-
Notifications
You must be signed in to change notification settings - Fork 4.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
connect: emit a metric for the seconds until root CA expiry #9924
Conversation
🤔 This PR has changes in the |
agent/consul/leader_connect.go
Outdated
@@ -146,6 +148,47 @@ func (s *Server) pruneCARoots() error { | |||
return nil | |||
} | |||
|
|||
func emitCAExpirationMetrics(s *Server) func(ctx context.Context) error { | |||
key := []string{"mesh", "root-ca", "expiry"} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thoughts on this metric name? I couldn't find any other CA specific metrics. We could use a different key.
e501512
to
ab176b0
Compare
ab176b0
to
e2ebb2c
Compare
e2ebb2c
to
83ed904
Compare
83ed904
to
e9a0f01
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM 👍
I can't think of a better name for the metric - mesh.root-ca.expiry
is concise and accurate.
e9a0f01
to
42ad984
Compare
and handle the case where there is no active root CA.
42ad984
to
aec7e79
Compare
Updated the metric name to |
🍒 If backport labels were added before merging, cherry-picking will start automatically. To retroactively trigger a backport after merging, add backport labels and re-run https://circleci.com/gh/hashicorp/consul/389762. |
Implements the metrics portion of #9891
This PR adds a new metric,
consul.mesh.root-ca.expiry
which is a gauge. The metric is update every hour by a goroutine run from the leader. The value of the gauge is the number of seconds until the root CA expires. Someone running Consul should be able to setup an alert on this value, so that they get notified when the value drops below some threshold.This is difficult to unit test so I might try and test it out manually.
TODO:
socat -d - udp6-listen:8125
as a statsd server)