expensive policy check operation

[Aaron Rosen]

If one does:

quantum port-list

The plugin will return a list of all ports but then in api/v2/base.py it does a get_network() for each network returned in the port list which is expensive. It would be better to avoid this or do a get_networks() instead.

            obj_list = [obj for obj in obj_list
                        if policy.check(request.context,
                                        self._plugin_handlers[self.SHOW],
                                        obj,
                                        plugin=self._plugin)]
https://github.com/openstack/quantum/blob/master/quantum/api/v2/base.py#L214

[Salvatore Orlando (salvatore-orlando)]

The get_network is used to return the owner of the parent resource which is used by some checks.
This could be avoided using the attribute map and passing the attribute as a non visible attribute with post and put disabled (this will make it a 'hidden' attribute).

[Salvatore Orlando (salvatore-orlando)]

Unfortunately the previous idea was dumb.
Indeed having the API returning the 'parent resource owner' than requesting the policy engine to load it, it's just changing the place where the extra db operation is performed.

In some cases this operation is performed anyway, and so there will be a saving. But in others (and most importantly the index use case) it's not.

Plugins which drive a 3rd party backend might benefit from this, but the extra db checks are stil annoying.

The approach to adopt is therefore to perform the ownership check for the parent resource only when it's needed.
This is determined by the policies configured on the system.

In the default setup, this will mean the extra plugin operation is performed only on create operations and update operations on 'shared' objects.

Also, we might use this bug to get rid of validate_tenant_ownership which does yet another plugin access.

[Salvatore Orlando (salvatore-orlando)]

The proposed if fix is now about to be pushed.
A simple test with https://gist.github.com/salv-orlando/5598358 revealed that plugin accesses for policy enforcements over 260 API requests are reduced from 810 to 10. It seems it might be acceptable.

Validate_tenant_ownership has not been removed in this patch.
The reason is that it requires a new check which validates extensively attribute in the parent resource.
The only admin_or_network_owner check is not enough.

We still want to fold it into the policy engine, but that will require changes that are outside of scope for this bug fix.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/29513

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/29513
Committed: http://github.com/openstack/quantum/commit/27bdfcab29d8e2c28e4aad31df6a56363cf2c6c5
Submitter: Jenkins
Branch: master

commit 27bdfcab29d8e2c28e4aad31df6a56363cf2c6c5
Author: Salvatore Orlando <email address hidden>
Date: Thu May 16 11:01:49 2013 +0200

    Reduce plugin accesses from policy engine

    Bug 1179745

    This patch introduces a new type of check whose aim is to fetch
    the parent resource's owner only when a rule that explicitly needs
    it needs to be checked.

    Change-Id: I1ff429eb3f92b35bcb9b4c4e01b65f8c0a595f48