From 5c49dbf4c475b6b44515af99426ada7498ba1a54 Mon Sep 17 00:00:00 2001 From: Alexander Zobnin Date: Thu, 4 Dec 2025 11:28:09 +0100 Subject: [PATCH] Zanzana: Non-blocking shadow compile (#114774) --- .../authz/zanzana/client/shadow_client.go | 31 +++++++++++++------ 1 file changed, 21 insertions(+), 10 deletions(-) diff --git a/pkg/services/authz/zanzana/client/shadow_client.go b/pkg/services/authz/zanzana/client/shadow_client.go index 93fbfd10b4d..a7946b53864 100644 --- a/pkg/services/authz/zanzana/client/shadow_client.go +++ b/pkg/services/authz/zanzana/client/shadow_client.go @@ -2,6 +2,7 @@ package client import ( "context" + "sync" "github.com/prometheus/client_golang/prometheus" @@ -71,6 +72,9 @@ func (c *ShadowClient) Check(ctx context.Context, id authlib.AuthInfo, req authl func (c *ShadowClient) Compile(ctx context.Context, id authlib.AuthInfo, req authlib.ListRequest) (authlib.ItemChecker, authlib.Zookie, error) { zanzanaItemCheckerChan := make(chan authlib.ItemChecker, 1) + var zanzanaItemChecker authlib.ItemChecker + var once sync.Once + go func() { if c.zanzanaClient == nil { zanzanaItemCheckerChan <- nil @@ -93,19 +97,26 @@ func (c *ShadowClient) Compile(ctx context.Context, id authlib.AuthInfo, req aut return nil, authlib.NoopZookie{}, err } - zanzanaItemChecker := <-zanzanaItemCheckerChan - shadowItemChecker := func(name, folder string) bool { rbacRes := rbacItemChecker(name, folder) - if zanzanaItemChecker != nil { - zanzanaRes := zanzanaItemChecker(name, folder) - if zanzanaRes != rbacRes { - c.metrics.evaluationStatusTotal.WithLabelValues("error").Inc() - c.logger.Warn("Zanzana compile result does not match", "expected", rbacRes, "actual", zanzanaRes, "name", name, "folder", folder) - } else { - c.metrics.evaluationStatusTotal.WithLabelValues("success").Inc() + + go func() { + // Wait for zanzana result to be ready and then use it to compare against RBAC + once.Do(func() { + zanzanaItemChecker = <-zanzanaItemCheckerChan + }) + + if zanzanaItemChecker != nil { + zanzanaRes := zanzanaItemChecker(name, folder) + if zanzanaRes != rbacRes { + c.metrics.evaluationStatusTotal.WithLabelValues("error").Inc() + c.logger.Warn("Zanzana compile result does not match", "expected", rbacRes, "actual", zanzanaRes, "name", name, "folder", folder) + } else { + c.metrics.evaluationStatusTotal.WithLabelValues("success").Inc() + } } - } + }() + return rbacRes }