envoy: add connection limits metrics

see also
https://www.envoyproxy.io/docs/envoy/latest/configuration/listeners/network_filters/connection_limit_filter

- Add envoy connection limits metrics
- unit test
- changelog
- Update metadata.csv

Signed-off-by: William Dauchy <[email protected]>

envoy/changelog.d/16718.added

@@ -0,0 +1 @@
+Add connection limit metrics for envoy

envoy/datadog_checks/envoy/check.py

@@ -17,6 +17,7 @@
     'cluster_name': 'envoy_cluster',
     'envoy_cluster_name': 'envoy_cluster',
     'envoy_local_http_ratelimit_prefix': 'stat_prefix',  # local rate limit
+    "envoy_connection_limit_prefix": 'stat_prefix', # connection limit
     'envoy_http_conn_manager_prefix': 'stat_prefix',  # tracing
     'envoy_listener_address': 'address',  # listener
     'envoy_virtual_cluster': 'virtual_envoy_cluster',  # vhost
@@ -90,6 +91,16 @@
         'metric_type': 'monotonic_count',
         'new_name': 'listener.downstream_cx.count',
     },
+    r'envoy_(.+)_connection_limit.active_connections$': {
+        'label_name': 'stat_prefix',
+        'metric_type': 'monotonic_count',
+        'new_name': 'connection_limit.active_connections.count',
+    },
+    r'envoy_(.+)_connection_limit.limited_connections$': {
+        'label_name': 'stat_prefix',
+        'metric_type': 'monotonic_count',
+        'new_name': 'connection_limit.limited_connections.count',
+    },
     r'envoy_(.+)_http_local_rate_limit_enabled$': {
         'label_name': 'stat_prefix',
         'metric_type': 'monotonic_count',

envoy/datadog_checks/envoy/metrics.py

@@ -377,6 +377,8 @@
     'envoy_http_local_rate_limit_rate_limited': 'http.local_rate_limit_rate_limited',
     'envoy_http_local_rate_limit_ok': 'http.local_rate_limit_ok',
     'envoy_control_plane_connected_state': 'control_plane.connected_state',
+    'envoy_connection_limit_active_connections': 'connection_limit.active_connections',
+    'envoy_connection_limit_limited_connections': 'connection_limit.limited_connections',
 }
 
 # fmt: off
@@ -3927,6 +3929,22 @@
         ),
         'method': 'monotonic_count',
     },
+    '*.connection_limit.active_connections': {
+        'tags': (
+            ('stat_prefix',),
+            (),
+            (),
+        ),
+        'method': 'monotonic_count',
+    },
+    '*.connection_limit.limited_connections': {
+        'tags': (
+            ('stat_prefix',),
+            (),
+            (),
+        ),
+        'method': 'monotonic_count',
+    },
 }
 # fmt: on
 

envoy/metadata.csv

@@ -149,6 +149,10 @@ envoy.cluster_manager.cluster_updated.count,count,,,,[OpenMetrics V2] Total clus
 envoy.cluster_manager.custer_updated_via_merge.count,count,,,,[OpenMetrics V2],0,envoy,,
 envoy.cluster_manager.update_merge_cancelled.count,count,,,,[OpenMetrics V2] Total merged updates that got cancelled and delivered early,0,envoy,,
 envoy.cluster_manager.update_out_of_merge_window.count,count,,,,[OpenMetrics V2] Total updates which arrived out of a merge window,0,envoy,,
+envoy.connection_limit.active_connections.count,count,,,,[OpenMetrics V2] Number of currently active connections in the scope of this network filter chain,0,envoy,,
+envoy.connection_limit.limited_connections.count,count,,,,[OpenMetrics V2] Total connections that have been rejected due to connection limit exceeded,0,envoy,,
+envoy.connection_limit.active_connections,count,,,,[Legacy] Number of currently active connections in the scope of this network filter chain,0,envoy,,
+envoy.connection_limit.limited_connections,count,,,,[Legacy] Total connections that have been rejected due to connection limit exceeded,0,envoy,,
 envoy.filesystem.flushed_by_timer.count,count,,,,[OpenMetrics V2],0,envoy,,
 envoy.filesystem.reopen_failed.count,count,,,,[OpenMetrics V2],0,envoy,,
 envoy.filesystem.write_buffered.count,count,,,,[OpenMetrics V2],0,envoy,,

envoy/tests/common.py

@@ -372,6 +372,8 @@
     "http.downstream_rq_http3.count",
     "http.rq.count",
     "vhost.vcluster.upstream_rq.count",
+    "connection_limit_active_connections.count",
+    "connection_limit_limited_connections.count",
 ]
 
 LOCAL_RATE_LIMIT_METRICS = [
@@ -711,6 +713,8 @@
     "tcp.on_demand_cluster_timeout.count",
     "tcp.upstream_flush.count",
     "tcp.upstream_flush_active",
+    "connection_limit_active_connections.count",
+    "connection_limit_limited_connections.count",
 ]
 
 

envoy/tests/docker/api_v3/front-envoy.yaml

@@ -24,6 +24,12 @@ static_resources:
       socket_address: {address: 0.0.0.0, port_value: 80}
     filter_chains:
     - filters:
+      - name: envoy.filters.network.connection_limit
+        typed_config:
+          "@type": type.googleapis.com/envoy.extensions.filters.network.connection_limit.v3.ConnectionLimit
+          stat_prefix: ingress_http
+          max_connections: 1000
+          delay: 0s
       - name: envoy.http_connection_manager
         typed_config:
           "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager

envoy/tests/fixtures/legacy/stat_prefix

@@ -8,3 +8,5 @@ cluster.foo.ext_authz.bar.disabled: 6
 cluster.foo.ext_authz.bar.error: 7
 cluster.foo.ext_authz.bar.failure_mode_allowed: 8
 cluster.foo.ext_authz.bar.ok: 9
+connection_limit.ingress_http.active_connections: 0
+connection_limit.ingress_http.limited_connections: 0

envoy/tests/fixtures/openmetrics/openmetrics.txt

@@ -517,6 +517,10 @@ envoy_filesystem_write_buffered{} 7
 envoy_http_downstream_cx_upgrades_total{envoy_http_conn_manager_prefix="admin"} 0
 # TYPE envoy_cluster_manager_cluster_removed counter
 envoy_cluster_manager_cluster_removed{} 0
+# TYPE envoy_connection_limit_ingress_http_limited_connections counter
+envoy_connection_limit_ingress_http_limited_connections{} 0
+# TYPE envoy_connection_limit_ingress_http_limited_connections counter
+envoy_connection_limit_ingress_http_limited_connections{} 0
 # TYPE envoy_server_debug_assertion_failures counter
 envoy_server_debug_assertion_failures{} 0
 # TYPE envoy_server_worker_3_watchdog_miss counter