shreemaan-abhishek opened a new pull request, #13668: URL: https://github.com/apache/apisix/pull/13668
### Description After a `secret` object is deleted via the Admin API, `$secret://` references keep resolving to the previously cached value indefinitely. Updates to a secret are only picked up after the cache TTL window. **Root cause:** `apisix/secret.lua` resolved secret URIs through the secret LRU cache with a constant version string: ```lua return secrets_cache(uri, "", fetch_by_uri, uri) ``` `core.lrucache` uses the `version` argument to detect staleness (an entry is re-resolved only when `obj.ver ~= version`). Every other cached resource passes its real `conf_version`; the secret cache passed `""`, so no `/secrets` change ever invalidated an entry. With `refresh_stale = true` an expired entry keeps being served while a background timer retries, so once the secret is deleted the refresh fails forever and the stale value is served forever. **Fix:** Pass the real secrets `conf_version` (already exposed via `_M.secrets()`). A change to `/secrets` bumps the version, so the cache re-resolves on the next access, matching how route/service caches behave. Notes: - `/secrets` has one shared `conf_version`, so any secret change invalidates all cached secret values (consistent with route/service cache behavior). - `$env://` shares this cache; bumping on `/secrets` changes also drops env entries, which is harmless since env values are static. ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [x] I have updated the documentation to reflect this change (no user-facing config/behavior change; restores expected behavior) - [x] I have verified that this change is backward compatible ### Test `t/secret/secret_lru.t` adds a case that resolves a secret through the cache, deletes it, and asserts the reference stops resolving (falls back to the literal string) instead of serving the stale value. Verified the test fails before the fix and passes after. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
