Repository: openyurtio/openyurt (Go)

Issue:
[feature request]yurthub doesn't need to cache certificatesigningrequests and subjectaccessreviews resource
<!-- Please only use this template for submitting feature requests -->

**What would you like to be added**:
1. Certain clients, such as kubelet, submit certificatesigningrequests (CSRs) and subjectaccessreviews (SARs) requests to the kube-apiserver via yurthub.

2. Yurthub is not required to cache the responses to these requests, as clients will not utilize cached CSRs or SARs data upon restart.

so we can add `check whether resource is CSRs or SARs` in the following function:

https://github.com/openyurtio/openyurt/blob/9fb701eb8b5d50c97674f441fede8273149fec73/pkg/yurthub/cachemanager/cache_manager.go#L709-L790

please add the following code in the above function:

```
var nonCacheableResources = map[string]struct{}{
    "certificatesigningrequests": {},
    "subjectaccessreviews": {},
}

if _, ok := nonCacheableResources[info.Resource]; ok {
    return false
}
```

at the same time, please add unit test cases into `TestCanCacheFor` func in `cache_manager_test.go` file.

**others**
/kind feature



Discussion:
/assign
@2456868764 Do you have any progress about this issue?
@2456868764 I will make a pull request for this issue.



Patch:
diff --git a/pkg/yurthub/cachemanager/cache_manager.go b/pkg/yurthub/cachemanager/cache_manager.go
index 1b9f3d7ef28..ac16db535ab 100644
--- a/pkg/yurthub/cachemanager/cache_manager.go
+++ b/pkg/yurthub/cachemanager/cache_manager.go
@@ -52,6 +52,11 @@ import (
 
 var (
 	ErrInMemoryCacheMiss = errors.New("in-memory cache miss")
+
+	nonCacheableResources = map[string]struct{}{
+		"certificatesigningrequests": {},
+		"subjectaccessreviews":       {},
+	}
 )
 
 // CacheManager is an adaptor to cache runtime object data into backend storage
@@ -705,7 +710,7 @@ func isCreate(ctx context.Context) bool {
 // 1. component is not set
 // 2. delete/deletecollection/proxy request
 // 3. sub-resource request but is not status
-// 4. csr resource request
+// 4. csr and sar resource request
 func (cm *cacheManager) CanCacheFor(req *http.Request) bool {
 	ctx := req.Context()
 
@@ -743,6 +748,10 @@ func (cm *cacheManager) CanCacheFor(req *http.Request) bool {
 		return false
 	}
 
+	if _, ok := nonCacheableResources[info.Resource]; ok {
+		return false
+	}
+
 	cm.Lock()
 	defer cm.Unlock()
 	if info.Verb == "list" && info.Name == "" {


Test patch:
diff --git a/pkg/yurthub/cachemanager/cache_manager_test.go b/pkg/yurthub/cachemanager/cache_manager_test.go
index e4f8a251aac..dfb8085fa91 100644
--- a/pkg/yurthub/cachemanager/cache_manager_test.go
+++ b/pkg/yurthub/cachemanager/cache_manager_test.go
@@ -3194,6 +3194,22 @@ func TestCanCacheFor(t *testing.T) {
 			cacheAgents: "xxx",
 			expectCache: false,
 		},
+		"do not cache csr": {
+			request: &proxyRequest{
+				userAgent: "kubelet",
+				verb:      "POST",
+				path:      "/apis/certificates.k8s.io/v1/certificatesigningrequests",
+			},
+			expectCache: false,
+		},
+		"do not cache sar": {
+			request: &proxyRequest{
+				userAgent: "kubelet",
+				verb:      "POST",
+				path:      "/apis/authorization.k8s.io/v1/subjectaccessreviews",
+			},
+			expectCache: false,
+		},
 	}
 
 	for k, tt := range testcases {