Configure metrics socket and forward /internal/v4/metrics to that socket (#551)

Author: svkrieger

jobs/cloud_controller_ng/templates/cloud_controller_ng.yml.erb

@@ -138,6 +138,7 @@ request_timeout_in_seconds: <%= p("request_timeout_in_seconds") %>
 nginx:
   use_nginx: true
   instance_socket: "/var/vcap/data/cloud_controller_ng/cloud_controller.sock"
+  metrics_socket: "/var/vcap/data/cloud_controller_ng/cloud_controller_metrics.sock"
 
 index: <%= spec.index %>
 name: <%= name %>

jobs/cloud_controller_ng/templates/nginx.conf.erb

@@ -54,6 +54,22 @@ limit_req_zone $http_authorization zone=<%= zone['name'] %>:10m rate=<%= zone['l
     server unix:/var/vcap/data/cloud_controller_ng/cloud_controller.sock;
   }
 
+<%
+def thin_webserver_enabled?
+  if_p('cc.experimental.use_puma_webserver') do |prop|
+    return !prop
+  end
+
+  p('cc.temporary_enable_deprecated_thin_webserver')
+end
+-%>
+
+<% unless thin_webserver_enabled? -%>
+  upstream cloud_controller_metrics {
+    server unix:/var/vcap/data/cloud_controller_ng/cloud_controller_metrics.sock;
+  }
+<% end -%>
+
   # This block ensures the endpoints it serves are handled by mutual TLS.
   # Refer to the 'return 403' statement in the http block to see how we secure those endpoints.
   server {
@@ -137,7 +153,11 @@ limit_req_zone $http_authorization zone=<%= zone['name'] %>:10m rate=<%= zone['l
     proxy_connect_timeout       10;
 
     location /internal/v4/metrics {
+<%- if thin_webserver_enabled? -%>
       proxy_pass http://cloud_controller;
+<%- else -%>
+      proxy_pass http://cloud_controller_metrics;
+<%- end -%>
     }
   }
 <% end -%>

spec/cloud_controller_ng/nginx_spec.rb

@@ -87,6 +87,32 @@ module Test
               expect(@rendered_file).not_to include('include prom_scraper_mtls.conf')
             end
           end
+
+          describe 'separate metrics webserver' do
+            let(:manifest_properties) { { 'cc' => { 'prom_scraper_tls' => { 'public_cert' => 'a public cert', 'private_key' => 'a private key', 'ca_cert' => 'an authority' } } } }
+
+            it 'renders the unix socket of the second webserver' do
+              expect(@rendered_file).to include('unix:/var/vcap/data/cloud_controller_ng/cloud_controller_metrics.sock;')
+            end
+
+            it 'forwards requests for the metrics endpoint to second webserver' do
+              expect(@rendered_file).to include('proxy_pass http://cloud_controller_metrics;')
+            end
+
+            context 'when the webserver is not puma' do
+              let(:manifest_properties) do
+                super().merge('cc' => super()['cc'].merge('temporary_enable_deprecated_thin_webserver' => true))
+              end
+
+              it 'does not render the second webserver' do
+                expect(@rendered_file).not_to include('unix:/var/vcap/data/cloud_controller_ng/cloud_controller_metrics.sock;')
+              end
+
+              it 'forwards requests for metrics endpoint to main app' do
+                expect(@rendered_file).not_to include('proxy_pass http://cloud_controller_metrics;')
+              end
+            end
+          end
         end
       end
     end