Performance: Cache RoleMaps produced by `RoleMap#newMatchingRoleMap()` #81

AbhyudayaSharma · 2019-06-20T07:01:15Z

From our discussion yesterday on the Gitter chat and since the newMatchingRoleMap is called for every ACL request and a lot of permissions are checked for a project when the home page loads, having a cache avoids checking regular expressions again for every time permission checks are called for a given Item.

Since the newMatchingRoleMap is called for every ACL request and a lot of permissions are checked for a project when the home page loads, having a cache avoids checking regular expressions again for every time permission checks are called for a given Item.

oleg-nenashev

Would be great to think about cache invalidation.
I would guess that ItemListener would be enough for it (so that we invalidate the cache on item creation or deletion). WDYT?

Also, would be great to have some performance metrics before and after the change from our benchmarks

AbhyudayaSharma · 2019-06-20T09:08:33Z

src/main/java/com/michelin/cio/hudson/plugins/rolestrategy/RoleMap.java

+   * for different permissions for the same {@code itemName}, so cache them and avoid wasting time
+   * matching regular expressions.
+   */
+  private final Cache<String, RoleMap> matchingRoleMapCache = CacheBuilder.newBuilder()


Do we continue with the Cache from Guava (avoid adding any dependencies) or use something else like JCS, Ehcache or something else?

It is fine to use Guava as long as we do not needed newer versions.
Maybe we could have a research task for comparing cache implementations with benchmarks in later phases

AbhyudayaSharma · 2019-06-20T09:19:35Z

Results compared to the benchmarks carried out in #80 :

* cleanup JavaDoc for newMatchingRoleMap * remove unused private method * cleanup unAssignRole

AbhyudayaSharma · 2019-06-20T11:35:33Z

src/main/java/com/michelin/cio/hudson/plugins/rolestrategy/RoleMap.java

   */
-  public RoleMap newMatchingRoleMap(String namePattern) {
-    RoleMap cachedRoleMap = matchingRoleMapCache.getIfPresent(namePattern);
+  public RoleMap newMatchingRoleMap(String itemName) {


I've changed the JavaDoc because I don't think it was correctly telling what was going on.

I agree that the original Javadoc was wrong,
Maybe we could rename it to itemNamePrefix or so, because actually it does some kind of "pattern matching", just not the regexp/wildcard/whatever. It just takes a string and verifies it against regexp, but it does not really have to be a full item name. For better or worse...

AbhyudayaSharma · 2019-06-20T11:36:22Z

src/main/java/com/michelin/cio/hudson/plugins/rolestrategy/RoleMap.java

-   * @param permission The permission you want to check
-   * @return A Set of Roles holding the given permission
-   */
-  private Set<Role> getRolesHavingPermission(final Permission permission) {


I've removed it because it was not being used anywhere.

It was refactored out in #54 and has no references to it now.

It looks like a good API method, but we can always recover it later if somebody needs it

AbhyudayaSharma · 2019-06-20T11:38:55Z

src/main/java/com/michelin/cio/hudson/plugins/rolestrategy/RoleMap.java

@@ -203,8 +203,8 @@ public SidACL getACL(RoleType roleType, AccessControlled controlledItem) {
  public void addRole(Role role) {
      if (this.getRole(role.getName()) == null) {
          this.grantedRoles.put(role, new CopyOnWriteArraySet<>());
+          matchingRoleMapCache.invalidateAll();


This cache would only be affected when a change to grantedRoles is made because the RoleMap returned contains only those roles applicable for a given name. So it won't be necessary to use ItemListener in this case.

oleg-nenashev

Fine with me, just minor comments

oleg-nenashev · 2019-06-21T07:09:18Z

src/main/java/com/michelin/cio/hudson/plugins/rolestrategy/RoleMap.java

+   * for different permissions for the same {@code itemName}, so cache them and avoid wasting time
+   * matching regular expressions.
+   */
+  private final Cache<String, RoleMap> matchingRoleMapCache = CacheBuilder.newBuilder()


It is fine to use Guava as long as we do not needed newer versions.
Maybe we could have a research task for comparing cache implementations with benchmarks in later phases

src/main/java/com/michelin/cio/hudson/plugins/rolestrategy/RoleMap.java

oleg-nenashev · 2019-06-21T07:10:16Z

src/main/java/com/michelin/cio/hudson/plugins/rolestrategy/RoleMap.java

@@ -203,8 +203,8 @@ public SidACL getACL(RoleType roleType, AccessControlled controlledItem) {
  public void addRole(Role role) {
      if (this.getRole(role.getName()) == null) {
          this.grantedRoles.put(role, new CopyOnWriteArraySet<>());
+          matchingRoleMapCache.invalidateAll();


oleg-nenashev · 2019-06-21T07:13:12Z

src/main/java/com/michelin/cio/hudson/plugins/rolestrategy/RoleMap.java

-   * @param permission The permission you want to check
-   * @return A Set of Roles holding the given permission
-   */
-  private Set<Role> getRolesHavingPermission(final Permission permission) {


It looks like a good API method, but we can always recover it later if somebody needs it

oleg-nenashev · 2019-06-24T05:13:07Z

Test failure is really odd here, and last reopen did not trigger the build. Let me try

AbhyudayaSharma · 2019-06-24T06:52:26Z

src/main/java/com/michelin/cio/hudson/plugins/rolestrategy/RoleMap.java

+   */
+  private final Cache<String, RoleMap> matchingRoleMapCache = CacheBuilder.newBuilder()
+          .softValues()
+          .maximumSize(Settings.USER_DETAILS_CACHE_MAX_SIZE)


The default value for the max size of the cache is 100. If there are more than 100 objects managed by Role Strategy, the cache would start evicting entries. Also, the max size of the cache cannot be increased after its creation. Should we care about this situation and create a larger cache using an ItemListener and a ComputerListener at the cost of higher memory usage?

+1. The objects are not big, so bumping to 2048 or so would make sense

AbhyudayaSharma · 2019-06-24T06:54:45Z

src/main/java/com/michelin/cio/hudson/plugins/rolestrategy/RoleMap.java

+   * for different permissions for the same {@code itemNamePrefix}, so cache them and avoid wasting time
+   * matching regular expressions.
+   */
+  private final Cache<String, RoleMap> matchingRoleMapCache = CacheBuilder.newBuilder()


The matching RoleMaps that are created also have a cache in them which is not needed. Do we reorganize the class structure to avoid it or don't care about a little more memory use?

I would submit a follow-up ticket for it. Memory usage is not a problem for the plugin ATM

oleg-nenashev

re-:+1:

scrwr · 2020-01-28T12:01:15Z

Hi. This has some really odd implication as it seems. A typical workflow is:

create a new role
assign the role

But role assignment doesn't invalidate the cache and hence, the user sticks with his old roleset for an hour.

odilontalk · 2020-08-28T16:08:59Z

Yeah, facing the same issue mentioned by @scrwr here.

There is any command that i can run to invalidate cache? Maybe in Jenkins Script Console?

oleg-nenashev · 2020-08-28T16:48:05Z

I plan to cut a releas soon, sorry for delays

…

On Fri, Aug 28, 2020, 18:09 Odilon Alves ***@***.***> wrote: Yeah, facing the same issue mentioned by @scrwr <https://github.com/scrwr> here <#81 (comment)> . There is any command that i can run to invalidate cache? Maybe in Jenkins Script Console? — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub <#81 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAW4RIEJVMV7SXDLRRFZA23SC7JCVANCNFSM4HZQA4CA> .

grickit · 2020-08-28T16:56:07Z

@odilontalk I just ran into this myself and confirmed (as implied by @scrwr's comment) that creating a new arbitrary dummy role and hitting "apply" will clear/update the cached permissions. You can then delete that role.

AbhyudayaSharma requested a review from a team June 20, 2019 07:01

AbhyudayaSharma self-assigned this Jun 20, 2019

AbhyudayaSharma changed the title ~~Add a cache for RoleMap#newMatchingRoleMap()~~ Cache RoleMaps produced by RoleMap#newMatchingRoleMap() Jun 20, 2019

oleg-nenashev reviewed Jun 20, 2019

View reviewed changes

Add items to the cache

86d94bd

AbhyudayaSharma commented Jun 20, 2019

View reviewed changes

Invalidate cache on adding and removing role

4846f65

* cleanup JavaDoc for newMatchingRoleMap * remove unused private method * cleanup unAssignRole

AbhyudayaSharma commented Jun 20, 2019

View reviewed changes

oleg-nenashev approved these changes Jun 21, 2019

View reviewed changes

Supun94 approved these changes Jun 21, 2019

View reviewed changes

Expire cache entries after 1 hour

b267c97

AbhyudayaSharma force-pushed the new-matching-rolemap-cache branch from 67fb6a0 to b267c97 Compare June 21, 2019 09:54

Rename itemName to itemNamePrefix

7eb9afe

AbhyudayaSharma closed this Jun 22, 2019

AbhyudayaSharma reopened this Jun 22, 2019

AbhyudayaSharma closed this Jun 24, 2019

AbhyudayaSharma reopened this Jun 24, 2019

oleg-nenashev closed this Jun 24, 2019

oleg-nenashev reopened this Jun 24, 2019

AbhyudayaSharma commented Jun 24, 2019

View reviewed changes

Increase max cache size to 2048 objects

1f9a783

oleg-nenashev changed the title ~~Cache RoleMaps produced by RoleMap#newMatchingRoleMap()~~ Performance: Cache RoleMaps produced by RoleMap#newMatchingRoleMap() Jun 24, 2019

oleg-nenashev added the enhancement label Jun 24, 2019

oleg-nenashev approved these changes Jun 24, 2019

View reviewed changes

runzexia approved these changes Jun 27, 2019

View reviewed changes

runzexia added on-hold and removed on-hold labels Jun 27, 2019

runzexia merged commit 474e172 into jenkinsci:master Jun 27, 2019

AbhyudayaSharma deleted the new-matching-rolemap-cache branch June 27, 2019 09:42

AbhyudayaSharma mentioned this pull request Jun 28, 2019

[JENKINS-58399] Performance: Avoid finding implying permissions on each hasPermission() call #83

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Performance: Cache RoleMaps produced by `RoleMap#newMatchingRoleMap()` #81

Performance: Cache RoleMaps produced by `RoleMap#newMatchingRoleMap()` #81

AbhyudayaSharma commented Jun 20, 2019

oleg-nenashev left a comment

AbhyudayaSharma Jun 20, 2019

oleg-nenashev Jun 21, 2019

AbhyudayaSharma commented Jun 20, 2019 •

edited

Loading

AbhyudayaSharma Jun 20, 2019 •

edited

Loading

oleg-nenashev Jun 20, 2019

AbhyudayaSharma Jun 20, 2019 •

edited

Loading

AbhyudayaSharma Jun 20, 2019

oleg-nenashev Jun 21, 2019

AbhyudayaSharma Jun 20, 2019

oleg-nenashev Jun 21, 2019

oleg-nenashev left a comment

oleg-nenashev Jun 21, 2019

oleg-nenashev Jun 21, 2019

oleg-nenashev Jun 21, 2019

oleg-nenashev commented Jun 24, 2019

AbhyudayaSharma Jun 24, 2019 •

edited

Loading

oleg-nenashev Jun 24, 2019

AbhyudayaSharma Jun 24, 2019

oleg-nenashev Jun 24, 2019

oleg-nenashev left a comment

scrwr commented Jan 28, 2020

odilontalk commented Aug 28, 2020

oleg-nenashev commented Aug 28, 2020 via email

grickit commented Aug 28, 2020

Performance: Cache RoleMaps produced by RoleMap#newMatchingRoleMap() #81

Performance: Cache RoleMaps produced by RoleMap#newMatchingRoleMap() #81

Conversation

AbhyudayaSharma commented Jun 20, 2019

oleg-nenashev left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

AbhyudayaSharma commented Jun 20, 2019 • edited Loading

AbhyudayaSharma Jun 20, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

AbhyudayaSharma Jun 20, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

oleg-nenashev left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

oleg-nenashev commented Jun 24, 2019

AbhyudayaSharma Jun 24, 2019 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

oleg-nenashev left a comment

Choose a reason for hiding this comment

scrwr commented Jan 28, 2020

odilontalk commented Aug 28, 2020

oleg-nenashev commented Aug 28, 2020 via email

grickit commented Aug 28, 2020

Performance: Cache RoleMaps produced by `RoleMap#newMatchingRoleMap()` #81

Performance: Cache RoleMaps produced by `RoleMap#newMatchingRoleMap()` #81

AbhyudayaSharma commented Jun 20, 2019 •

edited

Loading

AbhyudayaSharma Jun 20, 2019 •

edited

Loading

AbhyudayaSharma Jun 20, 2019 •

edited

Loading

AbhyudayaSharma Jun 24, 2019 •

edited

Loading