Skip to content

Commit ea7321a

Browse files
gsantos-hcschavis
gsantos-hc
and
schavis
authored
VAULT-39930 Add certificate counters to license usage reporting (#1147)
* VAULT-39930 Add certificate counters to license usage reporting Add mention of PKI certificate counts to the automated and manual license usage reporting docs. * Apply suggestions from code review Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com> --------- Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com>
1 parent 17a99d2 commit ea7321a

File tree

2 files changed

+186
-157
lines changed

2 files changed

+186
-157
lines changed

‎content/vault/v1.21.x (rc)/content/docs/license/utilization/auto-reporting.mdx‎

Lines changed: 109 additions & 80 deletions
Original file line numberDiff line numberDiff line change
@@ -13,13 +13,18 @@ description: >-
1313
Automated license utilization reporting sends license utilization data to
1414
HashiCorp without requiring you to manually collect and report them.
1515

16-
Automated reporting shares the minimum data required to validate license
17-
utilization as defined in our contracts. They consist of mostly computed metrics
18-
and will never contain Personal Identifiable Information (PII) or other
19-
sensitive information. Automated reporting shares the data with HashiCorp using
20-
a secure, unidirectional HTTPS API and makes an auditable record in the product
21-
logs each time it submits a report. The reporting process submits
22-
reports roughly once every 24 hours.
16+
Automated reporting shares the minimum data required to validate license utilization
17+
as defined in our contracts. The reported data consists mostly of computed metrics
18+
and never contains personal identifiable information (PII) or other sensitive information.
19+
As of Vault 1.21+, automated metrics include the following:
20+
21+
- The number of [Vault clients](../../concepts/client-count/counting)
22+
- The number of certificates issued by the PKI secrets engine.
23+
24+
Automated reporting writes to your Vault logs every time it submits a
25+
report and shares the report data with HashiCorp using a secure,
26+
unidirectional HTTPS API call. The reporting process submits reports
27+
roughly once every 24 hours.
2328

2429
## Enable automated reporting
2530

@@ -113,7 +118,6 @@ You have two options to opt out of automated reporting:
113118
- HCL configuration (recommended)
114119
- Environment variable (requires restart)
115120

116-
117121
#### HCL configuration
118122

119123
Opting out in your product’s configuration file doesn’t require a system
@@ -138,7 +142,6 @@ reporting status upon active unseal.
138142

139143
</Warning>
140144

141-
142145
You will find the following entry in the server log.
143146

144147
<CodeBlockConfig hideClipboard>
@@ -182,7 +185,6 @@ You will find the following entries in the server log.
182185

183186
</CodeBlockConfig>
184187

185-
186188
Check your product logs roughly 24 hours after opting out to make sure that the system
187189
isn’t trying to send reports.
188190

@@ -250,25 +252,28 @@ HashiCorp collects the following utilization data as JSON payloads:
250252
- `export_timestamp`- The date and time for this contribution
251253
- `snapshots` - An array of snapshot details. A snapshot is a structure that
252254
represents a single data collection
253-
- `snapshot_version` - The version of the snapshot package that produced this
254-
snapshot
255-
- `snapshot_id` - A unique identifier for this particular snapshot
256-
- `process_id` - An identifier for the system that produced this snapshot
257-
- `timestamp` - The date and time for this snapshot
258-
- `schema_version` - The version of the schema associated with this snapshot
259-
- `service` - The service that produced this snapshot (likely to be product
260-
name)
261-
- `metrics` - A map of representations of snapshot metrics contained within
262-
this snapshot
263-
- `key` - The key name associated with this metric
264-
- `kind` - The kind of metric (feature, counter, sum, or mean)
265-
- `mode` - The mode of operation associated with this metric (write or
266-
collect)
267-
- `labels` - The labels associated with each collected metric
268-
- `entity` - The sum of tokens generated for a unique client identifier
269-
- `nonentity` - The sum of tokens without an entity attached
270-
- `metadata` - Optional product-specific metadata
271-
- `billing_start` - The billing start date associated with the reporting cluster (license start date if not configured).
255+
- `snapshot_version` - The version of the snapshot package that produced the reporting
256+
snapshot.
257+
- `snapshot_id` - A unique identifier for this particular snapshot
258+
- `process_id` - An identifier for the system that produced this snapshot
259+
- `timestamp` - The date and time for this snapshot
260+
- `schema_version` - The version of the schema associated with this snapshot
261+
- `service` - The service that produced this snapshot (likely to be product
262+
name)
263+
- `metrics` - A map of representations of snapshot metrics contained within
264+
this snapshot
265+
- `key` - The key name associated with this metric
266+
- `kind` - The kind of metric (feature, counter, sum, or mean)
267+
- `mode` - The mode of operation associated with this metric (write or
268+
collect)
269+
- `labels` - The labels associated with each collected metric
270+
- `entity` - The sum of tokens generated for a unique client identifier
271+
- `nonentity` - The sum of tokens without an entity attached
272+
- `metadata` - Optional product-specific metadata
273+
- `billing_start` - The billing start date associated with the reporting
274+
cluster or the license start date if you do not have a billing date configured.
275+
- `cluster_id` - The cluster UUID as shown by `vault status` on the reporting cluster.
276+
- `development_cluster` - Whether or not the cluster operates as a development (non-production) cluster.
272277

273278
<Note title="Important change to supported versions">
274279

@@ -283,60 +288,85 @@ HashiCorp collects the following utilization data as JSON payloads:
283288

284289
</Note>
285290

286-
- `cluster_id` - The cluster UUID as shown by `vault status` on the reporting
287-
cluster.
288-
- `development_cluster` - Whether the cluster is operating as a development (non-production) cluster.
289-
290291
<CodeBlockConfig hideClipboard>
291292

292293
```json
293294
{
294-
"payload_version": "1",
295-
"license_id": "97afe7b4-b9c8-bf19-bf35-b89b5cc0efea",
296-
"product": "vault",
297-
"product_version": "1.14.0-rc1+ent",
298-
"export_timestamp": "2023-06-01T11:39:00.76643-04:00",
299-
"snapshots": [
300-
{
301-
"snapshot_version": 1,
302-
"snapshot_id": "0001J7HEWM1PEHPMF5YZT8EV65",
303-
"process_id": "01H1VSQMNYAP77R566F1Y03GE6",
304-
"timestamp": "2023-06-01T11:39:00.766099-04:00",
305-
"schema_version": "1.0.0",
306-
"service": "vault",
307-
"metrics": {
308-
"clientcount.current_month_estimate": {
309-
"key": "clientcount.current_month_estimate",
310-
"kind": "sum",
311-
"mode": "write",
312-
"labels": {
313-
"type": {
314-
"entity": 20,
315-
"nonentity": 11
316-
}
317-
}
318-
},
319-
"clientcount.previous_month_complete": {
320-
"key": "clientcount.previous_month_complete",
321-
"kind": "sum",
322-
"mode": "write",
323-
"labels": {
324-
"type": {
325-
"entity": 10,
326-
"nonentity": 11
327-
}
328-
}
329-
}
330-
}
331-
}
332-
],
333-
"metadata": {
334-
"vault": {
335-
"billing_start": "2023-03-01T00:00:00Z",
336-
"cluster_id": "a8d95acc-ec0a-6087-d7f6-4f054ab2e7fd",
337-
"development_cluster": "false",
338-
}
339-
}
295+
"payload_version": "1",
296+
"license_id": "7d68b16a-74fe-3b9f-a1a7-08cf461fff1c",
297+
"product": "vault",
298+
"product_version": "1.21.0+ent",
299+
"export_timestamp": "2024-02-08T18:55:28.085215-08:00",
300+
"snapshots": [
301+
{
302+
"snapshot_version": 2,
303+
"id": "0001JWAY00BRF8TEXC9CVRHBAC",
304+
"timestamp": "2024-02-08T16:55:28.085215-08:00",
305+
"schema_version": "2.0.0",
306+
"product": "vault",
307+
"process_id": "01HP5NJS21HN50FY0CBS0SYGCH",
308+
"metrics": {
309+
"clientcount.current_month_estimate.type.acme_client": {
310+
"key": "clientcount.current_month_estimate.type.acme_client",
311+
"value": 0,
312+
"mode": "write"
313+
},
314+
"clientcount.current_month_estimate.type.entity": {
315+
"key": "clientcount.current_month_estimate.type.entity",
316+
"value": 20,
317+
"mode": "write"
318+
},
319+
"clientcount.current_month_estimate.type.nonentity": {
320+
"key": "clientcount.current_month_estimate.type.nonentity",
321+
"value": 11,
322+
"mode": "write"
323+
},
324+
"clientcount.current_month_estimate.type.secret_sync": {
325+
"key": "clientcount.current_month_estimate.type.secret_sync",
326+
"value": 0,
327+
"mode": "write"
328+
},
329+
"clientcount.previous_month_complete.type.acme_client": {
330+
"key": "clientcount.previous_month_complete.type.acme_client",
331+
"value": 0,
332+
"mode": "write"
333+
},
334+
"clientcount.previous_month_complete.type.entity": {
335+
"key": "clientcount.previous_month_complete.type.entity",
336+
"value": 0,
337+
"mode": "write"
338+
},
339+
"clientcount.previous_month_complete.type.nonentity": {
340+
"key": "clientcount.previous_month_complete.type.nonentity",
341+
"value": 0,
342+
"mode": "write"
343+
},
344+
"clientcount.previous_month_complete.type.secret_sync": {
345+
"key": "clientcount.previous_month_complete.type.secret_sync",
346+
"value": 0,
347+
"mode": "write"
348+
},
349+
"certcount.current_month_estimate": {
350+
"key": "certcount.current_month_estimate",
351+
"value": 0,
352+
"mode": "write"
353+
},
354+
"certcount.previous_month_complete": {
355+
"key": "certcount.previous_month_complete",
356+
"value": 0,
357+
"mode": "write"
358+
}
359+
},
360+
"product_version": "1.21.0+ent",
361+
"license_id": "7d68b16a-74fe-3b9f-a1a7-08cf461fff1c",
362+
"checksum": 6861637915450723051,
363+
"metadata": {
364+
"billing_start": "2023-05-04T00:00:00Z",
365+
"cluster_id": "16d0ff5b-9d40-d7a7-384c-c9b95320c60e",
366+
"development_cluster": "false"
367+
}
368+
}
369+
]
340370
}
341371
```
342372

@@ -349,4 +379,3 @@ When upgrading Vault from 1.8 (or earlier) to 1.9 (or later), utilization report
349379
Starting in Vault 1.9, the activity log records and de-duplicates non-entity tokens by using the namespace and token's policies to generate a unique identifier. Because Vault did not create identifiers for these tokens before 1.9, the activity log cannot know whether this token has been seen pre-1.9. To prevent inaccurate and inflated counts, the activity log will ignore any counts of non-entity tokens that were created before the upgrade and only the non-entity tokens from versions 1.9 and later will be counted.
350380

351381
See the client count [overview](/vault/docs/concepts/client-count) and [FAQ](/vault/docs/concepts/client-count/faq) for more information.
352-

0 commit comments

Comments
 (0)