e9da29d16c
This patch changes all RBAC relationship method to "joined". This change
enforces that the RBAC associated registers are loaded along with the
parent resource. The rationale of this change is to be able to control
the SQL query executed; the subquery cannot be directly managed by
Neutron.
It is very usual to create the RBAC rules from one single project that
is usually the adminitrator project. That means all RBAC rules will
belong to it. Before this change, the SQL subquery performed to
retrieve the RBAC entries was this (from a network query):
SELECT networks.id AS networks_id
FROM networks LEFT OUTER JOIN networkrbacs ON networks.id =
networkrbacs.object_id
WHERE networks.project_id = 'bd133e2c499c4bf8aeb16206e31c3c20'
OR networkrbacs.action = 'access_as_external'
AND networkrbacs.target_project = 'bd133e2c499c4bf8aeb16206e31c3c20'
OR networkrbacs.target_project = '*'
OR networks.project_id = 'bd133e2c499c4bf8aeb16206e31c3c20'
OR networkrbacs.action IN ('access_as_shared', 'access_as_readonly')
AND (networkrbacs.target_project = 'bd133e2c499c4bf8aeb16206e31c3c20'
OR networkrbacs.target_project = '*');
This SQL result has a very low cardinality; that means there are many
duplicated registers. For example, with 10 external network, 1000
projects and 2500 RBAC rules, this query returns 1.4 million rows.
Instead if a "GROUP BY resource_id" (in this case network_id) clause is
added, the number of rows is reduced to 10 (considering this project
has a RBAC per network).
In order to introduce this "GROUP BY" clause, this patch is changing
the loading method. The clause is added in a neutron-lib patch [1].
This change by itself does not improve the query performance. The
neutron-lib patch is needed too. Although this patch does not modify
que SQL query results, the tests added will prove that the neutron-lib
patch does not introduce any regression.
[1]https://review.opendev.org/c/openstack/neutron-lib/+/884878
Closes-Bug: #1918145
Change-Id: Ic6001bd5a57493b8befdf81a41eb0bd1c8022df3
42 lines
1.7 KiB
Python
42 lines
1.7 KiB
Python
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
# not use this file except in compliance with the License. You may obtain
|
|
# a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
# License for the specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
from neutron_lib.db import constants as db_const
|
|
from neutron_lib.db import model_base
|
|
import sqlalchemy as sa
|
|
from sqlalchemy import sql
|
|
|
|
from neutron.db import rbac_db_models
|
|
|
|
|
|
class AddressScope(model_base.BASEV2, model_base.HasId, model_base.HasProject):
|
|
"""Represents a neutron address scope."""
|
|
|
|
__tablename__ = "address_scopes"
|
|
|
|
name = sa.Column(sa.String(db_const.NAME_FIELD_SIZE), nullable=False)
|
|
|
|
# TODO(imalinovskiy): drop this field when contract migrations will be
|
|
# allowed again
|
|
# NOTE(imalinovskiy): this field cannot be removed from model due to
|
|
# functional test test_models_sync, trailing underscore is required to
|
|
# prevent conflicts with RBAC code
|
|
shared_ = sa.Column("shared", sa.Boolean, nullable=False,
|
|
server_default=sql.false())
|
|
|
|
ip_version = sa.Column(sa.Integer(), nullable=False)
|
|
|
|
rbac_entries = sa.orm.relationship(rbac_db_models.AddressScopeRBAC,
|
|
backref='address_scopes',
|
|
lazy='joined',
|
|
cascade='all, delete, delete-orphan')
|