From c4239ced225b9fead5f6b44e3665c5ccd7eacc89 Mon Sep 17 00:00:00 2001 From: Aditya Manthramurthy Date: Tue, 29 Oct 2024 09:01:48 -0700 Subject: [PATCH] run IAM purge routines deterministically every hr (#20587) Existing implementation runs IAM purge routines for expired LDAP and OIDC accounts with a probability of 0.25 after every IAM refresh. This change ensures that they are run once in each hour. --- cmd/iam.go | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/cmd/iam.go b/cmd/iam.go index 569c5b424..c809eb929 100644 --- a/cmd/iam.go +++ b/cmd/iam.go @@ -406,6 +406,7 @@ func (sys *IAMSys) periodicRoutines(ctx context.Context, baseInterval time.Durat timer := time.NewTimer(waitInterval()) defer timer.Stop() + lastPurgeHour := -1 for { select { case <-timer.C: @@ -421,9 +422,9 @@ func (sys *IAMSys) periodicRoutines(ctx context.Context, baseInterval time.Durat } } - // The following actions are performed about once in 4 times that - // IAM is refreshed: - if r.Intn(4) == 0 { + // Run purge routines once in each hour. + if refreshStart.Hour() != lastPurgeHour { + lastPurgeHour = refreshStart.Hour() // Poll and remove accounts for those users who were removed // from LDAP/OpenID. if sys.LDAPConfig.Enabled() {