Use polling to watch certificate paths #50251
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
It's common for certificates to be rotated using symlinks and `FileSystemWatcher` doesn't resolve symlinks. Use polling, which does, but only for certificates since it has a CPU cost. Fixes dotnet#32351
We use polling which checks the last-modified-time of the target path _after resolving symlinks_. Since we don't know the resolved path, we can't check the last-modified-time accurately.
amcasey
requested review from
Tratcher,
halter73,
BrennanConroy,
JamesNK and
mgravell
as code owners
ghost
added
the
amcasey
commented
Aug 22, 2023
src/Servers/Kestrel/Core/src/Internal/CertificatePathWatcherLoggerExtensions.cs
Outdated
Show resolved
Hide resolved
src/Servers/Kestrel/Kestrel/test/KestrelConfigurationLoaderTests.cs
Outdated
Show resolved
Hide resolved
src/Servers/Kestrel/Kestrel/test/KestrelConfigurationLoaderTests.cs
Outdated
Show resolved
Hide resolved
BrennanConroy
approved these changes
Aug 24, 2023
|
@adityamandaleeka This should be good to go once CI passes (which it should, since I just added a comment). |
|
Approved for RC2, enabling auto merge. |
amcasey
added
area-networking
davidfowl
reviewed
Aug 27, 2023
| { | ||
| // Force polling because it monitors both symlinks and their targets, | ||
| // whereas the non-polling watcher only monitors the symlinks themselves | ||
| UseActivePolling = true, |
There was a problem hiding this comment.
Do we know the performance impact of always doing this?
There was a problem hiding this comment.
How many certs do we expect an app to have? I was assuming < 10. We only poll every four seconds, so I was expecting the CPU usage to be negligible. If the certs aren't all in the same directory, then there will likely be some overhead from having multiple timer loops.
I think a lot of apps would be fine with a longer polling period, but I don't actually see a way to configure it.
If an app has 100 certs, each in a different directory and they find the overhead is too high, there's an appcontext switch to disable watching certificates.
There was a problem hiding this comment.
Polling isn't on by default (for the IHostingEnvironment.ContentRootFileProvider), I'm not sure it's about the number of apps, it might be the number of files being polled in the common case. Is this just polling the path specified by the cert in the 90% scenario?
There was a problem hiding this comment.
Sorry, I'm not sure I understand the question. This change should have no effect on whether or not IHostingEnvironment.ContentRootFileProvider uses polling. It instantiates PhysicalFileProviders directly for paths to certificates and enables polling for those specifically.
You've previously pointed out that that's wrong, that certificates should be watched using the host env file provider. There are two reasons I didn't do that: first, the users requesting this functionality made clear that they wanted to be able to load and watch certificates that were not under their content root; second, I didn't want to enable polling for all files in the content root because I was worried about the perf (and respecting user settings).
There was a problem hiding this comment.
My point is that this change always turns on file watching no matter what. That’s not something we’ve tested before. I just wanted to understand the scope and impact of the polling.
There was a problem hiding this comment.
If ReloadOnChange is true, then we will poll files in your (non-code) configuration for the default certificate and for each endpoint's certificate and SNI certificates. Obviously, this only applies to file-based certs (vs from the store). If the same certificate file appears in more than one of those locations, it will only be polled once. (There's a corner case where two different symlinks point to the same file, in which case it would be polled twice.)
MackinnonBuck
added a commit
that referenced
this pull request
Aug 28, 2023
* Remove reflection from KestrelServer constructor (#50272) * Update dependencies from https://github.com/dotnet/extensions build 20230822.1 (#50288) [release/8.0] Update dependencies from dotnet/extensions * Ensure enhanced nav requests have the correct headers (#50263) * In SSR, supply HttpContext as cascading value (#50253) Fixes #48769 ### Usage ```cs [CascadingParameter] public HttpContext? Context { get; set; } ``` In SSR, this will receive the `HttpContext`. In other rendering modes where there is no HTTP context, no value will be supplied so the property will remain `null`. ### Alternative design considered In #48769 I suggested using `[SupplyParameterFromHttpContext]` but that turns out not to be practical unless we either (a) make `ICascadingValueSupplier` public, or (b) add an IVT from `M.A.Components` to `.Endpoints`. I'm not keen on doing either of the above on a whim. Plus, use of `[CascadingValue]` has advantages: * It's consistent with the existing pattern for authentication state (we have `[CascadingParameter] Task<AuthenticationState> AuthenticationStateTask { get; set; }`). * Longer term, if we add more things like this, it would be nice not to add a separate special attribute for each one when `[CascadingParameter]` is already descriptive enough. Special attributes are needed only when the type of thing being supplied might reasonably clash with something else the application is doing (for example, we do need it for form/query, as they supply arbitrary types). ## Review notes It's best to look at the two commits in this PR completely separately: 1. The first commit fixes an API design problem I discovered while considering how to do this. I realised that when we added `CascadingParameterAttributeBase`, we made a design mistake: * We put the `Name` property on the abstract base class just because `CascadingParameterAttribute`, `SupplyParameterFromQuery`, and `SupplyParameterFromForm` all have a `Name`. * However, in all three cases there, the `Name` has completely different meanings. For `CascadingParameterAttribute`, it's the name associated with `<CascadingValue Name=...>`, whereas for form it's the `Request.Form` entry or fall back on property name, and for query it's the `Request.Query` entry or fall back on property name. In general there's no reason why a `CascadingParameterAttributeBase` subclass should have a `Name` at all (`SupplyParameterFromHttpContext` wasn't going to), and if it does have one, its semantics are specific to it. So these should not be the same properties. * The change we made to make `CascadingParameterAttribute.Name` virtual might even be breaking (see https://learn.microsoft.com/en-us/dotnet/core/compatibility/library-change-rules stating *DISALLOWED: Adding the virtual keyword to a member*). So it's good we can revert that here. 2. The second commit is the completely trivial implementation of supplying `HttpContext` as a cascading value, with an E2E test. * Fix SSR redirections. Fixes #49670 (#50261) Fixes #49670 trivially by making `HttpNavigationManager`'s redirection logic consistent with the other `NavigationManager` implementations. You'll be wondering why there are no E2E tests with this PR. The reason is that, surprisingly, we *already* have E2E tests for these kinds of non-root redirections. However, they were falsely passing, which is tracked by #50260 and is outside the scope of this PR. I think we should address that other issue in .NET 9 as there should be no developer/API impact from leaving it as-is for .NET 8. * API review followups (#50181) * RazorComponentResult: change namespace, make executor internal, merge test classes * RazorComponentResult: Nullability and trim annotations * RazorComponentResult: IStatusCodeHttpResult and IContentTypeHttpResult * Cleanup * Further clean up annotations * Remove HtmlRootComponent.ComponentId as per API review * Rename SupplyParameterFromFormAttribute.Handler to FormName * API review: seal * Clarify RenderModeAttribute inheritance. Fixes #49848 * Rename valueFactory -> initialValueFactory * Remove unnecessary sequence params * Make [StreamRendering] default to true * Support hot reload for Blazor component endpoints (#50031) * Support hot reload for Blazor component endpoints * Use alternative navigation exports * Address feedback * Make HotReloadService optional * Address more feedback * [release/8.0] Update SDK (#50276) * [release/8.0] Update SDK * Fix IsAotCompatible warnings * Update nullability annotation for TemplatePart.Text * Update CodeGen.proj to account for conditional IsTrimmable metadata * Update Directory.Build.props.in --------- Co-authored-by: Stephen Halter <[email protected]> * Provide a better error (#50311) * Remove more setup overhead in RDG benchmarks (#50302) * Use polling to watch certificate paths (#50251) * Cache parsable and bindable type info in RDG (#50326) * Use absolute URLs for confirmation emails (#50297) This PR updates the MapIdentityApi endpoints that send confirmation emails to use absolute URLs. Previously the emails used relative links which of course do not work for links in emails. Fixes #50296 * [release/8.0] [Blazor] Close the circuit when all Blazor Server components are disposed (#50170) # [Blazor] Close the circuit when all Blazor Server components are disposed Allows a Blazor Server circuit to close when all root Blazor Server components get dynamically removed from the page. ## Description The overall approach I've taken is: 1. Define what it means for the circuit to be in use (`WebRootComponentManager.hasAnyExistingOrPendingServerComponents()`): * There are interactive Blazor Server components on the page, or... * The initialization of an interactive Blazor Server component has started, but hasn't completed yet, or... * There are SSR'd components on the page that haven't been initialized for interactivity yet (consider stream rendering, where we don't activate new components until the response completes), but they have either a "Server" or "Auto" render mode 2. Determine the cases where a circuit's "in use" status may have changed: * After a render batch is applied (see `attachCircuitAfterRenderCallback` in `WebRootComponentManager.ts`) * An applied render batch may result in the creation/disposal of a root component * After an SSR update occurs, but before the first render batch is applied * Consider the case where an SSR'd component with a Server render mode gets removed from the page, but before the circuit has a chance to initialize 3. Decide what to do if the "in use" status may have changed (`WebRootComponentManager.circuitMayHaveNoRootComponents()`): * If the circuit is not in use: * Start a timeout with some configurable duration (`SsrStartOptions.circuitInactivityTimeoutMs`), if it hasn't started already * When the timeout expires, dispose the circuit * If the circuit is not in use: * Clear any existing timeout This PR also: - [X] Addresses a bug preventing Virtualize from working correctly when a WebAssembly and Server instance is present on the page at the same time - [X] Adds E2E tests Fixes #48765 * [release/8.0] Update dependencies from dotnet/runtime (#50305) * Update dependencies from https://github.com/dotnet/runtime build 20230823.11 Microsoft.Bcl.AsyncInterfaces , Microsoft.Bcl.TimeProvider , Microsoft.Extensions.Caching.Abstractions , Microsoft.Extensions.Caching.Memory , Microsoft.Extensions.Configuration , Microsoft.Extensions.Configuration.Abstractions , Microsoft.Extensions.Configuration.Binder , Microsoft.Extensions.Configuration.CommandLine , Microsoft.Extensions.Configuration.EnvironmentVariables , Microsoft.Extensions.Configuration.FileExtensions , Microsoft.Extensions.Configuration.Ini , Microsoft.Extensions.Configuration.Json , Microsoft.Extensions.Configuration.UserSecrets , Microsoft.Extensions.Configuration.Xml , Microsoft.Extensions.DependencyInjection , Microsoft.Extensions.DependencyInjection.Abstractions , Microsoft.Extensions.DependencyModel , Microsoft.Extensions.Diagnostics , Microsoft.Extensions.Diagnostics.Abstractions , Microsoft.Extensions.FileProviders.Abstractions , Microsoft.Extensions.FileProviders.Composite , Microsoft.Extensions.FileProviders.Physical , Microsoft.Extensions.FileSystemGlobbing , Microsoft.Extensions.HostFactoryResolver.Sources , Microsoft.Extensions.Hosting , Microsoft.Extensions.Hosting.Abstractions , Microsoft.Extensions.Http , Microsoft.Extensions.Logging , Microsoft.Extensions.Logging.Abstractions , Microsoft.Extensions.Logging.Configuration , Microsoft.Extensions.Logging.Console , Microsoft.Extensions.Logging.Debug , Microsoft.Extensions.Logging.EventLog , Microsoft.Extensions.Logging.EventSource , Microsoft.Extensions.Logging.TraceSource , Microsoft.Extensions.Options , Microsoft.Extensions.Options.ConfigurationExtensions , Microsoft.Extensions.Options.DataAnnotations , Microsoft.Extensions.Primitives , Microsoft.Internal.Runtime.AspNetCore.Transport , Microsoft.NET.Runtime.MonoAOTCompiler.Task , Microsoft.NET.Runtime.WebAssembly.Sdk , Microsoft.NETCore.App.Ref , Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm , Microsoft.NETCore.App.Runtime.win-x64 , Microsoft.NETCore.BrowserDebugHost.Transport , Microsoft.NETCore.Platforms , System.Collections.Immutable , System.Composition , System.Configuration.ConfigurationManager , System.Diagnostics.DiagnosticSource , System.Diagnostics.EventLog , System.Diagnostics.PerformanceCounter , System.DirectoryServices.Protocols , System.IO.Hashing , System.IO.Pipelines , System.Net.Http.Json , System.Net.Http.WinHttpHandler , System.Reflection.Metadata , System.Resources.Extensions , System.Runtime.Caching , System.Security.Cryptography.Pkcs , System.Security.Cryptography.Xml , System.Security.Permissions , System.ServiceProcess.ServiceController , System.Text.Encodings.Web , System.Text.Json , System.Threading.AccessControl , System.Threading.Channels , System.Threading.RateLimiting From Version 8.0.0-rc.2.23418.14 -> To Version 8.0.0-rc.2.23423.11 * Update dependencies from https://github.com/dotnet/runtime build 20230823.5 Microsoft.Bcl.AsyncInterfaces , Microsoft.Bcl.TimeProvider , Microsoft.Extensions.Caching.Abstractions , Microsoft.Extensions.Caching.Memory , Microsoft.Extensions.Configuration , Microsoft.Extensions.Configuration.Abstractions , Microsoft.Extensions.Configuration.Binder , Microsoft.Extensions.Configuration.CommandLine , Microsoft.Extensions.Configuration.EnvironmentVariables , Microsoft.Extensions.Configuration.FileExtensions , Microsoft.Extensions.Configuration.Ini , Microsoft.Extensions.Configuration.Json , Microsoft.Extensions.Configuration.UserSecrets , Microsoft.Extensions.Configuration.Xml , Microsoft.Extensions.DependencyInjection , Microsoft.Extensions.DependencyInjection.Abstractions , Microsoft.Extensions.DependencyModel , Microsoft.Extensions.Diagnostics , Microsoft.Extensions.Diagnostics.Abstractions , Microsoft.Extensions.FileProviders.Abstractions , Microsoft.Extensions.FileProviders.Composite , Microsoft.Extensions.FileProviders.Physical , Microsoft.Extensions.FileSystemGlobbing , Microsoft.Extensions.HostFactoryResolver.Sources , Microsoft.Extensions.Hosting , Microsoft.Extensions.Hosting.Abstractions , Microsoft.Extensions.Http , Microsoft.Extensions.Logging , Microsoft.Extensions.Logging.Abstractions , Microsoft.Extensions.Logging.Configuration , Microsoft.Extensions.Logging.Console , Microsoft.Extensions.Logging.Debug , Microsoft.Extensions.Logging.EventLog , Microsoft.Extensions.Logging.EventSource , Microsoft.Extensions.Logging.TraceSource , Microsoft.Extensions.Options , Microsoft.Extensions.Options.ConfigurationExtensions , Microsoft.Extensions.Options.DataAnnotations , Microsoft.Extensions.Primitives , Microsoft.Internal.Runtime.AspNetCore.Transport , Microsoft.NET.Runtime.MonoAOTCompiler.Task , Microsoft.NET.Runtime.WebAssembly.Sdk , Microsoft.NETCore.App.Ref , Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm , Microsoft.NETCore.App.Runtime.win-x64 , Microsoft.NETCore.BrowserDebugHost.Transport , Microsoft.NETCore.Platforms , System.Collections.Immutable , System.Composition , System.Configuration.ConfigurationManager , System.Diagnostics.DiagnosticSource , System.Diagnostics.EventLog , System.Diagnostics.PerformanceCounter , System.DirectoryServices.Protocols , System.IO.Hashing , System.IO.Pipelines , System.Net.Http.Json , System.Net.Http.WinHttpHandler , System.Reflection.Metadata , System.Resources.Extensions , System.Runtime.Caching , System.Security.Cryptography.Pkcs , System.Security.Cryptography.Xml , System.Security.Permissions , System.ServiceProcess.ServiceController , System.Text.Encodings.Web , System.Text.Json , System.Threading.AccessControl , System.Threading.Channels , System.Threading.RateLimiting From Version 8.0.0-rc.2.23418.14 -> To Version 8.0.0-rc.2.23423.5 --------- Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com> * Update Version.Details.xml * Update dependencies from https://github.com/dotnet/source-build-reference-packages build 20230824.1 (#50337) [release/8.0] Update dependencies from dotnet/source-build-reference-packages * Update Microsoft.Identity.Model to 7.0.0-preview3 (#50218) * Update Microsoft.Identity.Model to 7.0.0-preview3 * fixing null refs in WsFed * Add link to tracking issue. * Add link to tracking issue. * Update dependencies from https://github.com/dotnet/source-build-externals build 20230824.1 Microsoft.SourceBuild.Intermediate.source-build-externals From Version 8.0.0-alpha.1.23421.1 -> To Version 8.0.0-alpha.1.23424.1 * Workaround AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#2261 in a test. --------- Co-authored-by: Eric Erhardt <[email protected]> Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com> * Update Versions.props * Quarantine tests (#50379) Co-authored-by: Mackinnon Buck <[email protected]> * [release/8.0] Update dependencies from dotnet/runtime (#50350) * Update dependencies from https://github.com/dotnet/runtime build 20230825.9 Microsoft.Bcl.AsyncInterfaces , Microsoft.Bcl.TimeProvider , Microsoft.Extensions.Caching.Abstractions , Microsoft.Extensions.Caching.Memory , Microsoft.Extensions.Configuration , Microsoft.Extensions.Configuration.Abstractions , Microsoft.Extensions.Configuration.Binder , Microsoft.Extensions.Configuration.CommandLine , Microsoft.Extensions.Configuration.EnvironmentVariables , Microsoft.Extensions.Configuration.FileExtensions , Microsoft.Extensions.Configuration.Ini , Microsoft.Extensions.Configuration.Json , Microsoft.Extensions.Configuration.UserSecrets , Microsoft.Extensions.Configuration.Xml , Microsoft.Extensions.DependencyInjection , Microsoft.Extensions.DependencyInjection.Abstractions , Microsoft.Extensions.DependencyModel , Microsoft.Extensions.Diagnostics , Microsoft.Extensions.Diagnostics.Abstractions , Microsoft.Extensions.FileProviders.Abstractions , Microsoft.Extensions.FileProviders.Composite , Microsoft.Extensions.FileProviders.Physical , Microsoft.Extensions.FileSystemGlobbing , Microsoft.Extensions.HostFactoryResolver.Sources , Microsoft.Extensions.Hosting , Microsoft.Extensions.Hosting.Abstractions , Microsoft.Extensions.Http , Microsoft.Extensions.Logging , Microsoft.Extensions.Logging.Abstractions , Microsoft.Extensions.Logging.Configuration , Microsoft.Extensions.Logging.Console , Microsoft.Extensions.Logging.Debug , Microsoft.Extensions.Logging.EventLog , Microsoft.Extensions.Logging.EventSource , Microsoft.Extensions.Logging.TraceSource , Microsoft.Extensions.Options , Microsoft.Extensions.Options.ConfigurationExtensions , Microsoft.Extensions.Options.DataAnnotations , Microsoft.Extensions.Primitives , Microsoft.Internal.Runtime.AspNetCore.Transport , Microsoft.NET.Runtime.MonoAOTCompiler.Task , Microsoft.NET.Runtime.WebAssembly.Sdk , Microsoft.NETCore.App.Ref , Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm , Microsoft.NETCore.App.Runtime.win-x64 , Microsoft.NETCore.BrowserDebugHost.Transport , Microsoft.NETCore.Platforms , System.Collections.Immutable , System.Composition , System.Configuration.ConfigurationManager , System.Diagnostics.DiagnosticSource , System.Diagnostics.EventLog , System.Diagnostics.PerformanceCounter , System.DirectoryServices.Protocols , System.IO.Hashing , System.IO.Pipelines , System.Net.Http.Json , System.Net.Http.WinHttpHandler , System.Reflection.Metadata , System.Resources.Extensions , System.Runtime.Caching , System.Security.Cryptography.Pkcs , System.Security.Cryptography.Xml , System.Security.Permissions , System.ServiceProcess.ServiceController , System.Text.Encodings.Web , System.Text.Json , System.Threading.AccessControl , System.Threading.Channels , System.Threading.RateLimiting From Version 8.0.0-rc.2.23423.5 -> To Version 8.0.0-rc.2.23425.9 * Update dependencies from https://github.com/dotnet/runtime build 20230826.4 Microsoft.Bcl.AsyncInterfaces , Microsoft.Bcl.TimeProvider , Microsoft.Extensions.Caching.Abstractions , Microsoft.Extensions.Caching.Memory , Microsoft.Extensions.Configuration , Microsoft.Extensions.Configuration.Abstractions , Microsoft.Extensions.Configuration.Binder , Microsoft.Extensions.Configuration.CommandLine , Microsoft.Extensions.Configuration.EnvironmentVariables , Microsoft.Extensions.Configuration.FileExtensions , Microsoft.Extensions.Configuration.Ini , Microsoft.Extensions.Configuration.Json , Microsoft.Extensions.Configuration.UserSecrets , Microsoft.Extensions.Configuration.Xml , Microsoft.Extensions.DependencyInjection , Microsoft.Extensions.DependencyInjection.Abstractions , Microsoft.Extensions.DependencyModel , Microsoft.Extensions.Diagnostics , Microsoft.Extensions.Diagnostics.Abstractions , Microsoft.Extensions.FileProviders.Abstractions , Microsoft.Extensions.FileProviders.Composite , Microsoft.Extensions.FileProviders.Physical , Microsoft.Extensions.FileSystemGlobbing , Microsoft.Extensions.HostFactoryResolver.Sources , Microsoft.Extensions.Hosting , Microsoft.Extensions.Hosting.Abstractions , Microsoft.Extensions.Http , Microsoft.Extensions.Logging , Microsoft.Extensions.Logging.Abstractions , Microsoft.Extensions.Logging.Configuration , Microsoft.Extensions.Logging.Console , Microsoft.Extensions.Logging.Debug , Microsoft.Extensions.Logging.EventLog , Microsoft.Extensions.Logging.EventSource , Microsoft.Extensions.Logging.TraceSource , Microsoft.Extensions.Options , Microsoft.Extensions.Options.ConfigurationExtensions , Microsoft.Extensions.Options.DataAnnotations , Microsoft.Extensions.Primitives , Microsoft.Internal.Runtime.AspNetCore.Transport , Microsoft.NET.Runtime.MonoAOTCompiler.Task , Microsoft.NET.Runtime.WebAssembly.Sdk , Microsoft.NETCore.App.Ref , Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm , Microsoft.NETCore.App.Runtime.win-x64 , Microsoft.NETCore.BrowserDebugHost.Transport , Microsoft.NETCore.Platforms , System.Collections.Immutable , System.Composition , System.Configuration.ConfigurationManager , System.Diagnostics.DiagnosticSource , System.Diagnostics.EventLog , System.Diagnostics.PerformanceCounter , System.DirectoryServices.Protocols , System.IO.Hashing , System.IO.Pipelines , System.Net.Http.Json , System.Net.Http.WinHttpHandler , System.Reflection.Metadata , System.Resources.Extensions , System.Runtime.Caching , System.Security.Cryptography.Pkcs , System.Security.Cryptography.Xml , System.Security.Permissions , System.ServiceProcess.ServiceController , System.Text.Encodings.Web , System.Text.Json , System.Threading.AccessControl , System.Threading.Channels , System.Threading.RateLimiting From Version 8.0.0-rc.2.23423.5 -> To Version 8.0.0-rc.2.23426.4 --------- Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com> * Update Versions.props --------- Co-authored-by: Stephen Halter <[email protected]> Co-authored-by: dotnet-maestro[bot] <42748379+dotnet-maestro[bot]@users.noreply.github.com> Co-authored-by: Steve Sanderson <[email protected]> Co-authored-by: Safia Abdalla <[email protected]> Co-authored-by: Andrew Casey <[email protected]> Co-authored-by: Mackinnon Buck <[email protected]> Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com> Co-authored-by: jennyf19 <[email protected]> Co-authored-by: Eric Erhardt <[email protected]> Co-authored-by: William Godbe <[email protected]> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Use polling to watch certificate paths
Description
It's common for certificates to be rotated using symlinks and
FileSystemWatcherdoesn't resolve symlinks. Use polling, which does, but only for certificates since it has a CPU cost.Polling checks the last-modified-time of the target path after resolving symlinks. Since we don't know the resolved path, we can't check the last-modified-time accurately, so don't check it at all.
Fixes #32351