Skip to content

Reduce memory consumption on logs decryption #1209

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
oleksandr-codefresh merged 3 commits into from
Apr 17, 2026
Merged

Reduce memory consumption on logs decryption #1209

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5c5911a
Refactor PodLogEncryptionProvider to use KeyParameter and GcmBlockCip…
oleksandr-codefresh Apr 7, 2026
51923f2
Merge branch 'main' into osaulyak/log-encryption-memory-issue
oleksandr-codefresh Apr 16, 2026
bff406b
trigger ci
oleksandr-codefresh Apr 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 9 additions & 10 deletions source/Octopus.Tentacle/Kubernetes/Crypto/PodLogEncryptionProvider.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,14 +16,18 @@ public interface IPodLogEncryptionProvider

public class PodLogEncryptionProvider : IPodLogEncryptionProvider
{
readonly byte[] keyBytes;
readonly KeyParameter keyParameter;
readonly GcmBlockCipher cipher;
readonly int macSize;
const int NonceLength = 12;

private PodLogEncryptionProvider(byte[] keyBytes)
{
this.keyBytes = keyBytes;
keyParameter = new KeyParameter(keyBytes);
cipher = new GcmBlockCipher(new AesEngine());
macSize = 8 * cipher.GetBlockSize();
}

public static IPodLogEncryptionProvider Create(byte[] keyBytes) => new PodLogEncryptionProvider(keyBytes);

public string Decrypt(string encryptedLogMessage)
Expand All @@ -33,9 +37,7 @@ public string Decrypt(string encryptedLogMessage)
var nonceSpan = allEncryptedBytes.Slice(0, NonceLength);
var logMessageBytes = allEncryptedBytes.Slice(NonceLength);

var cipher = new GcmBlockCipher(new AesEngine());
var macSize = 8 * cipher.GetBlockSize();
cipher.Init(false, new AeadParameters(new KeyParameter(keyBytes), macSize, nonceSpan.ToArray()));
cipher.Init(false, new AeadParameters(keyParameter, macSize, nonceSpan.ToArray()));

var outputSize = cipher.GetOutputSize(logMessageBytes.Length);
var plainTextData = new byte[outputSize];
Expand All @@ -53,10 +55,7 @@ public string Encrypt(string plainText, byte[]? nonce = null)
//if no nonce is provided, generate one
nonce ??= GenerateNonce();

var cipher = new GcmBlockCipher(new AesEngine());
var macSize = 8 * cipher.GetBlockSize();
var parameters = new AeadParameters(new KeyParameter(keyBytes), macSize, nonce, null);
cipher.Init(true, parameters);
cipher.Init(true, new AeadParameters(keyParameter, macSize, nonce, null));

var cipherText = new byte[cipher.GetOutputSize(plainTextBytes.Length)];
var len = cipher.ProcessBytes(plainTextBytes, 0, plainTextBytes.Length, cipherText, 0);
Expand Down