tree c0a7e1067739d0eda1d8856bd810c3c0c8fe3a46
parent 7ebd341a4c052dc959572f9f70a503f231ab8b9d
author Luca Milanesio <luca.milanesio@gmail.com> 1565221698 +0100
committer Marco Miller <marco.miller@ericsson.com> 1567803796 -0400

Do not propagate ldap_groups cache evictions

When Gerrit is using LDAP authentication, the group membership
is continuously loaded because of the expiry of existing entries
and the group membership being loaded during the authentication
phase.

Propagating the ldap_groups cache events would generate a
continuous flooding of evictions causing the second node to be
always bombarded by events and also having its ldap_groups cache
completely empty, which is unfortunate for the condition when the
node needs to become active and thus would benefit from having some
entries already in cache.

Additionally, when nodes are receiving traffic alternatively because
of workload balancing flipping, the generation of cache evictions
upon authentication would result in a cross-traffic of evictions
that would make both ldap_groups caches highly inefficient and
provoke also, in extreme cases, an overload of the LDAP server
and potentially a global outage of both nodes.

For all those reasons, it is not always useful and potentially
dangerous to propagate the ldap_groups cache evictions and thus
should still be configurable but not enabled by default.

Bug: Issue 11294
Change-Id: Ib96bd241da27ee6d3a1868fb3e5f11b27481dd91