feat(sensing-server): secure opt-in OpenTelemetry log export - #1465
Merged
Conversation
Import and harden the OpenTelemetry logging work from #1382. Preserve default stderr behavior, register and validate RuView semantic conventions, attach a published schema, enable TLS roots, pin demo images, and fix first-CSI node lifecycle reporting. Supersedes #1382 Closes #1460 Co-authored-by: Jens Holdgaard Pedersen <jens@holdgaard.org>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| # template-mining log backend that is OTLP-native on ingest. Query the | ||
| # logs at http://localhost:4319/v1/query — see docs/observability.md. | ||
| services: | ||
| sensing-server: |
| # template-mining log backend that is OTLP-native on ingest. Query the | ||
| # logs at http://localhost:4319/v1/query — see docs/observability.md. | ||
| services: | ||
| sensing-server: |
| # template-mining log backend that is OTLP-native on ingest. Query the | ||
| # logs at http://localhost:4319/v1/query — see docs/observability.md. | ||
| services: | ||
| sensing-server: |
| # only activates when OTEL_EXPORTER_OTLP_ENDPOINT is set. | ||
| SENSING_FEATURES: mqtt,otel | ||
| image: ruvnet/wifi-densepose:otel | ||
| ports: |
| depends_on: | ||
| - otel-collector | ||
|
|
||
| otel-collector: |
| # mining + DataFusion). Local-disk storage; the tenant derives from the | ||
| # exported resource's service.name, so RuView's logs land in tenant | ||
| # "ruview". | ||
| ourios: |
| - OURIOS_RECEIVER_HTTP_ADDR=0.0.0.0:4318 | ||
| - OURIOS_QUERIER_ENABLED=1 | ||
| - OURIOS_QUERIER_HTTP_ADDR=0.0.0.0:4319 | ||
| ports: |
| uses: actions/checkout@v4 | ||
| with: | ||
| persist-credentials: false | ||
| - uses: dtolnay/rust-toolchain@stable |
| ports: | ||
| - "4319:4319" # query endpoint (http://localhost:4319/v1/query) | ||
| volumes: | ||
| - ourios-data:/data |
| - "4319:4319" # query endpoint (http://localhost:4319/v1/query) | ||
| volumes: | ||
| - ourios-data:/data | ||
| - ourios-wal:/wal |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This imports and hardens the OpenTelemetry logging work from #1382 while preserving credit to @jensholdgaard.
otelfeature andOTEL_EXPORTER_OTLP_ENDPOINTruview.*events and attributes, exact Weaver validation/codegen, and a published OpenTelemetry schema documentSecurity review
otel,mqttsensing-server dependency graph contains none of the workspace's known RustSec-vulnerablequick-xml/rsapackages; the pre-existing yanked-onlyspin 0.9.8remains transitively underrumqttc -> flumeValidation
cargo check -p wifi-densepose-sensing-server --all-targetscargo check -p wifi-densepose-sensing-server --all-targets --features otel,mqttcargo test -p wifi-densepose-sensing-server --features otel,mqtt(778 passed, 0 failed, 1 ignored doc example)cargo build -p wifi-densepose-sensing-server --release --features otel,mqtt--benchmarksmoke test (1,000 frames)docker compose -f docker/otel-compose.yml config --quietcargo metadata --lockedgit diff --checkThe repository's existing all-target Clippy debt is unchanged; no finding points to the files added or modified for this feature.
Closes #1460
Supersedes #1382