Improve performance of retrieving windows desktops

[rosstimothy]

Problem

To retrieve a single windows desktop one must use the GetWindowsDesktops RPC with a DesktopFilter. The backend implementation does a range read and applies the filter on each desktop even though when the filter is given with a hostID and a name it should only match a single desktop.

teleport/lib/services/local/desktops.go

Lines 42 to 67 in 312c829

	func (s *WindowsDesktopService) GetWindowsDesktops(ctx context.Context, filter types.WindowsDesktopFilter) ([]types.WindowsDesktop, error) {
	startKey := backend.ExactKey(windowsDesktopsPrefix)
	result, err := s.GetRange(ctx, startKey, backend.RangeEnd(startKey), backend.NoLimit)
	if err != nil {
	return nil, trace.Wrap(err)
	}
	var desktops []types.WindowsDesktop
	for _, item := range result.Items {
	desktop, err := services.UnmarshalWindowsDesktop(item.Value,
	services.WithExpires(item.Expires), services.WithRevision(item.Revision))
	if err != nil {
	return nil, trace.Wrap(err)
	}
	if !filter.Match(desktop) {
	continue
	}
	desktops = append(desktops, desktop)
	}
	// If both HostID and Name are set in the filter only one desktop should be expected
	if filter.HostID != "" && filter.Name != "" && len(desktops) == 0 {
	return nil, trace.NotFound("windows desktop \"%s/%s\" doesn't exist", filter.HostID, filter.Name)
	}
	return desktops, nil
	}

Each time a desktop is heartbeated via UpsertWindowsDesktop the entire desktop range is read to find the matching host.

teleport/lib/auth/auth_with_roles.go

Lines 6715 to 6725 in 312c829

	// If the desktop exists, check access,
	// if it doesn't, continue.
	existing, err := a.authServer.GetWindowsDesktops(ctx,
	types.WindowsDesktopFilter{HostID: s.GetHostID(), Name: s.GetName()})
	if err == nil && len(existing) != 0 {
	if err := a.checkAccessToWindowsDesktop(existing[0]); err != nil {
	return trace.Wrap(err)
	}
	} else if err != nil && !trace.IsNotFound(err) {
	return trace.Wrap(err)
	}

In clusters with a large number of desktops this results in excessive CPU consumption to find a single desktop.

Additionally, the GetWindowsDesktops RPC is not paginated, and may result in OOM or exceeding the gRPC message sizes if called in a cluster with a large number of desktops.

Proposal

1. Modify the GetWindowsDesktops backend method to do a point read if the filter contains a hostID and a name. While this doesn't address the higher level concerns the RPC presents, it will eliminate the excessive CPU consumption during desktop heartbeats and can safely be backported.

2. Deprecate the GetWindowsDesktops RPC and add a GetWindowsDesktop and possibly a ListWindowsDesktop RPC. The latter may not be necessary since the same can be achieved with the ListResources or ListUnifiedResources RPCs.