envoyproxy / envoyproxy/envoy

ExtAuthz filter metrics

Open
#25,097 6 comments 0 reactions 0 assignees View on GitHub
area/stats no stalebot question
Dominant language
C++
Stars
28.9k
Forks
5.6k
Avg merge
1d 20h
Merged PRs (30d)
437

Description

Hi folks, wanted to clarify on metrics emitted by ExtAuthz filter:

1. There's a set of per-cluster `ext_authz.ok/denied/error` [metrics](https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/ext_authz_filter#statistics), is there any documentation on how are these metrics calculated? If they are based on the ExtAuthz filter response code, it seems I can derive them from `upstream_rq` [metric](https://www.envoyproxy.io/docs/envoy/latest/configuration/upstream/cluster_manager/cluster_stats#dynamic-http-statistics)?
2. The above per-cluster `ext_authz.ok/denied/error` metrics are attributed to the cluster that's selected before ExtAuthz filter is executed. However, if `clear_route_cache` is set to [true](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto#:~:text=data%20is%20partial.-,clear_route_cache,-(bool)%20Clears), the final destination of the upstream cluster could be different and the metric will reflect the wrong cluster, is this expected or a bug? I think it probably makes more sense to attribute these denied/ok stats to the cluster that's calculated after ExtAuthz if `clear_route_cache` is set.

Would appreciate if you can take a look and thanks in advance!

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.