perf(rules): add withNegation flag to simplify to policy flow (backport of #13151)
#13195
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![kumahq[bot]](https://avatars.githubusercontent.com/u/67433617?s=60&v=4){kind=small}
…3151) > [!NOTE] > This is not a problem when using `meshServices.mode: Exclusive` with policies in a new style When a user has multiple `to` policies for a single top-level target reference and a default to Mesh target, CPU usage spikes due to the expensive matching process. <img width="2053" alt="Screenshot 2025-03-20 at 18 43 36" src="https://github.com/user-attachments/assets/259af8fb-357f-4cfe-ae54-257ce0cd36d9" /> After analyzing the issue with @lobkovilya, we discovered that for `to` policies, our logic checks every permutation of tags. However, this is unnecessary because the only possible tags for `to` policies are `kuma.io/service`, or no tags at all when the target is `Mesh`. The only exception is `MeshHTTPRoute`, where we generate the `__rule-matches-hash__` tag, which points to a hash of the matcher. Since we don’t need to evaluate all permutations, we decided to iterate through the subsets and match them directly with the policies. To optimize further, we first deduplicate entries to avoid redundant computations. After implementing these changes, I deployed the update and ran a performance profile, which showed significant improvements.  fix: #13149 --------- Signed-off-by: Ilya Lobkov <[email protected]> Signed-off-by: Lukasz Dziedziak <[email protected]> Co-authored-by: Ilya Lobkov <[email protected]>
Signed-off-by: Lukasz Dziedziak <[email protected]>
Signed-off-by: Lukasz Dziedziak <[email protected]>
bartsmykla
approved these changes
Mar 26, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Automatic cherry-pick of #13151 for branch release-2.8
Generated by action
cherry-picked commit c3781d4