memoize policy instead of revaluate

[laurentiustroia]

Hi guys, is there a way for optimize a shared piece of code across multiple policies?

For example I have function that is a bit expensive and I need reuse same code over multiple policies but want avoid reevaluate this because would be same input.

shared.rego

parse_spiffe_uri(spiffe_uri) := {
	"ns": ns,
	"sa": sa,
} if {
	parts := split(spiffe_uri, "/")
	ns := parts[4]
	sa := parts[6]
}

parsed_destination_spiffe := parse_spiffe_uri(input.attributes.destination.principal)

and I have another 3 more files that use shared.rego in another sub-policies.

I don't want big policy with all code write inside of a single policy, it would be a pain for reuse it, how can I do parsed_destination_spiffe to not be recomputed for same input ?

[johanfylling]

Unless your shared support function calls a non-deterministic built-in function (e.g. http.send, rand.intn, time.now_ns, etc.) its value for a given input should be cached for quick retrieval on reuse and its body won't be evaluated again. Are you seeing evidence to the contrary happening for you?

[laurentiustroia]

I use profiler for checking and this is the output

+----------+------------+----------+-----------+------------+----------+----------+--------------+-------------------------------------------------------+
|   MIN    |    MAX     |   MEAN   |    90%    |    99%     | NUM EVAL | NUM REDO | NUM GEN EXPR |                       LOCATION                        |
+----------+------------+----------+-----------+------------+----------+----------+--------------+-------------------------------------------------------+
| 42.75µs  | 1.260836ms | 89.899µs | 145.804µs | 1.254278ms | 2        | 2        | 2            | bundle/dist/policies/utils/xfcc_parser.rego:54        |
| 5.833µs  | 28.375µs   | 9.312µs  | 14.85µs   | 28.344µs   | 3        | 3        | 3            | bundle/dist/policies/utils/xfcc_parser.rego:60        |

line 54 is parts := split(spiffe_uri, "/") ( I expected that to be 2 because I have 2 parsed_ rules that assigne from different input )

and line 60 is that assignment parsed_destination_spiffe := parse_spiffe_uri(input.attributes.destination.principal)

those mean that assigment was re evaluated without call again the function ?

[anderseknert]

That function should not be too expensive in the first place, unless you have thousands of path components in your spiffe_uri :)
A simple optimization would be to return the value pair in an array instead of that object though, as the keys wouldn't have to be allocated. I.e. instead of:

parse_spiffe_uri(spiffe_uri) := {"ns": ns, "sa": sa} if {

you'd do:

parse_spiffe_uri(spiffe_uri) := [ns, sa] {

But again, that's unlikely a bottleneck.

[laurentiustroia]

Good to know this 🙇‍♂️