New command: consul debug

agent/agent_endpoint.go

@@ -19,6 +19,7 @@ import (
 	"github.com/hashicorp/consul/agent/cache-types"
 	"github.com/hashicorp/consul/agent/checks"
 	"github.com/hashicorp/consul/agent/config"
+	"github.com/hashicorp/consul/agent/debug"
 	"github.com/hashicorp/consul/agent/structs"
 	"github.com/hashicorp/consul/api"
 	"github.com/hashicorp/consul/ipaddr"
@@ -1463,3 +1464,27 @@ type connectAuthorizeResp struct {
 	Authorized bool   // True if authorized, false if not
 	Reason     string // Reason for the Authorized value (whether true or false)
 }
+
+// AgentHost
+//
+// GET /v1/agent/host
+//
+// Retrieves information about resources available and in-use for the
+// host the agent is running on such as CPU, memory, and disk usage. Requires
+// a operator:read ACL token.
+func (s *HTTPServer) AgentHost(resp http.ResponseWriter, req *http.Request) (interface{}, error) {
+	// Fetch the ACL token, if any, and enforce agent policy.
+	var token string
+	s.parseToken(req, &token)
+	rule, err := s.agent.resolveToken(token)
+	if err != nil {
+		return nil, err
+	}
+	// TODO(pearkes): Is agent:read appropriate here? There could be relatively
+	// sensitive information made available in this API
+	if rule != nil && !rule.OperatorRead() {
+		return nil, acl.ErrPermissionDenied
+	}
+
+	return debug.CollectHostInfo(), nil
+}

agent/agent_endpoint_test.go

@@ -20,6 +20,7 @@ import (
 	"github.com/hashicorp/consul/agent/checks"
 	"github.com/hashicorp/consul/agent/config"
 	"github.com/hashicorp/consul/agent/connect"
+	"github.com/hashicorp/consul/agent/debug"
 	"github.com/hashicorp/consul/agent/local"
 	"github.com/hashicorp/consul/agent/structs"
 	"github.com/hashicorp/consul/api"
@@ -1877,9 +1878,9 @@ func TestAgent_RegisterService_TranslateKeys(t *testing.T) {
 
 	json := `
 	{
-		"name":"test", 
-		"port":8000, 
-		"enable_tag_override": true, 
+		"name":"test",
+		"port":8000,
+		"enable_tag_override": true,
 		"meta": {
 			"some": "meta",
 			"enable_tag_override": "meta is 'opaque' so should not get translated"
@@ -1929,9 +1930,9 @@ func TestAgent_RegisterService_TranslateKeys(t *testing.T) {
 				]
 			},
 			"sidecar_service": {
-				"name":"test-proxy", 
-				"port":8001, 
-				"enable_tag_override": true, 
+				"name":"test-proxy",
+				"port":8001,
+				"enable_tag_override": true,
 				"meta": {
 					"some": "meta",
 					"enable_tag_override": "sidecar_service.meta is 'opaque' so should not get translated"
@@ -2791,7 +2792,7 @@ func TestAgent_RegisterServiceDeregisterService_Sidecar(t *testing.T) {
 			require := require.New(t)
 
 			// Constrain auto ports to 1 available to make it deterministic
-			hcl := `ports { 
+			hcl := `ports {
 				sidecar_min_port = 2222
 				sidecar_max_port = 2222
 			}
@@ -5537,3 +5538,55 @@ func testAllowProxyConfig() string {
 		}
 	`
 }
+
+func TestAgent_Host(t *testing.T) {
+	t.Parallel()
+	assert := assert.New(t)
+
+	dc1 := "dc1"
+	a := NewTestAgent(t.Name(), `
+	acl_datacenter = "`+dc1+`"
+	acl_default_policy = "allow"
+	acl_master_token = "master"
+	acl_agent_token = "agent"
+	acl_agent_master_token = "towel"
+	acl_enforce_version_8 = true
+`)
+	defer a.Shutdown()
+
+	testrpc.WaitForLeader(t, a.RPC, "dc1")
+	req, _ := http.NewRequest("GET", "/v1/agent/host?token=master", nil)
+	resp := httptest.NewRecorder()
+	respRaw, err := a.srv.AgentHost(resp, req)
+	assert.Nil(err)
+	assert.Equal(http.StatusOK, resp.Code)
+	assert.NotNil(respRaw)
+
+	obj := respRaw.(*debug.HostInfo)
+	assert.NotNil(obj.CollectionTime)
+	assert.Empty(obj.Errors)
+}
+
+func TestAgent_HostBadACL(t *testing.T) {
+	t.Parallel()
+	assert := assert.New(t)
+
+	dc1 := "dc1"
+	a := NewTestAgent(t.Name(), `
+	acl_datacenter = "`+dc1+`"
+	acl_default_policy = "deny"
+	acl_master_token = "root"
+	acl_agent_token = "agent"
+	acl_agent_master_token = "towel"
+	acl_enforce_version_8 = true
+`)
+	defer a.Shutdown()
+
+	testrpc.WaitForLeader(t, a.RPC, "dc1")
+	req, _ := http.NewRequest("GET", "/v1/agent/host?token=agent", nil)
+	resp := httptest.NewRecorder()
+	respRaw, err := a.srv.AgentHost(resp, req)
+	assert.EqualError(err, "ACL not found")
+	assert.Equal(http.StatusOK, resp.Code)
+	assert.Nil(respRaw)
+}

agent/debug/host.go

@@ -0,0 +1,59 @@
+package debug
+
+import (
+	"time"
+
+	"github.com/shirou/gopsutil/cpu"
+	"github.com/shirou/gopsutil/disk"
+	"github.com/shirou/gopsutil/host"
+	"github.com/shirou/gopsutil/mem"
+)
+
+const (
+	// DiskUsagePath is the path to check usage of the disk.
+	// Must be a filessytem path such as "/", not device file path like "/dev/vda1"
+	DiskUsagePath = "/"
+)
+
+// HostInfo includes information about resources on the host as well as
+// collection time and
+type HostInfo struct {
+	Memory         *mem.VirtualMemoryStat
+	CPU            []cpu.InfoStat
+	Host           *host.InfoStat
+	Disk           *disk.UsageStat
+	CollectionTime int64
+	Errors         []error
+}
+
+// CollectHostInfo queries the host system and returns HostInfo. Any
+// errors encountered will be returned in HostInfo.Errors
+func CollectHostInfo() *HostInfo {
+	info := &HostInfo{CollectionTime: time.Now().UTC().UnixNano()}
+
+	if h, err := host.Info(); err != nil {
+		info.Errors = append(info.Errors, err)
+	} else {
+		info.Host = h
+	}
+
+	if v, err := mem.VirtualMemory(); err != nil {
+		info.Errors = append(info.Errors, err)
+	} else {
+		info.Memory = v
+	}
+
+	if d, err := disk.Usage(DiskUsagePath); err != nil {
+		info.Errors = append(info.Errors, err)
+	} else {
+		info.Disk = d
+	}
+
+	if c, err := cpu.Info(); err != nil {
+		info.Errors = append(info.Errors, err)
+	} else {
+		info.CPU = c
+	}
+
+	return info
+}

agent/debug/host_test.go

@@ -0,0 +1,20 @@
+package debug
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestCollectHostInfo(t *testing.T) {
+	assert := assert.New(t)
+
+	host := CollectHostInfo()
+
+	assert.Nil(host.Errors)
+
+	assert.NotNil(host.CollectionTime)
+	assert.NotNil(host.Host)
+	assert.NotNil(host.Disk)
+	assert.NotNil(host.Memory)
+}

agent/http.go

@@ -142,6 +142,41 @@ func (s *HTTPServer) handler(enableDebug bool) http.Handler {
 		mux.Handle(pattern, gzipHandler)
 	}
 
+	// handlePProf takes the given pattern and pprof handler
+	// and wraps it to add authorization and metrics
+	handlePProf := func(pattern string, handler http.HandlerFunc) {
+		wrapper := func(resp http.ResponseWriter, req *http.Request) {
+			var token string
+			s.parseToken(req, &token)
+
+			rule, err := s.agent.resolveToken(token)
+			if err != nil {
+				resp.WriteHeader(http.StatusForbidden)
+				return
+			}
+
+			// If enableDebug is not set, and ACLs are disabled, write
+			// an unauthorized response
+			if !enableDebug {
+				if s.checkACLDisabled(resp, req) {
+					return
+				}
+			}
+
+			// If the token provided does not have the necessary permissions,
+			// write a forbidden response
+			if rule != nil && !rule.OperatorRead() {
+				resp.WriteHeader(http.StatusForbidden)
+				return
+			}
+
+			// Call the pprof handler
+			handler(resp, req)
+		}
+
+		handleFuncMetrics(pattern, http.HandlerFunc(wrapper))
+	}
+
 	mux.HandleFunc("/", s.Index)
 	for pattern, fn := range endpoints {
 		thisFn := fn
@@ -151,12 +186,13 @@ func (s *HTTPServer) handler(enableDebug bool) http.Handler {
 		}
 		handleFuncMetrics(pattern, s.wrap(bound, methods))
 	}
-	if enableDebug {
-		handleFuncMetrics("/debug/pprof/", pprof.Index)
-		handleFuncMetrics("/debug/pprof/cmdline", pprof.Cmdline)
-		handleFuncMetrics("/debug/pprof/profile", pprof.Profile)
-		handleFuncMetrics("/debug/pprof/symbol", pprof.Symbol)
-	}
+
+	// Register wrapped pprof handlers
+	handlePProf("/debug/pprof/", pprof.Index)
+	handlePProf("/debug/pprof/cmdline", pprof.Cmdline)
+	handlePProf("/debug/pprof/profile", pprof.Profile)
+	handlePProf("/debug/pprof/symbol", pprof.Symbol)
+	handlePProf("/debug/pprof/trace", pprof.Trace)
 
 	if s.IsUIEnabled() {
 		legacy_ui, err := strconv.ParseBool(os.Getenv("CONSUL_UI_LEGACY"))

agent/http_oss.go

@@ -13,6 +13,7 @@ func init() {
 	registerEndpoint("/v1/acl/replication", []string{"GET"}, (*HTTPServer).ACLReplicationStatus)
 	registerEndpoint("/v1/agent/token/", []string{"PUT"}, (*HTTPServer).AgentToken)
 	registerEndpoint("/v1/agent/self", []string{"GET"}, (*HTTPServer).AgentSelf)
+	registerEndpoint("/v1/agent/host", []string{"GET"}, (*HTTPServer).AgentHost)
 	registerEndpoint("/v1/agent/maintenance", []string{"PUT"}, (*HTTPServer).AgentNodeMaintenance)
 	registerEndpoint("/v1/agent/reload", []string{"PUT"}, (*HTTPServer).AgentReload)
 	registerEndpoint("/v1/agent/monitor", []string{"GET"}, (*HTTPServer).AgentMonitor)