|
207 | 207 | instance ID on Grafana Cloud, a tenant name on a self-hosted |
208 | 208 | Mimir/Loki — so it is restricted to letters, digits, dot, underscore and |
209 | 209 | dash, and must not be a token or carry whitespace. Got "{{ item.value }}". |
210 | | - NOTE the Loki instance ID differs from the Prometheus one; the |
211 | | - access-policy token is shared and stays in |
| 210 | + NOTE the Loki and OTLP instance IDs are each their own number, distinct |
| 211 | + from the Prometheus one; the access-policy token is shared and stays in |
212 | 212 | {{ grafana_alloy_secret_file }} as GC_API_TOKEN. |
213 | 213 | loop: |
214 | 214 | - {name: grafana_alloy_prom_username, value: "{{ grafana_alloy_prom_username | string }}"} |
| 215 | + - {name: grafana_alloy_otlp_username, value: "{{ grafana_alloy_otlp_username | string }}"} |
215 | 216 | - {name: grafana_alloy_loki_username, value: "{{ grafana_alloy_loki_username | string }}"} |
216 | 217 | loop_control: |
217 | 218 | label: "{{ item.name }}" |
|
233 | 234 | - "{{ grafana_alloy_prom_url | string }}" |
234 | 235 | - "{{ grafana_alloy_prom_username | string }}" |
235 | 236 | - "{{ grafana_alloy_otlp_endpoint | string }}" |
| 237 | + - "{{ grafana_alloy_otlp_username | string }}" |
236 | 238 | - "{{ grafana_alloy_loki_url | string }}" |
237 | 239 | - "{{ grafana_alloy_loki_username | string }}" |
238 | 240 | loop_control: |
|
402 | 404 | | rejectattr('rc', 'equalto', 0) |
403 | 405 | | map(attribute='item') | list }} |
404 | 406 | when: _ga_missing | length > 0 |
| 407 | + |
| 408 | +# GC_OTLP_USERNAME is the one credential key that is legitimately OPTIONAL: with |
| 409 | +# neither inventory nor env-file value, the rendered config resolves the OTLP |
| 410 | +# username at runtime to the Prometheus ID — exactly what every pre-existing |
| 411 | +# deployment used — so ABSENT is correct and must not be required. But |
| 412 | +# PRESENT-AND-MALFORMED is not harmless: coalesce() returns the first non-empty |
| 413 | +# argument, so a value carrying whitespace or a stray comment wins over the valid |
| 414 | +# Prometheus fallback and 401s the entire trace pipeline while metrics and logs |
| 415 | +# stay healthy. The required-key gate above cannot cover it (it only greps keys it |
| 416 | +# demands), hence this present-then-shaped pair. Skipped when inventory supplies |
| 417 | +# the ID, because the template then inlines it and emits no sys.env lookup at all. |
| 418 | +- name: Detect a host-provided OTLP instance ID |
| 419 | + ansible.builtin.command: |
| 420 | + cmd: grep -qE -- '^GC_OTLP_USERNAME=.*[^[:space:]]' {{ grafana_alloy_secret_file | quote }} |
| 421 | + changed_when: false |
| 422 | + check_mode: false # read-only gate: must also run under make check |
| 423 | + failed_when: false |
| 424 | + register: _ga_otlp_user_present |
| 425 | + when: grafana_alloy_otlp_username | string | length == 0 |
| 426 | + |
| 427 | +# Same charset as the inventory instance-ID gate, plus the optional double quotes |
| 428 | +# systemd strips off an EnvironmentFile value. |
| 429 | +- name: Check the shape of a host-provided OTLP instance ID |
| 430 | + ansible.builtin.command: |
| 431 | + cmd: grep -qE -- '^GC_OTLP_USERNAME="?[A-Za-z0-9._-]{1,64}"?$' {{ grafana_alloy_secret_file | quote }} |
| 432 | + changed_when: false |
| 433 | + check_mode: false # read-only gate: must also run under make check |
| 434 | + failed_when: false |
| 435 | + register: _ga_otlp_user_shape |
| 436 | + when: |
| 437 | + - grafana_alloy_otlp_username | string | length == 0 |
| 438 | + - (_ga_otlp_user_present.rc | default(1)) == 0 |
| 439 | + |
| 440 | +- name: Refuse a malformed host-provided OTLP instance ID |
| 441 | + ansible.builtin.assert: |
| 442 | + that: |
| 443 | + - (_ga_otlp_user_shape.rc | default(0)) == 0 |
| 444 | + fail_msg: >- |
| 445 | + {{ grafana_alloy_secret_file }} sets GC_OTLP_USERNAME to a value that is |
| 446 | + not an instance ID (letters, digits, dot, underscore, dash, ≤ 64 chars, no |
| 447 | + whitespace and no trailing comment). The key is optional — drop the line |
| 448 | + entirely and traces fall back to the Prometheus instance ID, which is what |
| 449 | + this role used before the OTLP gateway got its own username — but a |
| 450 | + malformed value is worse than none: it takes precedence over that fallback |
| 451 | + and every span is rejected with a 401 while remote-write and Loki keep |
| 452 | + flowing. Fix the line on the host, remove it, or set |
| 453 | + grafana_alloy_otlp_username in inventory instead. |
| 454 | + when: |
| 455 | + - grafana_alloy_otlp_username | string | length == 0 |
| 456 | + - (_ga_otlp_user_present.rc | default(1)) == 0 |
0 commit comments