fix(cache): make acl entities group cache warmup

CHANGELOG.md

@@ -34,6 +34,8 @@
   [#11306](https://github.com/Kong/kong/pull/11306)
 - Fix an issue where cluster_cert or cluster_ca_cert is inserted into lua_ssl_trusted_certificate before being base64 decoded.
   [#11385](https://github.com/Kong/kong/pull/11385)
+- Fix cache warmup mechanism not working in `acls` plugin groups config entity scenario.
+  [#11414](https://github.com/Kong/kong/pull/11414)
 
 #### Plugins
 

kong/cache/warmup.lua

@@ -1,6 +1,10 @@
 local utils = require "kong.tools.utils"
 local constants = require "kong.constants"
 local buffer = require "string.buffer"
+local acl_groups
+if utils.load_module_if_exists("kong.plugins.acl.groups") then
+  acl_groups = require "kong.plugins.acl.groups"
+end
 
 
 local cache_warmup = {}
@@ -136,6 +140,14 @@ function cache_warmup.single_dao(dao)
     if not ok then
       return nil, err
     end
+
+    if entity_name == "acls" and acl_groups ~= nil then
+      log(NOTICE, "warmup acl groups cache for consumer id: ", entity.consumer.id , "...")
+      local _, err = acl_groups.warmup_groups_cache(entity.consumer.id)
+      if err then
+        log(NOTICE, "warmup acl groups cache for consumer id: ", entity.consumer.id , " err: ", err)
+      end
+    end
   end
 
   if entity_name == "services" and host_count > 0 then

kong/plugins/acl/groups.lua

@@ -196,11 +196,22 @@ local function group_in_groups(groups_to_check, groups)
   end
 end
 
+local function warmup_groups_cache(consumer_id)
+  local cache_key = kong.db.acls:cache_key(consumer_id)
+  local _, err = kong.cache:get(cache_key, nil,
+                                         load_groups_into_memory,
+                                         { id = consumer_id })
+  if err then
+    return nil, err
+  end
+end
+
 
 return {
   get_current_consumer_id = get_current_consumer_id,
   get_consumer_groups = get_consumer_groups,
   get_authenticated_groups = get_authenticated_groups,
   consumer_in_groups = consumer_in_groups,
   group_in_groups = group_in_groups,
+  warmup_groups_cache = warmup_groups_cache,
 }

spec/03-plugins/18-acl/02-access_spec.lua

@@ -711,10 +711,39 @@ for _, strategy in helpers.each_strategy() do
         }
       }
 
+      local route14 = bp.routes:insert({
+        hosts = { "acl14.com" }
+      })
+
+      local acl_prefunction_code = "        local consumer_id = \"" .. tostring(consumer2.id) .. "\"\n" .. [[
+        local cache_key = kong.db.acls:cache_key(consumer_id)
+
+        -- we must use shadict to get the cache, because the `kong.cache` was hooked by `kong.plugins.pre-function` 
+        local raw_groups, err = ngx.shared.kong_db_cache:get("kong_db_cache"..cache_key)
+        if raw_groups then
+          ngx.exit(200)
+        else
+          ngx.log(ngx.ERR, "failed to get cache: ", err)
+          ngx.exit(500)
+        end
+
+      ]]
+
+      bp.plugins:insert {
+        route = { id = route14.id },
+        name = "pre-function",
+        config = {
+          access = {
+            acl_prefunction_code,
+          },
+        }
+      }
+
       assert(helpers.start_kong({
         plugins    = "bundled, ctx-checker",
         database   = strategy,
         nginx_conf = "spec/fixtures/custom_nginx.template",
+        db_cache_warmup_entities = "keyauth_credentials,consumers,acls",
       }))
     end)
 
@@ -1315,6 +1344,26 @@ for _, strategy in helpers.each_strategy() do
         assert.same({ message = "You cannot consume this service" }, json)
       end)
     end)
+
+    describe("cache warmup acls group", function()
+      it("cache warmup acls group", function()
+        assert(helpers.restart_kong {
+          plugins    = "bundled, ctx-checker",
+          database   = strategy,
+          nginx_conf = "spec/fixtures/custom_nginx.template",
+          db_cache_warmup_entities = "keyauth_credentials,consumers,acls",
+        })
+
+        proxy_client = helpers.proxy_client()
+        local res = assert(proxy_client:get("/request", {
+          headers = {
+            ["Host"] = "acl14.com"
+          }
+        }))
+        assert.res_status(200, res)
+      end)
+    end)
+
   end)
 
   describe("Plugin: ACL (access) [#" .. strategy .. "] anonymous", function()