Increased capacity for Team LBAC rules
Increased capacity for Team LBAC rules
Grafana Team LBAC: Performance Considerations
What We’ve Improved
Storage Capacity
We previously had a limitation of about 500 LBAC rules per data source, which was challenging for some customers who needed more rules to meet their requirements. We’ve resolved this by expanding our storage capacity, allowing for significantly more rules to be stored.
Performance Considerations
Query Performance
While the storage concern has been alleviated, query performance can be affected when many LBAC rules are applied. Performance depends on several factors:
- Number of rules applied: Only rules for the teams a user belongs to are applied to queries, not all stored rules
- Rule complexity: Complex rules with many labels can slow down queries
- Datasource type: Some datasources handle LBAC rules more efficiently than others
Technical Limits
There’s a limit on how much data can be sent with each query. Queries exceeding this limit will fail. This becomes relevant with complex rules containing many labels.
How Rules Work
LBAC rules are configured per team. You can store a large number of rules applied to as many teams as you would like. The rules that are actually applied depend on the user running the query and which teams they belong to.
For example, a data source has rules configured for Team A and Team B. A user belonging to Team A but not Team B will only have the rules configured for Team A applied.
This means that the total number of rules saved for a specific datasource doesn’t necessarily affect query performance, but rather the number of rules that apply to the user’s teams.
Best Practices
Performance Guidelines
- Target rule count: In testing, we’ve found that queries generally work well with around 50 LBAC rules applied
- Rule design: Keep rules as simple as possible while meeting your access control requirements
- Team structure: Consider how your team structure affects which rules are applied to each user’s queries
There is no hard limit on the number of LBAC rules that can be sent on a query. This limit will vary depending on the datasource type, the user/team structure, and the rules themselves.
