#904 Replace pseudo-cache for environments and settings with proper cache Pull request opened by javuto Summary Replaced the TLS service pseudo-cache for environments/settings with Redis-backed cache wiring. Changes • Added a typed Redis JSON cache helper for reusable `GET`/`SET`/`DEL` storage of structured values. • Updated

EnvCache

to support Redis-backed environment caching with DB fallback on miss/error. • Kept API-to-TLS environment invalidation, now using a shared invalidation key prefix constant. • Added a Redis-backed TLS settings cache for settings such as

accelerated_seconds

. • Removed the TLS process-local

envsmap

/

settingsmap

globals and their periodic refresh goroutines. • Updated TLS handlers to use

EnvCache.GetByUUID(...)

consistently across osquery, osctrld, quick enroll, package download, and config endpoint paths. • Replaced handler debug checks from stale map lookups to the already-loaded cached environment. Validation •

GOCACHE=/tmp/osctrl-gocache go test ./pkg/cache ./pkg/settings ./pkg/environments ./cmd/tls/handlers ./cmd/tls ./cmd/api/handlers

•

GOCACHE=/tmp/osctrl-gocache go test ./...

Security Notes • Redis cache failures fall back to database reads rather than changing request authorization or validation behavior. • No cached payloads, enroll secrets, tokens, or Redis values are logged by the new cache helpers. • Existing TLS input validation and API/admin permission checks were left unchanged. jmpsec/osctrl