send rbac shadow policies metrics to mixer

include/istio/control/http/report_data.h

@@ -47,6 +47,13 @@ class ReportData {
   // Get destination ip/port.
   virtual bool GetDestinationIpPort(std::string* ip, int* port) const = 0;
 
+  // Get Rbac attributes.
+  struct RbacReportInfo {
+    std::string permissive_resp_code;
+    std::string permissive_policy_id;
+  };
+  virtual bool GetRbacReportInfo(RbacReportInfo* report_info) const = 0;
+
   // Get upstream host UID. This value overrides the value in the report bag.
   virtual bool GetDestinationUID(std::string* uid) const = 0;
 

include/istio/utils/attribute_names.h

@@ -95,6 +95,9 @@ struct AttributeName {
 
   static const char kResponseGrpcStatus[];
   static const char kResponseGrpcMessage[];
+
+  static const char kRbacPermissiveResponseCode[];
+  static const char kRbacPermissivePolicyId[];
 };
 
 }  // namespace utils

src/envoy/http/mixer/report_data.h

@@ -18,13 +18,17 @@
 #include "common/request_info/utility.h"
 #include "envoy/http/header_map.h"
 #include "envoy/request_info/request_info.h"
+#include "extensions/filters/http/well_known_names.h"
 #include "include/istio/control/http/controller.h"
 #include "src/envoy/utils/utils.h"
 
 namespace Envoy {
 namespace Http {
 namespace Mixer {
 namespace {
+const std::string kRbacPermissivePolicyIDField = "shadow_effective_policyID";
+const std::string kRbacPermissiveRespCodeField = "shadow_response_code";
+
 // Set of headers excluded from response.headers attribute.
 const std::set<std::string> ResponseHeaderExclusives = {};
 
@@ -114,6 +118,32 @@ class ReportData : public ::istio::control::http::ReportData {
     return ExtractGrpcStatus(trailers_, status) ||
            ExtractGrpcStatus(headers_, status);
   }
+
+  // Get Rbac related attributes.
+  bool GetRbacReportInfo(RbacReportInfo *report_info) const override {
+    const auto filter_meta = info_.dynamicMetadata().filter_metadata();
+    const auto filter_it =
+        filter_meta.find(Extensions::HttpFilters::HttpFilterNames::get().Rbac);
+    if (filter_it == filter_meta.end()) {
+      return false;
+    }
+
+    const auto &data_struct = filter_it->second;
+    const auto resp_code_it =
+        data_struct.fields().find(kRbacPermissiveRespCodeField);
+    if (resp_code_it != data_struct.fields().end()) {
+      report_info->permissive_resp_code = resp_code_it->second.string_value();
+    }
+
+    const auto policy_id_it =
+        data_struct.fields().find(kRbacPermissivePolicyIDField);
+    if (policy_id_it != data_struct.fields().end()) {
+      report_info->permissive_policy_id = policy_id_it->second.string_value();
+    }
+
+    return !report_info->permissive_resp_code.empty() ||
+           !report_info->permissive_policy_id.empty();
+  }
 };
 
 }  // namespace Mixer

src/istio/control/http/attributes_builder.cc

@@ -229,6 +229,18 @@ void AttributesBuilder::ExtractReportAttributes(ReportData *report_data) {
 
   builder.AddString(utils::AttributeName::kContextProxyErrorCode,
                     info.response_flags);
+
+  ReportData::RbacReportInfo rbac_info;
+  if (report_data->GetRbacReportInfo(&rbac_info)) {
+    if (!rbac_info.permissive_resp_code.empty()) {
+      builder.AddString(utils::AttributeName::kRbacPermissiveResponseCode,
+                        rbac_info.permissive_resp_code);
+    }
+    if (!rbac_info.permissive_policy_id.empty()) {
+      builder.AddString(utils::AttributeName::kRbacPermissivePolicyId,
+                        rbac_info.permissive_policy_id);
+    }
+  }
 }
 
 }  // namespace http

src/istio/control/http/attributes_builder_test.cc

@@ -342,6 +342,18 @@ attributes {
     string_value: "NR"
   }
 }
+attributes {
+  key: "rbac.permissive.response_code"
+  value {
+    string_value: "403"
+  }
+}
+attributes {
+  key: "rbac.permissive.effective_policy_id"
+  value {
+    string_value: "policy-foo"
+  }
+}
 )";
 
 void ClearContextTime(const std::string &name, RequestContext *request) {
@@ -561,6 +573,12 @@ TEST(AttributesBuilderTest, TestReportAttributes) {
         status->message = "grpc-message";
         return true;
       }));
+  EXPECT_CALL(mock_data, GetRbacReportInfo(_))
+      .WillOnce(Invoke([](ReportData::RbacReportInfo *report_info) -> bool {
+        report_info->permissive_resp_code = "403";
+        report_info->permissive_policy_id = "policy-foo";
+        return true;
+      }));
 
   RequestContext request;
   AttributesBuilder builder(&request);
@@ -610,6 +628,12 @@ TEST(AttributesBuilderTest, TestReportAttributesWithDestIP) {
         info->response_flags = "NR";
       }));
   EXPECT_CALL(mock_data, GetGrpcStatus(_)).WillOnce(testing::Return(false));
+  EXPECT_CALL(mock_data, GetRbacReportInfo(_))
+      .WillOnce(Invoke([](ReportData::RbacReportInfo *report_info) -> bool {
+        report_info->permissive_resp_code = "403";
+        report_info->permissive_policy_id = "policy-foo";
+        return true;
+      }));
 
   RequestContext request;
   SetDestinationIp(&request, "1.2.3.4");

src/istio/control/http/mock_report_data.h

@@ -31,6 +31,7 @@ class MockReportData : public ReportData {
   MOCK_CONST_METHOD2(GetDestinationIpPort, bool(std::string* ip, int* port));
   MOCK_CONST_METHOD1(GetDestinationUID, bool(std::string* ip));
   MOCK_CONST_METHOD1(GetGrpcStatus, bool(GrpcStatus* status));
+  MOCK_CONST_METHOD1(GetRbacReportInfo, bool(RbacReportInfo* info));
 };
 
 }  // namespace http

src/istio/utils/attribute_names.cc

@@ -91,5 +91,11 @@ const char AttributeName::kRequestAuthRawClaims[] = "request.auth.raw_claims";
 const char AttributeName::kResponseGrpcStatus[] = "response.grpc_status";
 const char AttributeName::kResponseGrpcMessage[] = "response.grpc_message";
 
+// Rbac attributes
+const char AttributeName::kRbacPermissiveResponseCode[] =
+    "rbac.permissive.response_code";
+const char AttributeName::kRbacPermissivePolicyId[] =
+    "rbac.permissive.effective_policy_id";
+
 }  // namespace utils
 }  // namespace istio