feat: ✨ add configurable cipher caching with async Moka #308
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Implements an in-memory cache for ScopedCipher instances to improve performance by avoiding repeated ZeroKMS cipher initialization. Key features: - Configurable cache size (CS_SERVER__CIPHER_CACHE_SIZE, default: 64 entries) - Configurable TTL (CS_SERVER__CIPHER_CACHE_TTL_SECONDS, default: 3600s) - Memory-aware caching with estimated 3KB per cipher entry - Prometheus metrics for cache hits and cipher initialization tracking - Keyset-scoped caching with proper cache key generation
tobyhede
force-pushed
the
scoped-cipher-lru
branch
from
f44a2d3 to
b812365
Compare
tobyhede
changed the title
freshtonic
approved these changes
Aug 21, 2025
Contributor
freshtonic
left a comment
freshtonic
left a comment
There was a problem hiding this comment.
Approved, but see my comment about using std::mem::size_of
tobyhede
force-pushed
the
scoped-cipher-lru
branch
from
249d7fd to
50e3d9c
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The client scoped_cipher fetches keyset information on init.
In multitenant operation, many keysets are used, and the initialisation occurs on every encrypt or decrypt operation.
Once initialised, scoped_ciphers should be retained to avoid the cost of the initial request for every operation.
Implements an in-memory cache for ScopedCipher instances to improve performance by avoiding repeated ZeroKMS cipher initialization. Key features: