Repository navigation
Conversation
…cope RBAC authorize compared each request against every scope the caller holds, so a list endpoint returning tens of thousands of nodes cost requests x scopes on the event loop. Scopes are now bucketed by resource type and action once per call, and a request is matched by set lookups over its name's prefixes.
✅ Deploy Preview for thriving-cassata-78ae72 canceled.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Before, each node was compared against every scope. For endpoints that return tens of thousands of nodes, this checks a lot of scopes and could stall the worker serving it. With this change, each node generates its own few prefixes and looks them up in a set built from the scopes.
For example, let's say the caller has three scopes:
finance.*marketing.campaigns.*sales.revenueThe request is for the node
ads.reports.daily.Before
For this one node, the scan goes through every scope:
finance.*coverads.reports.daily? Check whether the name starts withfinance.? no.marketing.campaigns.*cover it? Starts withmarketing.campaigns.? No.sales.revenuematch it exactly? No.That's 3 comparisons, and all fail, so the node is denied or falls to the default policy. With 800 scopes it's 800 comparisons for one node, and the same again for each of the other 10K nodes one of these endpoints might return.
List endpoints (e.g.,
/dimensions/common/,/metrics/,/dimensions/) authorize every node they return, so a result returning tens of thousands of nodes could stall the worker serving it.After
The scopes become two sets:
{finance, marketing.campaigns}{sales.revenue}For ads.reports.daily:
ads.reports.dailyin the exact set? No.ads, thenads.reports. Is either in the subtree set? No.The number of lookups stays at 3 even with 800 scopes.
Test Plan
make checkpassesmake testshows 100% unit test coverageDeployment Plan