Skip to content

Commit

Permalink
feat: reduce memory usage
Browse files Browse the repository at this point in the history
This commit significantly changes the internal architecture of Policy
Server workers.

This code takes advantage of the `PolicyEvaluatorPre` structure defined by
the latest `policy-evalautor` crate.
`PolicyEvaluatorPre` has different implementations, one per type of
policy we support (waPC, Rego, WASI). Under the hood it holds a
`wasmtime::InstancePre` instance that is used to quickly spawn a
WebAssembly environment.

Since `PolicyEvaluatorPre` instances are managed by the `EvaluationEnvironment`
structure. `EvaluationEnvironment` takes care of deduplicating the WebAssembly
modules defined inside of the `policies.yml` file, ensuring only one
`PolicyEvaluatorPre` is created per policy.

The `EvaluationEnvironment` struct provides `validate` and
`validate_settings` methods. These methods create a fresh `PolicyEvaluator`
instance by rehydrating its `PolicyEvaluatorPre` instance. Once the
WebAssembly evaluation is done, the `PolicyEvaluator` instance is
discarded.
This is a big change compared to the previous approach, where each WebAssembly
instance was a long lived object.

This new architecture assures that each evaluation is done inside of a freshly
created WebAssembly environment, which guarantees:
- Policies leaking memory have a smaller impact on the memory
  consumption of the Policy Server process
- Policy evaluation always starts with a clean slate, this is useful to
  prevent bugs caused by policies that are not written to be stateless

In terms of memory optimizations, the `EvaluationEnvironment` is now an
immutable object. That allows us to have one single instance of `EvaluationEnvironment`
shared across all the worker threads, all without using mutex or locks.
This significantly reduces the amount of memory required by the Policy Server instance,
without impacting on the system performances.

As an added bonus, a lot of code has been simplified during this
transition. More code can be removed by future PRs.

Signed-off-by: Flavio Castelli <[email protected]>
  • Loading branch information
flavio committed Dec 13, 2023
1 parent 147011b commit 592ecda
Show file tree
Hide file tree
Showing 5 changed files with 307 additions and 452 deletions.
Loading

0 comments on commit 592ecda

Please sign in to comment.