-
Notifications
You must be signed in to change notification settings - Fork 7.7k
Including OTLP headers for tracing #43122
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
mabartos
commented
Oct 1, 2025
- Closes Including OTLP headers for authorization #41007
caa5519 to
66b0cec
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
As discussed offline, let's make this wildcard option: --tracing-header-<header>, e.g. --tracing-header-Authorization.
For the Operator, we will rely on additionalOptions field.
36f0d4d to
f211a39
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@mabartos Thank you for the PR!
| * @param namedKey the fully qualified (resolved) configuration key | ||
| * @return the part of {@code namedKey} that replaces the wildcard in {@code option.getKey()}, otherwise {@code null} | ||
| */ | ||
| public static String getWildcardName(Option<?> option, String namedKey) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Shouldn't this be rather getWildcardValue? It's a value of the <wildcard>, not name (which may imply a key), no?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Works to me. It's up to our consensus.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Updated
| Map<String, String> headers = new HashMap<>(); | ||
| String prefix = getWildcardPrefix(TRACING_HEADER.getKey()); | ||
|
|
||
| Configuration.getPropertyNames().forEach(key -> { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Iterating through all options is not ideal. Though I don't have a better idea to do this. Maybe @shawkins will.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Unforuntately I don't think there's a better way to do this currently. As long as this is only getting resolved when the tracing-headers quarkus property is requested, it shouldn't be too bad. @mabartos how many time do you see this method hit? Is it erroneously being validated for example.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I double-checked it and I can confirm it's evaluated only once per startup - when the quarkus.otel.exporter.otlp.traces.headers is requested (on the Quarkus side).
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The only other approach I could imagine would be to add an aggregation routine to validation. That is for propertymappers marked as aggregates, call them with each key value pair during the validation routine, and then some final compute / save method. To have that survive the cutover to the quarkus classloader would probably mean storing it as a system property.
That would keep the iterations down to a single time, but adds a good bit of complexity. So we'll hold off on doing that until there seems to be an actual performance hit.
| * @param key the configuration key to check | ||
| * @return {@code true} if the key represents an external wildcard option | ||
| */ | ||
| public static boolean isExternalWildcardOption(String key) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'd be maybe more explicit in the naming here. Maybe isKcOrQuarkusWildcardOption? "External" would suggest we're looking for Quarkus options only.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Good point. I updated the code and now using isWildcardOption() and isKcWildcardOption() that should be sufficient for the required use cases.
| * <p> | ||
| * Wildcard options in Keycloak always <strong>end</strong> with the variable segment. | ||
| */ | ||
| public class WildcardOptionsUtil { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If a method is used exclusively internally to WildcardPropertyMapper, could we start with it there? As much as possible I'd like to encapsulate the wildcard logic.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@shawkins Unfortunatelly, it's not used only internally in the WildcardPropertyMapper. I'd like to have some unified approach on how to do the basic ops with wildcard options. So, the util class seems fine to me as it'd be needed in the config-api module. I'd like to also use some parts in the #43542
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@shawkins Unfortunatelly, it's not used only internally in the WildcardPropertyMapper.
It just looked like some of the methods weren't used in other places yet. If there are other plans to expand the usage a util class seems fine, but I'd still vote for keeping it to the minimum number of methods.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ok, works for me. I'll try to minimize util methods
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@shawkins I tried to find some reasonable balance on what will be part of the wildcard options util class and I think all these methods belongs together as it's suggested that you first ask whether it's a wildcard option and then do some operations on the wildcard option.
Is it ok for you to leave it as is, or do you suggest any better approach?
| * isKcWildcardOption("tracing-header-headxxx>") → "false" | ||
| * isKcWildcardOption("db-kind-<datasource>") → "true" | ||
| * isKcWildcardOption("http-port") → "false" | ||
| * isKcWildcardOption("quarkus.<sth>.end") → "false" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Are you sure we can make this assumption in general?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@shawkins Why not? We've said the proper KC wildcard option needs to have the wildcard (variable segment) at the end. And the described method shows how is it evaluated as it's only for cases without the resolved name; only for properties with the < and > chars.
Do you have any concern?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
My concern was specifically with "quarkus..end" as that seems to be mixing both qualified and unqualified keys - if we expect quarkus., shouldn't all of them something like kc. or smallrye.?
Then are we sure that quarkus options cannot end with a wildcard, and will always have ".end"?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I kept only the isWildcardOption method that only check if the property contains the variable segment (< and >)
@shawkins WDYT?
Closes keycloak#41007 Signed-off-by: Martin Bartoš <[email protected]>
Signed-off-by: Martin Bartoš <[email protected]>
Signed-off-by: Martin Bartoš <[email protected]>