Documentation
¶
Overview ¶
Package otelsetup is a node-agent-specific wrapper around github.com/kubescape/go-logger/otelsetup. It delegates provider initialisation to the shared package and adds the node-agent-specific slow-evaluation threshold, named accessors, and structured alert log emission.
Index ¶
- func EmitAlertLogRecord(ctx context.Context, attrs AlertLogAttrs)
- func InitProviders(ctx context.Context, cfg ProviderConfig) (shutdown func(context.Context) error, err error)
- func Logger() otellog.Logger
- func Meter() metric.Meter
- func SlowEvalThreshold() time.Duration
- func Tracer() trace.Tracer
- type AlertLogAttrs
- type ProfileLifecycleTracker
- func (t *ProfileLifecycleTracker) LearningCtx(containerID string) context.Context
- func (t *ProfileLifecycleTracker) LearningSpanID(containerID string) string
- func (t *ProfileLifecycleTracker) LearningTraceparent(containerID string) string
- func (t *ProfileLifecycleTracker) OnEntrySaved(containerID string, hasDropped bool)
- func (t *ProfileLifecycleTracker) OnLearningEnded(containerID, reason string)
- func (t *ProfileLifecycleTracker) OnLearningStarted(containerID, namespace, pod, image string)
- type ProviderConfig
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func EmitAlertLogRecord ¶
func EmitAlertLogRecord(ctx context.Context, attrs AlertLogAttrs)
EmitAlertLogRecord emits a structured "SecurityAlert" log record carrying all alert dimensions as record attributes so the back-office can index/filter without parsing the body.
func InitProviders ¶
func InitProviders(ctx context.Context, cfg ProviderConfig) (shutdown func(context.Context) error, err error)
InitProviders initialises OTEL providers via the shared go-logger package and resolves the node-agent-specific slow-evaluation threshold. When OTEL_METRICS_EXPORTER=prometheus, a Prometheus scrape endpoint is started on :8080/metrics in addition to (or instead of) OTLP metric export.
func SlowEvalThreshold ¶
SlowEvalThreshold returns the threshold above which rule evaluations should emit a trace span.
Types ¶
type AlertLogAttrs ¶
type AlertLogAttrs struct {
RuleID string
AlertType string
ContainerID string
ContainerName string
Namespace string
PodName string
Image string
EventType string
MalwareSignature string
}
AlertLogAttrs is the structured attribute payload for EmitAlertLogRecord. MalwareSignature is optional — leave empty for non-malware alerts.
type ProfileLifecycleTracker ¶
type ProfileLifecycleTracker struct {
// contains filtered or unexported fields
}
ProfileLifecycleTracker manages one long-running trace span per container learning period. State transitions are recorded as span events.
func NewProfileLifecycleTracker ¶
func NewProfileLifecycleTracker() *ProfileLifecycleTracker
func (*ProfileLifecycleTracker) LearningCtx ¶
func (t *ProfileLifecycleTracker) LearningCtx(containerID string) context.Context
LearningCtx returns the context carrying the active learning span for the given container, or context.Background() if no span is tracked. Pass this to logger.L().Ctx(...) at error sites so the log record inherits the learning span's trace_id/span_id for span↔log correlation.
func (*ProfileLifecycleTracker) LearningSpanID ¶
func (t *ProfileLifecycleTracker) LearningSpanID(containerID string) string
LearningSpanID returns the hex span ID of the active learning span for the given container, or an empty string if no span is tracked. Used by backend processors to link their own spans back into this trace.
func (*ProfileLifecycleTracker) LearningTraceparent ¶
func (t *ProfileLifecycleTracker) LearningTraceparent(containerID string) string
LearningTraceparent returns the W3C traceparent header value for the active learning span, or an empty string if no span is tracked. Stamp this onto storage objects so downstream components (kubescape/storage aggregation) can extract the remote span context and create properly parented child spans.
func (*ProfileLifecycleTracker) OnEntrySaved ¶
func (t *ProfileLifecycleTracker) OnEntrySaved(containerID string, hasDropped bool)
OnEntrySaved emits an immediate child span when a checkpoint profile is shipped, subject to M2 throttling: spans are emitted on the first snapshot, every 10th, and any snapshot that had dropped events. This keeps span volume within the per-agent budget while preserving visibility on errors.
func (*ProfileLifecycleTracker) OnLearningEnded ¶
func (t *ProfileLifecycleTracker) OnLearningEnded(containerID, reason string)
OnLearningEnded ends the lifecycle span with the given reason ("completed", "evicted", "too_large", "terminated").
func (*ProfileLifecycleTracker) OnLearningStarted ¶
func (t *ProfileLifecycleTracker) OnLearningStarted(containerID, namespace, pod, image string)
OnLearningStarted begins a lifecycle span for the container.
type ProviderConfig ¶
type ProviderConfig = gotelsetup.ProviderConfig
ProviderConfig is a type alias for the shared config so callers in this module need not import go-logger/otelsetup directly.
Source Files