Time taken by each constraint to validate the resources

[priyamshet]

Describe the solution you'd like
Log/report total(start/end) time taken by each constraint to validate all the resources

Anything else you would like to add:
[Miscellaneous information that will assist in solving the issue.]

Environment:

• Gatekeeper version:
• Kubernetes version: (use kubectl version):

[ritazh]

@priyamshet are you interested in this metric for audit or admission request?

[maxsmythe]

@ritazh @sozercan @shomron

I think this is another thing that could be made easier by using Go to coordinate constraint execution. Gonna file a bug on the constraint framework so we can start tracking the benefits better.

[maxsmythe]

Created as open-policy-agent/frameworks#135

[priyamshet]

@priyamshet are you interested in this metric for audit or admission request?

Mostly for audit, We are looking at using this information to profile the constraints execution, to understand how long each constraint takes to do the required auditing against all resources in cluster.

We see audit happens here but logs show audit_started and audit_finished but there is no information/logs/duration at the individual constraint level.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. Thank you for your contributions.

[maxsmythe]

gator validate provides some timing information, LMK if this is helpful

[maxsmythe]

https://open-policy-agent.github.io/gatekeeper/website/docs/gator

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. Thank you for your contributions.

[maxsmythe]

Having this on a live cluster may be good for debugging.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. Thank you for your contributions.

[maxsmythe]

open-policy-agent/frameworks#263

is aimed at enabling this