GoogleCloudSpannerReceiver: Mask lock stats PII

.chloggen/googlecloudspannerreceiver-hide-lock-stats-pii.yaml

@@ -0,0 +1,5 @@
+change_type: enhancement
+component: googlecloudspannerreceiver
+note: Configurably mask the PII in lock stats metrics.
+issues: [14607]
+subtext:

receiver/googlecloudspannerreceiver/README.md

@@ -32,6 +32,7 @@ receivers:
     top_metrics_query_max_rows: 100
     backfill_enabled: true
     cardinality_total_limit: 200000
+    hide_topn_lockstats_rowrangestartkey: false
     projects:
       - project_id: "spanner project 1"
         service_account_key: "path to spanner project 1 service account json key"
@@ -63,6 +64,7 @@ Brief description of configuration properties:
 - **top_metrics_query_max_rows** - max number of rows to fetch from Top N built-in table(100 by default)
 - **backfill_enabled** - turn on/off 1-hour data backfill(by default it is turned off)
 - **cardinality_total_limit** - limit of active series per 24 hours period. If specified, turns on cardinality filtering and handling. If zero or not specified, cardinality is not handled. You can read [this document](cardinality.md) for more information about cardinality handling and filtering.
+- **hide_topn_lockstats_rowrangestartkey** - if true, masks PII (key values) in row_range_start_key label for the "top minute lock stats" metric
 - **projects** - list of GCP projects
     - **project_id** - identifier of GCP project
     - **service_account_key** - path to service account JSON key It is highly recommended to set this property to the correct value. In case it is empty, the [Application Default Credentials](https://google.aip.dev/auth/4110) will be used for the database connection.

receiver/googlecloudspannerreceiver/config.go

@@ -29,10 +29,11 @@ const (
 type Config struct {
 	scraperhelper.ScraperControllerSettings `mapstructure:",squash"`
 
-	TopMetricsQueryMaxRows int       `mapstructure:"top_metrics_query_max_rows"`
-	BackfillEnabled        bool      `mapstructure:"backfill_enabled"`
-	CardinalityTotalLimit  int       `mapstructure:"cardinality_total_limit"`
-	Projects               []Project `mapstructure:"projects"`
+	TopMetricsQueryMaxRows            int       `mapstructure:"top_metrics_query_max_rows"`
+	BackfillEnabled                   bool      `mapstructure:"backfill_enabled"`
+	CardinalityTotalLimit             int       `mapstructure:"cardinality_total_limit"`
+	Projects                          []Project `mapstructure:"projects"`
+	HideTopnLockstatsRowrangestartkey bool      `mapstructure:"hide_topn_lockstats_rowrangestartkey"`
 }
 
 type Project struct {

receiver/googlecloudspannerreceiver/config_test.go

@@ -49,6 +49,7 @@ func TestLoadConfig(t *testing.T) {
 	assert.Equal(t, 120*time.Second, receiver.CollectionInterval)
 	assert.Equal(t, 10, receiver.TopMetricsQueryMaxRows)
 	assert.True(t, receiver.BackfillEnabled)
+	assert.True(t, receiver.HideTopnLockstatsRowrangestartkey)
 
 	assert.Equal(t, 2, len(receiver.Projects))
 

receiver/googlecloudspannerreceiver/factory.go

@@ -28,9 +28,10 @@ const (
 	typeStr   = "googlecloudspanner"
 	stability = component.StabilityLevelBeta
 
-	defaultCollectionInterval     = 60 * time.Second
-	defaultTopMetricsQueryMaxRows = 100
-	defaultBackfillEnabled        = false
+	defaultCollectionInterval                = 60 * time.Second
+	defaultTopMetricsQueryMaxRows            = 100
+	defaultBackfillEnabled                   = false
+	defaultHideTopnLockstatsRowrangestartkey = false
 )
 
 func NewFactory() component.ReceiverFactory {
@@ -46,8 +47,9 @@ func createDefaultConfig() config.Receiver {
 			ReceiverSettings:   config.NewReceiverSettings(config.NewComponentID(typeStr)),
 			CollectionInterval: defaultCollectionInterval,
 		},
-		TopMetricsQueryMaxRows: defaultTopMetricsQueryMaxRows,
-		BackfillEnabled:        defaultBackfillEnabled,
+		TopMetricsQueryMaxRows:            defaultTopMetricsQueryMaxRows,
+		BackfillEnabled:                   defaultBackfillEnabled,
+		HideTopnLockstatsRowrangestartkey: defaultHideTopnLockstatsRowrangestartkey,
 	}
 }
 

receiver/googlecloudspannerreceiver/internal/metadata/labelvalue.go

@@ -188,6 +188,10 @@ func (v byteSliceLabelValue) SetValueTo(attributes pcommon.Map) {
 	attributes.PutString(v.metadata.Name(), v.value)
 }
 
+func (v *byteSliceLabelValue) ModifyValue(s string) {
+	v.value = s
+}
+
 func newByteSliceLabelValue(metadata LabelValueMetadata, valueHolder interface{}) LabelValue {
 	return byteSliceLabelValue{
 		metadata: metadata,

receiver/googlecloudspannerreceiver/internal/metadata/labelvalue_test.go

@@ -199,6 +199,9 @@ func TestByteSliceLabelValue(t *testing.T) {
 
 	assert.True(t, exists)
 	assert.Equal(t, stringValue, attributeValue.Str())
+
+	labelValue.ModifyValue(labelName)
+	assert.Equal(t, labelName, labelValue.Value())
 }
 
 func TestLockRequestSliceLabelValue(t *testing.T) {

receiver/googlecloudspannerreceiver/internal/metadata/metricsdatapoint.go

@@ -16,6 +16,8 @@ package metadata // import "github.com/open-telemetry/opentelemetry-collector-co
 
 import (
 	"fmt"
+	"hash/fnv"
+	"strings"
 	"time"
 
 	"github.com/mitchellh/hashstructure"
@@ -114,6 +116,44 @@ func (mdp *MetricsDataPoint) toDataForHashing() dataForHashing {
 	}
 }
 
+// Convert row_range_start_key label of top-lock-stats metric from format "sample(key1, key2)" to "sample(hash1, hash2)"
+func parseAndHashRowrangestartkey(key string) string {
+	startIndexKeys := strings.Index(key, "(")
+	substring := key[startIndexKeys+1 : len(key)-1]
+	hashedKey := key[:startIndexKeys+1]
+	plusPresent := false
+	if substring[len(substring)-1] == '+' {
+		substring = substring[:len(substring)-1]
+		plusPresent = true
+	}
+	keySlice := strings.Split(substring, ",")
+	hashFunction := fnv.New32a()
+	for _, subKey := range keySlice {
+		hashFunction.Reset()
+		hashFunction.Write([]byte(subKey))
+		hashedKey += fmt.Sprint(hashFunction.Sum32()) + ","
+	}
+	hashedKey = hashedKey[:len(hashedKey)-1]
+	if plusPresent {
+		hashedKey += "+"
+	}
+	hashedKey += ")"
+	return hashedKey
+}
+
+func (mdp *MetricsDataPoint) HideLockStatsRowrangestartkeyPII() {
+	for index, labelValue := range mdp.labelValues {
+		if labelValue.Metadata().Name() == "row_range_start_key" {
+			key := labelValue.Value().(string)
+			hashedKey := parseAndHashRowrangestartkey(key)
+			v := mdp.labelValues[index].(byteSliceLabelValue)
+			p := &v
+			p.ModifyValue(hashedKey)
+			mdp.labelValues[index] = v
+		}
+	}
+}
+
 func (mdp *MetricsDataPoint) hash() (string, error) {
 	hashedData, err := hashstructure.Hash(mdp.toDataForHashing(), nil)
 	if err != nil {

receiver/googlecloudspannerreceiver/internal/metadata/metricsdatapoint_test.go

@@ -15,6 +15,8 @@
 package metadata
 
 import (
+	"fmt"
+	"hash/fnv"
 	"testing"
 	"time"
 
@@ -111,6 +113,35 @@ func TestMetricsDataPoint_CopyTo(t *testing.T) {
 	}
 }
 
+func TestMetricsDataPoint_HideLockStatsRowrangestartkeyPII(t *testing.T) {
+	btSliceLabelValueMetadata, _ := NewLabelValueMetadata("row_range_start_key", "byteSliceLabelColumnName", StringValueType)
+	labelValue1 := byteSliceLabelValue{metadata: btSliceLabelValueMetadata, value: "table1.s(23,hello,23+)"}
+	labelValue2 := byteSliceLabelValue{metadata: btSliceLabelValueMetadata, value: "table2(23,hello)"}
+	metricValues := allPossibleMetricValues(metricDataType)
+	labelValues := []LabelValue{labelValue1, labelValue2}
+	timestamp := time.Now().UTC()
+	metricsDataPoint := &MetricsDataPoint{
+		metricName:  metricName,
+		timestamp:   timestamp,
+		databaseID:  databaseID(),
+		labelValues: labelValues,
+		metricValue: metricValues[0],
+	}
+	hashFunction := fnv.New32a()
+	hashFunction.Reset()
+	hashFunction.Write([]byte("23"))
+	hashOf23 := fmt.Sprint(hashFunction.Sum32())
+	hashFunction.Reset()
+	hashFunction.Write([]byte("hello"))
+	hashOfHello := fmt.Sprint(hashFunction.Sum32())
+
+	metricsDataPoint.HideLockStatsRowrangestartkeyPII()
+
+	assert.Equal(t, len(metricsDataPoint.labelValues), 2)
+	assert.Equal(t, metricsDataPoint.labelValues[0].Value(), "table1.s("+hashOf23+","+hashOfHello+","+hashOf23+"+)")
+	assert.Equal(t, metricsDataPoint.labelValues[1].Value(), "table2("+hashOf23+","+hashOfHello+")")
+}
+
 func allPossibleLabelValues() []LabelValue {
 	strLabelValueMetadata, _ := NewLabelValueMetadata("stringLabelName", "stringLabelColumnName", StringValueType)
 	strLabelValue := stringLabelValue{

receiver/googlecloudspannerreceiver/internal/statsreader/intervalstatsreader.go

@@ -34,8 +34,9 @@ const (
 
 type intervalStatsReader struct {
 	currentStatsReader
-	timestampsGenerator *timestampsGenerator
-	lastPullTimestamp   time.Time
+	timestampsGenerator               *timestampsGenerator
+	lastPullTimestamp                 time.Time
+	hideTopnLockstatsRowrangestartkey bool
 }
 
 func newIntervalStatsReader(
@@ -57,8 +58,9 @@ func newIntervalStatsReader(
 	}
 
 	return &intervalStatsReader{
-		currentStatsReader:  reader,
-		timestampsGenerator: tsGenerator,
+		currentStatsReader:                reader,
+		timestampsGenerator:               tsGenerator,
+		hideTopnLockstatsRowrangestartkey: config.HideTopnLockstatsRowrangestartkey,
 	}
 }
 
@@ -82,6 +84,11 @@ func (reader *intervalStatsReader) Read(ctx context.Context) ([]*metadata.Metric
 		if err != nil {
 			return nil, err
 		}
+		if reader.hideTopnLockstatsRowrangestartkey && stmt.statement.SQL == "SELECT * FROM SPANNER_SYS.LOCK_STATS_TOP_MINUTE WHERE INTERVAL_END = @pullTimestamp ORDER BY INTERVAL_END DESC, LOCK_WAIT_SECONDS DESC LIMIT @topMetricsQueryMaxRows" {
+			for _, dataPoint := range dataPoints {
+				dataPoint.HideLockStatsRowrangestartkeyPII()
+			}
+		}
 
 		collectedDataPoints = append(collectedDataPoints, dataPoints...)
 	}

receiver/googlecloudspannerreceiver/internal/statsreader/intervalstatsreader_test.go

@@ -57,8 +57,9 @@ func TestNewIntervalStatsReader(t *testing.T) {
 	}
 	logger := zaptest.NewLogger(t)
 	config := ReaderConfig{
-		TopMetricsQueryMaxRows: topMetricsQueryMaxRows,
-		BackfillEnabled:        true,
+		TopMetricsQueryMaxRows:            topMetricsQueryMaxRows,
+		BackfillEnabled:                   true,
+		HideTopnLockstatsRowrangestartkey: true,
 	}
 
 	reader := newIntervalStatsReader(logger, database, metricsMetadata, config)
@@ -69,15 +70,17 @@ func TestNewIntervalStatsReader(t *testing.T) {
 	assert.Equal(t, topMetricsQueryMaxRows, reader.topMetricsQueryMaxRows)
 	assert.NotNil(t, reader.timestampsGenerator)
 	assert.True(t, reader.timestampsGenerator.backfillEnabled)
+	assert.True(t, reader.hideTopnLockstatsRowrangestartkey)
 }
 
 func TestIntervalStatsReader_NewPullStatement(t *testing.T) {
 	databaseID := datasource.NewDatabaseID(projectID, instanceID, databaseName)
 	timestamp := time.Now().UTC()
 	logger := zaptest.NewLogger(t)
 	config := ReaderConfig{
-		TopMetricsQueryMaxRows: topMetricsQueryMaxRows,
-		BackfillEnabled:        false,
+		TopMetricsQueryMaxRows:            topMetricsQueryMaxRows,
+		BackfillEnabled:                   false,
+		HideTopnLockstatsRowrangestartkey: true,
 	}
 	ctx := context.Background()
 	client, _ := spanner.NewClient(ctx, "")

receiver/googlecloudspannerreceiver/internal/statsreader/reader.go

@@ -21,8 +21,9 @@ import (
 )
 
 type ReaderConfig struct {
-	TopMetricsQueryMaxRows int
-	BackfillEnabled        bool
+	TopMetricsQueryMaxRows            int
+	BackfillEnabled                   bool
+	HideTopnLockstatsRowrangestartkey bool
 }
 
 type Reader interface {

receiver/googlecloudspannerreceiver/receiver.go

@@ -108,8 +108,9 @@ func (r *googleCloudSpannerReceiver) initializeProjectReaders(ctx context.Contex
 	parsedMetadata []*metadata.MetricsMetadata) error {
 
 	readerConfig := statsreader.ReaderConfig{
-		BackfillEnabled:        r.config.BackfillEnabled,
-		TopMetricsQueryMaxRows: r.config.TopMetricsQueryMaxRows,
+		BackfillEnabled:                   r.config.BackfillEnabled,
+		TopMetricsQueryMaxRows:            r.config.TopMetricsQueryMaxRows,
+		HideTopnLockstatsRowrangestartkey: r.config.HideTopnLockstatsRowrangestartkey,
 	}
 
 	for _, project := range r.config.Projects {

receiver/googlecloudspannerreceiver/testdata/config.yaml

@@ -4,6 +4,7 @@ receivers:
     top_metrics_query_max_rows: 10
     backfill_enabled: true
     cardinality_total_limit: 200000
+    hide_topn_lockstats_rowrangestartkey: true
     projects:
       - project_id: "spanner project 1"
         service_account_key: "path to spanner project 1 service account json key"