Design Discussion: External Fingerprint Storage for Jenkins

[Sumit Sarin]

Hi Everyone,

It would be amazing to get some community feedback on a design decision. I am working on Externalizing Fingerprint Storage of Jenkins, and I wish to allow a common external storage across multiple Jenkins instances. This would allow a much richer experience in tracking fingerprints (think artifacts, credentials, docker containers, etc.) across the entire CI/CD flow.

Currently, in a non distributed environment, a local XML-based database is used to store the fingerprints. When a fingerprint is brought from the disk into memory, we ensure that for each unique fingerprint, only one object of it is present in memory. Any and all changes happen to the same object, which subsequently overwrites itself to the XML database at the end of the day. 

But in a distributed environment, where there are multiple Jenkins instances storing fingerprints on a single external storage, it becomes challenging to ensure data consistency. Multiple instances may work on updating/deleting/adding facets at the same time. Moreover, these changes can happen by different plugins, making it hard to track when and what kind a change in attribute is about to happen. 

To solve this problem, the most promising solution that I can see is that I use a very similar design as the current offering, and ensure that a lock allows a fingerprint to enter the memory of only a single Jenkins instance. The lock would ensure that at a time only one Jenkins instance has the right to read or write to a particular fingerprint. This completely solves data inconsistency problems, while at the same time it also ensures simplicity and no change (or very less) to the current Fingerprint API architecture. However, it comes with the drawback that it is extra strict in allowing access, and would block a lot of other Jenkins instances, often unnecessarily (performance bottleneck).

What would be your thoughts on this? I could really benefit from some insights/feedback/comments on this.

Thanks and Regards,

Sumit Sarin

[Jesse Glick]

On Thu, Mar 19, 2020 at 5:29 PM Sumit Sarin
<sumitsari...@gmail.com> wrote:
> Multiple instances may work on updating/deleting/adding facets at the same time.

Then include the Jenkins instance ID as part of the database key for
facet metadata.