Skip to content

Managing Bridge Caches

This page covers day-to-day operational management of the secrets cache on a Bridge: monitoring sync and understanding key rotation.

For Bridge deployment and operational management (heartbeats, connectivity, updates), see CLM Bridges — Managing Bridges.

How the Bridge Syncs Lockers

Initial Sync

When the Bridge starts or receives an updated configuration from the platform, it requests the list of Lockers assigned to it via the sync-lockers endpoint. For each Locker in the list, the Bridge compares the Locker's updated_at timestamp against its in-memory cache. Lockers that are new or have a newer timestamp are downloaded and decrypted.

Incremental Refresh

The Bridge communicates with the platform via periodic heartbeats. When a secret in an assigned Locker is added or deleted, the platform sets a lockers_changed flag in the next heartbeat response. The Bridge starts an asynchronous sync task to refresh stale Lockers without blocking its primary operations.

This means:

  • Lockers are refreshed promptly when their contents change, without the Bridge continuously polling.
  • Only Lockers with changed updated_at timestamps are re-downloaded — unchanged Lockers are not re-fetched.

Encrypted Download

Each Locker download is encrypted with the Bridge's current public key, using the ECDH + AES-256-GCM protocol. The Bridge performs the ECDH locally and decrypts the bundle in memory.

Key Rotation

The Bridge automatically rotates its cryptographic key pair every 24 hours. Key rotation does not require any manual action or configuration change. After a rotation:

  • The Bridge registers its new public key with the platform.
  • The next Locker sync automatically re-downloads encrypted bundles using the new key.
  • Old key material is discarded from memory.

If you are troubleshooting sync issues after a key rotation, see CLM Bridges — Managing Bridges.

Memory Safety

Secret values in the Bridge are stored using memory types that zero their contents when dropped. This means:

  • On Bridge shutdown or restart, secret values are not recoverable from process memory.
  • The secrets cache is rebuilt from the platform on each startup.
  • If the Bridge is unable to reach the platform on startup, the cache starts empty and fills as connectivity is restored.

Audit Events

Event Description
locker.bridge_cache.assigned A Locker was assigned to a Bridge for caching
locker.bridge_cache.removed A Locker was removed from a Bridge cache
bridge.sync_lockers.success The Bridge successfully synced its Locker list
bridge.sync_locker.success The Bridge successfully downloaded and cached a Locker
bridge.sync_locker.access_denied The Bridge attempted to sync a Locker it is not authorised for

Audit logs are viewable under Admin → Audit Log.

Next Steps