Cache FileSecret reads - #954
Open
prymitive wants to merge 1 commit into
Open
Conversation
FileSecret reads files on every request, which means that if I configure a scrape job with: ```yaml tls_config: ca_file: ca.pem cert_file: cert.pem key_file: key.pem ``` All three files will be read using FileSecret every time a scrape starts for that target. With 1k targets and 1m scrape interval this means 50 file reads per second (1000 targets * 3 files / 60s). File reads require a blocking syscall so having to re-read files all the time isn't ideal on busy instances with a lot of targets. These files are normally small and reads are fast, but the overhead is still there. Make FileSecret cache file reads, for 1m by default, configurable via cache_ttl YAML key. Signed-off-by: Lukasz Mierzwa <lukasz@cloudflare.com>
bwplotka
reviewed
Aug 11, 2026
bwplotka
left a comment
bwplotka
left a comment
Member
There was a problem hiding this comment.
While more scalable, this will break scrapes for maximum of 1m on key rotation, just to be fair. Perhaps ok trade-off.
Member
|
I would recommend changing the default to be 0, no caching, to preserve the existing behavior. These reads should pull from page cache and be essentially free. |
Member
|
I agree with Ben's comment. Is there any numbers to bake that this is noticeable? I do not think we had complaints in the past 10 years. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
FileSecret reads files on every request, which means that if I configure a scrape job with:
All three files will be read using FileSecret every time a scrape starts for that target. With 1k targets and 1m scrape interval this means 50 file reads per second (1000 targets * 3 files / 60s).
File reads require a blocking syscall so having to re-read files all the time isn't ideal on busy instances with a lot of targets. These files are normally small and reads are fast, but the overhead is still there.
Make FileSecret cache file reads, for 1m by default, configurable via cache_ttl YAML key.