Implement a shared ResourceRules structure in MeshContext

[lobkovilya]

Description

Today, Kuma calls outbound.BuildRules method for each xDS connection

kuma/pkg/plugins/policies/core/rules/outbound/resourcerules.go

Line 86 in 4d8c12d

func BuildRules(policies []core_model.Resource, reader common.ResourceReader) (ResourceRules, error) {

This results in an outbound.ResourceRules structure per xDS connection. That's inefficient both from a CPU and memory point of view, as significant parts of these structures are the same.

Imagine a situation where a MeshService backend has only producer policies. In that case, all backend clients have exactly the same backend outbound configuration. But today we're computing and storing this configuration separately for each client.

There is still a way for each client to redefine the configuration for the backend outbound – by using consumer policies. That's why the shared structure in MeshContext can't be a simple MeshService -> Conf map; it has to be more complex and take into account clients with different confs.

Once this structure is implemented, we can switch policy plugins to use it instead of policies.ToRules.ResourceRules:

kuma/pkg/plugins/policies/meshtimeout/plugin/v1alpha1/plugin.go

Line 71 in d3a493d

err := applyToRealResources(rs, policies.ToRules.ResourceRules, ctx.Mesh)

Data structure considerations

Ideally, we'd like to have a data structure that for a given policy type maps (DPP, Mesh*Service) to Conf, but it's clear memory-wise it's going to depend, either on:

• Number of DPP proxies
• 2^N, where N is the number of consumer policies (each consumer policy can either match or not match the given DPP proxy)

Neither of the options is ideal.

What we can do, though, is to create a data structure that for a given policy type maps (Proxy, Mesh*Service) to []Conf, so that merging all confs in []Conf gives the resulting structure for Proxy that consumes Mesh*Service. In that case, both memory and the lookup complexity are O(N), where N is the number of consumer policies.