shreemaan-abhishek opened a new pull request, #13668:
URL: https://github.com/apache/apisix/pull/13668

   ### Description
   
   After a `secret` object is deleted via the Admin API, `$secret://` 
references keep resolving to the previously cached value indefinitely. Updates 
to a secret are only picked up after the cache TTL window.
   
   **Root cause:** `apisix/secret.lua` resolved secret URIs through the secret 
LRU cache with a constant version string:
   
   ```lua
   return secrets_cache(uri, "", fetch_by_uri, uri)
   ```
   
   `core.lrucache` uses the `version` argument to detect staleness (an entry is 
re-resolved only when `obj.ver ~= version`). Every other cached resource passes 
its real `conf_version`; the secret cache passed `""`, so no `/secrets` change 
ever invalidated an entry. With `refresh_stale = true` an expired entry keeps 
being served while a background timer retries, so once the secret is deleted 
the refresh fails forever and the stale value is served forever.
   
   **Fix:** Pass the real secrets `conf_version` (already exposed via 
`_M.secrets()`). A change to `/secrets` bumps the version, so the cache 
re-resolves on the next access, matching how route/service caches behave.
   
   Notes:
   - `/secrets` has one shared `conf_version`, so any secret change invalidates 
all cached secret values (consistent with route/service cache behavior).
   - `$env://` shares this cache; bumping on `/secrets` changes also drops env 
entries, which is harmless since env values are static.
   
   ### Checklist
   
   - [x] I have explained the need for this PR and the problem it solves
   - [x] I have explained the changes or the new features added to this PR
   - [x] I have added tests corresponding to this change
   - [x] I have updated the documentation to reflect this change (no 
user-facing config/behavior change; restores expected behavior)
   - [x] I have verified that this change is backward compatible
   
   ### Test
   
   `t/secret/secret_lru.t` adds a case that resolves a secret through the 
cache, deletes it, and asserts the reference stops resolving (falls back to the 
literal string) instead of serving the stale value. Verified the test fails 
before the fix and passes after.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to