-
Notifications
You must be signed in to change notification settings - Fork 1.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
pkg/trace: add support for meta_struct span proto field #10366
Conversation
You should also put |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Left some nits.
Co-authored-by: Gabriel Aszalos <gabriel.aszalos@gmail.com>
cdb1ac7
to
d6be19b
Compare
There is not a single test in this PR which tests that a Msgpack payload containing the new field gets decoded correctly. The new decoding code has 0 coverage. 🙁 |
What does this PR do?
This PR adds support for the
meta_struct
span proto field in the trace-agent. This field is analogous tometa
but allows to attach structured data serialized in msgpack to a span instead of strings.Motivation
AppSec runs inside the APM tracers and detects security events (also called triggers) thanks to AppSec rules. The security events are attached to the relevant span and are currently reported using the
_dd.appsec.json
meta tag as a JSON serialized string.There is currently no compatibility between the legacy
_dd.appsec.json
meta tag and the newappsec
meta struct tag. The tracers need to send one or the other depending on the protocol in use.Additional Notes
AppSec events are low-volume and it is estimated that 1 trace out of 100 000 have AppSec events for customers where the feature is enabled.
Possible Drawbacks / Trade-offs
Only the v0.7 protocol supports the new
meta_struct
field. A flag has been introduced to indicate that an agent supports themeta_struct
field.Reviewer's Checklist
Triage
milestone is set.team/..
label has been applied, if known.changelog/no-changelog
label has been applied.qa/skip-qa
label is not applied.need-change/operator
andneed-change/helm
labels have been applied.