zalando / skipper / 18462314072

push

github

Open Policy Agent: Instance Preloading (#3562)

## Overview

This feature implements issue #3526 by moving OPA instance startup and
bundle downloading out of filter creation to make route processing
faster and more reliable.

## Problem

Previously, OPA filters created instances synchronously during filter
creation, which:
- Blocked route processing during bundle downloads
- Could cause timeouts with large bundles or slow networks
- Violated the assumption that filter creation should be fast

## Solution

When enabled via the `--enable-open-policy-agent-preloading` flag, OPA
instances are pre-loaded during route processing instead of filter
creation:

1. **Route PreProcessor**: Scans routes for OPA filter usage and
pre-creates instances
2. **Loading Strategy**: Parallel and blocking loading on startup,
sequential on route updates
3. **Non-blocking Filter Creation**: Filters only lookup created
instances, failing fast on a hard error
4. **Filters Reflect Health**: Filters return a 503 as long as an
instance is not yet healthy

Not that when Skipper starts, the PreProcessor blocks on the first
invocation, guaranteeing that OPA instances have been tried to start.
Only in steady state, when new routes introduce new OPA policies, can a
503 occur temporarily. However since these are new routes, it would
rather be odd for them to immediately receive traffic.

Without the flag, the behaviour stays unchanged.

## Usage

### Enable the Feature

```bash
skipper --enable-open-policy-agent --enable-open-policy-agent-preloading
```

### Configuration

- `--enable-open-policy-agent-preloading`: Enable the pre-loading
behavior (default: false)
- All existing OPA configuration flags remain the same

---------

Signed-off-by: Magnus Jungsbluth <magnus.jungsbluth@zalando.de>
Signed-off-by: Pushpalanka Jayawardhana <pushpalankajaya@gmail.com>
Co-authored-by: Pushpalanka Jayawardhana <pushpalankajaya@gmail.com>
Co-authored-by: Pushpalanka Jayawardhana <pushpalanka.jayawar... (continued)

320 of 422 new or added lines in 10 files covered. (75.83%)

23555 of 30524 relevant lines covered (77.17%)

86278.25 hits per line