Cache region invalidation works for local CacheRegion object only

Wasn't added by CI for some reason:
https://review.openstack.org/#/c/327776/

I am adding keystone because it has some logic for cache invalidation across projects. Also, we ran into this issue originally on keystone.

The code on https://github.com/openstack/keystone/blob/stable/mitaka/keystone/common/cache/core.py#L71 is supposed to proxy calls to cache invalidation. Unfortunately, lines 123 and 124 do not set setters and deleters to _hard_invalidated and _soft_invalidated. This leads to dogpile.cache working like it was not patched.

For keystone it means that COMPUTED_CATALOG_REGION and COMPUTED_ASSIGNMENTS_REGION are not invalidated when catalog or assignments get changed.

http://paste.openstack.org/show/509291/ -- script to reproduce the issue. Cache must be enabled.

Fix proposed to branch: master
Review: https://review.openstack.org/327848

Fix proposed to branch: master
Review: https://review.openstack.org/327885

Change abandoned by Alexander Makarov (<email address hidden>) on branch: master
Review: https://review.openstack.org/327776
Reason: This will be solved another way: dogpile.cache will provide invalidation strategy interface.

is there any workaround for this? Kolla CI is busted due to this. How about restart the memcached server after all
the endpoint is registered?

Restarting memcached will help.

Fix proposed to branch: master
Review: https://review.openstack.org/354831

So, I'm not sure we can do anything about this in Mitaka.

Correct me if I'm wrong:

In Master/Newton this is solved in keystone via oslo.cache (we use dogpile >0.6.2)

In Mitaka the problem exists, and should be fixed in oslo.cache (https://review.openstack.org/354831). But I think would break stable policy since it's a fairly large change. I'm not sure, regardless this does not impact keystone itself.

In Liberty this won't go in since it's not a security or critical fix.

> In Liberty this won't go in since it's not a security or critical fix.

It thinks the impact of this bug should be considered a security issue. In Keystone, cache invalidation is used when assignments are updated. This means a user could still get a token with an assignment he is no longer supposed to have, even after an admin removed the assignment. This is how we (on our side) found out about the cache invalidation issue.

Reviewed: https://review.openstack.org/349704
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=42eda48c78f1153081b4c193dc13c88561409fd3
Submitter: Jenkins
Branch: master

commit 42eda48c78f1153081b4c193dc13c88561409fd3
Author: David Stanek <email address hidden>
Date: Mon Aug 1 21:06:50 2016 +0000

    Distributed cache namespace to invalidate regions

    dogpile.cache's region invalidation is not designed to work across
    processes. This patch enables distributed invalidation of keys in a
    region.

    Instead of using a static cache key, we use the original cache key
    and append a dynamic value to it. This value is looked up in
    memcached using the region name as a key. So anytime the value of
    the region key changes the cache keys in that region are
    effectively invalidated.

    Closes-Bug: #1590779
    Change-Id: Ib80d41d43ef815b37282d72ad68e7aa8e1ff354e

Change abandoned by Boris Bobrov (<email address hidden>) on branch: master
Review: https://review.openstack.org/327885
Reason: not needed any longer

Fix proposed to branch: stable/mitaka
Review: https://review.openstack.org/364593

This issue was fixed in the openstack/keystone 10.0.0.0b3 development milestone.

Fix proposed to branch: stable/mitaka
Review: https://review.openstack.org/369618

Change abandoned by Boris Bobrov (<email address hidden>) on branch: master
Review: https://review.openstack.org/327848
Reason: was fixed another way

Change abandoned by Eric Brown (<email address hidden>) on branch: stable/mitaka
Review: https://review.openstack.org/364593
Reason: Abandoning in favor of https://review.openstack.org/#/c/369618/

Reviewed: https://review.openstack.org/369618
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=f1d9c54ef07c61cb80def5779802cc4daf45f4cb
Submitter: Jenkins
Branch: stable/mitaka

commit f1d9c54ef07c61cb80def5779802cc4daf45f4cb
Author: David Stanek <email address hidden>
Date: Mon Aug 1 21:06:50 2016 +0000

    Distributed cache namespace to invalidate regions

    dogpile.cache's region invalidation is not designed to work across
    processes. This patch enables distributed invalidation of keys in a
    region.

    Instead of using a static cache key, we use the original cache key
    and append a dynamic value to it. This value is looked up in
    memcached using the region name as a key. So anytime the value of
    the region key changes the cache keys in that region are
    effectively invalidated.

    Conflicts:
     keystone/assignment/core.py: imports were fixed
     keystone/catalog/core.py: imports were fixed
     keystone/common/cache/core.py:
                    dogpile.cache doesn't have invalidation strategies
                    in 0.5.8. Because of that, call to
                    region.invalidate was redefined.
     keystone/identity/core.py:
                    there is no per-region cache in id_mapping_api
                    in Mitaka
     keystone/revoke/core.py:
                    there is no per-region cache in revocations
                    in Mitaka
     keystone/server/backends.py:
                    removed configuration of regions which were added
                    only in Newton
     keystone/tests/unit/test_v3_assignment.py:
                    conflict due to freezegun being used in Newton and
                    not used in Mitaka
     keystone/token/provider.py:
                    there is no per-region cache in token providers
                    in Mitaka

    Closes-Bug: #1590779
    Change-Id: Ib80d41d43ef815b37282d72ad68e7aa8e1ff354e
    (cherry picked from commit 42eda48c78f1153081b4c193dc13c88561409fd3)

This issue was fixed in the openstack/keystone 9.2.0 release.

Change abandoned by ChangBo Guo(gcb) (<email address hidden>) on branch: master
Review: https://review.openstack.org/354831
Reason: This is no update more than 10 weeks, feel free to restore it if you want to continue work on this.

We should confirm if the change was landed in dogpile.cache that makes this easier to handle natively in oslo.cache.

Hi,

Do you have any update it's still relevant?

It seems the issue has been fixed in keystone. I close that one, feel free to reopen it if I'm wrong.