Skip to content

LCORE-2923: Add missing configuration fields to telemetry configuration snapshot [Opus Firefly test] #2281

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
are-ces wants to merge 1 commit into
base: main
Choose a base branch
from
+2,135 −20
Draft

LCORE-2923: Add missing configuration fields to telemetry configuration snapshot [Opus Firefly test] #2281

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
179 changes: 178 additions & 1 deletion src/telemetry/configuration_snapshot.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,9 +79,11 @@ class ListFieldSpec:
FieldSpec("service.workers", MaskingType.PASSTHROUGH),
FieldSpec("service.host", MaskingType.SENSITIVE),
FieldSpec("service.port", MaskingType.PASSTHROUGH),
FieldSpec("service.base_url", MaskingType.SENSITIVE),
FieldSpec("service.auth_enabled", MaskingType.PASSTHROUGH),
FieldSpec("service.color_log", MaskingType.PASSTHROUGH),
FieldSpec("service.access_log", MaskingType.PASSTHROUGH),
FieldSpec("service.root_path", MaskingType.SENSITIVE),
FieldSpec("service.tls_config.tls_certificate_path", MaskingType.SENSITIVE),
FieldSpec("service.tls_config.tls_key_path", MaskingType.SENSITIVE),
FieldSpec("service.tls_config.tls_key_password", MaskingType.SENSITIVE),
Expand All @@ -94,11 +96,32 @@ class ListFieldSpec:
FieldSpec("llama_stack.url", MaskingType.SENSITIVE),
FieldSpec("llama_stack.api_key", MaskingType.SENSITIVE),
FieldSpec("llama_stack.library_client_config_path", MaskingType.SENSITIVE),
FieldSpec("llama_stack.timeout", MaskingType.PASSTHROUGH),
FieldSpec("llama_stack.max_retries", MaskingType.PASSTHROUGH),
FieldSpec("llama_stack.retry_delay", MaskingType.PASSTHROUGH),
FieldSpec("llama_stack.allow_degraded_mode", MaskingType.PASSTHROUGH),
FieldSpec("llama_stack.config.baseline", MaskingType.PASSTHROUGH),
FieldSpec("llama_stack.config.profile", MaskingType.SENSITIVE),
FieldSpec("llama_stack.config.native_override", MaskingType.SENSITIVE),
FieldSpec("inference.default_model", MaskingType.PASSTHROUGH),
FieldSpec("inference.default_provider", MaskingType.PASSTHROUGH),
FieldSpec("inference.context_windows", MaskingType.PASSTHROUGH),
FieldSpec("inference.max_infer_iters", MaskingType.PASSTHROUGH),
FieldSpec("inference.max_tool_calls", MaskingType.PASSTHROUGH),
ListFieldSpec(
"inference.providers",
item_fields=(
FieldSpec("type", MaskingType.PASSTHROUGH),
FieldSpec("id", MaskingType.PASSTHROUGH),
FieldSpec("api_key_env", MaskingType.SENSITIVE),
FieldSpec("allowed_models", MaskingType.PASSTHROUGH),
),
),
# Authentication & Authorization
FieldSpec("authentication.module", MaskingType.PASSTHROUGH),
FieldSpec("authentication.skip_tls_verification", MaskingType.PASSTHROUGH),
FieldSpec("authentication.skip_for_health_probes", MaskingType.PASSTHROUGH),
FieldSpec("authentication.skip_for_metrics", MaskingType.PASSTHROUGH),
FieldSpec("authentication.k8s_cluster_api", MaskingType.SENSITIVE),
FieldSpec("authentication.k8s_ca_cert_path", MaskingType.SENSITIVE),
FieldSpec("authentication.jwk_config.url", MaskingType.SENSITIVE),
Expand All @@ -120,13 +143,38 @@ class ListFieldSpec:
FieldSpec("negate", MaskingType.PASSTHROUGH),
),
),
FieldSpec("authentication.api_key_config.api_key", MaskingType.SENSITIVE),
FieldSpec(
"authentication.rh_identity_config.required_entitlements",
MaskingType.SENSITIVE,
),
FieldSpec(
"authentication.rh_identity_config.max_header_size",
MaskingType.PASSTHROUGH,
),
FieldSpec(
"authentication.trusted_proxy_config.user_header",
MaskingType.PASSTHROUGH,
),
ListFieldSpec(
"authentication.trusted_proxy_config.allowed_service_accounts",
item_fields=(
FieldSpec("namespace", MaskingType.SENSITIVE),
FieldSpec("name", MaskingType.SENSITIVE),
),
),
ListFieldSpec(
"authorization.access_rules",
item_fields=(
FieldSpec("role", MaskingType.PASSTHROUGH),
FieldSpec("actions", MaskingType.PASSTHROUGH),
),
),
# Azure Entra ID
FieldSpec("azure_entra_id.tenant_id", MaskingType.SENSITIVE),
FieldSpec("azure_entra_id.client_id", MaskingType.SENSITIVE),
FieldSpec("azure_entra_id.client_secret", MaskingType.SENSITIVE),
FieldSpec("azure_entra_id.scope", MaskingType.PASSTHROUGH),
# User Data Collection Features
FieldSpec("user_data_collection.feedback_enabled", MaskingType.PASSTHROUGH),
FieldSpec("user_data_collection.feedback_storage", MaskingType.SENSITIVE),
Expand All @@ -135,7 +183,10 @@ class ListFieldSpec:
# AI/ML Capabilities Configuration
FieldSpec("customization.system_prompt", MaskingType.SENSITIVE),
FieldSpec("customization.system_prompt_path", MaskingType.SENSITIVE),
FieldSpec("customization.profile_path", MaskingType.SENSITIVE),
FieldSpec("customization.disable_query_system_prompt", MaskingType.PASSTHROUGH),
FieldSpec("customization.disable_shield_ids_override", MaskingType.PASSTHROUGH),
FieldSpec("customization.agent_card_path", MaskingType.SENSITIVE),
# Database & Storage Configuration
FieldSpec("database.sqlite.db_path", MaskingType.SENSITIVE),
FieldSpec("database.postgres.host", MaskingType.SENSITIVE),
Expand All @@ -147,13 +198,139 @@ class ListFieldSpec:
FieldSpec("database.postgres.ssl_mode", MaskingType.PASSTHROUGH),
FieldSpec("database.postgres.gss_encmode", MaskingType.PASSTHROUGH),
FieldSpec("database.postgres.ca_cert_path", MaskingType.SENSITIVE),
# Conversation Cache
FieldSpec("conversation_cache.type", MaskingType.PASSTHROUGH),
FieldSpec("conversation_cache.memory.max_entries", MaskingType.PASSTHROUGH),
FieldSpec("conversation_cache.sqlite.db_path", MaskingType.SENSITIVE),
FieldSpec("conversation_cache.postgres.host", MaskingType.SENSITIVE),
FieldSpec("conversation_cache.postgres.port", MaskingType.PASSTHROUGH),
FieldSpec("conversation_cache.postgres.db", MaskingType.SENSITIVE),
FieldSpec("conversation_cache.postgres.user", MaskingType.SENSITIVE),
FieldSpec("conversation_cache.postgres.password", MaskingType.SENSITIVE),
FieldSpec("conversation_cache.postgres.namespace", MaskingType.SENSITIVE),
FieldSpec("conversation_cache.postgres.ssl_mode", MaskingType.PASSTHROUGH),
FieldSpec("conversation_cache.postgres.gss_encmode", MaskingType.PASSTHROUGH),
FieldSpec("conversation_cache.postgres.ca_cert_path", MaskingType.SENSITIVE),
# Conversation Compaction
FieldSpec("compaction.enabled", MaskingType.PASSTHROUGH),
FieldSpec("compaction.threshold_ratio", MaskingType.PASSTHROUGH),
FieldSpec("compaction.token_floor", MaskingType.PASSTHROUGH),
FieldSpec("compaction.buffer_turns", MaskingType.PASSTHROUGH),
FieldSpec("compaction.buffer_max_ratio", MaskingType.PASSTHROUGH),
# Quota Handlers
FieldSpec("quota_handlers.sqlite.db_path", MaskingType.SENSITIVE),
FieldSpec("quota_handlers.postgres.host", MaskingType.SENSITIVE),
FieldSpec("quota_handlers.postgres.port", MaskingType.PASSTHROUGH),
FieldSpec("quota_handlers.postgres.db", MaskingType.SENSITIVE),
FieldSpec("quota_handlers.postgres.user", MaskingType.SENSITIVE),
FieldSpec("quota_handlers.postgres.password", MaskingType.SENSITIVE),
FieldSpec("quota_handlers.postgres.namespace", MaskingType.SENSITIVE),
FieldSpec("quota_handlers.postgres.ssl_mode", MaskingType.PASSTHROUGH),
FieldSpec("quota_handlers.postgres.gss_encmode", MaskingType.PASSTHROUGH),
FieldSpec("quota_handlers.postgres.ca_cert_path", MaskingType.SENSITIVE),
ListFieldSpec(
"quota_handlers.limiters",
item_fields=(
FieldSpec("type", MaskingType.PASSTHROUGH),
FieldSpec("name", MaskingType.PASSTHROUGH),
FieldSpec("initial_quota", MaskingType.PASSTHROUGH),
FieldSpec("quota_increase", MaskingType.PASSTHROUGH),
FieldSpec("period", MaskingType.PASSTHROUGH),
),
),
FieldSpec("quota_handlers.scheduler.period", MaskingType.PASSTHROUGH),
FieldSpec(
"quota_handlers.scheduler.database_reconnection_count",
MaskingType.PASSTHROUGH,
),
FieldSpec(
"quota_handlers.scheduler.database_reconnection_delay",
MaskingType.PASSTHROUGH,
),
FieldSpec("quota_handlers.enable_token_history", MaskingType.PASSTHROUGH),
# BYOK RAG
ListFieldSpec(
"byok_rag",
item_fields=(
FieldSpec("rag_id", MaskingType.PASSTHROUGH),
FieldSpec("rag_type", MaskingType.PASSTHROUGH),
FieldSpec("embedding_model", MaskingType.PASSTHROUGH),
FieldSpec("embedding_dimension", MaskingType.PASSTHROUGH),
FieldSpec("vector_db_id", MaskingType.PASSTHROUGH),
FieldSpec("db_path", MaskingType.SENSITIVE),
FieldSpec("score_multiplier", MaskingType.PASSTHROUGH),
FieldSpec("host", MaskingType.SENSITIVE),
FieldSpec("port", MaskingType.SENSITIVE),
FieldSpec("db", MaskingType.SENSITIVE),
FieldSpec("user", MaskingType.SENSITIVE),
FieldSpec("password", MaskingType.SENSITIVE),
),
),
# A2A State
FieldSpec("a2a_state.sqlite.db_path", MaskingType.SENSITIVE),
FieldSpec("a2a_state.postgres.host", MaskingType.SENSITIVE),
FieldSpec("a2a_state.postgres.port", MaskingType.PASSTHROUGH),
FieldSpec("a2a_state.postgres.db", MaskingType.SENSITIVE),
FieldSpec("a2a_state.postgres.user", MaskingType.SENSITIVE),
FieldSpec("a2a_state.postgres.password", MaskingType.SENSITIVE),
FieldSpec("a2a_state.postgres.namespace", MaskingType.SENSITIVE),
FieldSpec("a2a_state.postgres.ssl_mode", MaskingType.PASSTHROUGH),
FieldSpec("a2a_state.postgres.gss_encmode", MaskingType.PASSTHROUGH),
FieldSpec("a2a_state.postgres.ca_cert_path", MaskingType.SENSITIVE),
# A2A Agents
ListFieldSpec(
"a2a_agents.agents",
item_fields=(
FieldSpec("name", MaskingType.PASSTHROUGH),
FieldSpec("url", MaskingType.SENSITIVE),
FieldSpec("auth_token", MaskingType.SENSITIVE),
FieldSpec("timeout", MaskingType.PASSTHROUGH),
FieldSpec("max_retries", MaskingType.PASSTHROUGH),
),
),
# Splunk
FieldSpec("splunk.enabled", MaskingType.PASSTHROUGH),
FieldSpec("splunk.url", MaskingType.SENSITIVE),
FieldSpec("splunk.token_path", MaskingType.SENSITIVE),
FieldSpec("splunk.index", MaskingType.SENSITIVE),
FieldSpec("splunk.source", MaskingType.PASSTHROUGH),
FieldSpec("splunk.timeout", MaskingType.PASSTHROUGH),
FieldSpec("splunk.verify_ssl", MaskingType.PASSTHROUGH),
# RAG Strategy
FieldSpec("rag.inline", MaskingType.PASSTHROUGH),
FieldSpec("rag.tool", MaskingType.PASSTHROUGH),
# OKP
FieldSpec("okp.rhokp_url", MaskingType.SENSITIVE),
FieldSpec("okp.offline", MaskingType.PASSTHROUGH),
FieldSpec("okp.chunk_filter_query", MaskingType.SENSITIVE),
# Reranker
FieldSpec("reranker.enabled", MaskingType.PASSTHROUGH),
FieldSpec("reranker.model", MaskingType.PASSTHROUGH),
# Approvals
FieldSpec("approvals.approval_timeout_seconds", MaskingType.PASSTHROUGH),
FieldSpec("approvals.approval_retention_days", MaskingType.PASSTHROUGH),
# rlsapi v1
FieldSpec("rlsapi_v1.allow_verbose_infer", MaskingType.PASSTHROUGH),
FieldSpec("rlsapi_v1.quota_subject", MaskingType.PASSTHROUGH),
# Saved Prompts
FieldSpec("saved_prompts.max_prompts_per_user", MaskingType.PASSTHROUGH),
FieldSpec("saved_prompts.max_display_name_length", MaskingType.PASSTHROUGH),
FieldSpec("saved_prompts.max_content_length", MaskingType.PASSTHROUGH),
# Skills
FieldSpec("skills.paths", MaskingType.SENSITIVE),
# Deployment Environment
FieldSpec("deployment_environment", MaskingType.PASSTHROUGH),
# Integration & Connectivity
ListFieldSpec(
"mcp_servers",
item_fields=(
FieldSpec("name", MaskingType.PASSTHROUGH),
FieldSpec("provider_id", MaskingType.PASSTHROUGH),
FieldSpec("url", MaskingType.SENSITIVE),
FieldSpec("authorization_headers", MaskingType.SENSITIVE),
FieldSpec("headers", MaskingType.SENSITIVE),
FieldSpec("require_approval", MaskingType.PASSTHROUGH),
FieldSpec("timeout", MaskingType.PASSTHROUGH),
),
),
)
Expand Down Expand Up @@ -303,7 +480,7 @@ def mask_value(value: Any, masking: MaskingType) -> Any:
The masked or serialized value.
"""
if masking == MaskingType.SENSITIVE:
if value is None:
if value is None or value == "":
return NOT_CONFIGURED
return CONFIGURED
return _serialize_passthrough(value)
Comment on lines 482 to 486

@coderabbitai coderabbitai Bot Jul 29, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Consider treating empty containers as not_configured too.

Empty strings now map to NOT_CONFIGURED, but empty lists/dicts still report CONFIGURED — e.g. trusted_proxy_config.allowed_service_accounts: [] (documented as equivalent to null), skills.paths: [], rh_identity_config.required_entitlements: [], mcp_servers[].authorization_headers: {}. That's misleading telemetry for the exact same "operator left it empty" case.

♻️ Suggested tweak 
     if masking == MaskingType.SENSITIVE:
-        if value is None or value == "":
+        # Empty strings/lists/dicts mean "operator left it unset".
+        if value is None or (isinstance(value, (str, list, tuple, dict)) and not value):
             return NOT_CONFIGURED
         return CONFIGURED
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
if masking == MaskingType.SENSITIVE:
if value is None:
if value is None or value == "":
return NOT_CONFIGURED
return CONFIGURED
return _serialize_passthrough(value)
if masking == MaskingType.SENSITIVE:
# Empty strings/lists/dicts mean "operator left it unset".
if value is None or (isinstance(value, (str, list, tuple, dict)) and not value):
return NOT_CONFIGURED
return CONFIGURED
return _serialize_passthrough(value)
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/telemetry/configuration_snapshot.py` around lines 482 - 486, Update the
MaskingType.SENSITIVE branch in the configuration serialization logic to return
NOT_CONFIGURED for empty containers as well as None and empty strings. Preserve
CONFIGURED for non-empty values and the existing _serialize_passthrough behavior
for other masking types.

Expand Down
Loading
Loading