Query Policy Evaluation Timeouts - #38938
Open
sebasslash wants to merge 1 commit into
Open
Conversation
sebasslash
force-pushed
the
tfsearch/per-call-and-overall-policy-eval-timeouts
branch
from
July 28, 2026 20:23
fc0ce0b to
99a4dce
Compare
sebasslash
added
the
no-changelog-needed
sebasslash
force-pushed
the
tfsearch/per-call-and-overall-policy-eval-timeouts
branch
from
July 28, 2026 20:39
99a4dce to
7c652cd
Compare
dsa0x
changed the base branch from
main
to
tfsearch/policy-query-summary-records
August 5, 2026 08:23
sebasslash
force-pushed
the
tfsearch/per-call-and-overall-policy-eval-timeouts
branch
from
August 10, 2026 16:44
7c652cd to
15a5c03
Compare
sebasslash
force-pushed
the
tfsearch/policy-query-summary-records
branch
from
August 10, 2026 16:44
618cf2c to
e955885
Compare
sebasslash
force-pushed
the
tfsearch/per-call-and-overall-policy-eval-timeouts
branch
2 times, most recently
from
August 10, 2026 21:30
f3d6084 to
292fd88
Compare
sebasslash
force-pushed
the
tfsearch/policy-query-summary-records
branch
from
August 11, 2026 14:04
e955885 to
8559a7c
Compare
…ce RPCs - Wrap each EvaluateResource RPC in a 30 s per-call context timeout; a timed-out call records the resource as error with a diagnostic naming the address and duration, then the pass continues. - Add a 10 min overall deadline for the entire policy pass; resources that have not been evaluated when the deadline fires are short-circuited with an error diagnostic so downstream aggregators still receive a row for every resource. - deadlineCtx stored as atomic.Pointer to make concurrent reads safe by construction; MockClient releases its mutex before invoking callback functions to prevent deadlocks under concurrent callers. - 14 unit tests covering per-call timeout, overall deadline, partial results, diagnostic content, parent cancellation, mid-RPC deadline race, and -race detector validation.
sebasslash
force-pushed
the
tfsearch/per-call-and-overall-policy-eval-timeouts
branch
from
August 12, 2026 15:46
292fd88 to
6903f34
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR introduces policy evaluation timeouts for Terraform's query policy evaluation.
Policy evaluations could previously block indefinitely if the policy server was slow or unresponsive. This PR adds two configurable timeout mechanisms:
DefaultPerCallTimeout = 30s): EachEvaluateResourceRPC is wrapped with acontext.WithTimeout. If the deadline fires while the parent context is still live, the resource is recorded asPolicyErrorResultwith a human-readable diagnostic. Crucially, this does not cancel the parent context, so subsequent resources continue to be evaluated.DefaultOverallDeadline = 10m): An overall deadline is installed on thepolicySubgraphviasetDeadline()innodePolicyEval.DynamicExpand. EachnodeQueryResourcePolicy.ExecutechecksoverallDeadlineExceeded()before acquiring the semaphore. Resources that arrive after the deadline is detected are short-circuited with aPolicyErrorResultand a deadline diagnostic instead of being silently dropped. The deadline context is cancelled innodePolicyEvalFinish.Executeto release resources.policy.EvalTimeoutsstruct andpolicy.DefaultEvalTimeouts()factory are introduced in a newinternal/policy/timeout.gofile.evaluatePoliciesnow returnsevaluatePoliciesResult(wrappingEvaluationResponse+PerCallTimedOutflag) so callers can rewrite diagnostics with precise timeout messages.policy.MockClientis refactored to release the mutex before calling delegate functions, preventing deadlocks in tests that call back into the mock from within the function.Fixes #
Target Release
1.17.x
Rollback Plan
Changes to Security Controls
No changes to access controls, encryption, or logging mechanisms. The timeout additions improve resilience against unresponsive policy servers; they do not alter what is evaluated or who can trigger evaluation.
CHANGELOG entry