent POM)
   
   Fixes #12771
   
   
   Made with [Cursor](https://cursor.com)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@ignite.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Fix #12771: remove KeystoreEncryptionSpi Cipher ThreadLocal on stop and after use [ignite]

Posted by "arimu1 (via GitHub)" <gi...@apache.org>.
arimu1 commented on PR #13582:
URL: https://github.com/apache/ignite/pull/13582#issuecomment-5963957939

   Yes. `69f2a44` is ready for review. The branch merges cleanly, and the Rolling Upgrade check on that commit passed. GitHub still shows the combined status as pending because no other status contexts are posted on the tip.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@ignite.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Fix #12771: remove KeystoreEncryptionSpi Cipher ThreadLocal on stop and after use [ignite]

Posted by "zstan (via GitHub)" <gi...@apache.org>.
zstan commented on PR #13582:
URL: https://github.com/apache/ignite/pull/13582#issuecomment-5887835939

   @arimu1 Hi ! is it ready for review ?


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@ignite.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org