Add trust level cache to trusted_filter

    Currently each time the trusted filter is called to check host_pass, it
polls Open Attestation Service to get the trusted level for the host. This
solution is not good on scalability.
    With a cache for the host trust level, trusted filter don't need to
consult OAT service if the cache is still valid, thus improves the
scalability. The cache is setup when the first time the filter consulting
the OAT service.
    The trusted_filters are reinitialized for each VM that is
scheduled, thus the cache is valid only for one VM instance scheduing.

    Implements blueprint trusted-filter-cache

Change-Id: I613da53876e6cd548566e27ab1693287023e9861
Signed-off-by: Yunhong, Jiang <yunhong.jiang@intel.com>

1 files changed, 84 insertions, 14 deletions

diff --git a/nova/tests/scheduler/test_host_filters.py b/nova/tests/scheduler/test_host_filters.py
index 9f7f189cc..f8b9f9296 100644
--- a/nova/tests/scheduler/test_host_filters.py
+++ b/nova/tests/scheduler/test_host_filters.py
@@ -22,6 +22,7 @@ from nova import context
 from nova import db
 from nova.openstack.common import cfg
 from nova.openstack.common import jsonutils
+from nova.openstack.common import timeutils
 from nova.scheduler import filters
 from nova.scheduler.filters import extra_specs_ops
 from nova.scheduler.filters.trusted_filter import AttestationService
@@ -233,11 +234,13 @@ class HostFiltersTestCase(test.TestCase):
 
     def fake_oat_request(self, *args, **kwargs):
         """Stubs out the response from OAT service."""
-        return httplib.OK, jsonutils.loads(self.oat_data)
+        self.oat_attested = True
+        return httplib.OK, self.oat_data
 
     def setUp(self):
         super(HostFiltersTestCase, self).setUp()
         self.oat_data = ''
+        self.oat_attested = False
         self.stubs = stubout.StubOutForTesting()
         self.stubs.Set(AttestationService, '_request', self.fake_oat_request)
         self.context = context.RequestContext('fake', 'fake')
@@ -1147,54 +1150,121 @@ class HostFiltersTestCase(test.TestCase):
     def test_trusted_filter_default_passes(self):
         self._stub_service_is_up(True)
         filt_cls = self.class_map['TrustedFilter']()
-        filter_properties = {'instance_type': {'memory_mb': 1024}}
+        filter_properties = {'context': self.context.elevated(),
+                             'instance_type': {'memory_mb': 1024}}
         host = fakes.FakeHostState('host1', 'node1', {})
         self.assertTrue(filt_cls.host_passes(host, filter_properties))
 
     def test_trusted_filter_trusted_and_trusted_passes(self):
-        self.oat_data =\
-            '{"hosts":[{"host_name":"host1","trust_lvl":"trusted"}]}'
+        self.oat_data = {"hosts": [{"host_name": "host1",
+                                   "trust_lvl": "trusted",
+                                   "vtime": timeutils.isotime()}]}
         self._stub_service_is_up(True)
         filt_cls = self.class_map['TrustedFilter']()
         extra_specs = {'trust:trusted_host': 'trusted'}
-        filter_properties = {'instance_type': {'memory_mb': 1024,
+        filter_properties = {'context': self.context.elevated(),
+                             'instance_type': {'memory_mb': 1024,
                                                'extra_specs': extra_specs}}
         host = fakes.FakeHostState('host1', 'node1', {})
         self.assertTrue(filt_cls.host_passes(host, filter_properties))
 
     def test_trusted_filter_trusted_and_untrusted_fails(self):
-        self.oat_data =\
-            '{"hosts":[{"host_name":"host1","trust_lvl":"untrusted"}]}'
+        self.oat_data = {"hosts": [{"host_name": "host1",
+                                    "trust_lvl": "untrusted",
+                                    "vtime": timeutils.isotime()}]}
         self._stub_service_is_up(True)
         filt_cls = self.class_map['TrustedFilter']()
         extra_specs = {'trust:trusted_host': 'trusted'}
-        filter_properties = {'instance_type': {'memory_mb': 1024,
+        filter_properties = {'context': self.context.elevated(),
+                             'instance_type': {'memory_mb': 1024,
                                                'extra_specs': extra_specs}}
         host = fakes.FakeHostState('host1', 'node1', {})
         self.assertFalse(filt_cls.host_passes(host, filter_properties))
 
     def test_trusted_filter_untrusted_and_trusted_fails(self):
-        self.oat_data =\
-            '{"hosts":[{"host_name":"host1","trust_lvl":"trusted"}]}'
+        self.oat_data = {"hosts": [{"host_name": "host1",
+                                    "trust_lvl": "trusted",
+                                    "vtime": timeutils.isotime()}]}
         self._stub_service_is_up(True)
         filt_cls = self.class_map['TrustedFilter']()
         extra_specs = {'trust:trusted_host': 'untrusted'}
-        filter_properties = {'instance_type': {'memory_mb': 1024,
+        filter_properties = {'context': self.context.elevated(),
+                             'instance_type': {'memory_mb': 1024,
                                                'extra_specs': extra_specs}}
         host = fakes.FakeHostState('host1', 'node1', {})
         self.assertFalse(filt_cls.host_passes(host, filter_properties))
 
     def test_trusted_filter_untrusted_and_untrusted_passes(self):
-        self.oat_data =\
-            '{"hosts":[{"host_name":"host1","trust_lvl":"untrusted"}]}'
+        self.oat_data = {"hosts": [{"host_name": "host1",
+                                    "trust_lvl": "untrusted",
+                                    "vtime":timeutils.isotime()}]}
         self._stub_service_is_up(True)
         filt_cls = self.class_map['TrustedFilter']()
         extra_specs = {'trust:trusted_host': 'untrusted'}
-        filter_properties = {'instance_type': {'memory_mb': 1024,
+        filter_properties = {'context': self.context.elevated(),
+                             'instance_type': {'memory_mb': 1024,
                                                'extra_specs': extra_specs}}
         host = fakes.FakeHostState('host1', 'node1', {})
         self.assertTrue(filt_cls.host_passes(host, filter_properties))
 
+    def test_trusted_filter_update_cache(self):
+        self.oat_data = {"hosts": [{"host_name":
+                                    "host1", "trust_lvl": "untrusted",
+                                    "vtime": timeutils.isotime()}]}
+
+        filt_cls = self.class_map['TrustedFilter']()
+        extra_specs = {'trust:trusted_host': 'untrusted'}
+        filter_properties = {'context': self.context.elevated(),
+                             'instance_type': {'memory_mb': 1024,
+                                               'extra_specs': extra_specs}}
+        host = fakes.FakeHostState('host1', 'node1', {})
+
+        filt_cls.host_passes(host, filter_properties)     # Fill the caches
+
+        self.oat_attested = False
+        filt_cls.host_passes(host, filter_properties)
+        self.assertFalse(self.oat_attested)
+
+        self.oat_attested = False
+
+        timeutils.set_time_override(timeutils.utcnow())
+        timeutils.advance_time_seconds(
+            CONF.trusted_computing.attestation_auth_timeout + 80)
+        filt_cls.host_passes(host, filter_properties)
+        self.assertTrue(self.oat_attested)
+
+        timeutils.clear_time_override()
+
+    def test_trusted_filter_update_cache_timezone(self):
+        self.oat_data = {"hosts": [{"host_name": "host1",
+                                    "trust_lvl": "untrusted",
+                                    "vtime": "2012-09-09T05:10:40-04:00"}]}
+
+        filt_cls = self.class_map['TrustedFilter']()
+        extra_specs = {'trust:trusted_host': 'untrusted'}
+        filter_properties = {'context': self.context.elevated(),
+                             'instance_type': {'memory_mb': 1024,
+                                               'extra_specs': extra_specs}}
+        host = fakes.FakeHostState('host1', 'node1', {})
+
+        timeutils.set_time_override(
+            timeutils.normalize_time(
+                timeutils.parse_isotime("2012-09-09T09:10:40Z")))
+
+        filt_cls.host_passes(host, filter_properties)     # Fill the caches
+
+        self.oat_attested = False
+        filt_cls.host_passes(host, filter_properties)
+        self.assertFalse(self.oat_attested)
+
+        self.oat_attested = False
+        timeutils.advance_time_seconds(
+            CONF.trusted_computing.attestation_auth_timeout - 10)
+        filt_cls.host_passes(host, filter_properties)
+        self.assertFalse(self.oat_attested)
+
+        timeutils.clear_time_override()
+
     def test_core_filter_passes(self):
         filt_cls = self.class_map['CoreFilter']()
         filter_properties = {'instance_type': {'vcpus': 1}}