Performance- and resource-issues with bigger broker configuration

[cmasopust]

One of our brokers should be deployed with ~650 addresses, ~300 diverts and ~620 roles. Our users are now complaining about very long runtime of the role and even in some cases the playbook is failing with the error "ERROR! A worker was found in a dead state" (which, after some googling, seems to be related to running out of memory).

I guess that this configuration is probably a bit away from usual broker configs, but that's what it is here.

Any ideas (besides reducing the number of addresses and diverts) what we can do to reduce the runtime and resource consumption? Have you ever tested the role with such big number of addresses and diverts?

Profiling the deployment shows the following result:

...
TASKS RECAP **********************************************************************
Saturday 30 August 2025  08:44:22 +0200 (0:00:00.075)          0:25:02.537 *******
==================================================================================
middleware_automation.amq.activemq : Create security settings matches ---- 483.80s
middleware_automation.amq.activemq : Create security settings matches ---- 480.07s
middleware_automation.amq.activemq : Create addresses string -------------- 70.89s
middleware_automation.amq.activemq : Create addresses string -------------- 59.88s
middleware_automation.amq.activemq : Create diverts configuration string -- 38.60s
middleware_automation.amq.activemq : Create security settings ------------- 27.57s
middleware_automation.amq.activemq : Create diverts configuration string -- 22.02s
middleware_automation.amq.activemq : Set journal configuration ------------ 18.18s
middleware_automation.amq.activemq : Create security settings ------------- 14.52s
Append configuration to file ---------------------------------------------- 11.83s
Gathering Facts ----------------------------------------------------------- 11.61s
middleware_automation.amq.activemq : Get masked password for user ---------- 4.01s
middleware_automation.amq.activemq : Get masked password for user ---------- 4.01s
middleware_automation.amq.activemq : Get masked password for user ---------- 3.90s
middleware_automation.amq.activemq : Get masked password for user ---------- 3.85s
middleware_automation.amq.activemq : Get masked password for user ---------- 3.82s
middleware_automation.amq.activemq : Get masked password for user ---------- 3.61s
middleware_automation.amq.activemq : Get masked password for user ---------- 3.58s
middleware_automation.amq.activemq : Get masked password for user ---------- 3.57s
middleware_automation.amq.activemq : Get masked password for user ---------- 3.47s

ROLES RECAP **********************************************************************
Saturday 30 August 2025  08:44:22 +0200 (0:00:00.081)          0:25:02.542 *******
==================================================================================
activemq ---------------------------------------------------------------- 1460.55s
...

Thanks!
Christian

[cmasopust]

So this is the loop that needs about 6 minutes to execute for ~600 roles: (and the same task in validate_config)

- name: Create security settings matches
  ansible.builtin.set_fact:
    security_settings_matches: "{{ security_settings_matches | default({}) | \
                                   combine( { match: { item.1: [ item.0.name ] }  }, recursive=true, list_merge='append' ) }}"
  vars:
    match: "{{ item.0.match | default('#') }}"
  loop: "{{ activemq_roles | subelements('permissions') }}"
  loop_control:
    label: "{{ item.0.match | default('#') }}"

I now created a simple filter that does exactly the same, but in python (pretty sure that the code can be improved, but...):

from __future__ import (absolute_import, division, print_function)
__metaclass__ = type

from ansible.errors import AnsibleFilterError
from ansible.plugins.filter.core import combine, subelements

def create_security_settings_matches(amq_broker_roles):
    if not isinstance(amq_broker_roles, list):
        raise AnsibleFilterError('create_security_settings_matches can only be used on amq_broker_roles lists')

    result = {}

    broker_roles_list = subelements(amq_broker_roles, 'permissions')

    for r in broker_roles_list:
            m = r[0]['match'] if r[0]['match'] else '#'
            d = { m: { r[1]: [ r[0]['name'] ] } }
            result = combine(result, d, recursive=True, list_merge='append')

    return result

class FilterModule(object):
    ''' private filters '''
    def filters(self):
        return {
            'create_security_settings_matches': create_security_settings_matches,
        }

and change the task to

- name: Create security settings matches with filter
  ansible.builtin.set_fact:
    security_settings_matches: "{{ amq_broker_roles | security_settings_matches }}"

Which dramatically reduces the runtime to less than 1s:

TASKS RECAP *******************************************************************
Sunday 31 August 2025  08:10:44 +0200 (0:23:31.858)       0:23:32.633 *********
===============================================================================
Create security settings matches ------------------------------------- 1411.86s
Create security settings matches with filter ---------------------------- 0.44s

[RanabirChakraborty]

@cmasopust if possible can you please sent a PR?