Merge branch 'main' into maxime.chambre/allow-check-config-without-init-config

Author: tobz

lib/saluki-components/src/common/otlp/traces/translator.rs

@@ -58,7 +58,7 @@ impl OtlpTracesTranslator {
 
     pub fn translate_resource_spans(&self, resource_spans: ResourceSpans, metrics: &Metrics) -> Vec<Event> {
         let resource: OtlpResource = resource_spans.resource.unwrap_or_default();
-        let resource_tags: TagSet = resource_attributes_to_tagset(&resource.attributes);
+        let resource_tags = resource_attributes_to_tagset(&resource.attributes).into_shared();
         let mut traces_by_id: FastHashMap<u64, TraceEntry> = FastHashMap::default();
         let ignore_missing_fields = self.config.ignore_missing_datadog_fields;
 

lib/saluki-components/src/common/otlp/util.rs

@@ -7,7 +7,7 @@ use std::sync::LazyLock;
 use opentelemetry_semantic_conventions::resource::*;
 use otlp_protos::opentelemetry::proto::common::v1::{self as otlp_common, any_value::Value};
 use saluki_common::collections::{FastHashMap, FastHashSet};
-use saluki_context::tags::TagSet;
+use saluki_context::tags::{SharedTagSet, TagSet};
 
 // ============================================================================
 // Datadog attribute key constants shared across the encoder and translator
@@ -144,9 +144,9 @@ pub fn extract_container_tags_from_resource_attributes(attributes: &[otlp_common
 
 /// Extracts container tags from a resource tagset and inserts them into the provided TagSet.
 ///
-/// This mirrors `extract_container_tags_from_resource_attributes`, but operates on a `TagSet` representation of the
-/// resource.
-pub fn extract_container_tags_from_resource_tagset(resource_tags: &TagSet, tags: &mut TagSet) {
+/// This mirrors `extract_container_tags_from_resource_attributes`, but operates on a `SharedTagSet` representation of
+/// the resource.
+pub fn extract_container_tags_from_resource_tagset(resource_tags: &SharedTagSet, tags: &mut TagSet) {
     let mut extracted_tags = FastHashSet::default();
 
     for tag in resource_tags {
@@ -208,10 +208,10 @@ pub fn resource_to_source(resource: &otlp_protos::opentelemetry::proto::resource
     None
 }
 
-/// Resolves the source metadata from a resource `TagSet`.
+/// Resolves the source metadata from a resource `SharedTagSet`.
 ///
 /// This is equivalent to `resource_to_source`, but avoids the OTLP protobuf resource type.
-pub fn tags_to_source(resource_tags: &TagSet) -> Option<Source> {
+pub fn tags_to_source(resource_tags: &SharedTagSet) -> Option<Source> {
     let get = |key: &str| -> Option<&str> { resource_tags.get_single_tag(key).and_then(|t| t.value()) };
 
     // AWS ECS Fargate

lib/saluki-components/src/encoders/datadog/traces/mod.rs

@@ -16,7 +16,7 @@ use opentelemetry_semantic_conventions::resource::{
 use protobuf::{rt::WireType, CodedOutputStream, Message};
 use saluki_common::task::HandleExt as _;
 use saluki_config::GenericConfiguration;
-use saluki_context::tags::TagSet;
+use saluki_context::tags::{SharedTagSet, TagSet};
 use saluki_core::data_model::event::trace::{
     AttributeScalarValue, AttributeValue, Span as DdSpan, SpanEvent as DdSpanEvent, SpanLink as DdSpanLink,
 };
@@ -774,12 +774,12 @@ fn write_map_entry_string_string(
     Ok(())
 }
 
-fn get_resource_tag_value<'a>(resource_tags: &'a TagSet, key: &str) -> Option<&'a str> {
+fn get_resource_tag_value<'a>(resource_tags: &'a SharedTagSet, key: &str) -> Option<&'a str> {
     resource_tags.get_single_tag(key).and_then(|t| t.value())
 }
 
 fn resolve_hostname<'a>(
-    resource_tags: &'a TagSet, source: Option<&'a OtlpSource>, default_hostname: Option<&'a str>,
+    resource_tags: &'a SharedTagSet, source: Option<&'a OtlpSource>, default_hostname: Option<&'a str>,
     ignore_missing_fields: bool,
 ) -> Option<&'a str> {
     let mut hostname = match source {
@@ -801,7 +801,7 @@ fn resolve_hostname<'a>(
     hostname
 }
 
-fn resolve_env(resource_tags: &TagSet, ignore_missing_fields: bool) -> Option<&str> {
+fn resolve_env(resource_tags: &SharedTagSet, ignore_missing_fields: bool) -> Option<&str> {
     if let Some(value) = get_resource_tag_value(resource_tags, KEY_DATADOG_ENVIRONMENT) {
         return Some(value);
     }
@@ -814,7 +814,7 @@ fn resolve_env(resource_tags: &TagSet, ignore_missing_fields: bool) -> Option<&s
     get_resource_tag_value(resource_tags, DEPLOYMENT_ENVIRONMENT_KEY)
 }
 
-fn resolve_container_id<'a>(resource_tags: &'a TagSet, first_span: Option<&'a DdSpan>) -> Option<&'a str> {
+fn resolve_container_id<'a>(resource_tags: &'a SharedTagSet, first_span: Option<&'a DdSpan>) -> Option<&'a str> {
     for key in [KEY_DATADOG_CONTAINER_ID, CONTAINER_ID, K8S_POD_UID] {
         if let Some(value) = get_resource_tag_value(resource_tags, key) {
             return Some(value);
@@ -832,15 +832,15 @@ fn resolve_container_id<'a>(resource_tags: &'a TagSet, first_span: Option<&'a Dd
     None
 }
 
-fn resolve_app_version(resource_tags: &TagSet) -> Option<&str> {
+fn resolve_app_version(resource_tags: &SharedTagSet) -> Option<&str> {
     if let Some(value) = get_resource_tag_value(resource_tags, KEY_DATADOG_VERSION) {
         return Some(value);
     }
     get_resource_tag_value(resource_tags, SERVICE_VERSION)
 }
 
 fn resolve_container_tags(
-    resource_tags: &TagSet, source: Option<&OtlpSource>, ignore_missing_fields: bool,
+    resource_tags: &SharedTagSet, source: Option<&OtlpSource>, ignore_missing_fields: bool,
 ) -> Option<MetaString> {
     // TODO: some refactoring is probably needed to normalize this function, the tags should already be normalized
     // since we do so when we transform OTLP spans to DD spans however to make this class extensible for non otlp traces, we would

lib/saluki-components/src/transforms/apm_stats/mod.rs

@@ -425,7 +425,7 @@ fn now_nanos() -> u64 {
 }
 
 /// Resolves container ID from OTLP resource tags.
-fn resolve_container_id(resource_tags: &TagSet) -> MetaString {
+fn resolve_container_id(resource_tags: &SharedTagSet) -> MetaString {
     for key in [KEY_DATADOG_CONTAINER_ID, CONTAINER_ID, K8S_POD_UID] {
         if let Some(tag) = resource_tags.get_single_tag(key) {
             if let Some(value) = tag.value() {
@@ -440,7 +440,7 @@ fn resolve_container_id(resource_tags: &TagSet) -> MetaString {
 }
 
 /// Extracts container tags from OTLP resource tags.
-fn extract_container_tags(resource_tags: &TagSet) -> SharedTagSet {
+fn extract_container_tags(resource_tags: &SharedTagSet) -> SharedTagSet {
     let mut container_tags_set = TagSet::default();
     extract_container_tags_from_resource_tagset(resource_tags, &mut container_tags_set);
 

lib/saluki-config/Cargo.toml

@@ -16,7 +16,8 @@ serde_json = { workspace = true }
 serde_yaml = { workspace = true }
 snafu = { workspace = true }
 tempfile = { workspace = true }
-tokio = { workspace = true, features = ["fs", "io-util", "process", "time"] }
+tokio = { workspace = true, features = ["fs", "io-util", "process", "sync", "time"] }
 tracing = { workspace = true }
+
 [dev-dependencies]
 tokio = { workspace = true, features = ["macros", "rt"] }

lib/saluki-config/src/lib.rs

@@ -334,20 +334,20 @@ impl ConfigurationLoader {
     /// Care should be taken to not return sensitive information in either the error output (standard error) of the
     /// backend command or the `error` field in the JSON response, as these values are logged in order to aid debugging.
     pub async fn with_default_secrets_resolution(mut self) -> Result<Self, ConfigurationError> {
-        let initial_figment = build_figment_from_sources(&self.provider_sources);
+        let configuration = build_figment_from_sources(&self.provider_sources);
 
         // If no secrets backend is set, we can't resolve secrets, so just return early.
-        if !initial_figment.contains("secret_backend_command") {
+        if !has_valid_secret_backend_command(&configuration) {
             debug!("No secrets backend configured; skipping secrets resolution.");
             return Ok(self);
         }
 
-        let resolver_config = initial_figment.extract::<secrets::resolver::ExternalProcessResolverConfiguration>()?;
+        let resolver_config = configuration.extract::<secrets::resolver::ExternalProcessResolverConfiguration>()?;
         let resolver = secrets::resolver::ExternalProcessResolver::from_configuration(resolver_config)
             .await
             .context(Secrets)?;
 
-        let provider = secrets::Provider::new(resolver, &initial_figment)
+        let provider = secrets::Provider::new(resolver, &configuration)
             .await
             .context(Secrets)?;
 
@@ -856,10 +856,53 @@ fn from_figment_error(lookup_sources: &HashSet<LookupSource>, e: figment::Error)
     }
 }
 
+fn has_valid_secret_backend_command(configuration: &Figment) -> bool {
+    configuration
+        .find_value("secret_backend_command")
+        .ok()
+        .is_some_and(|v| v.as_str().filter(|s| !s.is_empty()).is_some())
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    macro_rules! json_to_figment {
+        ($json:tt) => {
+            Figment::from(Serialized::defaults(serde_json::json!($json)))
+        };
+    }
+
+    #[test]
+    fn test_has_valid_secret_backend_command() {
+        // When `secrets_backend_command` is not set at all, or is set to an empty string, or isn't even a string
+        // value... then we should consider those scenarios as "secrets backend not configured".
+        let figment = Figment::new();
+        assert!(!has_valid_secret_backend_command(&figment));
+
+        let figment = json_to_figment!({
+            "secret_backend_command": ""
+        });
+        assert!(!has_valid_secret_backend_command(&figment));
+
+        let figment = json_to_figment!({
+            "secret_backend_command": false
+        });
+        assert!(!has_valid_secret_backend_command(&figment));
+
+        // Otherwise, whether it's a valid path or not, then we should consider things enabled, which means we'll
+        // at least attempt secrets resolution:
+        let figment = json_to_figment!({
+            "secret_backend_command": "/usr/bin/foo"
+        });
+        assert!(has_valid_secret_backend_command(&figment));
+
+        let figment = json_to_figment!({
+            "secret_backend_command": "or anything else"
+        });
+        assert!(has_valid_secret_backend_command(&figment));
+    }
+
     #[tokio::test]
     async fn test_static_configuration() {
         let (cfg, _) = ConfigurationLoader::for_tests(

lib/saluki-core/src/data_model/event/trace/mod.rs

@@ -1,7 +1,7 @@
 //! Traces.
 
 use saluki_common::collections::FastHashMap;
-use saluki_context::tags::TagSet;
+use saluki_context::tags::SharedTagSet;
 use stringtheory::MetaString;
 
 /// Trace-level sampling metadata.
@@ -61,7 +61,7 @@ pub struct Trace {
     /// Resource-level tags associated with this trace.
     ///
     /// This is derived from the resource of the spans and used to construct the tracer payload.
-    resource_tags: TagSet,
+    resource_tags: SharedTagSet,
     /// Trace-level sampling metadata.
     ///
     /// This field contains sampling decision information (priority, decision maker, rates)
@@ -72,10 +72,10 @@ pub struct Trace {
 
 impl Trace {
     /// Creates a new `Trace` with the given spans.
-    pub fn new(spans: Vec<Span>, resource_tags: TagSet) -> Self {
+    pub fn new(spans: Vec<Span>, resource_tags: impl Into<SharedTagSet>) -> Self {
         Self {
             spans,
-            resource_tags,
+            resource_tags: resource_tags.into(),
             sampling: None,
         }
     }
@@ -124,7 +124,7 @@ impl Trace {
     }
 
     /// Returns the resource-level tags associated with this trace.
-    pub fn resource_tags(&self) -> &TagSet {
+    pub fn resource_tags(&self) -> &SharedTagSet {
         &self.resource_tags
     }