Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
This commit significantly changes the internal architecture of Policy Server workers. This code takes advantage of the `PolicyEvaluatorPre` structure defined by the latest `policy-evalautor` crate. `PolicyEvaluatorPre` has different implementations, one per type of policy we support (waPC, Rego, WASI). Under the hood it holds a `wasmtime::InstancePre` instance that is used to quickly spawn a WebAssembly environment. Since `PolicyEvaluatorPre` instances are managed by the `EvaluationEnvironment` structure. `EvaluationEnvironment` takes care of deduplicating the WebAssembly modules defined inside of the `policies.yml` file, ensuring only one `PolicyEvaluatorPre` is created per policy. The `EvaluationEnvironment` struct provides `validate` and `validate_settings` methods. These methods create a fresh `PolicyEvaluator` instance by rehydrating its `PolicyEvaluatorPre` instance. Once the WebAssembly evaluation is done, the `PolicyEvaluator` instance is discarded. This is a big change compared to the previous approach, where each WebAssembly instance was a long lived object. This new architecture assures that each evaluation is done inside of a freshly created WebAssembly environment, which guarantees: - Policies leaking memory have a smaller impact on the memory consumption of the Policy Server process - Policy evaluation always starts with a clean slate, this is useful to prevent bugs caused by policies that are not written to be stateless In terms of memory optimizations, the `EvaluationEnvironment` is now an immutable object. That allows us to have one single instance of `EvaluationEnvironment` shared across all the worker threads, all without using mutex or locks. This significantly reduces the amount of memory required by the Policy Server instance, without impacting on the system performances. As an added bonus, a lot of code has been simplified during this transition. More code can be removed by future PRs. Signed-off-by: Flavio Castelli <[email protected]>
- Loading branch information