Ben Barclay 9884b4faad fix(cron/chronos): cache PyJWKClient across fires to stop JWKS fetch storm (#64641) ... The inbound cron-fire verifier constructed a fresh PyJWKClient on every fire, discarding the client's key cache and forcing a synchronous JWKS HTTP GET to the portal on each fire. Under a burst of concurrent fires (a hosted instance with several cron jobs firing in the same window) this fanned out into N simultaneous JWKS fetches that the portal rate-limited (HTTP 403 -> verification fails -> agent 401), or that blocked the event loop long enough that the fire webhook could not return its 202 before the relay's 30s timeout (observed in prod as relay 504s concentrated on high-job-count instances). Cache one PyJWKClient per JWKS URL at module scope (double-checked lock) so the signing keys are reused across fires; NAS keys rotate rarely, so the steady state is zero JWKS fetches per fire. Regression test proves 5 fires -> 1 client construction (was 5).		2026-07-15 09:27:35 +10:00
..
__init__.py	fix(cron): avoid provider package shadowing core cron	2026-06-23 23:39:22 -07:00
_nas_client.py	fix(cron): avoid provider package shadowing core cron	2026-06-23 23:39:22 -07:00
plugin.yaml	fix(cron): avoid provider package shadowing core cron	2026-06-23 23:39:22 -07:00
verify.py	fix(cron/chronos): cache PyJWKClient across fires to stop JWKS fetch storm (#64641)	2026-07-15 09:27:35 +10:00