Speed up v5 syslog_drain_urls

This commit adds a cache for credentials for user-provided-services
(since we know they are guaranteed to share the same creds, unlike
managed)

Co-authored-by: Seth Boyles <[email protected]>
Co-authored-by: Tim Downey <[email protected]>

Author: sethboyles

app/controllers/internal/syslog_drain_urls_controller.rb

@@ -1,3 +1,5 @@
+require 'oj'
+
 module VCAP::CloudController
   class SyslogDrainUrlsInternalController < RestController::BaseController
     # Endpoint uses mutual tls for auth, handled by nginx
@@ -55,32 +57,35 @@ def listv5
                  join(:apps, guid: :app_guid).
                  join(:spaces, guid: :apps__space_guid).
                  join(:organizations, id: :spaces__organization_id).
+                 join(:service_instances, guid: :service_bindings__service_instance_guid).
                  select(
                    :service_bindings__syslog_drain_url,
                    :service_bindings__credentials,
                    :service_bindings__salt,
                    :service_bindings__encryption_key_label,
                    :service_bindings__encryption_iterations,
                    :service_bindings__app_guid,
+                   :service_bindings__service_instance_guid,
                    :apps__name___app_name,
                    :spaces__name___space_name,
-                   :organizations__name___organization_name
+                   :organizations__name___organization_name,
+                   :service_instances__is_gateway_service___is_managed_service
                  ).
                  where(service_bindings__syslog_drain_url: syslog_drain_urls_query).
 
                  each_with_object({}) do |item, injected|
                    syslog_drain_url = item[:syslog_drain_url]
-                   credentials = item.credentials
-                   cert = credentials&.fetch('cert', '') || ''
-                   key = credentials&.fetch('key', '') || ''
-                   ca = credentials&.fetch('ca', '') || ''
+
                    hostname = hostname_from_app_name(item[:organization_name], item[:space_name], item[:app_name])
                    app_guid = item[:app_guid]
 
+                   cert, key, ca = fetch_credentials_from_cache(item)
+
                    injected_item = injected[syslog_drain_url] ||= {
                      url: syslog_drain_url,
                      binding_data_map: {}
                    }
+
                    cert_item = injected_item[:binding_data_map][[key, cert, ca]] ||= {
                      cert: cert,
                      key: key,
@@ -99,11 +104,45 @@ def listv5
 
       next_page_token = nil
       next_page_token = last_id + batch_size unless bindings.empty?
-      [HTTP::OK, MultiJson.dump({ results: bindings, next_id: next_page_token }, pretty: true)]
+      [HTTP::OK, Oj.dump({ results: bindings, next_id: next_page_token })]
     end
 
     private
 
+    def upsi_service_instance_credential_cache
+      @upsi_service_instance_credential_cache ||= {}
+    end
+
+    # Service Binding credentials are stored as encrypted values in CCDB.
+    # Decrypting them is computationally expensive and has caused performance
+    # issues since this endpoint may decrypt credentials from thousands of service bindings.
+    #
+    # Since all user-provided service instance bindings share the same credentials
+    # as their service instance we can safely cache the for a given service instance guid.
+    def fetch_credentials_from_cache(item)
+      if item[:is_managed_service]
+        credentials = item.credentials
+        cert = credentials&.fetch('cert', '') || ''
+        key = credentials&.fetch('key', '') || ''
+        ca = credentials&.fetch('ca', '') || ''
+      else # service is user-provided
+        upsi_service_instance_credential_cache[item.service_instance_guid] ||= {}
+
+        if upsi_service_instance_credential_cache[item.service_instance_guid].empty?
+          credentials = item.credentials
+          upsi_service_instance_credential_cache[item.service_instance_guid]['cert'] = credentials&.fetch('cert', '') || ''
+          upsi_service_instance_credential_cache[item.service_instance_guid]['key'] = credentials&.fetch('key', '') || ''
+          upsi_service_instance_credential_cache[item.service_instance_guid]['ca'] = credentials&.fetch('ca', '') || ''
+        end
+
+        cert = upsi_service_instance_credential_cache[item.service_instance_guid].fetch('cert', '')
+        key = upsi_service_instance_credential_cache[item.service_instance_guid].fetch('key', '')
+        ca = upsi_service_instance_credential_cache[item.service_instance_guid].fetch('ca', '')
+      end
+
+      [cert, key, ca]
+    end
+
     def syslog_drain_urls_query
       ServiceBinding.
         distinct.