chore: split admin API into unprivileged and privileged endpoints #461
Conversation
github-actions
bot
added
area/components
Regression Detector (DogStatsD)Regression Detector ResultsRun ID: 95227509-412c-4dc3-b591-07b46eeb255f Baseline: 7.63.0-rc.2 Optimization Goals: ✅ No significant changes detected
|
| perf | experiment | goal | Δ mean % | Δ mean % CI | trials | links |
|---|---|---|---|---|---|---|
| ➖ | quality_gates_idle_rss | memory utilization | +1.48 | [+1.38, +1.59] | 1 | |
| ➖ | dsd_uds_1mb_50k_contexts_memlimit | ingress throughput | +0.00 | [-0.00, +0.00] | 1 | |
| ➖ | dsd_uds_100mb_250k_contexts | ingress throughput | +0.00 | [-0.00, +0.00] | 1 | |
| ➖ | dsd_uds_512kb_3k_contexts | ingress throughput | -0.00 | [-0.01, +0.01] | 1 | |
| ➖ | dsd_uds_10mb_3k_contexts | ingress throughput | -0.00 | [-0.00, +0.00] | 1 | |
| ➖ | dsd_uds_1mb_3k_contexts | ingress throughput | -0.00 | [-0.00, +0.00] | 1 | |
| ➖ | dsd_uds_40mb_12k_contexts_40_senders | ingress throughput | -0.00 | [-0.00, +0.00] | 1 | |
| ➖ | dsd_uds_1mb_3k_contexts_dualship | ingress throughput | -0.00 | [-0.00, +0.00] | 1 | |
| ➖ | dsd_uds_1mb_50k_contexts | ingress throughput | -0.00 | [-0.00, +0.00] | 1 | |
| ➖ | dsd_uds_100mb_3k_contexts | ingress throughput | -0.00 | [-0.04, +0.04] | 1 | |
| ➖ | dsd_uds_100mb_3k_contexts_distributions_only | memory utilization | -0.47 | [-0.63, -0.32] | 1 | |
| ➖ | dsd_uds_500mb_3k_contexts | ingress throughput | -1.46 | [-1.60, -1.31] | 1 |
Bounds Checks: ❌ Failed
| perf | experiment | bounds_check_name | replicates_passed | links |
|---|---|---|---|---|
| ❌ | quality_gates_idle_rss | memory_usage | 0/10 |
Explanation
Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%
Performance changes are noted in the perf column of each table:
- ✅ = significantly better comparison variant performance
- ❌ = significantly worse comparison variant performance
- ➖ = no significant change in performance
A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".
For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:
-
Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.
-
Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.
-
Its configuration does not mark it "erratic".
Regression Detector (Saluki)Regression Detector ResultsRun ID: 464ab227-9be4-43f4-ae72-330714a5803f Baseline: 96693fa ❌ Experiments with missing or malformed dataThis is a critical error. No usable optimization goal data was produced by the listed experiments. This may be a result of misconfiguration. Ping #single-machine-performance and we can help out.
Optimization Goals: ✅ No significant changes detected
|
| perf | experiment | goal | Δ mean % | Δ mean % CI | trials | links |
|---|---|---|---|---|---|---|
| ➖ | dsd_uds_500mb_3k_contexts | ingress throughput | +0.04 | [-0.08, +0.17] | 1 | |
| ➖ | dsd_uds_512kb_3k_contexts | ingress throughput | +0.00 | [-0.01, +0.02] | 1 | |
| ➖ | dsd_uds_50mb_10k_contexts_no_inlining_no_allocs | ingress throughput | +0.00 | [-0.06, +0.07] | 1 | |
| ➖ | dsd_uds_100mb_3k_contexts | ingress throughput | -0.00 | [-0.05, +0.05] | 1 | |
| ➖ | dsd_uds_10mb_3k_contexts | ingress throughput | -0.01 | [-0.04, +0.03] | 1 | |
| ➖ | dsd_uds_1mb_50k_contexts | ingress throughput | -0.01 | [-0.02, +0.00] | 1 | |
| ➖ | dsd_uds_1mb_3k_contexts_dualship | ingress throughput | -0.01 | [-0.02, +0.00] | 1 | |
| ➖ | dsd_uds_1mb_3k_contexts | ingress throughput | -0.01 | [-0.02, +0.01] | 1 | |
| ➖ | dsd_uds_40mb_12k_contexts_40_senders | ingress throughput | -0.01 | [-0.04, +0.02] | 1 | |
| ➖ | dsd_uds_50mb_10k_contexts_no_inlining | ingress throughput | -0.01 | [-0.08, +0.05] | 1 | |
| ➖ | dsd_uds_1mb_50k_contexts_memlimit | ingress throughput | -0.40 | [-0.94, +0.14] | 1 | |
| ➖ | dsd_uds_100mb_3k_contexts_distributions_only | memory utilization | -1.19 | [-1.31, -1.06] | 1 | |
| ➖ | quality_gates_idle_rss | memory utilization | -1.32 | [-1.35, -1.29] | 1 |
Bounds Checks: ✅ Passed
| perf | experiment | bounds_check_name | replicates_passed | links |
|---|---|---|---|---|
| ✅ | quality_gates_idle_rss | memory_usage | 10/10 |
Explanation
Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%
Performance changes are noted in the perf column of each table:
- ✅ = significantly better comparison variant performance
- ❌ = significantly worse comparison variant performance
- ➖ = no significant change in performance
A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".
For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:
-
Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.
-
Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.
-
Its configuration does not mark it "erratic".
Regression Detector LinksExperiment Result Links
|
Summary
With the recent changes around starting to expose the necessary bits for Agent
status/flaresupport, we've now made the primary admin API use TLS for all connections. This breaks our ability to use this API for Kubernetes health checking (liveness/readiness) at least insofar as how the Operator is configured, which is to use HTTP.This PR splits out the privileged/sensitive API handlers currently attached to the primary admin API into their own API endpoint, and has reworked some of the wording to focus on unprivileged vs privileged.
The unprivileged API -- which is staying on the exist admin API port of
5100-- keeps the healthcheck endpoints and the memory status endpoint, and does not utilize TLS. The new privileged API gets the Remote Agent gRPC service and the logging handlers, as both are indeed intended to be privileged, and does utilize TLS. The privileged API takes over the previous default telemetry port of5101, and the default telemetry port will now move to5102.While we don't currently gate access to the privileged API with any sort of authentication/authorization scheme (the RA gRPC service does that only for itself), this split will facilitate doing so in the future.
Change Type
How did you test this PR?
Built ADP and ran it locally in non-standalone mode so that both the Status/Flare destination component, and telemetry, were enabled.
I observed that ADP spawn up HTTP servers on ports 5100, 5101, and 5102, with the privileged API server (5101) utilizing TLS. I also queried the relevant routes by hand, using
curl, to ensure they were split as described above.References
N/A