Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(detector-aws): add DetectorSync implementation for EKS detector #2333

Closed
wants to merge 4 commits into from
+609 −227
Closed

feat(detector-aws): add DetectorSync implementation for EKS detector #2333

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f1005f2
refactor(detector-aws): change implementation to DetectorSync interfa…
david-luna Jul 12, 2024
71d2193
Merge branch 'main' into dluna/aws-eks-detector-sync
david-luna Aug 1, 2024
8ca9707
refactor(detector-aws): add EKS detector implementing DetectorSync in…
david-luna Aug 1, 2024
acf8650
chore(detector-aws): fix lint issues
david-luna Aug 1, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
199 changes: 8 additions & 191 deletions detectors/node/opentelemetry-resource-detector-aws/src/detectors/AwsEksDetector.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,21 +16,11 @@

import {
Detector,
Resource,
IResource,
ResourceDetectionConfig,
} from '@opentelemetry/resources';
import {
SEMRESATTRS_CLOUD_PROVIDER,
SEMRESATTRS_CLOUD_PLATFORM,
SEMRESATTRS_K8S_CLUSTER_NAME,
SEMRESATTRS_CONTAINER_ID,
CLOUDPROVIDERVALUES_AWS,
CLOUDPLATFORMVALUES_AWS_EKS,
} from '@opentelemetry/semantic-conventions';
import * as https from 'https';
import * as fs from 'fs';
import * as util from 'util';
import { diag } from '@opentelemetry/api';

import { awsEksDetectorSync } from './AwsEksDetectorSync';

/**
* The AwsEksDetector can be used to detect if a process is running in AWS Elastic
Expand All @@ -39,193 +29,20 @@ import { diag } from '@opentelemetry/api';
*
* See https://docs.amazonaws.cn/en_us/xray/latest/devguide/xray-guide.pdf
* for more details about detecting information for Elastic Kubernetes plugins
*
* @deprecated Use the new {@link AwsEksDetectorSync} class instead.
*/

export class AwsEksDetector implements Detector {
// NOTE: these readonly props are kept for testing purposes
readonly K8S_SVC_URL = 'kubernetes.default.svc';
readonly K8S_TOKEN_PATH =
'/var/run/secrets/kubernetes.io/serviceaccount/token';
readonly K8S_CERT_PATH =
'/var/run/secrets/kubernetes.io/serviceaccount/ca.crt';
readonly AUTH_CONFIGMAP_PATH =
'/api/v1/namespaces/kube-system/configmaps/aws-auth';
readonly CW_CONFIGMAP_PATH =
'/api/v1/namespaces/amazon-cloudwatch/configmaps/cluster-info';
readonly CONTAINER_ID_LENGTH = 64;
readonly DEFAULT_CGROUP_PATH = '/proc/self/cgroup';
readonly TIMEOUT_MS = 2000;
readonly UTF8_UNICODE = 'utf8';

private static readFileAsync = util.promisify(fs.readFile);
private static fileAccessAsync = util.promisify(fs.access);

/**
* The AwsEksDetector can be used to detect if a process is running on Amazon
* Elastic Kubernetes and returns a promise containing a {@link Resource}
* populated with instance metadata. Returns a promise containing an
* empty {@link Resource} if the connection to kubernetes process
* or aws config maps fails
* @param config The resource detection config
*/
async detect(_config?: ResourceDetectionConfig): Promise<Resource> {
try {
await AwsEksDetector.fileAccessAsync(this.K8S_TOKEN_PATH);
const k8scert = await AwsEksDetector.readFileAsync(this.K8S_CERT_PATH);

if (!(await this._isEks(k8scert))) {
return Resource.empty();
}

const containerId = await this._getContainerId();
const clusterName = await this._getClusterName(k8scert);

return !containerId && !clusterName
? Resource.empty()
: new Resource({
[SEMRESATTRS_CLOUD_PROVIDER]: CLOUDPROVIDERVALUES_AWS,
[SEMRESATTRS_CLOUD_PLATFORM]: CLOUDPLATFORMVALUES_AWS_EKS,
[SEMRESATTRS_K8S_CLUSTER_NAME]: clusterName || '',
[SEMRESATTRS_CONTAINER_ID]: containerId || '',
});
} catch (e) {
diag.warn('Process is not running on K8S', e);
return Resource.empty();
}
}

/**
* Attempts to make a connection to AWS Config map which will
* determine whether the process is running on an EKS
* process if the config map is empty or not
*/
private async _isEks(cert: Buffer): Promise<boolean> {
const options = {
ca: cert,
headers: {
Authorization: await this._getK8sCredHeader(),
},
hostname: this.K8S_SVC_URL,
method: 'GET',
path: this.AUTH_CONFIGMAP_PATH,
timeout: this.TIMEOUT_MS,
};
return !!(await this._fetchString(options));
}

/**
* Attempts to make a connection to Amazon Cloudwatch
* Config Maps to grab cluster name
*/
private async _getClusterName(cert: Buffer): Promise<string | undefined> {
const options = {
ca: cert,
headers: {
Authorization: await this._getK8sCredHeader(),
},
host: this.K8S_SVC_URL,
method: 'GET',
path: this.CW_CONFIGMAP_PATH,
timeout: this.TIMEOUT_MS,
};
const response = await this._fetchString(options);
try {
return JSON.parse(response).data['cluster.name'];
} catch (e) {
diag.warn('Cannot get cluster name on EKS', e);
}
return '';
}
/**
* Reads the Kubernetes token path and returns kubernetes
* credential header
*/
private async _getK8sCredHeader(): Promise<string> {
try {
const content = await AwsEksDetector.readFileAsync(
this.K8S_TOKEN_PATH,
this.UTF8_UNICODE
);
return 'Bearer ' + content;
} catch (e) {
diag.warn('Unable to read Kubernetes client token.', e);
}
return '';
}

/**
* Read container ID from cgroup file generated from docker which lists the full
* untruncated docker container ID at the end of each line.
*
* The predefined structure of calling /proc/self/cgroup when in a docker container has the structure:
*
* #:xxxxxx:/
*
* or
*
* #:xxxxxx:/docker/64characterID
*
* This function takes advantage of that fact by just reading the 64-character ID from the end of the
* first line. In EKS, even if we fail to find target file or target file does
* not contain container ID we do not throw an error but throw warning message
* and then return null string
*/
private async _getContainerId(): Promise<string | undefined> {
try {
const rawData = await AwsEksDetector.readFileAsync(
this.DEFAULT_CGROUP_PATH,
this.UTF8_UNICODE
);
const splitData = rawData.trim().split('\n');
for (const str of splitData) {
if (str.length > this.CONTAINER_ID_LENGTH) {
return str.substring(str.length - this.CONTAINER_ID_LENGTH);
}
}
} catch (e: any) {
diag.warn(`AwsEksDetector failed to read container ID: ${e.message}`);
}
return undefined;
}

/**
* Establishes an HTTP connection to AWS instance document url.
* If the application is running on an EKS instance, we should be able
* to get back a valid JSON document. Parses that document and stores
* the identity properties in a local map.
*/
private async _fetchString(options: https.RequestOptions): Promise<string> {
return await new Promise((resolve, reject) => {
const timeoutId = setTimeout(() => {
req.abort();
reject(new Error('EKS metadata api request timed out.'));
}, 2000);

const req = https.request(options, res => {
clearTimeout(timeoutId);
const { statusCode } = res;
res.setEncoding(this.UTF8_UNICODE);
let rawData = '';
res.on('data', chunk => (rawData += chunk));
res.on('end', () => {
if (statusCode && statusCode >= 200 && statusCode < 300) {
try {
resolve(rawData);
} catch (e) {
reject(e);
}
} else {
reject(
new Error('Failed to load page, status code: ' + statusCode)
);
}
});
});
req.on('error', err => {
clearTimeout(timeoutId);
reject(err);
});
req.end();
});
detect(_config?: ResourceDetectionConfig): Promise<IResource> {
return Promise.resolve(awsEksDetectorSync.detect());
}
}

Expand Down
Loading
Loading