commit | e73bcbb8ad2bee100d590bf96708ddf0d4ea36d7 | [log] [tgz] |
---|---|---|
author | Luca Milanesio <luca.milanesio@gmail.com> | Sat Sep 09 03:23:30 2023 +0100 |
committer | Fabio Ponciroli <ponch78@gmail.com> | Wed Mar 27 13:46:05 2024 +0000 |
tree | 8f875042f1611cdd6cb8584e3e8923c957a08acd | |
parent | 209b05a4ff92d1a040676a2b37da5ff32423cf79 [diff] |
Do not cache negative results from open changes/timestamp lookups When the open changes and ts caches are failing to load their respective data from the repository, the caching of the failure may have disruptive consequences. If the failure was just the result of an intermediate replication event (e.g. a new patch-set has been been replicated but its associated /meta is still pending) the negative caching would result in making the ref not discoverable. The management of the loading failures from the cache is already coded in the ForProjectWrapper and therefore there is no need to duplicate a similar logic in the caches as well. Bug: Issue 299486879 Change-Id: Ic8015238d1f61ad6c47ebdbf6519533dbfa7ec04
Gerrit lib module to allow filtering out refs in the Git advertizing protocol phase.
Gerrit ACLs, Git's hideRefs and git-refs-filter are all tools for hiding refs from being visible to a remote Git client. However, the three tools have different scope and performance implications.
Use the Git's hideRefs when all Git clients need to be blocked from accessing some refs.
This method to hide refs is the fastest possible and has no performance implications.
The git-refs-filter is mostly used with CI systems to avoid the overloading of advertising and downloading a significant number of refs that would slowdown both Gerrit server and the Git client.
It is more flexible than Git‘s hideRefs because allows to define a limited group of users for hiding refs; it also allows to filter Gerrit NoteDb’s /meta
refs which would otherwise require a complex set of ACLs or plugins.
git-refs-filter is slightly slower than using Git's hideRefs and it does require the configuration of the change_notes cache in gerrit.config
to avoid potentially high overhead.
Additionally, this plugin uses an in-memory cache to store previously computed open/close change statuses to avoid processing them over and over again.
Explicit invalidation of such cache is not necessary, since the change revision is part of the cache key, so that previous entries automatically become obsolete once a change status is updated.
Use the Gerrit ACLs when you need to hide some of the refs on a per-project basis or when it is needed a very sophisticated pattern-matching of refs to be excluded.
This is the slowest way to hide refs and needs to be used only when a per-project ACLs policy is required.
Build this module as it was a Gerrit plugin:
git-refs-filter
directory to Gerrit /plugins/git-refs-filter
bazel build plugins/git-refs-filter
bazel test plugins/git-refs-filter:git_refs_filter_tests
git-refs-filter.jar
module is generated under /bazel-genfiles/plugins/git-refs-filter/
Copy git-refs-filter.jar
library to Gerrit /lib
and add the following one extra settings to gerrit.config
:
[gerrit] installModule = com.googlesource.gerrit.modules.gitrefsfilter.RefsFilterModule
The refsfilter module defines a new global capability called “Filter out closed changes refs”. By default the capability isn't assigned to any user or group, thus the module installation has no side effects.
Filtering a closed change refs has the following meaning:
It is also possible to define additional refs prefixes to be hidden or explicitly shown, using a similar syntax to the hideRefs setting, adding a set of git-refs-filter.hideRefs
configuration settings in gerrit.config
.
Example of how to hide all refs/backup/*
and refs/sandbox/*
from being advertised but still show refs/sandbox/mines/
:
[git-refs-filter] hideRefs = refs/backup/ hideRefs = refs/sandbox/ hideRefs = !refs/sandbox/mine/ ``` To enable a group of users of getting a "filtered list" of refs (e.g. CI jobs): - Define a new group of users (e.g. Builders) - Add a user to that group (e.g. Add 'jenkins' to the Builders group) - Go to the All-Projects ACLs, add the "Filter out closed changes refs" and assign to the group (e.g. Builders) *NOTE* Gerrit makes a super-simplified ACL evaluation if all the projects are globally readable (e.g. project has a READ rule to refs/*). To enable the closed changes filtering you need to disable any global read rule for the group that needs refs filtering. ### Grace time for closed changes The refsfilter allows to define `git-refs-filter: grace time [sec] for closed changes` project configuration parameter. This parameter controls the size of the grace time window in seconds. All closed changes newer than the grace time will not be filtered out. Value can be defined per project or can be inherited from its parents. Default value: 86400 Example of setting the grace time parameter in `project.config`: ``` [plugin "gerrit"] gitRefFilterClosedChangesGraceTimeSec = 3600 ```