feat: cache argo cd rbac #7587
feat: cache argo cd rbac #7587
Conversation
Part of: argoproj#4296 Signed-off-by: Jan Jansen <jan.jansen@gdata.de>
Signed-off-by: pashavictorovich <pavel@codefresh.io>
…e-argo-cd � Conflicts: � util/rbac/rbac.go
Signed-off-by: pashavictorovich <pavel@codefresh.io>
Signed-off-by: pashavictorovich <pavel@codefresh.io>
Signed-off-by: pashavictorovich <pavel@codefresh.io>
Codecov Report
@@ Coverage Diff @@
## master #7587 +/- ##
==========================================
+ Coverage 41.39% 41.46% +0.07%
==========================================
Files 161 161
Lines 21686 21723 +37
==========================================
+ Hits 8976 9008 +32
- Misses 11445 11449 +4
- Partials 1265 1266 +1
Continue to review full report at Codecov.
|
|
IIUC, the |
|
We also implemented the rbac cache based on #6739 and have been using it on prod for several weeks. The issue of the casbin cached enforcer is that it doesn't free memory and will hold cached items forever. |
|
Thank you for comment @yeya24 |
Signed-off-by: Alexander Matyushentsev <AMatyushentsev@gmail.com>
util/rbac/rbac.go
Outdated
| var err error | ||
| if policy == "" { | ||
| enf = e.Enforcer | ||
| enf = e.wrapperEnforcer | ||
| } else { | ||
| enf, err = newEnforcerSafe(newBuiltInModel(), newAdapter(e.adapter.builtinPolicy, e.adapter.userDefinedPolicy, policy)) |
There was a problem hiding this comment.
If the project has roles with policies then the cache is not used. We should support this use case as well and use cached enforces with project with policies.
Signed-off-by: pashavictorovich <pavel@codefresh.io>
Signed-off-by: pashavictorovich <pavel@codefresh.io>
c165c11 to
c252e4e
Compare
Signed-off-by: pashavictorovich <pavel@codefresh.io>
8507764 to
d20baa7
Compare
|
Thanks a lot to @farodin91 for working on initial implementation in #6739! |
feat: cache argo cd rbac (argoproj#7587) Part of: argoproj#4296 Signed-off-by: Jan Jansen <jan.jansen@gdata.de> Signed-off-by: pashavictorovich <pavel@codefresh.io> Signed-off-by: Alexander Matyushentsev <AMatyushentsev@gmail.com> Signed-off-by: lukasz.peplinski <lukpep@gmail.com>
Continuation on https://github.com/argoproj/argo-cd/pull/6739/files