diff --git a/apps/dashboard/pkg/apis/dashboard/cuevalidator/validator.go b/apps/dashboard/pkg/apis/dashboard/cuevalidator/validator.go index 38792ade026..2a3c075eb56 100644 --- a/apps/dashboard/pkg/apis/dashboard/cuevalidator/validator.go +++ b/apps/dashboard/pkg/apis/dashboard/cuevalidator/validator.go @@ -4,26 +4,65 @@ import ( "sync" "cuelang.org/go/cue" + "cuelang.org/go/cue/cuecontext" cuejson "cuelang.org/go/encoding/json" ) -// Validator provides thread-safe CUE schema validation. +const ( + // maxValidations limits how many validations can use the same context before it's recreated. + // This prevents unbounded memory growth while still allowing schema reuse for performance. + // After this many validations, the context is discarded and a new one is created. + maxValidations = 100 +) + +// Validator provides thread-safe CUE schema validation with periodic context recreation. // // CUE is not safe for concurrent use: https://github.com/cue-lang/cue/discussions/1205#discussioncomment-1189238 // This validator uses a mutex to protect concurrent access to the underlying CUE validation. +// +// To prevent memory leaks from CUE's internal caching, we reuse a context for up to maxValidations +// validations, then recreate it. This balances performance (schema reuse) with memory safety +// (periodic garbage collection of cached values). +// +// See https://github.com/grafana/grafana/issues/114344#issuecomment-3605562491 for details +// about the memory leak issue and this fix. type Validator struct { - schema cue.Value - mu sync.Mutex + schemaSource string + schemaPath cue.Path + mu sync.Mutex + ctx *cue.Context + compiledSchema cue.Value + validationCount int } -func NewValidator(schema cue.Value) *Validator { +// NewValidatorFromSource creates a new validator from a schema source string and path. +// This prevents memory leaks by periodically recreating the CUE context after maxValidations uses. +func NewValidatorFromSource(schemaSource string, schemaPath cue.Path) *Validator { + cueCtx := cuecontext.New() + compiledSchema := cueCtx.CompileString(schemaSource).LookupPath(schemaPath) return &Validator{ - schema: schema, + schemaSource: schemaSource, + schemaPath: schemaPath, + ctx: cueCtx, + compiledSchema: compiledSchema, } } func (v *Validator) Validate(data []byte) error { v.mu.Lock() defer v.mu.Unlock() - return cuejson.Validate(data, v.schema) + + // Increment validation count + v.validationCount++ + + // If we've reached the maximum number of validations, recreate the context + if v.validationCount >= maxValidations { + // Recreate context to allow GC to reclaim cached values + v.ctx = cuecontext.New() + v.compiledSchema = v.ctx.CompileString(v.schemaSource).LookupPath(v.schemaPath) + v.validationCount = 0 + } + + // Validate using the current compiled schema + return cuejson.Validate(data, v.compiledSchema) } diff --git a/apps/dashboard/pkg/apis/dashboard/v0alpha1/validation.go b/apps/dashboard/pkg/apis/dashboard/v0alpha1/validation.go index a90eab95126..295797a2fb5 100644 --- a/apps/dashboard/pkg/apis/dashboard/v0alpha1/validation.go +++ b/apps/dashboard/pkg/apis/dashboard/v0alpha1/validation.go @@ -12,7 +12,6 @@ import ( "k8s.io/apimachinery/pkg/util/validation/field" "cuelang.org/go/cue" - "cuelang.org/go/cue/cuecontext" "cuelang.org/go/cue/errors" ) @@ -83,11 +82,13 @@ var schemaSource string func getValidator() *cuevalidator.Validator { getSchemaOnce.Do(func() { - cueCtx := cuecontext.New() - compiledSchema := cueCtx.CompileString(schemaSource).LookupPath( + // The validator uses periodic context recreation to prevent memory leaks. + // The context is reused for up to 100 validations, then recreated to allow + // garbage collection of cached values while maintaining good performance. + validator = cuevalidator.NewValidatorFromSource( + schemaSource, cue.ParsePath("lineage.schemas[0].schema.spec"), ) - validator = cuevalidator.NewValidator(compiledSchema) }) return validator diff --git a/apps/dashboard/pkg/apis/dashboard/v1beta1/validation.go b/apps/dashboard/pkg/apis/dashboard/v1beta1/validation.go index 248dc27111c..0b57f702409 100644 --- a/apps/dashboard/pkg/apis/dashboard/v1beta1/validation.go +++ b/apps/dashboard/pkg/apis/dashboard/v1beta1/validation.go @@ -10,7 +10,6 @@ import ( "k8s.io/apimachinery/pkg/util/validation/field" "cuelang.org/go/cue" - "cuelang.org/go/cue/cuecontext" "cuelang.org/go/cue/errors" "github.com/grafana/grafana/apps/dashboard/pkg/apis/dashboard/cuevalidator" @@ -84,11 +83,13 @@ var schemaSource string func getValidator() *cuevalidator.Validator { getSchemaOnce.Do(func() { - cueCtx := cuecontext.New() - compiledSchema := cueCtx.CompileString(schemaSource).LookupPath( + // The validator uses periodic context recreation to prevent memory leaks. + // The context is reused for up to 100 validations, then recreated to allow + // garbage collection of cached values while maintaining good performance. + validator = cuevalidator.NewValidatorFromSource( + schemaSource, cue.ParsePath("lineage.schemas[0].schema.spec"), ) - validator = cuevalidator.NewValidator(compiledSchema) }) return validator diff --git a/apps/dashboard/pkg/apis/dashboard/v2alpha1/validation.go b/apps/dashboard/pkg/apis/dashboard/v2alpha1/validation.go index ca9dcd3e514..71f2e6d08e1 100644 --- a/apps/dashboard/pkg/apis/dashboard/v2alpha1/validation.go +++ b/apps/dashboard/pkg/apis/dashboard/v2alpha1/validation.go @@ -10,7 +10,6 @@ import ( "k8s.io/apimachinery/pkg/util/validation/field" "cuelang.org/go/cue" - "cuelang.org/go/cue/cuecontext" "cuelang.org/go/cue/errors" "github.com/grafana/grafana/apps/dashboard/pkg/apis/dashboard/cuevalidator" @@ -133,11 +132,13 @@ var schemaSource string func getValidator() *cuevalidator.Validator { getSchemaOnce.Do(func() { - cueCtx := cuecontext.New() - compiledSchema := cueCtx.CompileString(schemaSource).LookupPath( + // The validator uses periodic context recreation to prevent memory leaks. + // The context is reused for up to 100 validations, then recreated to allow + // garbage collection of cached values while maintaining good performance. + validator = cuevalidator.NewValidatorFromSource( + schemaSource, cue.ParsePath("DashboardSpec"), ) - validator = cuevalidator.NewValidator(compiledSchema) }) return validator diff --git a/apps/dashboard/pkg/apis/dashboard/v2beta1/validation.go b/apps/dashboard/pkg/apis/dashboard/v2beta1/validation.go index 518c133bcd7..875be7b4beb 100644 --- a/apps/dashboard/pkg/apis/dashboard/v2beta1/validation.go +++ b/apps/dashboard/pkg/apis/dashboard/v2beta1/validation.go @@ -10,7 +10,6 @@ import ( "k8s.io/apimachinery/pkg/util/validation/field" "cuelang.org/go/cue" - "cuelang.org/go/cue/cuecontext" "cuelang.org/go/cue/errors" "github.com/grafana/grafana/apps/dashboard/pkg/apis/dashboard/cuevalidator" @@ -133,11 +132,13 @@ var schemaSource string func getValidator() *cuevalidator.Validator { getSchemaOnce.Do(func() { - cueCtx := cuecontext.New() - compiledSchema := cueCtx.CompileString(schemaSource).LookupPath( + // The validator uses periodic context recreation to prevent memory leaks. + // The context is reused for up to 100 validations, then recreated to allow + // garbage collection of cached values while maintaining good performance. + validator = cuevalidator.NewValidatorFromSource( + schemaSource, cue.ParsePath("DashboardSpec"), ) - validator = cuevalidator.NewValidator(compiledSchema) }) return validator