fix(ingress-nginx): filter out healthcheck traces

Author: dmehala

src/tracing_library.cpp

@@ -31,23 +31,24 @@ extern "C" {
 namespace datadog {
 namespace nginx {
 
-inline constexpr std::string_view integration_name_from_flavor(
-    flavor nginx_flavor) {
+inline constexpr std::string_view
+integration_name_from_flavor(flavor nginx_flavor) {
   switch (nginx_flavor) {
-    case flavor::vanilla:
-      return "nginx";
-    case flavor::openresty:
-      return "nginx:openresty";
-    case flavor::ingress_nginx:
-      return "nginx:ingress-nginx";
+  case flavor::vanilla:
+    return "nginx";
+  case flavor::openresty:
+    return "nginx:openresty";
+  case flavor::ingress_nginx:
+    return "nginx:ingress-nginx";
   }
 
   static_assert(true, "unknown NGINX flavor");
   std::abort();
 }
 
-dd::Expected<dd::Tracer> TracingLibrary::make_tracer(
-    const datadog_main_conf_t &nginx_conf, std::shared_ptr<dd::Logger> logger) {
+dd::Expected<dd::Tracer>
+TracingLibrary::make_tracer(const datadog_main_conf_t &nginx_conf,
+                            std::shared_ptr<dd::Logger> logger) {
   dd::TracerConfig config;
   config.logger = std::move(logger);
   config.agent.event_scheduler = std::make_shared<NgxEventScheduler>();
@@ -97,8 +98,8 @@ dd::Expected<dd::Tracer> TracingLibrary::make_tracer(
         (nginx_conf.appsec_enabled != NGX_CONF_UNSET);
     security::register_with_remote_cfg(
         config.agent,
-        !has_custom_ruleset,         // no custom ruleset => ruleset via rem cfg
-        !appsec_enabling_explicit);  // no explicit => control via rem cfg
+        !has_custom_ruleset,        // no custom ruleset => ruleset via rem cfg
+        !appsec_enabling_explicit); // no explicit => control via rem cfg
   }
 #endif
 
@@ -119,6 +120,17 @@ dd::Expected<dd::Tracer> TracingLibrary::make_tracer(
                     .resource = "GET /is-dynamic-lb-initialized",
                     .tags = {}},
             .mechanism = datadog::tracing::SamplingMechanism::RULE});
+
+    // TODO(@dmehala): Disable tracing if `stub_status on;`.
+    final_config->trace_sampler.rules.emplace_back(
+        datadog::tracing::TraceSamplerRule{
+            .rate = datadog::tracing::Rate::zero(),
+            .matcher =
+                datadog::tracing::SpanMatcher{.service = "*",
+                                              .name = "*",
+                                              .resource = "GET /nginx_status",
+                                              .tags = {}},
+            .mechanism = datadog::tracing::SamplingMechanism::RULE});
   }
 
   if (!final_config) {
@@ -145,7 +157,7 @@ namespace {
 class SpanContextJSONWriter : public dd::DictWriter {
   rapidjson::Document output_object_;
 
- public:
+public:
   SpanContextJSONWriter() : output_object_() { output_object_.SetObject(); }
 
   void set(std::string_view key, std::string_view value) override {
@@ -193,7 +205,7 @@ std::string span_property(std::string_view key, const dd::Span &span) {
   return not_found;
 }
 
-}  // namespace
+} // namespace
 
 NginxVariableFamily TracingLibrary::span_variables() {
   return {.prefix = "datadog_", .resolve = span_property};
@@ -246,5 +258,5 @@ bool TracingLibrary::trace_locations_by_default() { return false; }
 
 bool TracingLibrary::bagage_span_tags_by_default() { return true; }
 
-}  // namespace nginx
-}  // namespace datadog
+} // namespace nginx
+} // namespace datadog

test/cases/ingress-nginx/conf/main.conf

@@ -21,5 +21,9 @@ http {
         location /is-dynamic-lb-initialized {
             proxy_pass http://http:8080;
         }
+
+        location /nginx_status {
+            proxy_pass http://http:8080;
+        }
     }
 }

test/cases/ingress-nginx/test_rules.py

@@ -35,3 +35,27 @@ def test_healthcheck(self):
         response = json.loads(body)
         self.assertEqual(response["headers"]["x-datadog-sampling-priority"],
                          "1")
+
+    def test_healthcheck_stubstatus(self):
+        # Healthcheck request MUST not be generated traces.
+        conf_path = Path(__file__).parent / "conf" / "main.conf"
+        conf_text = conf_path.read_text()
+
+        status, log_lines = self.orch.nginx_replace_config(
+            conf_text, conf_path.name)
+        self.assertEqual(status, 0, log_lines)
+
+        status, _, body = self.orch.send_nginx_http_request(
+            "/nginx_status")
+        self.assertEqual(status, 200)
+
+        response = json.loads(body)
+        self.assertEqual(response["headers"]["x-datadog-sampling-priority"],
+                         "-1")
+
+        status, _, body = self.orch.send_nginx_http_request("/")
+        self.assertEqual(status, 200)
+
+        response = json.loads(body)
+        self.assertEqual(response["headers"]["x-datadog-sampling-priority"],
+                         "1")

test/cases/opentelemetry/test_otel_drop_in_support.py

@@ -137,6 +137,13 @@ def test_directives(self):
                 "service": "*",
                 "tags": {},
             })
+            rules.append({
+                "name": "*",
+                "resource": "GET /nginx_status",
+                "sample_rate": 0.0,
+                "service": "*",
+                "tags": {},
+            })
 
         pattern = {
             "service": "foo",