feat: add admission count metric ingress_controller_admission_count

Originally submitted by https://github.com/dweber019 in
Kong/kubernetes-ingress-controller#6087.

Author: dweber019

CHANGELOG.md

@@ -43,6 +43,10 @@
 - DataPlane: Enable incremental config sync by default when using Konnect as control plane.
   This improves performance of config syncs for large configurations.
   [#2759](https://github.com/Kong/kong-operator/pull/2759)
+- Added new metric for Prometheus called `ingress_controller_admission_count`.
+  It's a counter and has two labels `allowed` to indicate if the resource was allowed
+  and `resource` to indicate the resource under admission.
+  [#2803](https://github.com/Kong/kong-operator/pull/2803)
 
 ## [v2.1.0-alpha.0]
 

ingress-controller/internal/admission/handler.go

@@ -20,6 +20,7 @@ import (
 	ctrlref "github.com/kong/kong-operator/ingress-controller/internal/controllers/reference"
 	"github.com/kong/kong-operator/ingress-controller/internal/gatewayapi"
 	"github.com/kong/kong-operator/ingress-controller/internal/labels"
+	"github.com/kong/kong-operator/ingress-controller/internal/metrics"
 	"github.com/kong/kong-operator/ingress-controller/internal/util"
 )
 
@@ -37,6 +38,9 @@ type RequestHandler struct {
 	// routing incoming requests to the appropriate validator.
 	validators map[string]KongValidator
 
+	// PromMetrics provides the Prometheus registry to record metrics.
+	PromMetrics *metrics.GlobalCtrlRuntimeMetricsRecorder
+
 	Logger logr.Logger
 }
 
@@ -176,6 +180,15 @@ func (h RequestHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		)
 	}
 
+	resource := review.Request.Resource
+	h.PromMetrics.RecordAdmissionResult(
+		response.Allowed,
+		fmt.Sprintf(
+			"%s.%s/%s",
+			resource.Resource, resource.Group, resource.Version,
+		),
+	)
+
 	review.Response = response
 
 	if err := json.NewEncoder(w).Encode(&review); err != nil {

ingress-controller/internal/metrics/prometheus.go

@@ -4,6 +4,7 @@ import (
 	"errors"
 	"fmt"
 	"net"
+	"strconv"
 	"time"
 
 	"github.com/prometheus/client_golang/prometheus"
@@ -76,6 +77,16 @@ const (
 	InstanceIDKey string = "instance_id"
 )
 
+const (
+	// AllowedKey defines the key of the metric label indicating admission was allowed.
+	AllowedKey string = "allowed"
+)
+
+const (
+	// AdmissionResourceKey defines the name of the metric label indicating which dataplane this time series is relevant for.
+	AdmissionResourceKey string = "resource"
+)
+
 // Regular config push metrics names.
 const (
 	MetricNameConfigPushCount            = "ingress_controller_configuration_push_count"
@@ -86,6 +97,7 @@ const (
 	MetricNameTranslationBrokenResources = "ingress_controller_translation_broken_resource_count"
 	MetricNameTranslationDuration        = "ingress_controller_translation_duration_milliseconds"
 	MetricNameConfigPushDuration         = "ingress_controller_configuration_push_duration_milliseconds"
+	MetricNameAdmissionCount             = "ingress_controller_admission_count"
 )
 
 // Fallback config push metrics names.
@@ -202,6 +214,20 @@ var (
 		[]string{SuccessKey, ProtocolKey, DataplaneKey, InstanceIDKey},
 	)
 
+	admissionCount = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: MetricNameAdmissionCount,
+			Help: fmt.Sprintf(
+				"Count of admissions processed by Kong. "+
+					"`%s` describes whether an admission was allowed. "+
+					"`%s` describes the resource under admission. ",
+				AllowedKey,
+				AdmissionResourceKey,
+			),
+		},
+		[]string{AllowedKey, AdmissionResourceKey},
+	)
+
 	configPushSize = prometheus.NewGaugeVec(
 		prometheus.GaugeOpts{
 			Name: MetricNameConfigPushSize,
@@ -407,6 +433,7 @@ func init() {
 		configPushDuration,
 		configPushSize,
 		configPushSuccessTime,
+		admissionCount,
 		fallbackTranslationCount,
 		fallbackTranslationBrokenResources,
 		fallbackTranslationDuration,
@@ -493,6 +520,14 @@ func (c *GlobalCtrlRuntimeMetricsRecorder) RecordTranslationBrokenResources(coun
 	}).Set(float64(count))
 }
 
+// RecordAdmissionResult records an admission request result.
+func (c *GlobalCtrlRuntimeMetricsRecorder) RecordAdmissionResult(allowed bool, resource string) {
+	admissionCount.With(prometheus.Labels{
+		AllowedKey:           strconv.FormatBool(allowed),
+		AdmissionResourceKey: resource,
+	}).Inc()
+}
+
 // RecordFallbackTranslationFailure records a failed fallback configuration translation.
 func (c *GlobalCtrlRuntimeMetricsRecorder) RecordFallbackTranslationFailure(duration time.Duration) {
 	fallbackTranslationCount.With(prometheus.Labels{