[KEYCLOAK-10954] - Cache invalidation Javascript policies - cluster mode

[pedroigor]

No description provided.

[abstractj]

@pedroigor I just commented on the same Jira. But it seems the changes you've been working for JS engine will supersede this PR.

[pedroigor]

@abstractj we need this one.

[stianst]

@pedroigor Can you explain why caching of JS policies are needed? It seems now there's no need for invalidation cache here, but rather it is just loaded from the filesystem and re-loaded on re-deploy?

[pedroigor]

@stianst this cache avoids unnecessary compilation of scripts every time they are executed. Thus helping to boost execution during runtime (I did this some time ago when looking authz performance). Even with the new approach for deploying scripts into the server, we still need this cache layer because of that.

I understand that with the new way of deploying scripts to the server, we don't need it anymore. And we should remove this once we completely remove script upload from the server.

[pedroigor]

@stianst can we have this one approved?

[slaskawi]

Approved.

[stianst]

As far as I can see this PR is still focusing on the old approach of uploading JS over REST, and is not the correct approach for the new approach. It is also only focusing on JS policies and not all JS code.

[stianst]

@stianst this cache avoids unnecessary compilation of scripts every time they are executed. Thus helping to boost execution during runtime (I did this some time ago when looking authz performance). Even with the new approach for deploying scripts into the server, we still need this cache layer because of that.

I understand that with the new way of deploying scripts to the server, we don't need it anymore. And we should remove this once we completely remove script upload from the server.

That seems to be two contradicting statements. #1 "Even with the new approach for deploying scripts into the server, we still need this" and #2 "with the new way of deploying scripts to the server, we don't need it anymore".

From my understanding of this PR it is not relevant with the new approach, and we should not make improvements/changes to what is a deprecated and no longer recommended approach.

When deploying JS code now I assume it is wrapped in a factory, where the factory instance should hold the compiled version of the JS. This renders a invalidation cache like this useless.

[pedroigor]

Yes, for the new strategy of deploying scripts to the server it is not needed anymore. But when using the deprecated way of doing so.

Closing.