knative-extensions / security-guard

Runtime security plug to protect user containers

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Analyze how best to approach Learn

davidhadas opened this issue · comments

Ideally from a service point of view, Learn() will be done with every merge - in every sync request, before the response with criteria is provided.
This will result in immediate reflection of the pile in the criteria.
This does not require updating the guardian crd - which can be done later.

The current implementation does Lean() combined with updating the guardian crd during Tick() every ~5 min (?) unless there are pileMergeLimit records in the pile.

Rethink ana analyze performance-wise if we can improve the current process.

We need 3 separate stages for the learning procedure at the guard service:

  1. every sync pile merge
  2. once we reach pileLearnMinTime (30s) or pile.Count > 1000 or if we do not have a guardian yet:
    1. learn - i.e. update guardian in memory
    2. clear pile (such that we can delete 1M worth of data)
  3. Once in guardianPersistMinTime (5 min) or if we do not have a guardian yet, persist the guardian

This will result in,
a. First Sync returns a guardian (which is nice for starting a new service)
b. Additional Syncs will return updated guardian if 30s passed since the last update (or 1000 accumulated in pile)
c. No more than 1999 accumulated per pile on the service side
d. We persist in a controlled manner, every 5 min, we do not rush to persist every time we have new guardian