Add a new index on revocation_event table

When validating a token, under load, a full table scan could happen
because of missing indexes.
This new index drastically help the database to get through the
revocation events.

Closes-Bug: #2081082
Change-Id: Ic44c945f3cb65b48ff72052fd2b4f6d45e118b2e
Signed-off-by: Quentin GROLLEAU <quentin.grolleau@corp.ovh.com>
Signed-off-by: Arnaud Morin <arnaud.morin@ovhcloud.com>

keystone/common/sql/migrations/versions/2026.1/expand/742c857f1dfb_add_index_in_revocation_event.py

@@ -0,0 +1,40 @@
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+"""Add index in revocation_event
+
+Revision ID: 742c857f1dfb
+Revises: e8725d6fa226
+Create Date: 2025-11-24 10:21:03.202908
+"""
+
+from alembic import op
+
+
+# revision identifiers, used by Alembic.
+revision = '742c857f1dfb'
+down_revision = 'e8725d6fa226'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    op.create_index(
+        'ix_revocation_event_project_id_user_id',
+        'revocation_event',
+        ['project_id', 'user_id'],
+    )
+    op.create_index(
+        'ix_revocation_event_composite',
+        'revocation_event',
+        ['issued_before', 'user_id', 'project_id', 'audit_id'],
+    )

keystone/common/sql/migrations/versions/EXPAND_HEAD

@@ -1 +1 @@
-e8725d6fa226
+742c857f1dfb

keystone/common/sql/upgrades.py

@@ -37,7 +37,7 @@ EXPAND_BRANCH = 'expand'
 DATA_MIGRATION_BRANCH = 'data_migration'
 CONTRACT_BRANCH = 'contract'
 
-RELEASES = ('yoga', 'bobcat', '2024.1', '2025.2')
+RELEASES = ('yoga', 'bobcat', '2024.1', '2025.2', '2026.1')
 MILESTONES = (
     'yoga',
     # Do not add the milestone until the end of the release

keystone/revoke/backends/sql.py

@@ -53,6 +53,16 @@ class RevocationEvent(sql.ModelBase, sql.ModelDictMixin):
             'audit_id',
             'issued_before',
         ),
+        sql.Index(
+            'ix_revocation_event_project_id_user_id', 'project_id', 'user_id'
+        ),
+        sql.Index(
+            'ix_revocation_event_composite',
+            'issued_before',
+            'user_id',
+            'project_id',
+            'audit_id',
+        ),
     )
 
 

keystone/tests/unit/test_sql_banned_operations.py

@@ -329,6 +329,28 @@ class KeystoneMigrationsWalk(test_fixtures.OpportunisticDBTestMixin):
         indexes = inspector.get_indexes('project_endpoint_group')
         self.assertIn('idx_project_id', {x['name'] for x in indexes})
 
+    def _pre_upgrade_742c857f1dfb(self, connection):
+        inspector = sqlalchemy.inspect(connection)
+        indexes = inspector.get_indexes('revocation_event')
+        self.assertNotIn(
+            'ix_revocation_event_project_id_user_id',
+            {x['name'] for x in indexes},
+        )
+        self.assertNotIn(
+            'ix_revocation_event_composite', {x['name'] for x in indexes}
+        )
+
+    def _check_742c857f1dfb(self, connection):
+        inspector = sqlalchemy.inspect(connection)
+        indexes = inspector.get_indexes('revocation_event')
+        self.assertIn(
+            'ix_revocation_event_project_id_user_id',
+            {x['name'] for x in indexes},
+        )
+        self.assertIn(
+            'ix_revocation_event_composite', {x['name'] for x in indexes}
+        )
+
     def test_single_base_revision(self):
         """Ensure we only have a single base revision.