gitlab-labkit 2.8.0 → 3.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a0038ac3c9b17772bb517d4e2fc9e61ca26d05647e3de991c4899dfc867f4d88
-  data.tar.gz: 041f4b6ee0f7257738b0bb7663adcbca06c9f520152cd7f7b8397b31ed280d7c
+  metadata.gz: 5c4b2288dc9341d5acd02a9ad274702ad2c44793c5760f04b6597c7404cad509
+  data.tar.gz: f6bc276c4452b9952dcd5e194f76d74c787ba122ae39070d35fc507aec06d444
 SHA512:
-  metadata.gz: ee2a000a091c0eb8433911f6a0e17d7921c1477204ed9f5e5fb54a3b8d625c8361b7653134cb5231c7b78e4fdc6df74c1b3c9d92424b1a17533f35257b913115
-  data.tar.gz: dd0a54427b6a2181bfad09efda0536ca4c0b703e2ee8182214a0ce02079f7ee207423f4e7f7d4f40f564a98d2e2d6eaeac8b4e312cf288450c2c0d8e6d146c4f
+  metadata.gz: fb5d89354c732b5ea0ac8579422a2fd3212e2e79f9d035ad0bdb642258710e2c7cf43abbfbd9c6b6f95d4fe190799ddbbcaf34b0b3d51ff857c0a8330e56af7f
+  data.tar.gz: cea073f528c655e9df4df9715a6a7a5728f13c55e75190f2ace56ca15aba59ec84ac902037125b54de0f7631fbcd03120fd1a8caad3d8854481d39a73eeb11d6

data/lib/labkit/net_http_publisher.rb

@@ -48,15 +48,68 @@ module Labkit
           begin
             super
           ensure
-            payload[:duration] = (::Labkit::System.monotonic_time - start_time).to_f
+            # Fold in any connection-establishment time (DNS/TCP/TLS) measured by
+            # `#do_start`, so a slow connect is attributed to the request instead
+            # of vanishing. Counted once, on the first request of the connection.
+            payload[:duration] = (::Labkit::System.monotonic_time - start_time).to_f + take_connect_duration
           end
         payload[:code] = response.code
         response
       end
     end
 
+    # Net::HTTP establishes the connection (DNS resolution, TCP connect, TLS
+    # handshake) here, before any `#request` runs. With the explicit-start
+    # pattern (`Net::HTTP.start(host) { |http| http.request(...) }`) this happens
+    # entirely outside `#request`, so without instrumenting it a connection that
+    # hangs -- or fails with e.g. Net::OpenTimeout before any request is sent --
+    # would contribute nothing to external_http timing or counts.
+    def do_start
+      start_time = ::Labkit::System.monotonic_time
+
+      begin
+        super
+      rescue StandardError
+        # The connection failed before any request could be sent, so `#request`
+        # will never run to attribute this time. Emit a standalone event so the
+        # failure and the time spent are still visible.
+        ActiveSupport::Notifications.instrument(
+          ::Labkit::EXTERNAL_HTTP_NOTIFICATION_TOPIC, create_connect_payload
+        ) do |payload|
+          payload[:duration] = (::Labkit::System.monotonic_time - start_time).to_f
+          raise
+        end
+      end
+
+      @labkit_connect_duration = (::Labkit::System.monotonic_time - start_time).to_f
+    end
+    private :do_start
+
     private
 
+    def take_connect_duration
+      duration = @labkit_connect_duration || 0.0
+      @labkit_connect_duration = nil
+      duration
+    end
+
+    def create_connect_payload
+      {
+        method: nil,
+        host: address,
+        port: port,
+        scheme: use_ssl? ? "https" : "http",
+        path: nil,
+        query: nil,
+        fragment: nil
+      }.tap do |payload|
+        if proxy?
+          payload[:proxy_host] = proxy_address
+          payload[:proxy_port] = proxy_port
+        end
+      end
+    end
+
     def create_request_payload(request)
       payload = {
         method: request.method

data/lib/labkit/rate_limit/README.md

@@ -146,7 +146,7 @@ A `Rule` is a `Data.define` value object with the following fields:
 | `match`           | Hash of identifier key/value predicates that must **all** be satisfied for the rule to apply. Empty hash matches anything. See [Matchers](#matchers).                |
 | `limit`           | Integer request threshold per `period`. May be a callable resolved on every check.                                                                                   |
 | `period`          | Window length in seconds. May be a callable resolved on every check.                                                                                                 |
-| `action`          | What the result reports when the limit is exceeded. One of `:block`, `:log`, `:allow`, `:skip`. Default `:block`. See [Actions](#actions).                           |
+| `action`          | What the result reports when the limit is exceeded. One of `:block`, `:log`, `:skip`. Default `:block`. See [Actions](#actions).                                     |
 | `characteristics` | Array of identifier keys whose values are folded into the Redis counter key. Each unique combination gets its own counter.                                           |
 
 Making `limit` or `period` callable is the supported pattern for
@@ -198,7 +198,7 @@ flowchart TD
     Build --> Emit[Emit calls_total + limit/period gauges]
     Emit --> Act{rule.action}
     Act -->|":log<br/>(non-terminating)"| Iter
-    Act -->|:block or :allow| Return([Return Result])
+    Act -->|:block| Return([Return Result])
     Iter -->|no more rules| Unmatched[Emit calls_total<br/>rule=unmatched, action=allow]
     Unmatched --> ReturnUnmatched([Return matched=false<br/>action=:allow])
     Eval -. StandardError .-> Error[Emit errors_total<br/>log warn]
@@ -219,17 +219,12 @@ which never touch Redis:
   together and the `:log` rule cannot disable the `:block` rule. Note that a
   pure `:log`-only check still emits one `rule="unmatched"` metric entry
   because no terminating rule fired.
-- `:allow` — when exceeded, `Result#action` is `:allow` (rather than
-  `:block`). Useful for "always allow this caller even if they're over the
-  limit" cases while still observing them via metrics. Evaluation terminates
-  on the first match.
 - `:skip` — bypass. A matching rule terminates evaluation with
   `Result#action` `:allow` **without any Redis operation**: nothing is
   counted, so `limit`, `period`, `characteristics`, and `count_distinct` are
   inert and the result carries no `info` (`to_response_headers` is `{}`).
   The match is still observable via `calls_total{action="skip"}`. Use this
-  for bypasses that don't need a counter; use `:allow` only when you want
-  the bypassed traffic counted.
+  for bypasses.
 
 ### Redis keys
 

data/lib/labkit/rate_limit/result.rb

@@ -8,9 +8,9 @@ module Labkit
     # action    - the outcome: what the caller should do
     #             :block = rule matched, exceeded, rule configured to block
     #             :log   = rule matched, exceeded, rule configured to log only
-    #             :allow = rule matched but count within limit, rule configured to allow,
-    #                      rule configured to skip (bypass, nothing counted),
-    #                      no rule matched, or error (fail-open)
+    #             :allow = rule matched but count within limit, rule configured
+    #                      to skip (bypass, nothing counted), no rule matched,
+    #                      or error (fail-open)
     #             The rule's configured action is available via rule.action.
     # rule      - the matched Rule object (nil when matched? is false)
     # error?    - true if Redis was unavailable; result fails open (exceeded? is false)

data/lib/labkit/rate_limit/rule.rb

@@ -2,7 +2,7 @@
 
 module Labkit
   module RateLimit
-    KNOWN_ACTIONS = %i[block log allow skip].freeze
+    KNOWN_ACTIONS = %i[block log skip].freeze
     RULE_NAME_PATTERN = /\A[a-z0-9_]+\z/
     RULE_NAME_MAX_LENGTH = 64
 
@@ -13,9 +13,7 @@ module Labkit
     # limit           - request threshold; may be a callable (resolved per check)
     # period          - window in seconds; may be a callable (resolved per check)
     # action          - :block (enforce), :log (count and log only, do not block,
-    #                   evaluation continues to subsequent rules), :allow
-    #                   (count but always permit; terminates evaluation on match
-    #                   regardless of whether the limit was exceeded), or :skip
+    #                   evaluation continues to subsequent rules), or :skip
     #                   (bypass: permit and terminate evaluation on match without
     #                   counting; performs no Redis operation, so limit, period,
     #                   characteristics, and count_distinct are inert)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-labkit
 version: !ruby/object:Gem::Version
-  version: 2.8.0
+  version: 3.0.0
 platform: ruby
 authors:
 - Andrew Newdigate