filters/auth: add jwtMetrics #3020
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
AlexanderYastrebov
force-pushed
the
filters/auth/jwtMetrics
branch
from
c49d6b5
to
94e2336
Compare
AlexanderYastrebov
force-pushed
the
filters/auth/jwtMetrics
branch
12 times, most recently
from
53208f9
to
327394e
Compare
AlexanderYastrebov
force-pushed
the
filters/auth/jwtMetrics
branch
2 times, most recently
from
6a235e0
to
a2c8e8a
Compare
szuecs
reviewed
Apr 17, 2024
szuecs
reviewed
Apr 17, 2024
| metrics.IncCounter(metricsPrefix + "missing-issuer") | ||
| } else if !slices.Contains(f.Issuers, issuer) { | ||
| metrics.IncCounter(metricsPrefix + "invalid-issuer") | ||
| } |
There was a problem hiding this comment.
You do not count valid tokens, why?
There was a problem hiding this comment.
Its not a goal to reveal valid tokens, besides we don't validate so we could only know that it parses as JWT token.
There was a problem hiding this comment.
As a user I would wonder why we do not have a counter for valid tokens
There was a problem hiding this comment.
The idea is to count configured claims (e.g. token realms) but this may be implemented later.
There was a problem hiding this comment.
At this stage jwtMetrics is essentially invalidJwtMetrics because it only counts wrong tokens. I do not want to put "invalid" into the name and we may extend it in the future to count other claims.
Add jwtMetrics filter that parses JWT token and increments a set of counters, see documentation for details. Signed-off-by: Alexander Yastrebov <[email protected]>
AlexanderYastrebov
force-pushed
the
filters/auth/jwtMetrics
branch
from
a2c8e8a
to
7008969
Compare
|
👍 |
1 similar comment
|
👍 |
AlexanderYastrebov
added a commit
that referenced
this pull request
Apr 19, 2024
Extend configuration of `jwtMetrics` (#3020) to support opt-out - disable when any of the configured route annotations (#3022) is present. This can be used to collect data about missing/invalid JWT tokens per hostname in multitenant ingress setup. Add `jwtMetrics` filter to all routes using `-default-filters-append` flag and allow users to annotate routes that do not require JWT token. Signed-off-by: Alexander Yastrebov <[email protected]>
AlexanderYastrebov
added a commit
that referenced
this pull request
Apr 19, 2024
Extend configuration of `jwtMetrics` (#3020) to support opt-out - disable metrics collection when any of the configured route annotations (#3022) is present. This can be used to collect data about missing/invalid JWT tokens per hostname in multitenant ingress setup. Add `jwtMetrics` filter to all routes using `-default-filters-append` flag and allow users to annotate routes that do not require JWT token. Signed-off-by: Alexander Yastrebov <[email protected]>
AlexanderYastrebov
added a commit
that referenced
this pull request
Apr 22, 2024
Extend configuration of `jwtMetrics` (#3020) to support opt-out - disable metrics collection when any of the configured route annotations (#3022) is present. This can be used to collect data about missing/invalid JWT tokens per hostname in multitenant ingress setup. Add `jwtMetrics` filter to all routes using `-default-filters-append` flag and allow users to annotate routes that do not require JWT token. Signed-off-by: Alexander Yastrebov <[email protected]>
AlexanderYastrebov
added a commit
that referenced
this pull request
Apr 22, 2024
Extend configuration of `jwtMetrics` (#3020) to support opt-out - disable metrics collection when any of the configured route annotations (#3022) is present. This can be used to collect data about missing/invalid JWT tokens per hostname in multitenant ingress setup. Add `jwtMetrics` filter to all routes using `-default-filters-append` flag and allow users to annotate routes that do not require JWT token. Signed-off-by: Alexander Yastrebov <[email protected]>
AlexanderYastrebov
added a commit
to zalando-incubator/kubernetes-on-aws
that referenced
this pull request
Apr 22, 2024
[Changes](zalando/skipper@v0.21.54...v0.21.61) * [build(deps): bump amazonlinux from `ef9435f` to `5478f82` in /fuzz](zalando/skipper#3031) * [build(deps): bump actions/upload-artifact from 4.3.1 to 4.3.2](zalando/skipper#3033) * [build(deps): bump actions/checkout from 4.1.2 to 4.1.3](zalando/skipper#3032) * [build(deps): bump github.com/miekg/dns from 1.1.58 to 1.1.59](zalando/skipper#3030) * [proxy: support configurable metrics](zalando/skipper#3027) * [filters/auth: add login redirect stub support](zalando/skipper#3028) * [filters: move annotate into own package](zalando/skipper#3023) * [filters/auth: add jwtMetrics](zalando/skipper#3020) * [filters/builtin: add annotate filter](zalando/skipper#3022) Signed-off-by: Alexander Yastrebov <[email protected]>
AlexanderYastrebov
added a commit
to zalando-incubator/kubernetes-on-aws
that referenced
this pull request
Apr 22, 2024
[Changes](zalando/skipper@v0.21.54...v0.21.61) * `build(deps): bump amazonlinux from `ef9435f` to `5478f82` in /fuzz` zalando/skipper#3031 * `build(deps): bump actions/upload-artifact from 4.3.1 to 4.3.2` zalando/skipper#3033 * `build(deps): bump actions/checkout from 4.1.2 to 4.1.3` zalando/skipper#3032 * `build(deps): bump github.com/miekg/dns from 1.1.58 to 1.1.59` zalando/skipper#3030 * `proxy: support configurable metrics` zalando/skipper#3027 * `filters/auth: add login redirect stub support` zalando/skipper#3028 * `filters: move annotate into own package` zalando/skipper#3023 * `filters/auth: add jwtMetrics` zalando/skipper#3020 * `filters/builtin: add annotate filter` zalando/skipper#3022 Signed-off-by: Alexander Yastrebov <[email protected]>
AlexanderYastrebov
added a commit
to zalando-incubator/kubernetes-on-aws
that referenced
this pull request
Apr 22, 2024
[Changes](zalando/skipper@v0.21.54...v0.21.61) * zalando/skipper#3031 * zalando/skipper#3033 * zalando/skipper#3032 * zalando/skipper#3030 * zalando/skipper#3027 * zalando/skipper#3028 * zalando/skipper#3023 * zalando/skipper#3020 * zalando/skipper#3022 Signed-off-by: Alexander Yastrebov <[email protected]>
This was referenced Apr 22, 2024
AlexanderYastrebov
added a commit
to zalando-incubator/kubernetes-on-aws
that referenced
this pull request
Apr 22, 2024
[Changes](zalando/skipper@v0.21.54...v0.21.62) * zalando/skipper#3025 * zalando/skipper#3031 * zalando/skipper#3033 * zalando/skipper#3032 * zalando/skipper#3030 * zalando/skipper#3027 * zalando/skipper#3028 * zalando/skipper#3023 * zalando/skipper#3020 * zalando/skipper#3022 Signed-off-by: Alexander Yastrebov <[email protected]>
This was referenced Apr 22, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add jwtMetrics filter that parses JWT token and increments a set of counters,
see documentation for details.