[v18] Database authorization resource consumption enhancements#64311
Merged
wethreetrees merged 1 commit intobranch/v18from Mar 6, 2026
Merged
[v18] Database authorization resource consumption enhancements#64311wethreetrees merged 1 commit intobranch/v18from
wethreetrees merged 1 commit intobranch/v18from
Conversation
Replace the call to CachingAccessPoint.GetDatabaseServers in ProxyServer.Authorize with a DatabaseServerWatcher lookup using CurrentResourcesWithFilter. Previously, every inbound database connection allocated and iterated a full copy of all database servers in the cache, then discarded all but the matching entries. Under high concurrency with large numbers of registered databases this caused significant GC pressure and OOM. The watcher lookup only allocates the servers matching the requested database name. The watcher is initialized once at startup in service.go and plumbed through the Cluster interface.
Contributor
Author
|
There were some merge conflicts, mostly in the reversetunnel, and a few adjacent changes snuck in through the cherry-pick (AppServerWatcher and a few others). While I am pretty sure I got everything cleaned up, additional checks would be greatly appreciated! |
github-actions
bot
added
backport
database-access
github-actions
bot
requested review from
Tener,
espadolini,
greedy52,
okraport and
rosstimothy
espadolini
approved these changes
Mar 5, 2026
Contributor
espadolini
left a comment
espadolini
left a comment
There was a problem hiding this comment.
Remember to run the same manual testing as the original PR
Contributor
Author
Ran through the test plan and everything looks good 👍 Manual testing detailsTest EnvironmentCloud tenant created in staging Name:
Trusted cluster tests were run locally with two instances of teleport. Test Cases
|
public-teleport-github-review-bot
bot
removed request for
Tener,
greedy52 and
rosstimothy
Contributor
|
Thanks Tyler! 🎉 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport #63878 to branch/v18
changelog: Improved performance and reduced resource usage of the database proxy for clusters with large numbers of registered databases.