canonical / canonical/github-profiles-automator

Don't list all RoleBindings and use PMR only

Open
#19 2 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Python
Stars
1
Forks
2
Avg merge
1d 11h
Merged PRs (30d)
4

Description

### Context

This came up from the discussion of the early implementation of the PMR library https://github.com/canonical/github-profiles-automator/pull/17#discussion_r1906124821

Right now the PMR functions, during `create_or_update_profiles()`, will remove **all** RoleBindings and AuthorizationPolicies in a **stale** Profile. This has the following performance implications
1. If there's no cache, so that the code efficiently gets the list of RoleBindings, then a request to fetch all RoleBindings will happen every time `create_or_update_profiles()` is called
2. The code will then iterate over all RoleBindings to filter the ones that are KFAM RoleBindings

The current architecture was done this way to ensure that if someone onboards the Profile Automator charm(s) to an existing cluster, in which an admin might be manually updating the RoleBindings with custom automation, the state can align with our design.

If a user though starts from a clean cluster, then there's no need to look at all RoleBindings and we could rely on the fact that only RoleBindings were created via the Profile Automator charm(s), thus we could only use the PMR to remove RoleBindings in stale Profiles.

### What needs to get done

1. Re-evaluate once we start seeing performance issues
2. Iron out the edge cases of the execution path, when handling stale Profiles, if we would only use the PMR
3. Evaluate if we can
1. Remove the function `list_contributor_rolebindings` altogether
2. Parse the PMR and figure out which RoleBindings need to be deleted

### Definition of Done

1. The code doesn't run `list_contributor_rolebindings` at all

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.