From 2875ba54ea6f98f7cc391a20bc8571c31b67fbc1 Mon Sep 17 00:00:00 2001
From: Marco Dinis <marco.dinis@goteleport.com>
Date: Tue, 17 Dec 2024 09:34:28 +0000
Subject: [PATCH] add mutex to cached responses

---
 lib/srv/discovery/fetchers/kube_services.go | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/lib/srv/discovery/fetchers/kube_services.go b/lib/srv/discovery/fetchers/kube_services.go
index 82958653bd7a4..f6afe625d8c00 100644
--- a/lib/srv/discovery/fetchers/kube_services.go
+++ b/lib/srv/discovery/fetchers/kube_services.go
@@ -320,6 +320,7 @@ type ProtoChecker struct {
 	// When the Kubernetes Service ResourceVersion changes, then we assume the protocol might've changed as well, so the cache is invalidated.
 	// Only protocol checkers that require a network connection are cached.
 	cacheKubernetesServiceProtocol map[kubernetesNameNamespace]appResourceVersionProtocol
+	cacheMU                        sync.RWMutex
 }
 
 type appResourceVersionProtocol struct {
@@ -357,10 +358,13 @@ func (p *ProtoChecker) CheckProtocol(service v1.Service, port v1.ServicePort) st
 	}
 
 	key := kubernetesNameNamespace{namespace: service.Namespace, name: service.Name}
-	if versionProtocol, ok := p.cacheKubernetesServiceProtocol[key]; ok {
-		if versionProtocol.resourceVersion == service.ResourceVersion {
-			return versionProtocol.protocol
-		}
+
+	p.cacheMU.RLock()
+	versionProtocol, keyIsCached := p.cacheKubernetesServiceProtocol[key]
+	p.cacheMU.RUnlock()
+
+	if keyIsCached && versionProtocol.resourceVersion == service.ResourceVersion {
+		return versionProtocol.protocol
 	}
 
 	var result string
@@ -380,10 +384,12 @@ func (p *ProtoChecker) CheckProtocol(service v1.Service, port v1.ServicePort) st
 
 	}
 
+	p.cacheMU.Lock()
 	p.cacheKubernetesServiceProtocol[key] = appResourceVersionProtocol{
 		resourceVersion: service.ResourceVersion,
 		protocol:        result,
 	}
+	p.cacheMU.Unlock()
 
 	return result
 }