cache: add prefix/glob watch support to LinearCache for LEDS by wdauchy · Pull Request #1411 · envoyproxy/go-control-plane

wdauchy · 2026-02-20T09:40:09Z

Envoy's LEDS (Locality Endpoint Discovery Service) uses delta xDS with
glob collection subscriptions. Clients subscribe to resource names ending
in /* (e.g. ns_svc_8080/us-east-1a/*) via resource_names_subscribe
in DeltaDiscoveryRequest, and expect to receive all individual resources
whose name starts with that prefix.

Currently LinearCache only supports exact-name watches (resourceWatches)
and full wildcard (wildcardWatches). A subscription to collection/* is
stored as a literal key in resourceWatches and never matches individual
resources under that prefix.

This PR adds prefix/glob watch support to LinearCache:

Subscription layer (subscription.go):

Prefix globs are detected and split at subscription time into a separate
subscribedPrefixes map (keyed by the prefix, e.g. "collection/")
SubscribedPrefixes() is added to the Subscription interface so the
cache never has to check for globbing at operation time

Cache layer (linear.go):

New prefixWatches map handles glob subscriptions
trackWatch/removeWatch: use SubscribedPrefixes() directly to
register/clean up prefix watches — no glob parsing at watch time
notifyAll: iterates prefixWatches for each modified resource and
triggers matching prefix watches
computeResourceChange: single pass over the cache for prefix
expansion (all prefixes checked per resource). Consolidated removal loop
handles both unsubscription and cache deletion in one place
computeResponse: single cache pass for prefix expansion in the
full-state non-wildcard branch
isSubscribedTo: O(1) map lookup when no prefix subscriptions are
active, zero overhead for users not using the feature

Existing exact-name and wildcard behavior is unchanged.

wdauchy

fyi I started to merge this on Datadog production to see how far we can go with it

valerian-roche

Logic looks okay, but it should not impact users not using the feature.
I'm also concerned on all those full cache iterations which can be very costly on endpoints cache (where wildcards are not used hence never happen today).
As xds TP1 mandates a path to be along the line of xds:://<type>/<some>/<segments>/..., we should potentially build a tree matcher to guarantee O(segments) instead of O(entries)

valerian-roche · 2026-03-09T00:32:10Z

+		return true
+	}
+	for sub := range subscribedResources {
+		if prefix, ok := isPrefixGlob(sub); ok {


That's a lot of matching everyone will pay even if not using the feature, changing the check from O(1) to O(subscribed).
Could it be changed to be stored in a different set?
TP1 does not define rules on the use of / within resources so I don't think O(1) is achievable, but the cost should at least be restricted to collections and not all resources

agreed, fixed. isSubscribedTo now does a single O(1) map lookup on SubscribedResources() first. the prefix iteration only kicks in when SubscribedPrefixes() is non-empty, so users not using the feature pay zero extra cost

valerian-roche · 2026-03-09T00:34:30Z

 		}
 	} else {
 		for resourceName := range sub.SubscribedResources() {
+			if prefix, ok := isPrefixGlob(resourceName); ok {


Could this be reverted? Identify all prefixes then iterate once above the cache? Iterating over a large map is slow and thrash caches

done, prefix expansion now does a single pass over the cache checking all prefixes per resource (inner loop over prefixes, outer loop over cache entries). the whole block is also guarded by len(subscribedPrefixes) > 0 so it's completely skipped when no prefix subscriptions exist

valerian-roche · 2026-03-09T00:38:30Z

+					}
+				}
+				// Detect resources previously returned under this prefix that were deleted.
+				for knownName := range knownVersions {


Can you clarify this one? A resource can still be directly requested or match another collection (theoretically). We should not check for negative this way, but by checking what's still matching at the end compared to previously known
Your check at line 270 should be handling this

good point, removed the inline deletion check entirely. the consolidated loop over knownVersions now handles both cases in one place: unsubscription (!isSubscribedTo) and cache deletion (still subscribed but !inCache). this also correctly handles a resource that matches both an exact subscription and a prefix

wdauchy · 2026-03-10T09:36:03Z

addressed the feedback.

re: tree matcher for O(segments), makes sense as a follow-up, the current approach is O(prefixes) per resource which should be fine for now to start with something

wdauchy · 2026-03-22T18:14:11Z

@valerian-roche if you have some time to have a look

valerian-roche

One minor comment left, otherwise lgtm.
Thanks for rewriting the PR in a way that avoids most impact for non-prefix users

valerian-roche · 2026-03-23T01:50:22Z

-			if _, ok := sub.SubscribedResources()[resourceName]; !ok {
+			if !isSubscribedTo(sub, resourceName) {
+				removedResources = append(removedResources, resourceName)
+			} else if _, inCache := cache.resources[resourceName]; !inCache {


Minor: I'd expect cache evolution to be more common than watch removal, and isSubscribedTo is more expensive when prefixes are used, so might be better to revert evaluation order

good point, swapped the order, cache deletion check (O(1) map lookup) now comes first, isSubscribedTo only runs if the resource is still in cache

Envoy's LEDS uses delta xDS with glob collection subscriptions where clients subscribe to resource names ending in /* (e.g. ns_svc_8080/us-east-1a/*) and expect to receive all individual resources whose name starts with that prefix. Currently LinearCache only supports exact-name watches and full wildcard watches. A subscription to collection/* is stored as a literal key in resourceWatches and never matches individual resources under that prefix. Add a new prefixWatches map to LinearCache that is keyed by the prefix (with trailing * stripped, keeping the separator). When a subscribed resource name ends with /*, the watch is registered in prefixWatches instead of resourceWatches. notifyAll iterates prefixWatches for each modified resource and triggers matching prefix watches. computeResourceChange expands prefix subscriptions to all matching resources in the cache, detecting new, updated, and deleted resources under the prefix. Signed-off-by: William Dauchy <william.dauchy@datadoghq.com>

Address review feedback: - Move glob detection into Subscription (SubscribedPrefixes) so prefix sets are precomputed once at subscription time instead of checked on every cache operation. - Single pass over cache.resources for prefix expansion instead of one iteration per prefix subscription. - Consolidated removal check: detect both unsubscription and cache deletion in a single loop over knownVersions. - isSubscribedTo is O(1) when no prefix subscriptions are active. - Remove isPrefixGlob and isResourceMatchingSubscription helpers from the cache package. Signed-off-by: William Dauchy <william.dauchy@datadoghq.com>

Signed-off-by: William Dauchy <william.dauchy@datadoghq.com>

…e-prefix-watches

wdauchy · 2026-03-23T11:57:09Z

golangci-lint are failing but I don't think it is related to my PR

wdauchy · 2026-03-26T08:09:17Z

@valerian-roche is it ready to merge?

valerian-roche · 2026-03-28T19:46:28Z

@valerian-roche is it ready to merge?

@wdauchy Can you rebase? The linter issue has been addressed on main

…e-prefix-watches

wdauchy · 2026-03-29T14:37:16Z

@wdauchy Can you rebase? The linter issue has been addressed on main

should be good now!

wdauchy force-pushed the wdauchy/linear-cache-prefix-watches branch from aefeae0 to 441aa0e Compare February 20, 2026 09:44

wdauchy marked this pull request as ready for review February 20, 2026 09:46

wdauchy commented Feb 23, 2026

View reviewed changes

valerian-roche reviewed Mar 9, 2026

View reviewed changes

wdauchy force-pushed the wdauchy/linear-cache-prefix-watches branch from 76e794f to 307eaa3 Compare March 10, 2026 09:31

wdauchy requested a review from valerian-roche March 10, 2026 09:56

valerian-roche previously approved these changes Mar 23, 2026

View reviewed changes

wdauchy dismissed valerian-roche’s stale review via d0daea0 March 23, 2026 09:28

wdauchy added 6 commits March 23, 2026 10:32

cache: fix gocritic ifElseChain lint in subscription.go

d934383

Signed-off-by: William Dauchy <william.dauchy@datadoghq.com>

cache: remove redundant comments on SubscribedResources

9843144

Signed-off-by: William Dauchy <william.dauchy@datadoghq.com>

cache: check cache deletion before subscription in removal loop

b27f145

Signed-off-by: William Dauchy <william.dauchy@datadoghq.com>

Merge remote-tracking branch 'upstream/main' into wdauchy/linear-cach…

1c25d95

…e-prefix-watches

wdauchy force-pushed the wdauchy/linear-cache-prefix-watches branch from d0daea0 to 1c25d95 Compare March 23, 2026 09:34

wdauchy requested a review from valerian-roche March 23, 2026 09:35

valerian-roche approved these changes Mar 28, 2026

View reviewed changes

Merge remote-tracking branch 'upstream/main' into wdauchy/linear-cach…

9ef7c6d

…e-prefix-watches

valerian-roche merged commit 7d94a89 into envoyproxy:main Mar 30, 2026
5 checks passed

Uh oh!

Conversation

wdauchy commented Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wdauchy left a comment

Choose a reason for hiding this comment

Uh oh!

valerian-roche left a comment

Choose a reason for hiding this comment

Uh oh!

valerian-roche Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

wdauchy Mar 10, 2026

Choose a reason for hiding this comment

Uh oh!

valerian-roche Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

wdauchy Mar 10, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

valerian-roche Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

wdauchy Mar 10, 2026

Choose a reason for hiding this comment

Uh oh!

wdauchy commented Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wdauchy commented Mar 22, 2026

Uh oh!

valerian-roche left a comment

Choose a reason for hiding this comment

Uh oh!

valerian-roche Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

wdauchy Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wdauchy commented Mar 23, 2026

Uh oh!

wdauchy commented Mar 26, 2026

Uh oh!

valerian-roche commented Mar 28, 2026

Uh oh!

wdauchy commented Mar 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

wdauchy commented Feb 20, 2026 •

edited

Loading

wdauchy commented Mar 10, 2026 •

edited

Loading

wdauchy Mar 23, 2026 •

edited

Loading