From 05be83b3848edd5a4979972298c65f3730012c8f Mon Sep 17 00:00:00 2001
From: Vadim Rutkovsky <vrutkovs@redhat.com>
Date: Thu, 12 Sep 2024 10:32:46 +0200
Subject: [PATCH] tracing: set audit-id on incoming requests

This helps us connect traces to audit logs via auditID. Some other
span also set audit-id, but it would be useful to have it set on
top-level span too
---
 .../apiserver/pkg/endpoints/filters/traces.go  |  7 ++++++-
 .../apiserver/tracing/tracing_test.go          | 18 ++++++++++++++++++
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/staging/src/k8s.io/apiserver/pkg/endpoints/filters/traces.go b/staging/src/k8s.io/apiserver/pkg/endpoints/filters/traces.go
index 6e36ffec862..90eb0f180c5 100644
--- a/staging/src/k8s.io/apiserver/pkg/endpoints/filters/traces.go
+++ b/staging/src/k8s.io/apiserver/pkg/endpoints/filters/traces.go
@@ -20,8 +20,10 @@ import (
 	"net/http"
 
 	"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
+	"go.opentelemetry.io/otel/attribute"
 	semconv "go.opentelemetry.io/otel/semconv/v1.17.0"
 	"go.opentelemetry.io/otel/trace"
+	"k8s.io/apiserver/pkg/audit"
 	"k8s.io/apiserver/pkg/endpoints/request"
 
 	tracing "k8s.io/component-base/tracing"
@@ -45,9 +47,12 @@ func WithTracing(handler http.Handler, tp trace.TracerProvider) http.Handler {
 	wrappedHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		// Add the http.target attribute to the otelhttp span
 		// Workaround for https://github.com/open-telemetry/opentelemetry-go-contrib/issues/3743
+		span := trace.SpanFromContext(r.Context())
 		if r.URL != nil {
-			trace.SpanFromContext(r.Context()).SetAttributes(semconv.HTTPTarget(r.URL.RequestURI()))
+			span.SetAttributes(semconv.HTTPTarget(r.URL.RequestURI()))
 		}
+		// Add auditID attribute if available. This helps us connect traces to audit log entries
+		span.SetAttributes(attribute.String("audit-id", audit.GetAuditIDTruncated(r.Context())))
 		handler.ServeHTTP(w, r)
 	})
 	// With Noop TracerProvider, the otelhttp still handles context propagation.
diff --git a/test/integration/apiserver/tracing/tracing_test.go b/test/integration/apiserver/tracing/tracing_test.go
index 0a00a138f9c..eafefa45b78 100644
--- a/test/integration/apiserver/tracing/tracing_test.go
+++ b/test/integration/apiserver/tracing/tracing_test.go
@@ -320,6 +320,9 @@ endpoint: %s`, listener.Addr().String())), os.FileMode(0755)); err != nil {
 						"http.method": func(v *commonv1.AnyValue) bool {
 							return v.GetStringValue() == "POST"
 						},
+						"audit-id": func(v *commonv1.AnyValue) bool {
+							return v.GetStringValue() != ""
+						},
 					},
 				},
 				{
@@ -439,6 +442,9 @@ endpoint: %s`, listener.Addr().String())), os.FileMode(0755)); err != nil {
 						"http.method": func(v *commonv1.AnyValue) bool {
 							return v.GetStringValue() == "GET"
 						},
+						"audit-id": func(v *commonv1.AnyValue) bool {
+							return v.GetStringValue() != ""
+						},
 					},
 				},
 				{
@@ -529,6 +535,9 @@ endpoint: %s`, listener.Addr().String())), os.FileMode(0755)); err != nil {
 						"http.method": func(v *commonv1.AnyValue) bool {
 							return v.GetStringValue() == "GET"
 						},
+						"audit-id": func(v *commonv1.AnyValue) bool {
+							return v.GetStringValue() != ""
+						},
 					},
 				},
 				{
@@ -615,6 +624,9 @@ endpoint: %s`, listener.Addr().String())), os.FileMode(0755)); err != nil {
 						"http.method": func(v *commonv1.AnyValue) bool {
 							return v.GetStringValue() == "PUT"
 						},
+						"audit-id": func(v *commonv1.AnyValue) bool {
+							return v.GetStringValue() != ""
+						},
 					},
 				},
 				{
@@ -759,6 +771,9 @@ endpoint: %s`, listener.Addr().String())), os.FileMode(0755)); err != nil {
 						"http.method": func(v *commonv1.AnyValue) bool {
 							return v.GetStringValue() == "PATCH"
 						},
+						"audit-id": func(v *commonv1.AnyValue) bool {
+							return v.GetStringValue() != ""
+						},
 					},
 				},
 				{
@@ -880,6 +895,9 @@ endpoint: %s`, listener.Addr().String())), os.FileMode(0755)); err != nil {
 						"http.method": func(v *commonv1.AnyValue) bool {
 							return v.GetStringValue() == "DELETE"
 						},
+						"audit-id": func(v *commonv1.AnyValue) bool {
+							return v.GetStringValue() != ""
+						},
 					},
 				},
 				{