Follow-ups from the review of #192 (bundle cache + singleflight de-duplication). Two valid reviewer findings were deferred from that PR to keep it scoped to the cache/singleflight behavior and its correctness fixes.
A. Expose the bundle-cache flags via the Helm chart
The provider now supports -bundle-cache-ttl and -bundle-cache-max-entries, but the supported Helm deployment cannot set them: charts/artifact-attestations-opa-provider/templates/deployment.yaml renders a fixed argument list and values.yaml has no corresponding settings (nor an extraArgs escape hatch). Helm users therefore cannot tune or disable the cache despite the documented configuration surface.
E. Keep registry-fetch metrics uncontaminated by cache hits
aaop_attestations_retrieved_timer and aaop_attestations_retrieved_total are recorded in Provider.Validate around the fetch call and are documented as OCI-registry fetch latency / downloads. With the cache in place, a cache hit returns through the same path and is recorded as a ~0-latency "fetch"/"download"; once hits dominate, the latency distribution no longer reflects the registry and can mask the fetch-timeout signal the cache is meant to monitor.
Source
Raised by the automated reviewer on #192 (second review round). Deferred there; the correctness fixes from that round (negative-result caching, referrer-set staleness docs, cancelled-request fetch guard) are handled in #192 itself.
Follow-ups from the review of #192 (bundle cache + singleflight de-duplication). Two valid reviewer findings were deferred from that PR to keep it scoped to the cache/singleflight behavior and its correctness fixes.
A. Expose the bundle-cache flags via the Helm chart
The provider now supports
-bundle-cache-ttland-bundle-cache-max-entries, but the supported Helm deployment cannot set them:charts/artifact-attestations-opa-provider/templates/deployment.yamlrenders a fixed argument list andvalues.yamlhas no corresponding settings (nor anextraArgsescape hatch). Helm users therefore cannot tune or disable the cache despite the documented configuration surface.values.yamlentries (e.g.bundleCache.ttl/bundleCache.maxEntries, or a generalextraArgs).E. Keep registry-fetch metrics uncontaminated by cache hits
aaop_attestations_retrieved_timerandaaop_attestations_retrieved_totalare recorded inProvider.Validatearound the fetch call and are documented as OCI-registry fetch latency / downloads. With the cache in place, a cache hit returns through the same path and is recorded as a ~0-latency "fetch"/"download"; once hits dominate, the latency distribution no longer reflects the registry and can mask the fetch-timeout signal the cache is meant to monitor.DefaultBundleFetcher) so they only measure real registry calls — or otherwise propagate hit/upstream status so hits are excluded.aaop_bundle_cache_hits_total/aaop_bundle_cache_misses_total.)Source
Raised by the automated reviewer on #192 (second review round). Deferred there; the correctness fixes from that round (negative-result caching, referrer-set staleness docs, cancelled-request fetch guard) are handled in #192 itself.