OpenIdBackgroundTask - need to run every 30 minutes?

[KWC252]

Related to #13262 and #13109

Is there a reason that OpenIdBackgroundTask is set to run every 30 minutes? We get a large spike of certificate calls every 30 minutes because of this task, and have been trying to manage that. We thought it might help to run the task less often, but I don't know if that will just mean even bigger spikes when it does run, lagging, etc.

Do you think we could run it less frequently without too much risk? Thanks.

[Piedone]

@kevinchalet could you please comment?

[kevinchalet]

It could certainly run less frequently. As to why it's so expensive, it would be nice to profile it to see what's causing the spike (or we could just ignore that and wait for the secrets module to ship to replace all that stuff 🤣)

[Piedone]

For reference: #7891

[KWC252]

Thank you for getting back to me, I'll keep an eye on #7891 . We've reduced the spikes by only allowing a single instance to handle the task for each tenant every 30 minutes, so we're not in a rush. But it would be nice to reduce the spikes even more.

[sebastienros]

We've reduced the spikes by only allowing a single instance to handle the task for each tenant every 30 minutes

If this task doesn't need to be executed by every tenant, like if it doesn't require tenant's state, it could be a host task. Or maybe this should be a feature in the Default tenant only.

[kevinchalet]

If this task doesn't need to be executed by every tenant, like if it doesn't require tenant's state, it could be a host task. Or maybe this should be a feature in the Default tenant only.

Sadly, the logic it runs is tenant-aware, so unless we decide to make the OpenID server feature only usable in the default tenant, it won't work 😃

[KWC252]

Yes, it definitely does need to run for every tenant - just not multiple times per tenant, as it does when there are multiple instances.

[jtkech]

@KWC252

Yes we plan to implement exclusive execution, for now we can only prevent concurrent execution through the Admin UI (need the RedisLock feature), see #10140 (comment). But in the meantime you can implement a full ownership, see #11463 (comment).

[KWC252]

Yes, we had ended up going with a solution similar to the one in your second link. Thanks!