chore: More complete tracing for RBAC functions #5690
Conversation
Remaining data points untracked: - Number of queries after a prepare - CompileToSQL time Excluded: - Any IDs, not needed - Authorize result (true/false) - Authorize reason (group or perms for true)
The input.json is required to play with the rego cli and debug the policy without golang. It is good to have an example to run the commands in the readme.md
Prometheus metrics only track single authorize and prepare calls
coderd/rbac/authz.go
Outdated
| span.AddEvent("prepared", | ||
| trace.WithAttributes(attribute.Int("num_queries", len(prepared.preparedQueries))), | ||
| trace.WithAttributes(attribute.Bool("always_true", prepared.alwaysTrue)), | ||
| ) |
There was a problem hiding this comment.
I think instead of adding an event to attach these attributes it'd make more sense to just attach them to the parent span above, or just give (RegoAuthorizer).Prepare it's own span?
There was a problem hiding this comment.
I made it an event because I wanted the timing of the prepare call, so these are the return values. I agree it would be better on the parent.
If I use time.Now() and WithTimestamp though, I could start the span after the call happened and get all attributes. what do you think?
There was a problem hiding this comment.
I think it might just be better to call tracing.StartSpan() inside prepare then? That way you have the timing for that function specifically and can add attributes to it
There was a problem hiding this comment.
The attributes are the return though. So even if I put it in, I cannot put those attributes at the start of the call.
There was a problem hiding this comment.
tracing.StartSpan returns a span you can set the attributes on
There was a problem hiding this comment.
Oh TIL I can add attributes after a span was stared. I thought I read that you could not. I'll just add to parent span 👍
Github syncing is having issues on this PR for some reason.
Filterfunction has tracing for the batch ifFilterbecomes slow.Extra
I also added more benchmarks to benchmark the
Authorizefunction. I am seeing the average time being <1ms. Telemetry shows some slower authorize calls, hoping these attributes helps identify some patterns in what calls are slow.