8000 metrics: add peer identities to all TLS metric labels by hawkw · Pull Request #687 · linkerd/linkerd2-proxy · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

metrics: add peer identities to all TLS metric labels #687

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Oct 1, 2020
Merged

metrics: add peer identities to all TLS metric labels #687

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6c1f866
add client & server identity to all metric labels
hawkw Oct 1, 2020
e5bda48
missing comma
hawkw Oct 1, 2020
b1bc961
whoops, fix both being client ids
hawkw Oct 1, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 4 additions & 10 deletions linkerd/app/core/src/metric_labels.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
use crate::proxy::identity;
use crate::transport::{labels::TlsStatus, tls};
pub use crate::transport::labels::TlsStatus;
use linkerd2_addr::Addr;
use linkerd2_conditional::Conditional;
use linkerd2_metrics::FmtLabels;
use std::fmt::{self, Write};

Expand All @@ -16,7 +15,7 @@ pub struct ControlLabels {
#[derive(Clone, Debug, PartialEq, Eq, Hash)]
pub struct EndpointLabels {
pub direction: Direction,
pub tls_id: Conditional<TlsId, tls::ReasonForNoPeerName>,
pub tls_id: TlsStatus,
pub authority: Option<http::uri::Authority>,
pub labels: Option<String>,
}
Expand Down Expand Up @@ -55,7 +54,7 @@ impl From<control::ControlAddr> for ControlLabels {
fn from(c: control::ControlAddr) -> Self {
ControlLabels {
addr: c.addr.clone(),
tls_status: c.identity.as_ref().into(),
tls_status: c.identity.map(|id| TlsId::ServerId(id)).into(),
}
}
}
Expand Down Expand Up @@ -106,12 +105,7 @@ impl FmtLabels for EndpointLabels {
}

write!(f, ",")?;
TlsStatus::from(self.tls_id.as_ref()).fmt_labels(f)?;

if let Conditional::Some(ref id) = self.tls_id {
write!(f, ",")?;
id.fmt_labels(f)?;
}
self.tls_id.fmt_labels(f)?;

Ok(())
}
Expand Down
59 changes: 41 additions & 18 deletions linkerd/app/core/src/transport/labels.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
use super::tls;
pub use crate::metric_labels::{Direction, EndpointLabels};
pub use crate::metric_labels::{Direction, EndpointLabels, TlsId};
use linkerd2_conditional::Conditional;
use linkerd2_metrics::FmtLabels;
use std::fmt;
Expand All @@ -15,11 +15,17 @@ pub enum Key {
Connect(EndpointLabels),
}

#[derive(Copy, Clone, Debug, Eq, PartialEq, Hash)]
pub struct TlsStatus(tls::Conditional<()>);
#[derive(Clone, Debug, Eq, PartialEq, Hash)]
pub struct TlsStatus(tls::Conditional<TlsId>);

// === impl Key ===

impl Key {
pub fn accept(direction: Direction, id: tls::PeerIdentity) -> Self {
Self::Accept(direction, TlsStatus::client(id))
}
}

impl FmtLabels for Key {
fn fmt_labels(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
match self {
Expand All @@ -37,36 +43,53 @@ impl FmtLabels for Key {

// === impl TlsStatus ===

impl<T> From<tls::Conditional<T>> for TlsStatus {
fn from(inner: tls::Conditional<T>) -> Self {
TlsStatus(inner.map(|_| ()))
impl TlsStatus {
pub fn client(id: tls::PeerIdentity) -> Self {
Self(id.map(TlsId::ClientId))
}

pub fn server(id: tls::PeerIdentity) -> Self {
Self(id.map(TlsId::ServerId))
}
}

impl Into<tls::Conditional<()>> for TlsStatus {
fn into(self) -> tls::Conditional<()> {
self.0
impl From<tls::Conditional<TlsId>> for TlsStatus {
fn from(inner: tls::Conditional<TlsId>) -> Self {
TlsStatus(inner)
}
}

impl Into<tls::PeerIdentity> for TlsStatus {
fn into(self) -> tls::PeerIdentity {
self.0.map(|id| match id {
TlsId::ClientId(id) => id,
TlsId::ServerId(id) => id,
})
}
}

impl fmt::Display for TlsStatus {
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
match self.0 {
Conditional::Some(()) => write!(f, "true"),
Conditional::None(r) => fmt::Display::fmt(&r, f),
Conditional::Some(_) => write!(f, "true"),
Conditional::None(ref r) => fmt::Display::fmt(&r, f),
}
}
}

impl FmtLabels for TlsStatus {
fn fmt_labels(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
if let Self(Conditional::None(tls::ReasonForNoPeerName::LocalIdentityDisabled)) = self {
return write!(f, "tls=\"disabled\"");
}
if let Self(Conditional::None(why)) = self {
return write!(f, "tls=\"no_identity\",no_tls_reason=\"{}\"", why);
match self.0 {
Conditional::None(tls::ReasonForNoPeerName::LocalIdentityDisabled) => {
write!(f, "tls=\"disabled\"")
}
Conditional::None(ref why) => {
write!(f, "tls=\"no_identity\",no_tls_reason=\"{}\"", why)
}
Conditional::Some(ref id) => {
write!(f, "tls=\"true\",")?;
id.fmt_labels(f)
}
}

write!(f, "tls=\"{}\"", self)
}
}
5 changes: 4 additions & 1 deletion linkerd/app/inbound/src/endpoint.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -137,7 +137,10 @@ impl Into<metric_labels::EndpointLabels> for Target {
metric_labels::EndpointLabels {
authority: self.dst.name_addr().map(|d| d.as_http_authority()),
direction: metric_labels::Direction::In,
tls_id: self.tls_client_id.map(metric_labels::TlsId::ClientId),
tls_id: self
.tls_client_id
.map(metric_labels::TlsId::ClientId)
.into(),
labels: None,
}
}
Expand Down
8 changes: 4 additions & 4 deletions linkerd/app/inbound/src/lib.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -471,9 +471,9 @@ impl transport::metrics::TransportLabels<listen::Addrs> for TransportLabels {
type Labels = transport::labels::Key;

fn transport_labels(&self, _: &listen::Addrs) -> Self::Labels {
transport::labels::Key::Accept(
transport::labels::Key::accept(
transport::labels::Direction::In,
tls::Conditional::<()>::None(tls::ReasonForNoPeerName::PortSkipped).into(),
tls::Conditional::None(tls::ReasonForNoPeerName::PortSkipped),
)
}
}
Expand All @@ -482,9 +482,9 @@ impl transport::metrics::TransportLabels<tls::accept::Meta> for TransportLabels
type Labels = transport::labels::Key;

fn transport_labels(&self, target: &tls::accept::Meta) -> Self::Labels {
transport::labels::Key::Accept(
transport::labels::Key::accept(
transport::labels::Direction::In,
target.peer_identity.as_ref().into(),
target.peer_identity.clone(),
)
}
}
Expand Down
10 changes: 5 additions & 5 deletions linkerd/app/outbound/src/endpoint.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ use indexmap::IndexMap;
use linkerd2_app_core::{
dst,
metric_labels,
metric_labels::{prefix_labels, EndpointLabels},
metric_labels::{prefix_labels, EndpointLabels, TlsStatus},
profiles,
proxy::{
api_resolve::{Metadata, ProtocolHint},
Expand Down Expand Up @@ -314,11 +314,11 @@ impl CanOverrideAuthority for HttpEndpoint {

impl Into<EndpointLabels> for HttpEndpoint {
fn into(self) -> EndpointLabels {
use linkerd2_app_core::metric_labels::{Direction, TlsId};
use linkerd2_app_core::metric_labels::Direction;
EndpointLabels {
authority: Some(self.concrete.logical.dst.to_http_authority()),
direction: Direction::Out,
tls_id: self.identity.as_ref().map(|id| TlsId::ServerId(id.clone())),
tls_id: TlsStatus::server(self.identity.clone()),
labels: prefix_labels("dst", self.metadata.labels().into_iter()),
}
}
Expand Down Expand Up @@ -357,12 +357,12 @@ impl tls::HasPeerIdentity for TcpEndpoint {

impl Into<EndpointLabels> for TcpEndpoint {
fn into(self) -> EndpointLabels {
use linkerd2_app_core::metric_labels::{Direction, TlsId};
use linkerd2_app_core::metric_labels::Direction;
EndpointLabels {
authority: Some(self.dst.to_http_authority()),
direction: Direction::Out,
labels: self.labels,
tls_id: self.identity.as_ref().map(|id| TlsId::ServerId(id.clone())),
tls_id: TlsStatus::server(self.identity),
}
}
}
Expand Down
5 changes: 3 additions & 2 deletions linkerd/app/outbound/src/lib.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -577,8 +577,9 @@ impl transport::metrics::TransportLabels<listen::Addrs> for TransportLabels {
type Labels = transport::labels::Key;

fn transport_labels(&self, _: &listen::Addrs) -> Self::Labels {
const NO_TLS: tls::Conditional<()> = Conditional::None(tls::ReasonForNoPeerName::Loopback);
transport::labels::Key::Accept(transport::labels::Direction::Out, NO_TLS.into())
const NO_TLS: tls::Conditional<identity::Name> =
Conditional::None(tls::ReasonForNoPeerName::Loopback);
transport::labels::Key::accept(transport::labels::Direction::Out, NO_TLS.into())
}
}

Expand Down
0