SQL T&I OTEL Collector PoC with JDBC driver - #2973
Draft
mdrakiburrahman wants to merge 19 commits into
Draft
Conversation
Replace the OSS observability stack (collector-contrib, Prometheus, Grafana, Jaeger) with the internal telemetry pipeline: the mssql-jdbc driver ships OTLP to otelcol-arcdata, which fans every signal out to Azure Delta Lake (Managed Identity via token-server, Event Hub via delta-bulk-loader) and to a local .NET Aspire Dashboard for metrics, traces, and logs. - docker-compose.yml: add token-server, otelcol-arcdata, delta-bulk-loader and aspire-dashboard; rewire driver -> otelcol-arcdata:4318; mount host ~/.azure. - internal/: vendor token-server build context, the arcdata collector config (otlp -> deltalake + otlp/aspire + debug), and delta-bulk-loader appsettings. - dev.sh: fresh-start teardown on every up, ACR login + pull, local-only green gates (smoke test, arcdata received metrics+traces, Aspire receiving, health), forever loadgen, prominent Aspire URL print. - Remove otel-collector-config.yaml, prometheus.yml, grafana/. - Trim README to a lean Docker-only runbook. - bootstrap_devbox.sh: point ACR login at arcdataanalyticsacr (hosts the images). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
mdrakiburrahman
changed the title
Add connection option otelUseSqlAccessToken and wire OTel bootstrap to consume fedAuthToken when available.\n\nAlso add OtelBootstrap header precedence tests, adjust callback test signatures, and document auth precedence/defaults in the OTel POC README. (cherry picked from commit ce9e726)
Replaces the one-shot Authorization header (set once at exporter init) with a Supplier<Map<String,String>> backed by an AtomicReference<String>. Every OTLP HTTP request now re-reads the current bearer, so the exporter survives the 1-hour AAD token expiry that previously caused 401s after the first refresh. - OtelBootstrap: new updateSqlToken(SqlAuthenticationToken) writes a pre-formatted 'Bearer <jwt>' into a shared AtomicReference; buildOrReuseGlobal now wires setHeaders(Supplier) on both the metric and span exporters when otelUseSqlAccessToken=true. - SQLServerConnection.onFedAuthInfo: calls OtelBootstrap.updateSqlToken right after fedAuthToken is assigned (covers first connect and every pool reconnect through SQLServerPooledConnection.needsReconnect). - Gated behind a cached otelEnabled boolean (set once in connectInternal from otelEndpoint) so non-OTel fedAuth connections pay zero overhead on the hot path. Cherry-pick conflict resolution (this branch): merged the upstream change with this branch's otelAccessTokenCallbackClass feature and extended the rotating Supplier to the callback path. currentBearer() resolves the live Authorization on every export with the same precedence as otlpHeaders() (SQL token > callback > explicit bearer); the callback JWT is re-minted near expiry (CALLBACK_REFRESH_SKEW_MS) and the reused SQL token refreshes on each fedAuth (re)connect. otlpHeaders() and its unit tests are preserved for one-shot resolution; OtelTokenHeaderCheck now validates currentBearer(); OtelBootstrapTest adds cases proving callback re-mint on expiry and caching before it. Verified E2E via the docs/otel-poc green gate. (cherry picked from commit 7c59861) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…n/sqlotelexperiment Resolves the PR microsoft#2973 conflicts. This branch supersedes the base for all OTel work, so every conflict was resolved in favor of this branch: - OtelBootstrap / SQLServerDriver / SQLServerResource / OtelBootstrapTest: kept this branch's versions (otelAccessTokenCallbackClass + a per-export rotating Supplier covering both the SQL-token and callback paths), which fully contain the base's sql-token-only rotation. - docs/otel-poc: kept this branch's arcdata + Aspire + Delta Lake docker-only stack, which deliberately replaced the base's Prometheus/Grafana/Jaeger stack. SQLServerConnection.java and PerformanceLogCallbackTest.java were already identical on both branches. The merged tree is identical to this branch's pre-merge tree (verified: git diff HEAD is empty), so there is no regression. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Driver: new optional otelArmResourceId connection property, sent as the x-ms-arm-resource-id OTLP header so the collector can run a CheckAccess (RBAC) authorization for callers whose token has no resource identity (no xms_mirid). POC: configure the MISE container's AzureAuthorizationModule with the kusto-proxy-3p-dev SNI cert (under AzureAd, SendX5C), enable authz_check_access on the collector, bump the collector image, and wire cert download (ensure_mise_cert), the arm id, and a CheckAccess assertion into dev.sh so 'dev.sh up' runs the whole flow. The downloaded PFX is git-ignored. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Remove otelEndpoint + otelArmResourceId from the POC connection string. On telemetry boot the driver now queries msdb.dbo.SQLServerAzureArcProperties (Arc-style) to self-discover the OTLP endpoint, Azure resource id, and region. - OtelBootstrap.discoverAndInitialize: post-login msdb probe, normalizes the endpoint to /v1/metrics, sets the x-ms-arm-resource-id header, and surfaces the region as a cloud.region resource attribute. Best-effort: never throws (missing table/perms/OTel libs all safe-skip). Explicit otelEndpoint still wins. - SQLServerConnection: guarded once-per-JVM hook after the connection opens. - docs/otel-poc: new sqlserver-init service idempotently seeds the 3 columns on boot from env vars; compose strips the two props; dev.sh waits for init to complete. Verified GREEN end-to-end (CheckAccess allowed, metrics+traces flow, cloud.region=eastus exported). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
mdrakiburrahman
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.