[Bug 1723030] Re: Under certain conditions check_rules is very sluggish

[Hemanth Nakkina]

** Description changed:

  In Horizon we observe in certain projects function check_rules() taking
  up to 10 seconds while in the others maximum 2 seconds.
  
  In order to remedy this, we would like to have check_rules function
  executed only if oslo.policy is configured to check the syntax, i.e. to
  introduce a config parameter defaulting to True but with a possibility
  to disable it. In that case (operator setting it to False) there
  wouldn't be any checks from oslo.policy side if the syntax of provided
  JSON file is correct.
  
  Current behavior shouldn't be changed, i.e. syntax checks should be opt-
  out.
  
  ==========================================================================
  
  SRU for UCA Queens
  
  [Impact]
  In Horizon, Admin->Network->Networks page takes longer time to load. One of the improvements is to avoid any redundant policy checks which consume time.
  
  This fix optimizes the policy logic to avoid any redundant policy checks
  and further enhancing API response times.
  
  [Test Case]
  Create 240 networks and observe page load time before and after fix
  
  1. Collect information before fix
  
  1a. Increase network and subnet quota for the admin project
-     openstack quota set --networks -1 <project id>
-     openstack quota set --subnets -1 <project id>
+     openstack quota set --networks -1 <project id>
+     openstack quota set --subnets -1 <project id>
  
  1b. Create 240 networks using openstack cli
-     for i in {1..240}; do openstack network create test$i; openstack subnet create --subnet-range 10.1.$i.0/24 --network test$i test$i; done
+     for i in {1..240}; do openstack network create test$i; openstack subnet create --subnet-range 10.1.$i.0/24 --network test$i test$i; done
  
  1c. Login to dashboard as admin user in a preferred browser
  1d. Open Developer options --> Network tab. This should show all the outgoing network traffic information from browser.
  1e. Open Admin->Network->Networks page
  1f. Note down the time taken for /admin/networks in Network tab of browser
  1g. Repeat 1c 3-5 times and take average time taken for /admin/networks
  
- 2. Install the package with the fixed code
+ 2. Install the package with the fixed code and restart apache service
  
  3. Collect information after fix
  
  3a. Repeat steps 1c-1g
  
  3b.You should observe an improvement in time reduction of
  /admin/networks after the fix.
  
  [Regression Potential]
  
  Given the following indicators, the regression potential is negligible
  
- a. Upstream CI passed with all tempest test cases passed. Indicates no break in
-    functionality.
+ a. Upstream CI passed with all tempest test cases passed. Indicates no break in functionality.
  b. The fix is available on releases Rocky, Stein, Train since a year ago and no problems reported with this functionality.
+ 
+ There will be downtime of milliseconds during restart of apache
+ services.

** Tags added: sts-sru-needed

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to Ubuntu Cloud Archive.
https://bugs.launchpad.net/bugs/1723030

Title:
  Under certain conditions check_rules is very sluggish

Status in Ubuntu Cloud Archive:
  New
Status in oslo.policy:
  Fix Released

Bug description:
  In Horizon we observe in certain projects function check_rules()
  taking up to 10 seconds while in the others maximum 2 seconds.

  In order to remedy this, we would like to have check_rules function
  executed only if oslo.policy is configured to check the syntax, i.e.
  to introduce a config parameter defaulting to True but with a
  possibility to disable it. In that case (operator setting it to False)
  there wouldn't be any checks from oslo.policy side if the syntax of
  provided JSON file is correct.

  Current behavior shouldn't be changed, i.e. syntax checks should be
  opt-out.

  ==========================================================================

  SRU for UCA Queens

  [Impact]
  In Horizon, Admin->Network->Networks page takes longer time to load. One of the improvements is to avoid any redundant policy checks which consume time.

  This fix optimizes the policy logic to avoid any redundant policy
  checks and further enhancing API response times.

  [Test Case]
  Create 240 networks and observe page load time before and after fix

  1. Collect information before fix

  1a. Increase network and subnet quota for the admin project
      openstack quota set --networks -1 <project id>
      openstack quota set --subnets -1 <project id>

  1b. Create 240 networks using openstack cli
      for i in {1..240}; do openstack network create test$i; openstack subnet create --subnet-range 10.1.$i.0/24 --network test$i test$i; done

  1c. Login to dashboard as admin user in a preferred browser
  1d. Open Developer options --> Network tab. This should show all the outgoing network traffic information from browser.
  1e. Open Admin->Network->Networks page
  1f. Note down the time taken for /admin/networks in Network tab of browser
  1g. Repeat 1c 3-5 times and take average time taken for /admin/networks

  2. Install the package with the fixed code and restart apache service

  3. Collect information after fix

  3a. Repeat steps 1c-1g

  3b.You should observe an improvement in time reduction of
  /admin/networks after the fix.

  [Regression Potential]

  Given the following indicators, the regression potential is negligible

  a. Upstream CI passed with all tempest test cases passed. Indicates no break in functionality.
  b. The fix is available on releases Rocky, Stein, Train since a year ago and no problems reported with this functionality.

  There will be downtime of milliseconds during restart of apache
  services.

To manage notifications about this bug go to:
https://bugs.launchpad.net/cloud-archive/+bug/1723030/+subscriptions