Merge pull request #4038 from pierresouchay/ACL_additional_info

Track calls blocked by ACLs using metrics

agent/local/state.go

@@ -11,7 +11,7 @@ import (
 	"sync/atomic"
 	"time"
 
-	"github.com/hashicorp/go-uuid"
+	"github.com/armon/go-metrics"
 
 	"github.com/hashicorp/consul/acl"
 	"github.com/hashicorp/consul/agent/structs"
@@ -19,6 +19,7 @@ import (
 	"github.com/hashicorp/consul/api"
 	"github.com/hashicorp/consul/lib"
 	"github.com/hashicorp/consul/types"
+	"github.com/hashicorp/go-uuid"
 )
 
 // Config is the configuration for the State.
@@ -1087,6 +1088,7 @@ func (l *State) deleteService(id string) error {
 		// todo(fs): some backoff strategy might be a better solution
 		l.services[id].InSync = true
 		l.logger.Printf("[WARN] agent: Service %q deregistration blocked by ACLs", id)
+		metrics.IncrCounter([]string{"acl", "blocked", "service", "deregistration"}, 1)
 		return nil
 
 	default:
@@ -1124,6 +1126,7 @@ func (l *State) deleteCheck(id types.CheckID) error {
 		// todo(fs): some backoff strategy might be a better solution
 		l.checks[id].InSync = true
 		l.logger.Printf("[WARN] agent: Check %q deregistration blocked by ACLs", id)
+		metrics.IncrCounter([]string{"acl", "blocked", "check", "deregistration"}, 1)
 		return nil
 
 	default:
@@ -1194,6 +1197,7 @@ func (l *State) syncService(id string) error {
 			l.checks[check.CheckID].InSync = true
 		}
 		l.logger.Printf("[WARN] agent: Service %q registration blocked by ACLs", id)
+		metrics.IncrCounter([]string{"acl", "blocked", "service", "registration"}, 1)
 		return nil
 
 	default:
@@ -1239,6 +1243,7 @@ func (l *State) syncCheck(id types.CheckID) error {
 		// todo(fs): some backoff strategy might be a better solution
 		l.checks[id].InSync = true
 		l.logger.Printf("[WARN] agent: Check %q registration blocked by ACLs", id)
+		metrics.IncrCounter([]string{"acl", "blocked", "check", "registration"}, 1)
 		return nil
 
 	default:
@@ -1270,6 +1275,7 @@ func (l *State) syncNodeInfo() error {
 		// todo(fs): some backoff strategy might be a better solution
 		l.nodeInfoInSync = true
 		l.logger.Printf("[WARN] agent: Node info update blocked by ACLs")
+		metrics.IncrCounter([]string{"acl", "blocked", "node", "registration"}, 1)
 		return nil
 
 	default:

website/source/docs/agent/telemetry.html.md

@@ -138,6 +138,18 @@ This is a full list of metrics emitted by Consul.
     <th>Unit</th>
     <th>Type</th>
   </tr>
+  <tr>
+    <td>`consul.acl.blocked.service.registration`</td>
+    <td>This increments whenever a deregistration fails for a service (blocked by an ACL)</td>
+    <td>requests</td>
+    <td>counter</td>
+  </tr>
+  <tr>
+    <td>`consul.acl.blocked.&lt;check|node|service&gt;.registration`</td>
+    <td>This increments whenever a registration fails for an entity (check, node or service) is blocked by an ACL</td>
+    <td>requests</td>
+    <td>counter</td>
+  </tr>
   <tr>
     <td>`consul.client.rpc`</td>
     <td>This increments whenever a Consul agent in client mode makes an RPC request to a Consul server. This gives a measure of how much a given agent is loading the Consul servers. Currently, this is only generated by agents in client mode, not Consul servers.</td>