Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

modified resource sync to use an informer #137

Merged
merged 5 commits into from
May 13, 2022

Conversation

rg2011
Copy link
Contributor

@rg2011 rg2011 commented Mar 9, 2022

Rewrite of data.GenericSync that uses an informer to manage the connection to the Kubernetes API. Fixes issue #134

The informer uses a workqueue to schedule updates to OPA. To avoid an initial flood of individual resource updates, the controller keeps dropping items from the queue until it has completed the first bulk update to OPA.

A major drawback of this PR is that the flood might occur later on, if the informer restarts the watch and flushes all resources to the queue again. The controller will then update OPA item by item.

I'm publishing this PR as a draft, in case someone is interested and wants to give it a thought. Any suggestion on how to avoid an update flood when the informer reconnects would be appreciated.

@rg2011 rg2011 force-pushed the fix/issue-134-bis branch 2 times, most recently from 6a905ca to 6d67b02 Compare March 10, 2022 08:57
@rg2011
Copy link
Contributor Author

rg2011 commented Mar 10, 2022

I have updated the PR to filter out updates in the ResourceHandler UpdateFunc when the ResourceVersion has not changed. Since this informer is not configured to perform periodic resyncs, I think this is a safe way to avoid possible relist flood.

I'm removing draft from the title.

@rg2011 rg2011 changed the title [draft] modified resource sync to use an informer modified resource sync to use an informer Mar 10, 2022
Copy link
Contributor

@srenatus srenatus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm no expert with the innards of kube-mgmt so please bear with me on the questions and comments here 🙃

pkg/data/generic.go Outdated Show resolved Hide resolved
pkg/data/generic.go Outdated Show resolved Hide resolved
pkg/data/generic.go Show resolved Hide resolved
@@ -474,9 +473,9 @@ func TestGenericSync(t *testing.T) {

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❓ How do you judge our test coverage here, does it inspire confidence? (I really don't know, it's a genuine question since you're working on this.)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After #135 we have the initial load covered, and I'm confident on that part. But I have failed to add tests for addition / update / removal of resources after the initial load, and that's a problem.

I have tried both FakeDynamicClient.Tracker and FakeDynamicClient.Resource(){.Create, .Update, .Delete}, but I couldn't make them work. The tests didn't work even with the previous version.

So I'm currently testing this "on the field", in my company's dev environment, before we deploy the service to our production. In parallel, I'm checking out the FakeDynamicClient code to try and find out why the tests don't work.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I could make the tests work in 602be1f and now the coverage is around 78%. I think it's safe to remove the draft label now.

@rg2011 rg2011 force-pushed the fix/issue-134-bis branch from 6d67b02 to c421f3b Compare March 10, 2022 11:03
@anderseknert
Copy link
Member

Hey @rg2011 , are you on the OPA Slack by any chance?

@srenatus srenatus marked this pull request as draft March 10, 2022 17:11
@rg2011 rg2011 force-pushed the fix/issue-134-bis branch 3 times, most recently from a773b8f to 911a83a Compare March 11, 2022 11:03
@rg2011 rg2011 force-pushed the fix/issue-134-bis branch 2 times, most recently from 8f5864c to b7adb52 Compare March 11, 2022 15:01
@rg2011 rg2011 force-pushed the fix/issue-134-bis branch from b7adb52 to 602be1f Compare March 11, 2022 15:21
@rg2011 rg2011 marked this pull request as ready for review March 11, 2022 16:45
@rg2011 rg2011 force-pushed the fix/issue-134-bis branch from 7e180bb to 10f90c4 Compare March 12, 2022 10:23
@rg2011 rg2011 requested a review from srenatus March 14, 2022 08:40
@srenatus
Copy link
Contributor

@rg2011 didn't get to this today. I'll re-review later this week 🤞 Thanks for pushing this forward.

@rg2011 rg2011 marked this pull request as draft March 15, 2022 10:18
@rg2011 rg2011 force-pushed the fix/issue-134-bis branch from d49ee72 to 9a98fac Compare March 15, 2022 14:42
@rg2011 rg2011 marked this pull request as ready for review March 15, 2022 15:56
Signed-off-by: rg2011 <[email protected]>
Copy link
Contributor

@srenatus srenatus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry for the radio silence. I've gotten around to skimming the change, it looks good, but I'll need to have another closer look to approve.

Added a comment on what stood out to me when reading this.

return f.actor(req, value)
}

var errNotSupported = errors.New("PostData not supported")
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nit We could inline this, it's only used once (unless I'm missing something).

Copy link
Contributor Author

@rg2011 rg2011 Mar 30, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No real reason to create a variable, other than I'm used to it because it makes it easier to check this kind of errors with errors.Is later. But this particular error will never be checked, so we could remove it.

return fmt.Sprintf("{req: %q, path: %q, op: %q}", r.req, r.path, r.op)
}

func optional(expected ...[]byte) []byte {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nicely done

pkg/data/generic.go Show resolved Hide resolved
@eshepelyuk eshepelyuk requested a review from srenatus May 6, 2022 20:37
@eshepelyuk
Copy link
Contributor

@rg2011 @anderseknert @srenatus should I merge this ?

@eshepelyuk eshepelyuk merged commit cc4898a into open-policy-agent:master May 13, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants