arimu1 opened a new pull request, #13582: URL: https://github.com/apache/ignite/pull/13582
## Summary - Clear `aesWithPadding` and `aesWithoutPadding` static `ThreadLocal<Cipher>` entries in `spiStop()` and after each encrypt/decrypt path so worker threads do not retain JCA `Cipher` instances (and associated providers) after use. - Add `KeystoreEncryptionSpiSelfTest.testCipherThreadLocalsRemovedAfterUse` to verify ThreadLocal entries are refreshed after crypto operations and SPI stop. ## Problem `KeystoreEncryptionSpi` caches `Cipher` instances in static `ThreadLocal`s but never called `remove()`. Long-lived threads (e.g. embedded Tomcat workers) could keep references to `Cipher`/provider classes and pin the webapp classloader, leading to metaspace OOM on redeploy. ## Test plan - [x] `./mvnw -pl modules/core test -Dtest=org.apache.ignite.spi.encryption.KeystoreEncryptionSpiSelfTest` (JBR 17, Maven `MAVEN_OPTS` with Ignite `--add-opens` flags from parent POM) Fixes #12771 Made with [Cursor](https://cursor.com) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
