feat(allocation_policies): attach policies via sentry-options by pbhandari · Pull Request #8387 · getsentry/snuba

pbhandari · 2026-08-24T14:53:16Z

What

Move allocation-policy configuration (which classes run for a ResourceIdentifier) from hardcoded construction onto a new sentry-option, allocation_policy.

AllocationPolicies each hardcode required_tenant_types, since those will require code changes anyway, hardcoding them will allow us to change this only in one place.
AllocationPolicys no longer have the following fields:
- is_active => is_enforced is enough to disable it, or we can configure the values to have this be an empty dict. If the Policy exists and has flags tuned it's active.
- default_config_overrides => 2 ways of overriding keys is confusing. Collating them into a single flow relying only on the **kwargs while keeping the ConfigurableComponent shape.
Currently we're not changing how each tenant configured allocation policies and am leaving configurable_component_overrides alone, my intent is to drop that config path completely and have this be configurable only via the proper path.

Part of EAP-725.

Behavior

Option is a map of resource.
Schema default is {}. Unset / empty falls back to PassthroughPolicy
StorageRouting.get_allocation_policies() reads EAP
SNQL storages with no YAML list fall through to the same helper (today: passthrough)

Tests

pytest tests/query/allocation_policies/test_attachment.py tests/web/rpc/v1/test_storage_routing.py::test_metrics_output tests/web/rpc/v1/routing_strategies/test_outcomes_based.py

linear-code · 2026-08-24T14:53:19Z

EAP-725

pbhandari · 2026-08-24T14:53:23Z

Automator PR: https://github.com/getsentry/sentry-options-automator/pull/9311

sentry · 2026-08-25T14:33:43Z

+        # All routing strategies share allocation policies: they protect the same
+        # resource (EAP). The list is configured via allocation_policy.
+        return get_active_allocation_policies(ResourceIdentifier("EAP"))


Bug: The code defaults to a PassthroughPolicy if the allocation_policy sentry-option is not configured, silently disabling EAP rate-limiting policies in production.
_{Severity: CRITICAL}

Suggested Fix

To prevent silently disabling policies, the code should not fall back to a PassthroughPolicy if the allocation_policy option is missing for EAP. Instead, it should either log a prominent error and reject the query, or, more safely, default to the previous hardcoded policies (ConcurrentRateLimitAllocationPolicy, ReferrerGuardRailPolicy, BytesScannedRejectingPolicy) to maintain the existing safeguards. This ensures that a configuration oversight does not lead to a critical failure.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not valid. Location: snuba/web/rpc/storage_routing/routing_strategies/storage_routing.py#L368-L370 Potential issue: The code replaces hardcoded EAP allocation policies with a system that relies on the `allocation_policy` sentry-option. If this option is not configured in a production environment before deployment, the system will default to a `PassthroughPolicy`. This silently disables all previously active rate limiting, byte-scanning limits, and concurrent query limits for EAP queries. This could allow an unlimited number of EAP queries, potentially leading to cluster instability. The fallback to `PassthroughPolicy` happens without any warning logs, making the issue difficult to detect.

Feature not bug.

Read which AllocationPolicy classes run for a ResourceIdentifier from allocation_policy_attachment instead of hardcoding them on StorageRouting. Unset/empty falls back to PassthroughPolicy. Settings stay on configurable_component_overrides. Refs EAP-725

…le in that dict

…ptions-automator

…cation policy

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c109434. Configure here.}

phacops

We need to make sure these configurations get reloaded on each query and not just initialized when we start the server.

phacops · 2026-08-25T23:04:53Z

        )

-    @property
-    def is_active(self) -> bool:


Are we removing the option to measure the policy but not enforce it? I don't think we'd fully want that.

My thinking isif the policy exists => it is "active". There is still the option to have a policy be un-enforced. But to imo "Policy exists in config but is configured to be entirely inert" doesn't seem wise.

The follow up PR allows us to explicitly "remove" policies instead to allow them to be neither enforced, nor active for specific overrides.

phacops · 2026-08-25T23:09:40Z

      "default": {},
      "description": "Override values for ConfigurableComponent (allocation policy and storage-routing strategy) configs, keyed by the fully-qualified config key '{resource}.{ClassName}.{config}' (parameterized configs append '|{param}:{value}|...', params sorted). Values are numbers cast to each config's declared numeric type (int/float) on read. All current ConfigurableComponent configs are numeric; a non-numeric config would require widening this type. Authoritative source for these configs; a key absent here falls back to the code default. Read-only at runtime and managed in sentry-options-automator. Migrated from the per-component runtime config of the same key."
    },
+    "allocation_policy": {


This should be plural.

phacops · 2026-08-25T23:14:56Z

        See `_build_config_key()` for more info.
    """

+    required_tenant_types: frozenset[str] = frozenset()


Why is this a property like this instead of a piece of configuration like before?

The follow up PR drops this completely. I just wanted to maintain a smaller blast radius for this change.

But I'm not sure this field is really a good idea tbh. I'm thinking all "tenant types" should be optional.

sentry · 2026-08-26T14:49:10Z

+                AllocationPolicy.get_from_name(name).from_kwargs(
+                    storage_key=resource_identifier.value,
+                    **spec,
+                )
+            )
+        except InvalidConfigKeyError:
+            logger.warning(
+                "Unknown allocation policy %s for %s",
+                name,
+                resource_identifier.value,
+            )


Bug: The get_active_allocation_policies function only catches InvalidConfigKeyError, leaving other exceptions from policy constructors (like ValueError) unhandled, which can crash request handlers.
_{Severity: HIGH}

Suggested Fix

Broaden the except block in get_active_allocation_policies to catch other potential exceptions from policy initialization, such as ValueError and TypeError. Log the error and gracefully skip the malformed policy, which aligns with the apparent intent to degrade gracefully on bad configurations.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not valid. Location: snuba/query/allocation_policies/__init__.py#L633-L645 Potential issue: The `get_active_allocation_policies` function initializes allocation policies from configuration. Its error handling only catches `InvalidConfigKeyError`. However, policy constructors, such as `CrossOrgQueryAllocationPolicy`, can raise other exceptions like `ValueError` or `TypeError` if the configuration data is malformed (e.g., a string instead of an integer for `max_threads`). An unhandled exception will propagate to callers like `get_routing_decision` and `db_query`, potentially crashing user-facing query routing and execution requests. This can occur with a misconfigured `sentry-option` that passes schema validation but fails constructor validation.

pbhandari · 2026-08-27T13:37:47Z

We need to make sure these configurations get reloaded on each query and not just initialized when we start the server.

Yup; this get reloaded on each query. Existing handling of options get_mapped_option already does this.

pbhandari commented Aug 24, 2026

View reviewed changes

Comment thread sentry-options/schemas/snuba/schema.json Outdated

Comment thread snuba/datasets/storage.py Outdated

Comment thread snuba/query/allocation_policies/__init__.py Outdated

Comment thread sentry-options/schemas/snuba/schema.json Outdated

pbhandari commented Aug 24, 2026

View reviewed changes

Comment thread snuba/query/allocation_policies/__init__.py Outdated

pbhandari marked this pull request as ready for review August 24, 2026 21:44

pbhandari requested review from a team as code owners August 24, 2026 21:44

sentry Bot reviewed Aug 24, 2026

View reviewed changes

Comment thread snuba/query/allocation_policies/__init__.py Outdated

cursor Bot reviewed Aug 24, 2026

View reviewed changes

Comment thread snuba/query/allocation_policies/__init__.py Outdated

sentry Bot reviewed Aug 24, 2026

View reviewed changes

Comment thread snuba/query/allocation_policies/__init__.py

sentry Bot reviewed Aug 25, 2026

View reviewed changes

cursor Bot reviewed Aug 25, 2026

View reviewed changes

Comment thread snuba/query/allocation_policies/__init__.py

pbhandari mentioned this pull request Aug 25, 2026

feat(allocation_policies): per-tenant attachment via match blocks #8393

Open

MeredithAnya reviewed Aug 25, 2026

View reviewed changes

Comment thread snuba/query/allocation_policies/__init__.py Outdated

MeredithAnya approved these changes Aug 25, 2026

View reviewed changes

pbhandari and others added 14 commits August 25, 2026 15:10

ref(allocation_policies): rename option and nest settings on each policy

c94be07

Streamline PassthroughPolicy creation, and ensure it's always availab…

79bf8b8

…le in that dict

Hardcode required_tenant_types, that should not be configurable via o…

053ed30

…ptions-automator

Remove required_tenant_types from teh ctor

1a1d125

Drop unused constant

3ed506c

If an allocation policy is configured; it should be considered active.

9796293

Stop always returning the passthrough policy

daeac90

Remove default_config_overrides from AllocationPolicies as well

f63f0f8

Don't mutate spec

5548f13

Read allocation_policy as a list of match blocks

6e0768e

Don't declare unused 'remove' key

80b3bab

Apply suggestion from @pbhandari

ed784f7

Update test_db_query test to accurately reflect the now enforced allo…

c109434

…cation policy

pbhandari force-pushed the prajjwalbhandari/eap-725-configure-allocation-policy-attachment-via-sentry-options branch from d2e969e to c109434 Compare August 25, 2026 19:34

cursor Bot reviewed Aug 25, 2026

View reviewed changes

Comment thread snuba/query/allocation_policies/__init__.py

phacops reviewed Aug 25, 2026

View reviewed changes

Rename allocation_policy option key to allocation_policies

d22d53f

sentry Bot reviewed Aug 26, 2026

View reviewed changes

pbhandari merged commit 60af357 into master Aug 27, 2026
68 checks passed

pbhandari deleted the prajjwalbhandari/eap-725-configure-allocation-policy-attachment-via-sentry-options branch August 27, 2026 14:36

Uh oh!

Uh oh!

Conversation

pbhandari commented Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Behavior

Tests

Uh oh!

linear-code Bot commented Aug 24, 2026

Uh oh!

pbhandari commented Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sentry Bot Aug 25, 2026

Choose a reason for hiding this comment

Uh oh!

pbhandari Aug 26, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

phacops left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

phacops Aug 25, 2026

Choose a reason for hiding this comment

Uh oh!

pbhandari Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

phacops Aug 25, 2026

Choose a reason for hiding this comment

Uh oh!

phacops Aug 25, 2026

Choose a reason for hiding this comment

Uh oh!

pbhandari Aug 26, 2026

Choose a reason for hiding this comment

Uh oh!

sentry Bot Aug 26, 2026

Choose a reason for hiding this comment

Uh oh!

pbhandari commented Aug 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

pbhandari commented Aug 24, 2026 •

edited

Loading

pbhandari commented Aug 24, 2026 •

edited

Loading

pbhandari Aug 26, 2026 •

edited

Loading