Merge pull request #2 from bigcommerce/infra_21584

INFRA-21482: Add CF DNS Firewall metrics

Author: Jason Gellatly

cloudflare.go

@@ -221,6 +221,24 @@ type lbResp struct {
 	ZoneTag string `json:"zoneTag"`
 }
 
+type cloudflareResponseDnsFirewall struct {
+	Viewer struct {
+		Accounts []dnsFirewallAccountResp `json:"accounts"`
+	} `json:"viewer"`
+}
+
+type dnsFirewallAccountResp struct {
+	DnsFirewallAnalyticsAdaptiveGroups []struct {
+		Count      uint64 `json:"count"`
+		Dimensions struct {
+			ClusterTag   string `json:"clusterTag"`
+			QueryType    string `json:"queryType"`
+			ResponseCode string `json:"responseCode"`
+		} `json:"dimensions"`
+	} `json:"dnsFirewallAnalyticsAdaptiveGroups"`
+	AccountTag string `json:"accountTag"`
+}
+
 func fetchZones() []cloudflare.Zone {
 	var api *cloudflare.API
 	var err error
@@ -607,3 +625,52 @@ func filterNonFreePlanZones(zones []cloudflare.Zone) (filteredZones []cloudflare
 	}
 	return
 }
+
+func fetchDnsFirewallTotals(accountID string) (*cloudflareResponseDnsFirewall, error) {
+	now := time.Now().Add(-time.Duration(cfgScrapeDelay) * time.Second).UTC()
+	s := 60 * time.Second
+	now = now.Truncate(s)
+	oneHourAgo := now.Add(-60 * time.Minute)
+
+	request := graphql.NewRequest(`
+query ($accountID: string, $mintime: Time!, $maxtime: Time!, $limit: Int!) {
+	viewer {
+		accounts(filter: { accountTag: $accountID }) {
+			accountTag
+			dnsFirewallAnalyticsAdaptiveGroups(
+				limit: $limit
+				filter: { datetime_geq: $mintime, datetime_lt: $maxtime }
+			) {
+				count
+				dimensions {
+					clusterTag
+					queryType
+					responseCode
+				}
+			}
+		}
+	}
+}
+`)
+	if len(cfgCfAPIToken) > 0 {
+		request.Header.Set("Authorization", "Bearer "+cfgCfAPIToken)
+	} else {
+		request.Header.Set("X-AUTH-EMAIL", cfgCfAPIEmail)
+		request.Header.Set("X-AUTH-KEY", cfgCfAPIKey)
+	}
+	request.Var("limit", 9999)
+	request.Var("maxtime", now)
+	request.Var("mintime", oneHourAgo)
+	request.Var("accountID", accountID)
+
+	ctx := context.Background()
+	graphqlClient := graphql.NewClient(cfGraphQLEndpoint)
+
+	var resp cloudflareResponseDnsFirewall
+	if err := graphqlClient.Run(ctx, request, &resp); err != nil {
+		log.Error(err)
+		return nil, err
+	}
+
+	return &resp, nil
+}

main.go

@@ -9,7 +9,7 @@ import (
 
 	"github.com/cloudflare/cloudflare-go"
 	"github.com/namsral/flag"
-	"github.com/nelkinda/health-go"
+	health "github.com/nelkinda/health-go"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
 	log "github.com/sirupsen/logrus"
 )
@@ -106,8 +106,9 @@ func fetchMetrics(deniedMetricsSet MetricsSet) {
 	accounts := fetchAccounts()
 	filteredZones := filterExcludedZones(filterZones(zones, getTargetZones()), getExcludedZones())
 
-	for _, a := range accounts {
-		go fetchWorkerAnalytics(a, &wg)
+	for _, account := range accounts {
+		go fetchWorkerAnalytics(account, &wg)
+		go fetchDnsFirewallAnalytics(account, &wg, deniedMetricsSet)
 	}
 
 	// Make requests in groups of cfgBatchSize to avoid rate limit

prometheus.go

@@ -47,6 +47,7 @@ const (
 	workerDurationMetricName                     MetricName = "cloudflare_worker_duration"
 	poolHealthStatusMetricName                   MetricName = "cloudflare_zone_pool_health_status"
 	poolRequestsTotalMetricName                  MetricName = "cloudflare_zone_pool_requests_total"
+	dnsFirewallQueryCountMetricName              MetricName = "cloudflare_dns_firewall_query_count"
 )
 
 type MetricsSet map[MetricName]struct{}
@@ -243,6 +244,12 @@ var (
 	},
 		[]string{"zone", "load_balancer_name", "pool_name", "origin_name"},
 	)
+
+	dnsFirewallQueryCount = prometheus.NewGaugeVec(prometheus.GaugeOpts{
+		Name: dnsFirewallQueryCountMetricName.String(),
+		Help: "DNS Firewall query count by query type and response code",
+	}, []string{"account_id", "account_name", "dns_firewall_id", "query_type", "response_code"},
+	)
 )
 
 func buildAllMetricsSet() MetricsSet {
@@ -277,6 +284,7 @@ func buildAllMetricsSet() MetricsSet {
 	allMetricsSet.Add(workerDurationMetricName)
 	allMetricsSet.Add(poolHealthStatusMetricName)
 	allMetricsSet.Add(poolRequestsTotalMetricName)
+	allMetricsSet.Add(dnsFirewallQueryCountMetricName)
 	return allMetricsSet
 }
 
@@ -383,6 +391,9 @@ func mustRegisterMetrics(deniedMetrics MetricsSet) {
 	if !deniedMetrics.Has(poolRequestsTotalMetricName) {
 		prometheus.MustRegister(poolRequestsTotal)
 	}
+	if !deniedMetrics.Has(dnsFirewallQueryCountMetricName) {
+		prometheus.MustRegister(dnsFirewallQueryCount)
+	}
 }
 
 func fetchWorkerAnalytics(account cloudflare.Account, wg *sync.WaitGroup) {
@@ -410,6 +421,30 @@ func fetchWorkerAnalytics(account cloudflare.Account, wg *sync.WaitGroup) {
 	}
 }
 
+func fetchDnsFirewallAnalytics(account cloudflare.Account, wg *sync.WaitGroup, deniedMetricsSet MetricsSet) {
+	wg.Add(1)
+	defer wg.Done()
+
+	r, err := fetchDnsFirewallTotals(account.ID)
+	if err != nil {
+		return
+	}
+
+	for _, a := range r.Viewer.Accounts {
+		for _, d := range a.DnsFirewallAnalyticsAdaptiveGroups {
+			if !deniedMetricsSet.Has(dnsFirewallQueryCountMetricName) {
+				dnsFirewallQueryCount.WithLabelValues(
+					account.ID,
+					account.Name,
+					d.Dimensions.ClusterTag,
+					d.Dimensions.QueryType,
+					d.Dimensions.ResponseCode,
+				).Set(float64(d.Count))
+			}
+		}
+	}
+}
+
 func fetchZoneColocationAnalytics(zones []cloudflare.Zone, wg *sync.WaitGroup, deniedMetricsSet MetricsSet) {
 	wg.Add(1)
 	defer wg.Done()