* feat(observability): OpenTelemetry logs+traces with secret redaction Part of #265. Adds opt-in OpenTelemetry (logs + traces) alongside the existing stderr + opslog pipeline, plus secret redaction on all sinks. Default-off: with no OTEL_* / SILO_OTEL_ENABLED config, behavior is unchanged. Bootstrap (internal/telemetry): - Setup() builds one shared resource, a TracerProvider (parent-based trace-id ratio sampler), a LoggerProvider, and the W3C TraceContext+Baggage propagator from env. It installs NO MeterProvider — metrics stay on Prometheus, and the built-in no-op global MeterProvider keeps the trace instrumentation libs from double-emitting. Shutdown is deferred with a flush timeout. - Logs are bridged via otelslog fan-out (slog.MultiHandler), level-gated by the shared LevelVar and best-effort so a failing collector can't break the console or DB branches. stderr + opslog stay untouched. Secret redaction (internal/logredact): - A slog.Handler masks secret-keyed attributes (password, token, api_key, authorization, cookie, ...) — including .With-bound attrs, nested groups, secret-keyed group subtrees, and values behind a LogValuer — on the console and OTLP sinks, with a no-op fast path when a record has no secret keys. opslog.shouldRedact delegates to logredact.SecretKey so all sinks share one marker list. Rotation is infra-managed (no custom file sink): container runtime for stderr, collector/backend for OTLP, opslog partition-pruning for the DB. Documented in docs/architecture/observability.md. Verification: go build ./..., go vet, gofmt -l — clean; go test ./internal/telemetry/ ./internal/logredact/ -race pass. AI-use disclosure: implemented with AI assistance (Claude Code), including adversarial reviews that hardened the bootstrap and fixed two redaction leak paths; reviewed by the author. * refactor(observability): slog context+component sweep, sloglint gate (phase 3) Part of #265. Builds on the OTel bootstrap + redaction commit. Standardizes every log call site onto the context-carrying slog variants so records correlate with the active OpenTelemetry trace, and locks the standard in with a machine gate so future code (human- or AI-authored) can't drift back. - Call-site sweep: converted the remaining slog.<Level>(...) calls to the slog.<Level>Context(ctx, ...) form wherever a context.Context is in scope (background/init calls with no ctx are left as-is), across 183 files. Applied via a type-aware AST codemod. Log levels and message strings are preserved verbatim; a component attr (canonical per-package name) is added to direct package-level slog calls. Bound-logger calls keep their existing .With bindings. The main.go and telemetry package conversions rode with their file in the previous commit to keep each file within a single commit. - Enforcement (.golangci.yml): enable sloglint with context=scope, static-msg, key-naming-case=snake, no-mixed-args. After the sweep all four report zero violations repo-wide (tests included), so make lint / CI now blocks any regression to the non-context form. The gate ships with the sweep because it cannot be green until the legacy sites are converted. Metrics remain on Prometheus; no behavior change to /metrics or Grafana. Verification: go build ./..., go vet ./..., gofmt -l — clean; sloglint (all 4 rules) 0 violations repo-wide; log levels verified unchanged. AI-use disclosure: implemented with AI assistance (Claude Code), including the codemod; reviewed by the author. * fix(observability): honor per-signal OTLP protocol and secret WithGroup names Two Codex review findings on PR #290: - telemetry: OTEL_EXPORTER_OTLP_{TRACES,LOGS}_PROTOCOL now override the generic OTEL_EXPORTER_OTLP_PROTOCOL per signal, so mixed collector setups (e.g. HTTP logs + gRPC traces) build the right exporter. - logredact: entering a group whose name is secret-bearing (e.g. WithGroup("authorization")) now masks every leaf in that subtree, matching how slog.Group("authorization", ...) is masked as a whole. * fix(observability): address review feedback on telemetry bootstrap - Telemetry setup failure no longer kills boot: Setup returns usable no-op providers alongside the error and main logs and continues with telemetry disabled, honoring the best-effort contract. - Honor OTEL_TRACES_SAMPLER (always_on/off, traceidratio, parentbased_* variants); unsupported values fall back to parentbased_traceidratio. - Attach node identity as semconv service.instance.id instead of the non-semconv node.name. - Rename opslog retention-scope log attrs to target_component/target_level so they no longer collide with the canonical component routing key, and tag those lines with component=opslog. - Fix stale levelGated comment casing; use WarnContext in the telemetry shutdown defer; document the LogValuer double-resolve on the redaction slow path. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Quick <31828688+Quick104@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
136 lines
3.9 KiB
Go
136 lines
3.9 KiB
Go
package activitylog
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"log/slog"
|
|
"time"
|
|
|
|
"github.com/jackc/pgx/v5/pgxpool"
|
|
)
|
|
|
|
const (
|
|
keyRetentionDays = "activitylog.retention_days"
|
|
defaultRetentionStr = "90"
|
|
defaultRetention = 90
|
|
cleanupBatchSize = 10000
|
|
)
|
|
|
|
// SettingsStore is satisfied by *catalog.ServerSettingsRepo.
|
|
type SettingsStore interface {
|
|
Get(ctx context.Context, key string) (string, error)
|
|
Set(ctx context.Context, key, value string) error
|
|
}
|
|
|
|
type PartitionManager interface {
|
|
EnsureFuturePartitions(ctx context.Context) error
|
|
DropExpiredPartitions(ctx context.Context, cutoff time.Time) ([]string, error)
|
|
DeleteExpiredRowsFromDefault(ctx context.Context, cutoff time.Time) (int64, error)
|
|
}
|
|
|
|
// SeedDefaults writes default activity log settings if not already set.
|
|
func SeedDefaults(ctx context.Context, store SettingsStore) error {
|
|
existing, err := store.Get(ctx, keyRetentionDays)
|
|
if err != nil {
|
|
return fmt.Errorf("seed activitylog defaults: %w", err)
|
|
}
|
|
if existing != "" {
|
|
return nil
|
|
}
|
|
return store.Set(ctx, keyRetentionDays, defaultRetentionStr)
|
|
}
|
|
|
|
// RunCleanup starts a background goroutine that runs batched deletes daily.
|
|
// Blocks until ctx is cancelled.
|
|
func RunCleanup(ctx context.Context, pool *pgxpool.Pool, store SettingsStore, pm PartitionManager) {
|
|
// Run once at startup, then every 24 hours
|
|
CleanupOnce(ctx, pool, store, pm)
|
|
|
|
ticker := time.NewTicker(24 * time.Hour)
|
|
defer ticker.Stop()
|
|
|
|
for {
|
|
select {
|
|
case <-ctx.Done():
|
|
return
|
|
case <-ticker.C:
|
|
CleanupOnce(ctx, pool, store, pm)
|
|
}
|
|
}
|
|
}
|
|
|
|
// CleanupOnce runs a single activity log retention pass.
|
|
func CleanupOnce(ctx context.Context, pool *pgxpool.Pool, store SettingsStore, pm PartitionManager) int64 {
|
|
days := defaultRetention
|
|
if raw, err := store.Get(ctx, keyRetentionDays); err == nil && raw != "" {
|
|
if d := parseInt(raw); d > 0 {
|
|
days = d
|
|
}
|
|
}
|
|
|
|
cutoff := time.Now().UTC().AddDate(0, 0, -days)
|
|
if pm != nil {
|
|
if err := pm.EnsureFuturePartitions(ctx); err != nil {
|
|
slog.WarnContext(ctx, "activitylog ensure future partitions error", "component", "activitylog", "error", err)
|
|
}
|
|
|
|
partitionCleanupFailed := false
|
|
totalDeleted := int64(0)
|
|
if dropped, err := pm.DropExpiredPartitions(ctx, cutoff); err != nil {
|
|
slog.WarnContext(ctx, "activitylog partition cleanup error", "component", "activitylog", "error", err)
|
|
partitionCleanupFailed = true
|
|
} else if len(dropped) > 0 {
|
|
slog.InfoContext(ctx, "activitylog dropped expired partitions", "component", "activitylog", "partitions", dropped)
|
|
}
|
|
|
|
if deleted, err := pm.DeleteExpiredRowsFromDefault(ctx, cutoff); err != nil {
|
|
slog.WarnContext(ctx, "activitylog default partition cleanup error", "component", "activitylog", "error", err)
|
|
partitionCleanupFailed = true
|
|
} else if deleted > 0 {
|
|
totalDeleted += deleted
|
|
slog.InfoContext(ctx, "activitylog default partition cleanup completed", "component", "activitylog", "deleted", deleted, "retention_days", days)
|
|
}
|
|
|
|
if !partitionCleanupFailed {
|
|
return totalDeleted
|
|
}
|
|
slog.WarnContext(ctx, "activitylog partition cleanup degraded, falling back to row deletes", "component", "activitylog", "retention_days", days)
|
|
}
|
|
|
|
total := deleteExpiredRowsBefore(ctx, pool, cutoff)
|
|
if total > 0 {
|
|
slog.InfoContext(ctx, "activitylog cleanup completed", "component", "activitylog", "deleted", total, "retention_days", days)
|
|
}
|
|
return total
|
|
}
|
|
|
|
func deleteExpiredRowsBefore(ctx context.Context, pool *pgxpool.Pool, cutoff time.Time) int64 {
|
|
total := int64(0)
|
|
for {
|
|
result, err := pool.Exec(ctx, `
|
|
DELETE FROM activity_log
|
|
WHERE id IN (
|
|
SELECT id FROM activity_log
|
|
WHERE timestamp < $1
|
|
LIMIT $2
|
|
)
|
|
`, cutoff, cleanupBatchSize)
|
|
if err != nil {
|
|
slog.WarnContext(ctx, "activitylog cleanup error", "component", "activitylog", "error", err)
|
|
return total
|
|
}
|
|
deleted := result.RowsAffected()
|
|
total += deleted
|
|
if deleted < int64(cleanupBatchSize) {
|
|
break
|
|
}
|
|
}
|
|
return total
|
|
}
|
|
|
|
func parseInt(s string) int {
|
|
var v int
|
|
fmt.Sscanf(s, "%d", &v)
|
|
return v
|
|
}
|