-
Notifications
You must be signed in to change notification settings - Fork 11
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix(core): reduces GetEntitlements calls in GetDecisions (#1822)
### Proposed Changes * `GetEntitlements` is an expensive call. `GetDecisions` is calling `GetEntitlements` repetitively, despite no change in entities, but different Resource Attribute Policies. This can cause an unnecessary heavy load on the IDaP when a bulk amount Decisions are being made on one entity chain. * By getting all pertinent FAQs from the per Decision, and calling `GetEntitlements` per Decision will reduce IDaP load and have a huge performance win. ### Checklist - [ ] I have added or updated unit tests - [ ] I have added or updated integration tests (if appropriate) - [ ] I have added or updated documentation ### Testing Instructions Compare the newly added benchmark test `benchmark-decision` result in commit `c9215db` before the benchmark test was made to the `HEAD` of this PR (`e903758`) Follow the Platform Quickstart, and run `go run ./examples benchmark-decision --insecurePlaintextConn` for a quick test. Locally, on PR changes ``` Benchmark Results: Result: DECISION_PERMIT Total Time: 227.609ms ``` Locally, before PR changes ``` Benchmark Results: Result: DECISION_PERMIT Total Time: 2.143040292s ```
- Loading branch information
1 parent
a683f79
commit 8bb5744
Showing
3 changed files
with
270 additions
and
153 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,78 @@ | ||
| package cmd | ||
|
|
||
| import ( | ||
| "context" | ||
| "time" | ||
|
|
||
| "github.com/opentdf/platform/protocol/go/authorization" | ||
| "github.com/opentdf/platform/protocol/go/policy" | ||
| "github.com/spf13/cobra" | ||
| ) | ||
|
|
||
| func init() { | ||
| benchmarkCmd := &cobra.Command{ | ||
| Use: "benchmark-decision", | ||
| Short: "OpenTDF benchmark tool", | ||
| Long: `A OpenTDF benchmark tool to measure throughput and latency with configurable concurrency.`, | ||
| RunE: runDecisionBenchmark, | ||
| } | ||
|
|
||
| ExamplesCmd.AddCommand(benchmarkCmd) | ||
| } | ||
|
|
||
| func runDecisionBenchmark(cmd *cobra.Command, args []string) error { | ||
| // Create new offline client | ||
| client, err := newSDK() | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| ras := []*authorization.ResourceAttribute{} | ||
| for i := 0; i < 100; i++ { | ||
| ras = append(ras, &authorization.ResourceAttribute{AttributeValueFqns: []string{"https://example.com/attr/attr1/value/value1"}}) | ||
| } | ||
|
|
||
| start := time.Now() | ||
| res, err := client.Authorization.GetDecisions(context.Background(), &authorization.GetDecisionsRequest{ | ||
| DecisionRequests: []*authorization.DecisionRequest{ | ||
| { | ||
| Actions: []*policy.Action{{Value: &policy.Action_Standard{ | ||
| Standard: policy.Action_STANDARD_ACTION_DECRYPT, | ||
| }}}, | ||
| EntityChains: []*authorization.EntityChain{ | ||
| {Id: "rewrap-tok", Entities: []*authorization.Entity{ | ||
| {Id: "jwtentity-0-clientid-opentdf-public", EntityType: &authorization.Entity_ClientId{ClientId: "opentdf-public"}, Category: authorization.Entity_CATEGORY_ENVIRONMENT}, | ||
| {Id: "jwtentity-1-username-sample-user", EntityType: &authorization.Entity_UserName{UserName: "sample-user"}, Category: authorization.Entity_CATEGORY_SUBJECT}, | ||
| }}}, | ||
| ResourceAttributes: ras, | ||
| }, | ||
| }, | ||
| }) | ||
| end := time.Now() | ||
| totalTime := end.Sub(start) | ||
|
|
||
| numberApproved := 0 | ||
| numberDenied := 0 | ||
| if err == nil { | ||
| for _, dr := range res.GetDecisionResponses() { | ||
| if dr.Decision == authorization.DecisionResponse_DECISION_PERMIT { | ||
| numberApproved += 1 | ||
| } else { | ||
| numberDenied += 1 | ||
| } | ||
|
|
||
| } | ||
| } | ||
|
|
||
| // Print results | ||
| cmd.Printf("\nBenchmark Results:\n") | ||
| if err == nil { | ||
| cmd.Printf("Approved Decision Requests: %d\n", numberApproved) | ||
| cmd.Printf("Denied Decision Requests: %d\n", numberDenied) | ||
| } else { | ||
| cmd.Printf("Error: %s\n", err.Error()) | ||
| } | ||
| cmd.Printf("Total Time: %s\n", totalTime) | ||
|
|
||
| return nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.