data.json file is getting big and causing opa latency

[itayhac]

i got a bundle with the following structure:

the data.json's size is usually ~2-5KB and total evaluation time is <10ms.
but recently i faced an issue with data.json's size getting to ~1MB , which makes opa very slow, which in turn makes opa's total evaluation time ~ 300ms.

after running opa eval with profiler it looks like the import of the data.json file to the logic.rego takes most of the time (the 300ms).
need to say that the data.json does not change during a revision of bundle.

im using the following command for debugging:
opa eval -d . -i input.json "data.logic.access" --profile --format=pretty --count=1

i can see using the profiler that almost of all the time is consumed by the constraints = object.get(index, "constraints", {}) line of code. meaning that the dynamic import of the data set is slowing us down.

the question is as followed:

how can i improve the latency of opa component in our system?
first thing that came to my mind is to "hard code" the data.json in our rego file, instead of importing it.

package logic.access

import data.my_data.index

access[decision]{
  constraints = object.get(index, "constraints", {})
  decision := access_buisness_logic(constraints)
}

access_buisness_logic(constraints) = ret {
    # some logic here #
    ret := {
        "result": "allowed",
    }
}

[charlieegan3]

Hey @itayhac, 1MB isn't a very large dataset so my guess is that the policy is using some inefficient logic. Have you tried reviewing the recommendations in https://www.openpolicyagent.org/docs/latest/policy-performance/ ?

[itayhac]

when running opa eval with --profile tag i can see that this line takes almost all of the time.
constraints = object.get(index, "constraints", {})
i can clearly see even if i remove the logic function, the time remains the same.
so my question is : if the data set import takes a lot of time, can i do something to optimize it? can i use caching? so even if the data set import if "heavy" at least it would happen only once?

[anderseknert]

I'm not sure I follow here — and your screenshot is cut off before any metrics are shown.

Are you using opa eval? You'd normally do that either in development or in CI/CD, and 300 ms wouldn't likely be considered much in that context. If you could expand some on your use case, and the commands you execute, that'd be helpful 🙂

[anderseknert]

The one evaluates in 1.9 milliseconds:

❯ curl 'localhost:8181/v1/data/opa/access?metrics=true&pretty=true'
{
  "metrics": {
    "counter_server_query_cache_hit": 1,
    "timer_rego_external_resolve_ns": 875,
    "timer_rego_input_parse_ns": 750,
    "timer_rego_query_eval_ns": 1871209,
    "timer_server_handler_ns": 1943208
  }
}

I think you might be looking at the wrong place. Can you run with the same query parameters as seen below? That way you'll get the evaluation time back in the response.

[itayhac]

ok now that i understand how to query opa and get metrics in the response:

i have:

1. bundle with imported dataset - takes 200ms
   ways to reproduce:
   run > opa run -s -l debug slow_bundle.tar.gz
   query > curl 'localhost:8181/v1/data/evaluator/access?metrics=true&pretty=true'

2. bundle with hard coded dataset - takes <1ms
   ways to reproduce:
   fast_bundle.tar.gz
   slow_bundle.tar.gz

run > opa run -s -l debug fast_bundle.tar.gz
query > curl 'localhost:8181/v1/data/evaluator/access?metrics=true&pretty=true'

thank you so much for your help!

[anderseknert]

Please attach the full output of running both of those commands. I've seen nothing close to 200 ms.

[itayhac]

slow command:

fast command:

[anderseknert]

Ah, I see it now, thanks! Will take a look tomorrow.