Merge branch 'main' into sqlite-concurrency-fix

* main:
  chore: bump prom verison (#1305)
  Otel improvements (#1306)
  fix: disable csp headers in non-release mode for ui dev (#1304)
  chore(deps): bump go.opentelemetry.io/otel/exporters/jaeger (#1299)
  chore(deps): bump google.golang.org/grpc from 1.52.0 to 1.52.3 (#1303)
  feat(logging): support custom time, level and message keys (#1295)
  fix: get linter running correctly locally (#1296)
  chore(deps): bump go.opentelemetry.io/otel from 1.11.2 to 1.12.0 (#1301)
  chore(deps): bump golangci/golangci-lint-action from 3.3.1 to 3.4.0 (#1298)

.github/workflows/lint.yml

@@ -20,7 +20,7 @@ jobs:
           cache: true
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v3.3.1
+        uses: golangci/golangci-lint-action@v3.4.0
         with:
           # Required: the version of golangci-lint is required and must be specified without patch version: we always use the latest patch version.
           version: v1.49

.golangci.yml

@@ -14,10 +14,12 @@ run:
     - "bin"
     - "_tools"
     - "dist"
-    - "rpc"
-    - "swagger"
+    - "rpc/flipt"
     - "ui"
 
+  skip-files:
+    - ".*pb.go"
+
   # which files to skip: they will be analyzed, but issues from them
   # won't be reported. Default value is empty list, but there is
   # no need to include all autogenerated files, we confidently recognize
@@ -30,7 +32,6 @@ linters:
     - errcheck
     - goconst
     - gocritic
-    - goimports
     - gosec
     - gosimple
     - govet
@@ -39,12 +40,12 @@ linters:
     - misspell
     - staticcheck
     - stylecheck
+    - sqlclosecheck
     - unconvert
     - unparam
   disable:
     - contextcheck
     - exhaustive
-    - rowserrcheck
   enable-all: false
   presets:
     - bugs
@@ -68,6 +69,10 @@ linters-settings:
     checks:
       - all
       - "-SA1019" # exclude staticcheck messages from github.com/golang/protobuf
+  stylecheck:
+    checks:
+      - all
+      - "-ST1003" # exclude underscores
   gosec:
     excludes: # exclude gosec messages about weak crypto
       - "G501"

cmd/flipt/main.go

@@ -33,15 +33,13 @@ import (
 	_ "github.com/golang-migrate/migrate/v4/source/file"
 )
 
-const devVersion = "dev"
-
 var (
 	cfg         *config.Config
 	cfgWarnings []string
 
 	cfgPath      string
 	forceMigrate bool
-	version      = devVersion
+	version      = "dev"
 	commit       string
 	date         string
 	goVersion    = runtime.Version()
@@ -164,6 +162,9 @@ func main() {
 		cfg = res.Config
 		cfgWarnings = res.Warnings
 
+		loggerConfig.EncoderConfig.TimeKey = cfg.Log.Keys.Time
+		loggerConfig.EncoderConfig.LevelKey = cfg.Log.Keys.Level
+		loggerConfig.EncoderConfig.MessageKey = cfg.Log.Keys.Message
 		// log to file if enabled
 		if cfg.Log.File != "" {
 			loggerConfig.OutputPaths = []string{cfg.Log.File}

examples/tracing/docker-compose.yml

@@ -4,11 +4,21 @@ services:
   jaeger:
     image: jaegertracing/all-in-one:1
     ports:
+      - "6831:6831/udp"
+      - "6832:6832/udp"
+      - "5778:5778"
       - "16686:16686"
+      - "4317:4317"
+      - "4318:4318"
+      - "14250:14250"
+      - "14268:14268"
+      - "14269:14269"
+      - "9411:9411"
     networks:
       - flipt_network
     environment:
-      - "COLLECTOR_ZIPKIN_HTTP_PORT=9411"
+      - "COLLECTOR_ZIPKIN_HOST_PORT=:9411"
+      - "COLLECTOR_OTLP_ENABLED=true"
 
   flipt:
     image: flipt/flipt:latest

go.mod

@@ -38,19 +38,19 @@ require (
 	github.com/uber/jaeger-client-go v2.30.0+incompatible
 	github.com/xo/dburl v0.0.0-20200124232849-e9ec94f52bc3
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.37.0
-	go.opentelemetry.io/otel v1.11.2
-	go.opentelemetry.io/otel/exporters/jaeger v1.11.2
-	go.opentelemetry.io/otel/exporters/prometheus v0.33.1-0.20221021151223-ccbc38e66ede
+	go.opentelemetry.io/otel v1.12.0
+	go.opentelemetry.io/otel/exporters/jaeger v1.12.0
+	go.opentelemetry.io/otel/exporters/prometheus v0.34.0
 	go.opentelemetry.io/otel/metric v0.34.0
-	go.opentelemetry.io/otel/sdk v1.11.2
+	go.opentelemetry.io/otel/sdk v1.12.0
 	go.opentelemetry.io/otel/sdk/metric v0.34.0
-	go.opentelemetry.io/otel/trace v1.11.2
+	go.opentelemetry.io/otel/trace v1.12.0
 	go.uber.org/zap v1.24.0
 	golang.org/x/exp v0.0.0-20221012211006-4de253d81b95
 	golang.org/x/net v0.5.0
 	golang.org/x/sync v0.1.0
 	google.golang.org/genproto v0.0.0-20221227171554-f9683d7f8bef
-	google.golang.org/grpc v1.52.0
+	google.golang.org/grpc v1.52.3
 	google.golang.org/protobuf v1.28.1
 	gopkg.in/segmentio/analytics-go.v3 v3.1.0
 	gopkg.in/yaml.v2 v2.4.0

go.sum

@@ -1283,33 +1283,33 @@ go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.3
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.20.0/go.mod h1:2AboqHi0CiIZU0qwhtUfCYD1GeUzvvIXWNkhDt7ZMG4=
 go.opentelemetry.io/otel v0.20.0/go.mod h1:Y3ugLH2oa81t5QO+Lty+zXf8zC9L26ax4Nzoxm/dooo=
 go.opentelemetry.io/otel v1.3.0/go.mod h1:PWIKzi6JCp7sM0k9yZ43VX+T345uNbAkDKwHVjb2PTs=
-go.opentelemetry.io/otel v1.11.2 h1:YBZcQlsVekzFsFbjygXMOXSs6pialIZxcjfO/mBDmR0=
-go.opentelemetry.io/otel v1.11.2/go.mod h1:7p4EUV+AqgdlNV9gL97IgUZiVR3yrFXYo53f9BM3tRI=
-go.opentelemetry.io/otel/exporters/jaeger v1.11.2 h1:ES8/j2+aB+3/BUw51ioxa50V9btN1eew/2J7N7n1tsE=
-go.opentelemetry.io/otel/exporters/jaeger v1.11.2/go.mod h1:nwcF/DK4Hk0auZ/a5vw20uMsaJSXbzeeimhN5f9d0Lc=
+go.opentelemetry.io/otel v1.12.0 h1:IgfC7kqQrRccIKuB7Cl+SRUmsKbEwSGPr0Eu+/ht1SQ=
+go.opentelemetry.io/otel v1.12.0/go.mod h1:geaoz0L0r1BEOR81k7/n9W4TCXYCJ7bPO7K374jQHG0=
+go.opentelemetry.io/otel/exporters/jaeger v1.12.0 h1:1Vy11S0iAD70EPfcP3N2f2IhLq/cIuTW+Zt010MswR8=
+go.opentelemetry.io/otel/exporters/jaeger v1.12.0/go.mod h1:SCLbaspEoU9mGJZB6ksc2iSGU6CLWY5yefchDqOM0IM=
 go.opentelemetry.io/otel/exporters/otlp v0.20.0/go.mod h1:YIieizyaN77rtLJra0buKiNBOm9XQfkPEKBeuhoMwAM=
 go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.3.0/go.mod h1:VpP4/RMn8bv8gNo9uK7/IMY4mtWLELsS+JIP0inH0h4=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.3.0/go.mod h1:hO1KLR7jcKaDDKDkvI9dP/FIhpmna5lkqPUQdEjFAM8=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.3.0/go.mod h1:keUU7UfnwWTWpJ+FWnyqmogPa82nuU5VUANFq49hlMY=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.3.0/go.mod h1:QNX1aly8ehqqX1LEa6YniTU7VY9I6R3X/oPxhGdTceE=
-go.opentelemetry.io/otel/exporters/prometheus v0.33.1-0.20221021151223-ccbc38e66ede h1:cHViU9YS+sHIhsSx/XPi+gEI6byWA9pM3yywAaqmAkw=
-go.opentelemetry.io/otel/exporters/prometheus v0.33.1-0.20221021151223-ccbc38e66ede/go.mod h1:ZSmYfKdYWEdSDBB4njLBIwTf4AU2JNsH3n2quVQDebI=
+go.opentelemetry.io/otel/exporters/prometheus v0.34.0 h1:L5D+HxdaC/ORB47ribbTBbkXRZs9JzPjq0EoIOMWncM=
+go.opentelemetry.io/otel/exporters/prometheus v0.34.0/go.mod h1:6gUoJyfhoWqF0tOLaY0ZmKgkQRcvEQx6p5rVlKHp3s4=
 go.opentelemetry.io/otel/metric v0.20.0/go.mod h1:598I5tYlH1vzBjn+BTuhzTCSb/9debfNp6R3s7Pr1eU=
 go.opentelemetry.io/otel/metric v0.34.0 h1:MCPoQxcg/26EuuJwpYN1mZTeCYAUGx8ABxfW07YkjP8=
 go.opentelemetry.io/otel/metric v0.34.0/go.mod h1:ZFuI4yQGNCupurTXCwkeD/zHBt+C2bR7bw5JqUm/AP8=
 go.opentelemetry.io/otel/oteltest v0.20.0/go.mod h1:L7bgKf9ZB7qCwT9Up7i9/pn0PWIa9FqQ2IQ8LoxiGnw=
 go.opentelemetry.io/otel/sdk v0.20.0/go.mod h1:g/IcepuwNsoiX5Byy2nNV0ySUF1em498m7hBWC279Yc=
 go.opentelemetry.io/otel/sdk v1.3.0/go.mod h1:rIo4suHNhQwBIPg9axF8V9CA72Wz2mKF1teNrup8yzs=
-go.opentelemetry.io/otel/sdk v1.11.2 h1:GF4JoaEx7iihdMFu30sOyRx52HDHOkl9xQ8SMqNXUiU=
-go.opentelemetry.io/otel/sdk v1.11.2/go.mod h1:wZ1WxImwpq+lVRo4vsmSOxdd+xwoUJ6rqyLc3SyX9aU=
+go.opentelemetry.io/otel/sdk v1.12.0 h1:8npliVYV7qc0t1FKdpU08eMnOjgPFMnriPhn0HH4q3o=
+go.opentelemetry.io/otel/sdk v1.12.0/go.mod h1:WYcvtgquYvgODEvxOry5owO2y9MyciW7JqMz6cpXShE=
 go.opentelemetry.io/otel/sdk/export/metric v0.20.0/go.mod h1:h7RBNMsDJ5pmI1zExLi+bJK+Dr8NQCh0qGhm1KDnNlE=
 go.opentelemetry.io/otel/sdk/metric v0.20.0/go.mod h1:knxiS8Xd4E/N+ZqKmUPf3gTTZ4/0TjTXukfxjzSTpHE=
 go.opentelemetry.io/otel/sdk/metric v0.34.0 h1:7ElxfQpXCFZlRTvVRTkcUvK8Gt5DC8QzmzsLsO2gdzo=
 go.opentelemetry.io/otel/sdk/metric v0.34.0/go.mod h1:l4r16BIqiqPy5rd14kkxllPy/fOI4tWo1jkpD9Z3ffQ=
 go.opentelemetry.io/otel/trace v0.20.0/go.mod h1:6GjCW8zgDjwGHGa6GkyeB8+/5vjT16gUEi0Nf1iBdgw=
 go.opentelemetry.io/otel/trace v1.3.0/go.mod h1:c/VDhno8888bvQYmbYLqe41/Ldmr/KKunbvWM4/fEjk=
-go.opentelemetry.io/otel/trace v1.11.2 h1:Xf7hWSF2Glv0DE3MH7fBHvtpSBsjcBUe5MYAmZM/+y0=
-go.opentelemetry.io/otel/trace v1.11.2/go.mod h1:4N+yC7QEz7TTsG9BSRLNAa63eg5E06ObSbKPmxQ/pKA=
+go.opentelemetry.io/otel/trace v1.12.0 h1:p28in++7Kd0r2d8gSt931O57fdjUyWxkVbESuILAeUc=
+go.opentelemetry.io/otel/trace v1.12.0/go.mod h1:pHlgBynn6s25qJ2szD+Bv+iwKJttjHSI3lUAyf0GNuQ=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
 go.opentelemetry.io/proto/otlp v0.11.0/go.mod h1:QpEjXPrNQzrFDZgoTo49dgHR9RYRSrg3NAKnUGl9YpQ=
 go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
@@ -1923,8 +1923,8 @@ google.golang.org/grpc v1.40.1/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9K
 google.golang.org/grpc v1.42.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
 google.golang.org/grpc v1.43.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
 google.golang.org/grpc v1.45.0/go.mod h1:lN7owxKUQEqMfSyQikvvk5tf/6zMPsrK+ONuO11+0rQ=
-google.golang.org/grpc v1.52.0 h1:kd48UiU7EHsV4rnLyOJRuP/Il/UHE7gdDAQ+SZI7nZk=
-google.golang.org/grpc v1.52.0/go.mod h1:pu6fVzoFb+NBYNAvQL08ic+lvB2IojljRYuun5vorUY=
+google.golang.org/grpc v1.52.3 h1:pf7sOysg4LdgBqduXveGKrcEwbStiK2rtfghdzlUYDQ=
+google.golang.org/grpc v1.52.3/go.mod h1:pu6fVzoFb+NBYNAvQL08ic+lvB2IojljRYuun5vorUY=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=

internal/cmd/grpc.go

@@ -132,7 +132,8 @@ func NewGRPCServer(
 	var tracingProvider = trace.NewNoopTracerProvider()
 
 	if cfg.Tracing.Jaeger.Enabled {
-		logger.Debug("tracing enabled", zap.String("type", "jaeger"))
+		logger.Debug("otel tracing enabled")
+
 		exp, err := jaeger.New(jaeger.WithAgentEndpoint(
 			jaeger.WithAgentHost(cfg.Tracing.Jaeger.Host),
 			jaeger.WithAgentPort(strconv.FormatInt(int64(cfg.Tracing.Jaeger.Port), 10)),
@@ -149,9 +150,12 @@ func NewGRPCServer(
 			tracesdk.WithResource(resource.NewWithAttributes(
 				semconv.SchemaURL,
 				semconv.ServiceNameKey.String("flipt"),
+				semconv.ServiceVersionKey.String(info.Version),
 			)),
 			tracesdk.WithSampler(tracesdk.AlwaysSample()),
 		)
+
+		logger.Debug("otel tracing exporter configured", zap.String("type", "jaeger"))
 	}
 
 	otel.SetTracerProvider(tracingProvider)

internal/cmd/http.go

@@ -81,8 +81,11 @@ func NewHTTPServer(
 		logger.Info("CORS enabled", zap.Strings("allowed_origins", cfg.Cors.AllowedOrigins))
 	}
 
-	r.Use(middleware.SetHeader("X-Content-Type-Options", "nosniff"))
-	r.Use(middleware.SetHeader("Content-Security-Policy", "default-src 'self'; img-src * data:;"))
+	// TODO: replace with more robust 'mode' detection
+	if !info.IsDevelopment() {
+		r.Use(middleware.SetHeader("X-Content-Type-Options", "nosniff"))
+		r.Use(middleware.SetHeader("Content-Security-Policy", "default-src 'self'; img-src * data:;"))
+	}
 
 	r.Use(middleware.RequestID)
 	r.Use(middleware.RealIP)

internal/config/config_test.go

@@ -168,6 +168,11 @@ func defaultConfig() *Config {
 			Level:     "INFO",
 			Encoding:  LogEncodingConsole,
 			GRPCLevel: "ERROR",
+			Keys: LogKeys{
+				Time:    "T",
+				Level:   "L",
+				Message: "M",
+			},
 		},
 
 		UI: UIConfig{
@@ -424,6 +429,11 @@ func TestLoad(t *testing.T) {
 					File:      "testLogFile.txt",
 					Encoding:  LogEncodingJSON,
 					GRPCLevel: "ERROR",
+					Keys: LogKeys{
+						Time:    "time",
+						Level:   "level",
+						Message: "msg",
+					},
 				}
 				cfg.Cors = CorsConfig{
 					Enabled:        true,

internal/config/log.go

@@ -16,13 +16,25 @@ type LogConfig struct {
 	File      string      `json:"file,omitempty" mapstructure:"file"`
 	Encoding  LogEncoding `json:"encoding,omitempty" mapstructure:"encoding"`
 	GRPCLevel string      `json:"grpcLevel,omitempty" mapstructure:"grpc_level"`
+	Keys      LogKeys     `json:"keys" mapstructure:"keys"`
+}
+
+type LogKeys struct {
+	Time    string `json:"time" mapstructure:"time"`
+	Level   string `json:"level" mapstructure:"level"`
+	Message string `json:"message" mapstructure:"message"`
 }
 
 func (c *LogConfig) setDefaults(v *viper.Viper) {
 	v.SetDefault("log", map[string]any{
 		"level":      "INFO",
 		"encoding":   "console",
 		"grpc_level": "ERROR",
+		"keys": map[string]any{
+			"time":    "T",
+			"level":   "L",
+			"message": "M",
+		},
 	})
 }
 

internal/config/testdata/advanced.yml

@@ -2,6 +2,10 @@ log:
   level: WARN
   file: "testLogFile.txt"
   encoding: "json"
+  keys:
+    time: "time"
+    level: "level"
+    message: "msg"
 
 cors:
   enabled: true

internal/info/flipt.go

@@ -15,6 +15,10 @@ type Flipt struct {
 	IsRelease       bool   `json:"isRelease"`
 }
 
+func (f Flipt) IsDevelopment() bool {
+	return f.Version == "dev" && !f.IsRelease
+}
+
 func (f Flipt) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	var (
 		out []byte

internal/server/evaluator.go

@@ -11,8 +11,11 @@ import (
 
 	errs "go.flipt.io/flipt/errors"
 	"go.flipt.io/flipt/internal/server/metrics"
+	fliptotel "go.flipt.io/flipt/internal/server/otel"
 	"go.flipt.io/flipt/internal/storage"
 	flipt "go.flipt.io/flipt/rpc/flipt"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/trace"
 	"go.uber.org/zap"
 )
 
@@ -23,6 +26,26 @@ func (s *Server) Evaluate(ctx context.Context, r *flipt.EvaluationRequest) (*fli
 	if err != nil {
 		return resp, err
 	}
+
+	spanAttrs := []attribute.KeyValue{
+		fliptotel.AttributeFlag.String(r.FlagKey),
+		fliptotel.AttributeEntityID.String(r.EntityId),
+		fliptotel.AttributeRequestID.String(r.RequestId),
+	}
+
+	if resp != nil {
+		spanAttrs = append(spanAttrs,
+			fliptotel.AttributeMatch.Bool(resp.Match),
+			fliptotel.AttributeSegment.String(resp.SegmentKey),
+			fliptotel.AttributeValue.String(resp.Value),
+			fliptotel.AttributeReason.String(resp.Reason.String()),
+		)
+	}
+
+	// add otel attributes to span
+	span := trace.SpanFromContext(ctx)
+	span.SetAttributes(spanAttrs...)
+
 	s.logger.Debug("evaluate", zap.Stringer("response", resp))
 	return resp, nil
 }

internal/server/flag.go

@@ -4,8 +4,11 @@ import (
 	"context"
 	"encoding/base64"
 
+	fliptotel "go.flipt.io/flipt/internal/server/otel"
 	"go.flipt.io/flipt/internal/storage"
 	flipt "go.flipt.io/flipt/rpc/flipt"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/trace"
 	"go.uber.org/zap"
 	empty "google.golang.org/protobuf/types/known/emptypb"
 )
@@ -14,6 +17,19 @@ import (
 func (s *Server) GetFlag(ctx context.Context, r *flipt.GetFlagRequest) (*flipt.Flag, error) {
 	s.logger.Debug("get flag", zap.Stringer("request", r))
 	flag, err := s.store.GetFlag(ctx, r.Key)
+
+	spanAttrs := []attribute.KeyValue{
+		fliptotel.AttributeFlag.String(r.Key),
+	}
+
+	if flag != nil {
+		spanAttrs = append(spanAttrs, fliptotel.AttributeFlagEnabled.Bool(flag.Enabled))
+	}
+
+	// add otel attributes to span
+	span := trace.SpanFromContext(ctx)
+	span.SetAttributes(spanAttrs...)
+
 	s.logger.Debug("get flag", zap.Stringer("response", flag))
 	return flag, err
 }

internal/server/otel/attributes.go

@@ -0,0 +1,14 @@
+package otel
+
+import "go.opentelemetry.io/otel/attribute"
+
+var (
+	AttributeMatch       = attribute.Key("flipt.match")
+	AttributeFlag        = attribute.Key("flipt.flag")
+	AttributeFlagEnabled = attribute.Key("flipt.flag_enabled")
+	AttributeSegment     = attribute.Key("flipt.segment")
+	AttributeReason      = attribute.Key("flipt.reason")
+	AttributeValue       = attribute.Key("flipt.value")
+	AttributeEntityID    = attribute.Key("flipt.entity_id")
+	AttributeRequestID   = attribute.Key("flipt.request_id")
+)