feat(PLAT-1332): browser instrumentation - #5754
Draft
BenElferink wants to merge 20 commits into
Draft
Conversation
- Introduced a new browser proxy component to inject OpenTelemetry SDK into served HTML and forward telemetry to the Odigos collector. - Updated Makefile to include build and push targets for the browser proxy. - Added GitHub Actions workflow for building and testing the browser proxy image. - Enhanced instrumentation configuration to support browser as a new agent category. - Implemented necessary server logic for handling OTLP telemetry from the browser. This commit lays the groundwork for improved browser instrumentation and telemetry collection.
Updated the QuickScan method in the BrowserInspector to use the correct ExePath field from the ProcessContext, ensuring accurate process name retrieval for static server process names.
Included the actions/setup-go@v6 step in the GitHub Actions build workflow to specify Go version 1.26.2, ensuring consistent Go environment for builds and tests.
Added logic to the IsRestartRequired function to ensure that a restart is required when a browser sidecar is present. This change addresses the unique deployment requirements for browser distributions, which necessitate a rollout for the sidecar to be injected into the pod manifest.
Adjusted the logic in the IsRestartRequired function to check for the presence of the RuntimeAgent after verifying the BrowserSidecar. This change ensures that the function correctly determines when a restart is necessary based on the distribution's configuration.
Enhanced the instrumentation configuration by introducing a new reason, BrowserPortMissing, to indicate when browser instrumentation cannot be applied due to the absence of a TCP container port. This update includes modifications to the relevant CRD, types, and logic to ensure proper handling of this scenario in the agent's behavior.
Fold browser e2e into the source scenario, publish the browser-proxy image, add sidecar health probes, recompress gzip HTML after injection, and skip mesh pods that would collide on iptables. Co-authored-by: Cursor <cursoragent@cursor.com>
Chainsaw matches container slice length/order, so listing only the sidecar failed even though injection succeeded. Co-authored-by: Cursor <cursoragent@cursor.com>
Close the unauthenticated OTLP write path and stop injecting inline scripts. The sidecar now serves /__odigos/config.js with a per-process export token, requires Authorization on /__odigos/v1/*, rate-limits by IP/token, enforces same-site Origin checks, and propagates CSP nonces onto injected script tags. Co-authored-by: Ben <BenElferink@users.noreply.github.com>
BenElferink
changed the title
BenElferink
changed the title
BenElferink
changed the title
Keep browser-proxy build/scan/load targets and BrowserPortMissing status while adopting main's workflow matrix style, victoria-metrics kind load, and EnabledWithOtherAgents agent reason. Co-authored-by: Ben <BenElferink@users.noreply.github.com>
Update public.ecr.aws/odigos/agents/browser-community image tag from v0.2.0 to the newly released v0.3.0. Co-authored-by: Ben <BenElferink@users.noreply.github.com>
Add missing browser language enum values to Actions and InstrumentationConfig CRDs, and pass Release into the browser-proxy imageName helper so helm lint can resolve .Release.Namespace. Co-authored-by: Ben <BenElferink@users.noreply.github.com>
Chainsaw was failing on k8s 1.21 when Available/Progressing landed in the opposite order even though the deployment was ready. Co-authored-by: Ben <BenElferink@users.noreply.github.com>
Browser-proxy and agents POST OTLP logs to the node collector :4318, but the logs pipeline only wired filelog/eBPF. Without otlp/in as a logs consumer, the OTLP HTTP receiver returns 404 for /v1/logs. Co-authored-by: Ben <BenElferink@users.noreply.github.com>
During RollingUpdate maxSurge, status.replicas can briefly be 2 while Available/readyReplicas/updatedReplicas are already 1, which flakes trace-collection and similar suites. Co-authored-by: Ben <BenElferink@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Agent repo: https://github.com/odigos-io/opentelemetry-browser
Summary
Supersedes the security follow-up for #5129 (PLAT-1332).
Keeps the zero-code same-origin gateway (sidecar) but closes the production concerns raised in Slack:
/__odigos/v1/*exportTokenminted into/__odigos/config.js; required on OTLP POSTswindow.__ODIGOS__/__odigos/config.jsfor CSP compatibilityCompanion PRs: opentelemetry-browser, odigos-enterprise, vm-agent.
Proof of data: