public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Zanzana: Add more openfga settings for fine tuning (#115928)

Browse Source 
* Zanzana: Add more openfga settings for fine tuning

* neat

* refactor
This commit is contained in:
Alexander Zobnin
2026-01-07 13:07:13 +01:00
committed by GitHub
parent 20eeff3e7b
commit 0b9046be15
2 changed files with 274 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/authz/zanzana/server/openfga_server.go
+135 -1
View File
@@ -32,6 +32,8 @@ func NewOpenFGAServer(cfg setting.ZanzanaServerSettings, store storage.OpenFGADa
opts := []server.OpenFGAServiceV1Option{
server.WithDatastore(store),
server.WithLogger(zlogger.New(logger)),
// Cache settings
server.WithCheckCacheLimit(cfg.CacheSettings.CheckCacheLimit),
server.WithCacheControllerEnabled(cfg.CacheSettings.CacheControllerEnabled),
server.WithCacheControllerTTL(cfg.CacheSettings.CacheControllerTTL),
@@ -40,16 +42,25 @@ func NewOpenFGAServer(cfg setting.ZanzanaServerSettings, store storage.OpenFGADa
server.WithCheckIteratorCacheEnabled(cfg.CacheSettings.CheckIteratorCacheEnabled),
server.WithCheckIteratorCacheMaxResults(cfg.CacheSettings.CheckIteratorCacheMaxResults),
server.WithCheckIteratorCacheTTL(cfg.CacheSettings.CheckIteratorCacheTTL),
// ListObjects settings
server.WithListObjectsMaxResults(cfg.ListObjectsMaxResults),
server.WithListObjectsIteratorCacheEnabled(cfg.CacheSettings.ListObjectsIteratorCacheEnabled),
server.WithListObjectsIteratorCacheMaxResults(cfg.CacheSettings.ListObjectsIteratorCacheMaxResults),
server.WithListObjectsIteratorCacheTTL(cfg.CacheSettings.ListObjectsIteratorCacheTTL),
server.WithListObjectsDeadline(cfg.ListObjectsDeadline),
// Shared iterator settings
server.WithSharedIteratorEnabled(cfg.CacheSettings.SharedIteratorEnabled),
server.WithSharedIteratorLimit(cfg.CacheSettings.SharedIteratorLimit),
server.WithSharedIteratorTTL(cfg.CacheSettings.SharedIteratorTTL),
server.WithListObjectsDeadline(cfg.ListObjectsDeadline),
server.WithContextPropagationToDatastore(true),
}
openfgaOpts := withOpenFGAOptions(cfg)
opts = append(opts, openfgaOpts...)
srv, err := server.NewServerWithOpts(opts...)
if err != nil {
return nil, err
@@ -58,6 +69,129 @@ func NewOpenFGAServer(cfg setting.ZanzanaServerSettings, store storage.OpenFGADa
return srv, nil
}
func withOpenFGAOptions(cfg setting.ZanzanaServerSettings) []server.OpenFGAServiceV1Option {
opts := make([]server.OpenFGAServiceV1Option, 0)
listOpts := withListOptions(cfg)
opts = append(opts, listOpts...)
// Check settings
if cfg.OpenFgaServerSettings.MaxConcurrentReadsForCheck != 0 {
opts = append(opts, server.WithMaxConcurrentReadsForCheck(cfg.OpenFgaServerSettings.MaxConcurrentReadsForCheck))
}
if cfg.OpenFgaServerSettings.CheckDatabaseThrottleThreshold != 0 || cfg.OpenFgaServerSettings.CheckDatabaseThrottleDuration != 0 {
opts = append(opts, server.WithCheckDatabaseThrottle(cfg.OpenFgaServerSettings.CheckDatabaseThrottleThreshold, cfg.OpenFgaServerSettings.CheckDatabaseThrottleDuration))
}
// Batch check settings
if cfg.OpenFgaServerSettings.MaxConcurrentChecksPerBatchCheck != 0 {
opts = append(opts, server.WithMaxConcurrentChecksPerBatchCheck(cfg.OpenFgaServerSettings.MaxConcurrentChecksPerBatchCheck))
}
if cfg.OpenFgaServerSettings.MaxChecksPerBatchCheck != 0 {
opts = append(opts, server.WithMaxChecksPerBatchCheck(cfg.OpenFgaServerSettings.MaxChecksPerBatchCheck))
}
// Resolve node settings
if cfg.OpenFgaServerSettings.ResolveNodeLimit != 0 {
opts = append(opts, server.WithResolveNodeLimit(cfg.OpenFgaServerSettings.ResolveNodeLimit))
}
if cfg.OpenFgaServerSettings.ResolveNodeBreadthLimit != 0 {
opts = append(opts, server.WithResolveNodeBreadthLimit(cfg.OpenFgaServerSettings.ResolveNodeBreadthLimit))
}
// Dispatch throttling settings
if cfg.OpenFgaServerSettings.DispatchThrottlingCheckResolverEnabled {
opts = append(opts, server.WithDispatchThrottlingCheckResolverEnabled(cfg.OpenFgaServerSettings.DispatchThrottlingCheckResolverEnabled))
}
if cfg.OpenFgaServerSettings.DispatchThrottlingCheckResolverFrequency != 0 {
opts = append(opts, server.WithDispatchThrottlingCheckResolverFrequency(cfg.OpenFgaServerSettings.DispatchThrottlingCheckResolverFrequency))
}
if cfg.OpenFgaServerSettings.DispatchThrottlingCheckResolverThreshold != 0 {
opts = append(opts, server.WithDispatchThrottlingCheckResolverThreshold(cfg.OpenFgaServerSettings.DispatchThrottlingCheckResolverThreshold))
}
if cfg.OpenFgaServerSettings.DispatchThrottlingCheckResolverMaxThreshold != 0 {
opts = append(opts, server.WithDispatchThrottlingCheckResolverMaxThreshold(cfg.OpenFgaServerSettings.DispatchThrottlingCheckResolverMaxThreshold))
}
// Shadow check/query settings
if cfg.OpenFgaServerSettings.ShadowCheckResolverTimeout != 0 {
opts = append(opts, server.WithShadowCheckResolverTimeout(cfg.OpenFgaServerSettings.ShadowCheckResolverTimeout))
}
if cfg.OpenFgaServerSettings.ShadowListObjectsQueryTimeout != 0 {
opts = append(opts, server.WithShadowListObjectsQueryTimeout(cfg.OpenFgaServerSettings.ShadowListObjectsQueryTimeout))
}
if cfg.OpenFgaServerSettings.ShadowListObjectsQueryMaxDeltaItems != 0 {
opts = append(opts, server.WithShadowListObjectsQueryMaxDeltaItems(cfg.OpenFgaServerSettings.ShadowListObjectsQueryMaxDeltaItems))
}
if cfg.OpenFgaServerSettings.RequestTimeout != 0 {
opts = append(opts, server.WithRequestTimeout(cfg.OpenFgaServerSettings.RequestTimeout))
}
if cfg.OpenFgaServerSettings.MaxAuthorizationModelSizeInBytes != 0 {
opts = append(opts, server.WithMaxAuthorizationModelSizeInBytes(cfg.OpenFgaServerSettings.MaxAuthorizationModelSizeInBytes))
}
if cfg.OpenFgaServerSettings.AuthorizationModelCacheSize != 0 {
opts = append(opts, server.WithAuthorizationModelCacheSize(cfg.OpenFgaServerSettings.AuthorizationModelCacheSize))
}
if cfg.OpenFgaServerSettings.ChangelogHorizonOffset != 0 {
opts = append(opts, server.WithChangelogHorizonOffset(cfg.OpenFgaServerSettings.ChangelogHorizonOffset))
}
return opts
}
func withListOptions(cfg setting.ZanzanaServerSettings) []server.OpenFGAServiceV1Option {
opts := make([]server.OpenFGAServiceV1Option, 0)
// ListObjects settings
if cfg.OpenFgaServerSettings.MaxConcurrentReadsForListObjects != 0 {
opts = append(opts, server.WithMaxConcurrentReadsForListObjects(cfg.OpenFgaServerSettings.MaxConcurrentReadsForListObjects))
}
if cfg.OpenFgaServerSettings.ListObjectsDispatchThrottlingEnabled {
opts = append(opts, server.WithListObjectsDispatchThrottlingEnabled(cfg.OpenFgaServerSettings.ListObjectsDispatchThrottlingEnabled))
}
if cfg.OpenFgaServerSettings.ListObjectsDispatchThrottlingFrequency != 0 {
opts = append(opts, server.WithListObjectsDispatchThrottlingFrequency(cfg.OpenFgaServerSettings.ListObjectsDispatchThrottlingFrequency))
}
if cfg.OpenFgaServerSettings.ListObjectsDispatchThrottlingThreshold != 0 {
opts = append(opts, server.WithListObjectsDispatchThrottlingThreshold(cfg.OpenFgaServerSettings.ListObjectsDispatchThrottlingThreshold))
}
if cfg.OpenFgaServerSettings.ListObjectsDispatchThrottlingMaxThreshold != 0 {
opts = append(opts, server.WithListObjectsDispatchThrottlingMaxThreshold(cfg.OpenFgaServerSettings.ListObjectsDispatchThrottlingMaxThreshold))
}
if cfg.OpenFgaServerSettings.ListObjectsDatabaseThrottleThreshold != 0 || cfg.OpenFgaServerSettings.ListObjectsDatabaseThrottleDuration != 0 {
opts = append(opts, server.WithListObjectsDatabaseThrottle(cfg.OpenFgaServerSettings.ListObjectsDatabaseThrottleThreshold, cfg.OpenFgaServerSettings.ListObjectsDatabaseThrottleDuration))
}
// ListUsers settings
if cfg.OpenFgaServerSettings.ListUsersDeadline != 0 {
opts = append(opts, server.WithListUsersDeadline(cfg.OpenFgaServerSettings.ListUsersDeadline))
}
if cfg.OpenFgaServerSettings.ListUsersMaxResults != 0 {
opts = append(opts, server.WithListUsersMaxResults(cfg.OpenFgaServerSettings.ListUsersMaxResults))
}
if cfg.OpenFgaServerSettings.MaxConcurrentReadsForListUsers != 0 {
opts = append(opts, server.WithMaxConcurrentReadsForListUsers(cfg.OpenFgaServerSettings.MaxConcurrentReadsForListUsers))
}
if cfg.OpenFgaServerSettings.ListUsersDispatchThrottlingEnabled {
opts = append(opts, server.WithListUsersDispatchThrottlingEnabled(cfg.OpenFgaServerSettings.ListUsersDispatchThrottlingEnabled))
}
if cfg.OpenFgaServerSettings.ListUsersDispatchThrottlingFrequency != 0 {
opts = append(opts, server.WithListUsersDispatchThrottlingFrequency(cfg.OpenFgaServerSettings.ListUsersDispatchThrottlingFrequency))
}
if cfg.OpenFgaServerSettings.ListUsersDispatchThrottlingThreshold != 0 {
opts = append(opts, server.WithListUsersDispatchThrottlingThreshold(cfg.OpenFgaServerSettings.ListUsersDispatchThrottlingThreshold))
}
if cfg.OpenFgaServerSettings.ListUsersDispatchThrottlingMaxThreshold != 0 {
opts = append(opts, server.WithListUsersDispatchThrottlingMaxThreshold(cfg.OpenFgaServerSettings.ListUsersDispatchThrottlingMaxThreshold))
}
if cfg.OpenFgaServerSettings.ListUsersDatabaseThrottleThreshold != 0 || cfg.OpenFgaServerSettings.ListUsersDatabaseThrottleDuration != 0 {
opts = append(opts, server.WithListUsersDatabaseThrottle(cfg.OpenFgaServerSettings.ListUsersDatabaseThrottleThreshold, cfg.OpenFgaServerSettings.ListUsersDatabaseThrottleDuration))
}
return opts
}
func NewOpenFGAHttpServer(cfg setting.ZanzanaServerSettings, srv grpcserver.Provider) (*http.Server, error) {
dialOpts := []grpc.DialOption{
grpc.WithTransportCredentials(insecure.NewCredentials()),