Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Jjo/otlp wip #612

Closed
wants to merge 43 commits into from
Closed

Jjo/otlp wip #612

wants to merge 43 commits into from

Conversation

jjo
Copy link
Contributor

@jjo jjo commented Aug 31, 2023

What type of PR is this?
/kind feature

Any specific area of the project related to this PR?
/area outputs

What this PR does / why we need it:
Implements OTLP/Traces (OpenTelemetry) output.

Folding Falco events into traces allows them to be represented as "hierarchical" views.
Using a TraceID taken from container.id (or Kubernetes labels down to k8s.pod.name if present), all Falco events will be "rooted" under the container where it occurred, enabling a tree~ish view of these.

Which issue(s) this PR fixes:

Special notes for your reviewer:
Will provide some screenshots of these hierarchical views, as shown by an OTLP Traces backend like Jaeger or Grafana Tempo.

jjo and others added 30 commits August 31, 2023 11:39
@jjo
rebase to master (go.mod changes)
4b98535 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
fix: directly call c.Post(trace), as it takes care of marshalling; …
1f42498 
…add gcompat to alpine image to be able to use locally built binary

Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@mostafa @jjo
Fix message format
fc427fc
@petewall @jjo
Add auth options for OTLP
6230ca4 
Signed-off-by: Pete Wall <pete.wall@grafana.com>
@petewall @jjo
Update config.go
65ba901
@jjo
Makefile: add IMAGE_TAG and push-image target
ff48346 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
hack: as we have 1:1 span:event, copy event's Attributes up to its Sp…
9fe20e5 
…an, it also greatly improves TempoQL UX

Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
add OTLP.Tenant, logic copied from outputs/loki.go
809b3ec 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
hack: add artificial OTLP_DURATION=1000(ms) to overcome the lack of e…
cece9cb 
…vents endtime

Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
reimplement OTLP using upstream libs SDK
a0b09b8 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
improve otlpSetEnvs() handling
c993c83 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
cleanup old code
880b769 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
bit refactor
af60eb2 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
add OTLP_TRACES_MINIMUMPRIORITY support
a81ea29 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
more env rework
30f1c50 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
add otlp_init_test.go
1cae262 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
support OTLP_TRACES_INSECURE, update README.md
ec1e71e 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
add outputs/otlp_test.go
0444669 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
remove fmt.Printf()-s from outputs/otlp_test.go
10c9b07 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
test all falcopayload Outputfields == span attributes
a5c48e4 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
refactor+improve otlp_test.go
fe3db5c 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
minors
182f9d5 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
minors
26dcee8 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
rework tags to use StringSlice-s
2acdaf4 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
minors
162da22 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
support TraceIDFormat, else default to kubeTemplateStr or containerTe…
eed52f9 
…mplateStr

Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
better Debug handling
c0da32a 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
OTLP: fix templating
ea72166 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
OTLP tests: random traceID coverage
3c9ea4a 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
update
417a686 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
jjo added 13 commits August 31, 2023 11:39
@jjo
typo fix
ca7ff7f 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
otlp test: const templateOption="missingkey=zero"
6ee3e5a 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
minors
d189c80 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
minors
3bb11d7 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
golangci-lint fixes
984a918 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
gofumpt-ed
581ced7 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
OTLP: add prometheus stats
fd1d738 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
fix OTLP stats
b9281ed 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
keep falcopayload outputfield values as interface{}
9248fe9 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
undo go.mod updates by codeium
19969d4 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
re-fix go.mod
2b6e8ce 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
OTLP: s/TraceIDFormat/TraceIDHash/
cc2c6dd 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@jjo
adjust metrics
503736b 
Signed-off-by: JuanJo Ciarlante <juanjosec@gmail.com>
@poiana poiana requested review from cpanato and Issif August 31, 2023 15:29
@poiana
Copy link

poiana commented Aug 31, 2023

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: jjo
Once this PR has been reviewed and has the lgtm label, please assign leogr for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@poiana
Copy link

poiana commented Aug 31, 2023

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.

📝 Please follow instructions in the contributing guide to update your commits with the DCO

Full details of the Developer Certificate of Origin can be found at developercertificate.org.

The list of commits missing DCO signoff:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@poiana
Copy link

poiana commented Aug 31, 2023

Welcome @jjo! It looks like this is your first PR to falcosecurity/falcosidekick 🎉

@jjo jjo closed this Aug 31, 2023
@jjo
Copy link
Contributor Author

jjo commented Aug 31, 2023

Welcome @jjo! It looks like this is your first PR to falcosecurity/falcosidekick 🎉

Thanks!, mis-submitted this from my WIP branch, re- submitted as #613

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@cpanato cpanato Awaiting requested review from cpanato

@Issif Issif Awaiting requested review from Issif

Assignees
No one assigned
Labels
area/outputs dco-signoff: no kind/feature New feature or request size/XXL
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@jjo @poiana @mostafa @petewall