Oracle Cloud Infrastructure's Go SDK (oci-go-sdk) exhibits a memory leak on OKE Workload Identity providers due to unclosed keep-alive connections that fail to garbage collect discarded providers.

{
  "signal_id": "be4c7d8b-63e9-5ca1-a5a9-4549ea122868",
  "signal_type": "reddit-company",
  "signal_subtype": "customerFeedback",
  "detected_at": "2026-10-31T13:40:46+00:00",
  "company": {
    "name": "Oracle",
    "domain": "oracle.com"
  },
  "data": {
    "nsfw": false,
    "stage": "none",
    "awards": 0,
    "timing": "ongoing_state",
    "topics": [
      "kubernetes",
      "cloud infrastructure",
      "memory leak",
      "sdk"
    ],
    "post_id": "1xkaivn",
    "summary": "Oracle Cloud Infrastructure's Go SDK (oci-go-sdk) exhibits a memory leak on OKE Workload Identity providers due to unclosed keep-alive connections that fail to garbage collect discarded providers.",
    "category": "reliability",
    "comments": [
      {
        "url": "https://www.reddit.com/r/kubernetes/comments/1xkaivn/comment/19rxqltu73x0g/",
        "depth": 0,
        "score": 1,
        "author": "kaizakin",
        "excerpt": "nice find. does the lru in eso evict per store or per provider key, and would a bigger cache just hide the sdk leak",
        "posted_at": "2026-10-31T15:59:59.000Z",
        "author_url": "https://www.reddit.com/user/kaizakin/"
      },
      {
        "url": "https://www.reddit.com/r/kubernetes/comments/1xkaivn/comment/19rz7mkqqf1t1/",
        "depth": 0,
        "score": 1,
        "author": "SilentLennie",
        "excerpt": "For a moment there, I was worried this would be a security leak or exploitable somehow, that would worse. Luckily it's not that.",
        "posted_at": "2026-11-01T11:48:43.000Z",
        "author_url": "https://www.reddit.com/user/SilentLennie/"
      }
    ],
    "evidence": [
      "[post] The root cause is in the OCI Go SDK: an OKE Workload Identity provider that is thrown away keeps its proxymux connection open forever.",
      "[post] In oci-go-sdk, the provider's token client talks to the OKE proxymux over an http.Transport with keep-alives on and no IdleConnTimeout, and nothing ever closes it."
    ],
    "link_url": "/r/oracle/comments/1xkady1/external_secrets_operator_on_oke_leaks_memory/",
    "virality": "low",
    "post_date": "2026-10-31T13:40:46.000Z",
    "post_kind": "crosspost",
    "post_text": "TL;DR: If you run External Secrets Operator (ESO) on OKE with principalType: Workload and more than 50 SecretStores that set serviceAccountRef, the controller leaks memory, about 20–25 MiB/h, until it is OOM-killed. The root cause is in the OCI Go SDK: an OKE Workload Identity provider that is thrown away keeps its proxymux connection open forever. The SDK fix is one line, and ESO also needs a configurable cache size.\n\nWhat we saw\n\nESO v2.8.0 on OKE. We have one SecretStore per namespace, each with its own service account, so that IAM only lets a namespace read its own secrets.\n\nAt 50 stores, memory was flat.\n\nThe day the 51st store was created, the controller started growing 20–25 MiB/h. It was then SIGKILLed at its 1 GiB limit every ~36 h.\n\nExternalSecrets with a 1m refresh were 4–5 minutes behind.\n\nWhy\n\nESO caches one Workload Identity configuration provider per store, in an LRU fixed at 50 entries. With 51+ stores, the reconciles cycle through more keys than the cache holds, so every lookup misses and ESO builds a new provider.\n\nIn oci-go-sdk, the provider's token client talks to the OKE proxymux over an http.Transport with keep-alives on and no IdleConnTimeout, and nothing ever closes it. The idle connection's goroutines keep the transport, the federation client and its RSA session key reachable. So a provider that is dropped is never...",
    "sentiment": "negative",
    "subreddit": "kubernetes",
    "event_date": "2026-10",
    "post_title": "External Secrets Operator on OKE leaks memory above 50 Workload Identity SecretStores: root cause is in oci-go-sdk (fix inside)",
    "prominence": "core",
    "source_url": "https://www.reddit.com/r/kubernetes/comments/1xkaivn/external_secrets_operator_on_oke_leaks_memory/",
    "entity_role": "vendor",
    "post_author": "danielfree19",
    "upvote_ratio": 0.8125,
    "mention_count": 3,
    "mention_surge": true,
    "subreddit_url": "https://www.reddit.com/r/kubernetes/",
    "total_upvotes": 10,
    "comments_total": 4,
    "total_comments": 2,
    "post_author_url": "https://www.reddit.com/user/danielfree19/",
    "signal_category": "feedback",
    "comments_included": 2,
    "products_mentioned": [
      "OKE",
      "oci-go-sdk",
      "Oracle Cloud Infrastructure"
    ]
  }
}

curl https://signals.autobound.ai/v1/signals/be4c7d8b-63e9-5ca1-a5a9-4549ea122868 \
  -H "X-API-KEY: $AUTOBOUND_API_KEY"

curl -X POST https://signals.autobound.ai/v1/companies/enrich \
  -H "X-API-KEY: $AUTOBOUND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"oracle.com","limit":20}'