GitNimay opened a new pull request, #14059:
URL: https://github.com/apache/apisix/pull/14059
### Description
The `opa` plugin sends its decision request to OPA with only a
`Content-Type` header. So with distributed tracing enabled, OPA never gets the
W3C trace context, and its spans start a new trace instead of joining the
APISIX request trace. The incoming `traceparent` is visible to OPA only inside
the JSON input (`input.request.headers`), which OPA does not use for tracing
(see open-policy-agent/opa#6905).
This PR forwards the request's current `traceparent` header on the call to
OPA. When the `opentelemetry` plugin is enabled, its rewrite phase has already
put the APISIX span into that header, so OPA's spans become children of the
APISIX span. If the header is missing, nothing extra is sent.
```mermaid
sequenceDiagram
participant C as Client
participant A as APISIX (opentelemetry + opa)
participant O as OPA
C->>A: GET /hello (traceparent: 00-T-client-01)
Note over A: opentelemetry starts span S and<br/>injects traceparent
00-T-S-xx
A->>O: POST /v1/data/<policy> (traceparent: 00-T-S-xx)
Note over O: OPA span is a child of S in trace T
```
I used a plain header rather than a schema option because OPA ignores
`traceparent` when its tracing is off, so forwarding it is harmless. I can put
it behind an option (e.g. `propagate_trace_context`) if reviewers prefer.
#### Which issue(s) this PR fixes:
Fixes #14051
### Tests
New `t/plugin/opa4.t` runs a mock OPA endpoint in the test server that
denies every request and echoes back the `traceparent` it received:
- TEST 2: a client `traceparent` is forwarded to OPA.
- TEST 3: no `traceparent` is sent when the request has none.
- TEST 5: with `opentelemetry` enabled, OPA gets the same trace id but the
APISIX span id, not the client's.
Without the fix, TEST 2 and TEST 5 fail (OPA gets no header). With the fix,
the file passes. `luacheck` and `lj-releng` are clean on
`apisix/plugins/opa.lua`.
### Checklist
- [x] I have explained the need for this PR and the problem it solves
- [x] I have explained the changes or the new features added to this PR
- [x] I have added tests corresponding to this change
- [x] I have updated the documentation to reflect this change
- [x] I have verified that this change is backward compatible (If not,
please discuss on the [APISIX mailing
list](https://github.com/apache/apisix/tree/master#community) first)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
