[exporter/datadog] Add api.fail_on_invalid_key to fail fast if API …

…Key is invalid (open-telemetry#9426)

* add new `fail_on_invalid_key` option

* improve the description of fail_on_invalid_key

* avoid failing when a transient network error

* remove unnecessary comment

* utils.ValidateAPI() returns error

* add tests

* not returning error when api failure

* fix test names

* fix lint

* fix go vet: prevent possible context leak

Co-authored-by: Alex Boten <[email protected]>

CHANGELOG.md

@@ -23,6 +23,7 @@
 - `internal/stanza`: Add support for `remove` operator (#9524)
 - `k8sattributesprocessor`: Support regex capture groups in tag_name (#9525)
 - `transformprocessor`: Add new `truncation` function to allow truncating string values in maps such as `attributes` or `resource.attributes` (#9546)
+- `datadogexporter`: Add `api.fail_on_invalid_key` to fail fast if api key is invalid (#9426)
 
 ### 🧰 Bug fixes 🧰
 

exporter/datadogexporter/config/config.go

@@ -51,6 +51,10 @@ type APIConfig struct {
 	// It can also be set through the `DD_SITE` environment variable (Deprecated: [v0.47.0] set environment variable explicitly on configuration instead).
 	// The default value is "datadoghq.com".
 	Site string `mapstructure:"site"`
+
+	// FailOnInvalidKey states whether to exit at startup on invalid API key.
+	// The default value is false.
+	FailOnInvalidKey bool `mapstructure:"fail_on_invalid_key"`
 }
 
 // MetricsConfig defines the metrics exporter specific configuration options

exporter/datadogexporter/example/config.yaml

@@ -83,6 +83,11 @@ exporters:
       #
       # site: datadoghq.com
 
+      ## @param fail_on_invalid_key - boolean - optional - default: false
+      ## Whether to exit at startup on invalid API key.
+      #
+      # fail_on_invalid_key: false
+
     ## @param tls - custom object - optional
     # TLS settings for HTTPS communications.
     # tls:

exporter/datadogexporter/factory.go

@@ -198,6 +198,7 @@ func (f *factory) createTracesExporter(
 	}
 
 	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
 	var pushTracesFn consumer.ConsumeTracesFunc
 
 	if cfg.OnlyMetadata {
@@ -214,7 +215,11 @@ func (f *factory) createTracesExporter(
 			return nil
 		}
 	} else {
-		pushTracesFn = newTracesExporter(ctx, set, cfg, &f.onceMetadata).pushTraceDataScrubbed
+		exporter, err := newTracesExporter(ctx, set, cfg, &f.onceMetadata)
+		if err != nil {
+			return nil, err
+		}
+		pushTracesFn = exporter.pushTraceDataScrubbed
 	}
 
 	return exporterhelper.NewTracesExporter(

exporter/datadogexporter/factory_test.go

@@ -71,8 +71,9 @@ func TestCreateDefaultConfig(t *testing.T) {
 		QueueSettings:    exporterhelper.NewDefaultQueueSettings(),
 
 		API: ddconfig.APIConfig{
-			Key:  "API_KEY",
-			Site: "SITE",
+			Key:              "API_KEY",
+			Site:             "SITE",
+			FailOnInvalidKey: false,
 		},
 
 		Metrics: ddconfig.MetricsConfig{
@@ -152,8 +153,9 @@ func TestLoadConfig(t *testing.T) {
 		Tags:       []string{"example:tag"},
 	}, apiConfig.TagsConfig)
 	assert.Equal(t, ddconfig.APIConfig{
-		Key:  "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-		Site: "datadoghq.eu",
+		Key:              "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+		Site:             "datadoghq.eu",
+		FailOnInvalidKey: true,
 	}, apiConfig.API)
 	assert.Equal(t, ddconfig.MetricsConfig{
 		TCPAddr: confignet.TCPAddr{
@@ -203,8 +205,9 @@ func TestLoadConfig(t *testing.T) {
 		},
 
 		API: ddconfig.APIConfig{
-			Key:  "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-			Site: "datadoghq.com",
+			Key:              "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+			Site:             "datadoghq.com",
+			FailOnInvalidKey: false,
 		},
 
 		Metrics: ddconfig.MetricsConfig{
@@ -304,8 +307,9 @@ func TestLoadConfigEnvVariables(t *testing.T) {
 	}, apiConfig.TagsConfig)
 	assert.Equal(t,
 		ddconfig.APIConfig{
-			Key:  "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-			Site: "datadoghq.eu",
+			Key:              "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+			Site:             "datadoghq.eu",
+			FailOnInvalidKey: false,
 		}, apiConfig.API)
 	assert.Equal(t,
 		ddconfig.MetricsConfig{
@@ -358,8 +362,9 @@ func TestLoadConfigEnvVariables(t *testing.T) {
 		EnvVarTags: "envexample:tag envexample2:tag",
 	}, defaultConfig.TagsConfig)
 	assert.Equal(t, ddconfig.APIConfig{
-		Key:  "replacedapikey",
-		Site: "datadoghq.test",
+		Key:              "replacedapikey",
+		Site:             "datadoghq.test",
+		FailOnInvalidKey: false,
 	}, defaultConfig.API)
 	assert.Equal(t, ddconfig.MetricsConfig{
 		TCPAddr: confignet.TCPAddr{
@@ -418,6 +423,49 @@ func TestCreateAPIMetricsExporter(t *testing.T) {
 	assert.NotNil(t, exp)
 }
 
+func TestCreateAPIMetricsExporterFailOnInvalidkey(t *testing.T) {
+	server := testutils.DatadogServerMock(testutils.ValidateAPIKeyEndpointInvalid)
+	defer server.Close()
+
+	factories, err := componenttest.NopFactories()
+	require.NoError(t, err)
+
+	factory := NewFactory()
+	factories.Exporters[typeStr] = factory
+	cfg, err := servicetest.LoadConfigAndValidate(filepath.Join("testdata", "config.yaml"), factories)
+
+	require.NoError(t, err)
+	require.NotNil(t, cfg)
+
+	// Use the mock server for API key validation
+	c := (cfg.Exporters[config.NewComponentIDWithName(typeStr, "api")]).(*ddconfig.Config)
+	c.Metrics.TCPAddr.Endpoint = server.URL
+	c.HostMetadata.Enabled = false
+
+	t.Run("fail_on_invalid_key is true", func(t *testing.T) {
+		c.API.FailOnInvalidKey = true
+		ctx := context.Background()
+		exp, err := factory.CreateMetricsExporter(
+			ctx,
+			componenttest.NewNopExporterCreateSettings(),
+			cfg.Exporters[config.NewComponentIDWithName(typeStr, "api")],
+		)
+		assert.EqualError(t, err, "API Key validation failed")
+		assert.Nil(t, exp)
+	})
+	t.Run("fail_on_invalid_key is false", func(t *testing.T) {
+		c.API.FailOnInvalidKey = false
+		ctx := context.Background()
+		exp, err := factory.CreateMetricsExporter(
+			ctx,
+			componenttest.NewNopExporterCreateSettings(),
+			cfg.Exporters[config.NewComponentIDWithName(typeStr, "api")],
+		)
+		assert.Nil(t, err)
+		assert.NotNil(t, exp)
+	})
+}
+
 func TestCreateAPITracesExporter(t *testing.T) {
 	server := testutils.DatadogServerMock()
 	defer server.Close()
@@ -448,6 +496,49 @@ func TestCreateAPITracesExporter(t *testing.T) {
 	assert.NotNil(t, exp)
 }
 
+func TestCreateAPITracesExporterFailOnInvalidkey(t *testing.T) {
+	server := testutils.DatadogServerMock(testutils.ValidateAPIKeyEndpointInvalid)
+	defer server.Close()
+
+	factories, err := componenttest.NopFactories()
+	require.NoError(t, err)
+
+	factory := NewFactory()
+	factories.Exporters[typeStr] = factory
+	cfg, err := servicetest.LoadConfigAndValidate(filepath.Join("testdata", "config.yaml"), factories)
+
+	require.NoError(t, err)
+	require.NotNil(t, cfg)
+
+	// Use the mock server for API key validation
+	c := (cfg.Exporters[config.NewComponentIDWithName(typeStr, "api")]).(*ddconfig.Config)
+	c.Metrics.TCPAddr.Endpoint = server.URL
+	c.HostMetadata.Enabled = false
+
+	t.Run("fail_on_invalid_key is true", func(t *testing.T) {
+		c.API.FailOnInvalidKey = true
+		ctx := context.Background()
+		exp, err := factory.CreateTracesExporter(
+			ctx,
+			componenttest.NewNopExporterCreateSettings(),
+			cfg.Exporters[config.NewComponentIDWithName(typeStr, "api")],
+		)
+		assert.EqualError(t, err, "API Key validation failed")
+		assert.Nil(t, exp)
+	})
+	t.Run("fail_on_invalid_key is false", func(t *testing.T) {
+		c.API.FailOnInvalidKey = false
+		ctx := context.Background()
+		exp, err := factory.CreateTracesExporter(
+			ctx,
+			componenttest.NewNopExporterCreateSettings(),
+			cfg.Exporters[config.NewComponentIDWithName(typeStr, "api")],
+		)
+		assert.Nil(t, err)
+		assert.NotNil(t, exp)
+	})
+}
+
 func TestOnlyMetadata(t *testing.T) {
 	server := testutils.DatadogServerMock()
 	defer server.Close()

exporter/datadogexporter/internal/testutils/test_utils.go

@@ -40,22 +40,40 @@ type DatadogServer struct {
 }
 
 // DatadogServerMock mocks a Datadog backend server
-func DatadogServerMock() *DatadogServer {
+func DatadogServerMock(overwriteHandlerFuncs ...OverwriteHandleFunc) *DatadogServer {
 	metadataChan := make(chan []byte)
-	handler := http.NewServeMux()
-	handler.HandleFunc("/api/v1/validate", validateAPIKeyEndpoint)
-	handler.HandleFunc("/api/v1/series", metricsEndpoint)
-	handler.HandleFunc("/intake", newMetadataEndpoint(metadataChan))
-	handler.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {})
+	mux := http.NewServeMux()
 
-	srv := httptest.NewServer(handler)
+	handlers := map[string]http.HandlerFunc{
+		"/api/v1/validate": validateAPIKeyEndpoint,
+		"/api/v1/series":   metricsEndpoint,
+		"/intake":          newMetadataEndpoint(metadataChan),
+		"/":                func(w http.ResponseWriter, r *http.Request) {},
+	}
+	for _, f := range overwriteHandlerFuncs {
+		p, hf := f()
+		handlers[p] = hf
+	}
+	for pattern, handler := range handlers {
+		mux.HandleFunc(pattern, handler)
+	}
+
+	srv := httptest.NewServer(mux)
 
 	return &DatadogServer{
 		srv,
 		metadataChan,
 	}
 }
 
+// OverwriteHandleFuncs allows to overwrite the default handler functions
+type OverwriteHandleFunc func() (string, http.HandlerFunc)
+
+// ValidateAPIKeyEndpointInvalid returns a handler function that returns an invalid API key response
+func ValidateAPIKeyEndpointInvalid() (string, http.HandlerFunc) {
+	return "/api/v1/validate", validateAPIKeyEndpointInvalid
+}
+
 type validateAPIKeyResponse struct {
 	Valid bool `json:"valid"`
 }
@@ -68,6 +86,14 @@ func validateAPIKeyEndpoint(w http.ResponseWriter, r *http.Request) {
 	w.Write(resJSON)
 }
 
+func validateAPIKeyEndpointInvalid(w http.ResponseWriter, r *http.Request) {
+	res := validateAPIKeyResponse{Valid: false}
+	resJSON, _ := json.Marshal(res)
+
+	w.Header().Set("Content-Type", "application/json")
+	w.Write(resJSON)
+}
+
 type metricsResponse struct {
 	Status string `json:"status"`
 }

exporter/datadogexporter/internal/utils/api.go

@@ -15,6 +15,8 @@
 package utils // import "github.com/open-telemetry/opentelemetry-collector-contrib/exporter/datadogexporter/internal/utils"
 
 import (
+	"errors"
+
 	"go.uber.org/zap"
 	"gopkg.in/zorkian/go-datadog-api.v2"
 )
@@ -27,17 +29,20 @@ func CreateClient(APIKey string, endpoint string) *datadog.Client {
 	return client
 }
 
+var ErrInvalidAPI = errors.New("API Key validation failed")
+
 // ValidateAPIKey checks that the provided client was given a correct API key.
-func ValidateAPIKey(logger *zap.Logger, client *datadog.Client) {
+func ValidateAPIKey(logger *zap.Logger, client *datadog.Client) error {
 	logger.Info("Validating API key.")
-	res, err := client.Validate()
-	if err != nil {
-		logger.Warn("Error while validating API key.", zap.Error(err))
-	}
-
-	if res {
+	valid, err := client.Validate()
+	if err == nil && valid {
 		logger.Info("API key validation successful.")
-	} else {
-		logger.Warn("API key validation failed.")
+		return nil
+	}
+	if err != nil {
+		logger.Warn("Error while validating API key", zap.Error(err))
+		return nil
 	}
+	logger.Warn(ErrInvalidAPI.Error())
+	return ErrInvalidAPI
 }

exporter/datadogexporter/metrics_exporter.go

@@ -105,7 +105,9 @@ func newMetricsExporter(ctx context.Context, params component.ExporterCreateSett
 	client.ExtraHeader["User-Agent"] = utils.UserAgent(params.BuildInfo)
 	client.HttpClient = utils.NewHTTPClient(cfg.TimeoutSettings, cfg.LimitedHTTPClientSettings.TLSSetting.InsecureSkipVerify)
 
-	utils.ValidateAPIKey(params.Logger, client)
+	if err := utils.ValidateAPIKey(params.Logger, client); err != nil && cfg.API.FailOnInvalidKey {
+		return nil, err
+	}
 
 	tr, err := translatorFromConfig(params.Logger, cfg)
 	if err != nil {

exporter/datadogexporter/testdata/config.yaml

@@ -21,6 +21,7 @@ exporters:
     api:
       key: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
       site: datadoghq.eu
+      fail_on_invalid_key: true
 
     traces:
       sample_rate: 1
@@ -63,7 +64,7 @@ exporters:
   datadog/invalid:
     metrics:
       endpoint: "invalid:"
-    
+
     traces:
       endpoint: "invalid:"
 

exporter/datadogexporter/traces_exporter.go

@@ -66,10 +66,12 @@ var (
 	}
 )
 
-func newTracesExporter(ctx context.Context, params component.ExporterCreateSettings, cfg *config.Config, onceMetadata *sync.Once) *traceExporter {
+func newTracesExporter(ctx context.Context, params component.ExporterCreateSettings, cfg *config.Config, onceMetadata *sync.Once) (*traceExporter, error) {
 	// client to send running metric to the backend & perform API key validation
 	client := utils.CreateClient(cfg.API.Key, cfg.Metrics.TCPAddr.Endpoint)
-	utils.ValidateAPIKey(params.Logger, client)
+	if err := utils.ValidateAPIKey(params.Logger, client); err != nil && cfg.API.FailOnInvalidKey {
+		return nil, err
+	}
 
 	// removes potentially sensitive info and PII, approach taken from serverless approach
 	// https://github.com/DataDog/datadog-serverless-functions/blob/11f170eac105d66be30f18eda09eca791bc0d31b/aws/logs_monitoring/trace_forwarder/cmd/trace/main.go#L43
@@ -90,7 +92,7 @@ func newTracesExporter(ctx context.Context, params component.ExporterCreateSetti
 		onceMetadata:   onceMetadata,
 	}
 
-	return exporter
+	return exporter, nil
 }
 
 // TODO: when component.Host exposes a way to retrieve processors, check for batch processors