Do not propagate ldap_groups cache evictions
When Gerrit is using LDAP authentication, the group membership
is continuously loaded because of the expiry of existing entries
and the group membership being loaded during the authentication
phase.
Propagating the ldap_groups cache events would generate a
continuous flooding of evictions causing the second node to be
always bombarded by events and also having its ldap_groups cache
completely empty, which is unfortunate for the condition when the
node needs to become active and thus would benefit from having some
entries already in cache.
Additionally, when nodes are receiving traffic alternatively because
of workload balancing flipping, the generation of cache evictions
upon authentication would result in a cross-traffic of evictions
that would make both ldap_groups caches highly inefficient and
provoke also, in extreme cases, an overload of the LDAP server
and potentially a global outage of both nodes.
For all those reasons, it is not always useful and potentially
dangerous to propagate the ldap_groups cache evictions and thus
should still be configurable but not enabled by default.
Bug: Issue 11294
Change-Id: Ib96bd241da27ee6d3a1868fb3e5f11b27481dd91
3 files changed
