Files
substrate/cmd/atecontroller/internal/controllers/workerpool_controller.go
T
Krisztian F 15eecd02c9 Define a production-ready default tracing policy (#711)
Today everything outside ateapi hardcodes `ParentBased(NeverSample)`,
and setting `OTEL_TRACES_SAMPLER` does nothing because an explicit
sampler silences the SDK's env handling. This makes troubleshooting
production issues impossible via traces.

This PR gives every component a sane default and makes the standard OTel
env vars work:

- Control plane (ateapi, atelet, ateom) defaults to
`parentbased_traceidratio` 0.1, the router (data plane root) to 0.01,
per the discussion on #584.
- `OTEL_TRACES_SAMPLER` / `OTEL_TRACES_SAMPLER_ARG` override any of this
without a rebuild. Invalid values keep the component default and log a
warning instead of inheriting the SDK's fall-open-to-100% behavior.
- Envoy's `RandomSampling` is derived from the router's resolved policy,
so the two root decisions cannot drift.
- kubectl-ate without `--trace` no longer installs a tracer provider at
all: the old `NeverSample` provider injected `sampled=0`, which pinned
every parent based sampler downstream and would have defeated the server
side ratios. `--trace` still forces a full end to end trace.
- ate-controller propagates the two env vars to the ateom worker pods it
creates, same as the metric export vars.
- kind pins ateapi to `parentbased_always_on`, so the local Jaeger flow
keeps showing every API call.
- The agentgateway integration follows what we have above. its
`randomSampling` changes from `true` to `0.01` to match the data plane
default, though as static config it does not follow
`OTEL_TRACES_SAMPLER` overrides, so the two need adjusting together.


Verified on a kind cluster e2e manually. It resolved samplers logged at
startup, a `--trace` resume produced one trace across ateapi, atelet,
and ateom, an unsampled CLI call got picked up server side, Envoy
continued a sampled traceparent while sampling 0 of 30 parentless
requests at the 1% default, and an invalid env value fell back to the
component default.

Gating who may use `--trace` stays a separate follow-up (and a
discussion), and the more sophisticaed tracing policies belongs in a
collector, not in substrate.

Fixes #584
cc. @git286 

- [x] Tests pass
- [x] Appropriate changes to documentation are included in the PR
2026-08-04 11:31:04 -04:00

149 lines
4.9 KiB
Go

// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package controllers
import (
"context"
"fmt"
appsv1 "k8s.io/api/apps/v1"
"k8s.io/apimachinery/pkg/api/equality"
k8errors "k8s.io/apimachinery/pkg/api/errors"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apimachinery/pkg/types"
ctrl "sigs.k8s.io/controller-runtime"
"sigs.k8s.io/controller-runtime/pkg/client"
"sigs.k8s.io/controller-runtime/pkg/log"
atev1alpha1 "github.com/agent-substrate/substrate/pkg/api/v1alpha1"
)
const workerPoolFieldOwner = "workerpool-controller"
type WorkerPoolReconciler struct {
client.Client
Scheme *runtime.Scheme
OTelEndpoint string
// OTelMetricExportInterval is the OTEL_METRIC_EXPORT_INTERVAL propagated to
// ateom pods. Empty keeps the SDK's default.
OTelMetricExportInterval string
// OTelMetricExportTimeout is the OTEL_METRIC_EXPORT_TIMEOUT propagated to
// ateom pods. Empty keeps the SDK's default.
OTelMetricExportTimeout string
// OTelTracesSampler is the OTEL_TRACES_SAMPLER propagated to ateom pods.
// Empty keeps the ateom binary's default.
OTelTracesSampler string
// OTelTracesSamplerArg is the OTEL_TRACES_SAMPLER_ARG propagated to ateom
// pods. Ignored unless OTelTracesSampler is set.
OTelTracesSamplerArg string
}
//+kubebuilder:rbac:groups=ate.dev,resources=workerpools,verbs=get;list;watch;create;update;patch;delete
//+kubebuilder:rbac:groups=ate.dev,resources=workerpools/status,verbs=get;update;patch
//+kubebuilder:rbac:groups=ate.dev,resources=workerpools/finalizers,verbs=update
//+kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;watch;create;update;patch;delete
// Reconcile is part of the main kubernetes reconciliation loop which aims to
// move the current state of the cluster closer to the desired state.
func (r *WorkerPoolReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
log := log.FromContext(ctx)
// Fetch worker pool
wp := &atev1alpha1.WorkerPool{}
if err := r.Get(ctx, req.NamespacedName, wp); err != nil {
if k8errors.IsNotFound(err) {
return ctrl.Result{}, nil
}
return ctrl.Result{}, fmt.Errorf("failed to get worker pool %q: %w", req.NamespacedName, err)
}
// Handle deletion
if !wp.GetDeletionTimestamp().IsZero() {
log.Info("WorkerPool is being deleted")
return ctrl.Result{}, nil
}
if err := r.reconcileWorkerPool(ctx, wp); err != nil {
log.Error(err, "Failed to reconcile worker pool")
return ctrl.Result{}, err
}
return ctrl.Result{}, nil
}
func (r *WorkerPoolReconciler) reconcileWorkerPool(ctx context.Context, wp *atev1alpha1.WorkerPool) error {
log := log.FromContext(ctx)
log.Info("Reconciling worker pool")
if err := r.applyDeployment(ctx, wp); err != nil {
return err
}
dep := &appsv1.Deployment{}
if err := r.Get(ctx, types.NamespacedName{Name: wp.Name, Namespace: wp.Namespace}, dep); err != nil {
if k8errors.IsNotFound(err) {
return nil
}
return fmt.Errorf("failed to get deployment: %w", err)
}
return r.syncStatus(ctx, wp, dep)
}
func (r *WorkerPoolReconciler) applyDeployment(ctx context.Context, wp *atev1alpha1.WorkerPool) error {
depAC := buildDeploymentApplyConfig(wp, ateomOTelSettings{
Endpoint: r.OTelEndpoint,
MetricExportInterval: r.OTelMetricExportInterval,
MetricExportTimeout: r.OTelMetricExportTimeout,
TracesSampler: r.OTelTracesSampler,
TracesSamplerArg: r.OTelTracesSamplerArg,
})
if err := r.Apply(ctx, depAC, client.FieldOwner(workerPoolFieldOwner), client.ForceOwnership); err != nil {
return fmt.Errorf("failed to apply Deployment: %w", err)
}
return nil
}
func (r *WorkerPoolReconciler) syncStatus(ctx context.Context, wp *atev1alpha1.WorkerPool, dep *appsv1.Deployment) error {
selector, err := metav1.LabelSelectorAsSelector(dep.Spec.Selector)
if err != nil {
return fmt.Errorf("failed to convert Deployment selector: %w", err)
}
want := atev1alpha1.WorkerPoolStatus{
Replicas: dep.Status.Replicas,
Selector: selector.String(),
}
if equality.Semantic.DeepEqual(wp.Status, want) {
return nil
}
wp.Status = want
if err := r.Status().Update(ctx, wp); err != nil {
return fmt.Errorf("failed to update WorkerPool status: %w", err)
}
return nil
}
// SetupWithManager sets up the controller with the Manager.
func (r *WorkerPoolReconciler) SetupWithManager(mgr ctrl.Manager) error {
return ctrl.NewControllerManagedBy(mgr).
For(&atev1alpha1.WorkerPool{}).
Owns(&appsv1.Deployment{}).
Complete(r)
}