ory/oathkeeper

Unable to initialize Tracer.

KieronWiltshire opened this issue · 4 comments

Preflight checklist

Describe the bug

I have a docker compose file which sets up the ory infrastructure locally, but Oathkeeper won't connect to Jaeger and I'm not sure why.

Reproducing the bug

Copy the docker compose file I have provided and run docker-compose up

Relevant log output

https://pastebin.com/raw/pRbi8eFK

Relevant configuration

version: "3.9"
services:
#  api:
#    build:
#      dockerfile: Dockerfile
#      context: .
#      # Only will build development stage from our dockerfile
#      target: development
#    depends_on:
#      - redis
#      - timescaledb
#    ports:
#      - 8000:80
#    volumes:
#      - ./:/usr/src/app/
#    command: npm run start:dev
#    env_file:
#      - .env
#    networks:
#      - dev

  timescaledb:
    image: timescale/timescaledb:latest-pg14
    container_name: postgres
    restart: always
    ports:
      - 5432:5432
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: password
    volumes:
      - ./docker/data/timescaledb:/var/lib/postgresql/data
    networks:
      - dev
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready -U postgres" ]
      interval: 5s
      timeout: 5s
      retries: 5

  redis:
    image: redis:alpine
    container_name: redis
    restart: always
    ports:
      - 6379:6379
    volumes:
      - ./docker/data/redis:/data
    networks:
      - dev

  pgadmin:
    image: dpage/pgadmin4:latest
    container_name: pgadmin
    restart: always
    depends_on:
      - timescaledb
    ports:
      - 8080:80
    environment:
      - PGADMIN_CONFIG_MASTER_PASSWORD_REQUIRED=False
      - PGADMIN_CONFIG_SERVER_MODE=False
      - PGADMIN_DEFAULT_EMAIL=admin@admin.org
      - PGADMIN_DEFAULT_PASSWORD=admin
      - PGADMIN_LISTEN_PORT=80
    volumes:
      - ./docker/data/pgadmin:/var/lib/pgadmin
    networks:
      - dev

  redis-commander:
    image: rediscommander/redis-commander:latest
    container_name: redis-commander
    restart: always
    depends_on:
      - redis
    ports:
      - 8081:8081
    environment:
      - REDIS_HOSTS=local:redis:6379:1
    networks:
      - dev

  mailslurper:
    image: oryd/mailslurper:latest-smtps
    container_name: mailslurper
    ports:
      - "4436:4436"
      - "4437:4437"
    networks:
      - dev

  hydra-migrate:
    image: oryd/hydra:latest
    container_name: hydra-migrate
    restart: on-failure
    depends_on:
      - timescaledb
    command:
      migrate -c /etc/config/hydra/hydra.yml sql -e --yes
    environment:
      DSN: postgres://postgres:password@timescaledb:5432/ory?sslmode=disable&max_conns=20&max_idle_conns=4
    volumes:
      -
        type: bind
        source: ./docker/configs/ory/hydra
        target: /etc/config/hydra
    networks:
      - dev

  kratos-migrate:
    image: oryd/kratos:latest
    container_name: kratos-migrate
    restart: on-failure
    depends_on:
      - timescaledb
    command:
      migrate -c /etc/config/kratos/kratos.yml sql -e --yes
    environment:
      DSN: postgres://postgres:password@timescaledb:5432/ory?sslmode=disable&max_conns=20&max_idle_conns=4
      LOG_LEVEL: debug
    volumes:
      -
        type: bind
        source: ./docker/configs/ory/kratos
        target: /etc/config/kratos
    networks:
      - dev

  hydra:
    image: oryd/hydra:latest
    container_name: hydra
    restart: unless-stopped
    depends_on:
      - hydra-migrate
    command:
      serve -c /etc/config/hydra/hydra.yml all --dev
    environment:
      DSN: postgres://postgres:password@timescaledb:5432/ory?sslmode=disable&max_conns=20&max_idle_conns=4
      OIDC_SUBJECT_IDENTIFIERS_SUPPORTED_TYPES: public
      LOG_LEVEL: trace
    volumes:
      -
        type: bind
        source: ./docker/configs/ory/hydra
        target: /etc/config/hydra
    ports:
      - 4444:4444
      - 4445:4445
      - 5555:5555
    networks:
      - dev

  kratos:
    image: oryd/kratos:latest
    container_name: kratos
    restart: unless-stopped
    depends_on:
      - kratos-migrate
    command: serve -c /etc/config/kratos/kratos.yml --dev
    environment:
      DSN: postgres://postgres:password@timescaledb:5432/ory?sslmode=disable&max_conns=20&max_idle_conns=4
      LOG_LEVEL: trace
    volumes:
      -
        type: bind
        source: ./docker/configs/ory/kratos
        target: /etc/config/kratos
    ports:
      - 4433:4433
      - 4434:4434
    networks:
      - dev

  kratos-selfservice-ui-node:
    image: oryd/kratos-selfservice-ui-node:latest
    container_name: kratos-selfservice-ui
    depends_on:
      - kratos
    environment:
      - JWKS_URL=http://oathkeeper:4456/.well-known/jwks.json
      - KRATOS_PUBLIC_URL=http://kratos:4433/
      - KRATOS_ADMIN_URL=http://kratos:4434/
      - KRATOS_BROWSER_URL=http://127.0.0.1:4455/.ory/kratos/public
      - PORT=4435
      - SECURITY_MODE=jwks
    networks:
      - dev

  oathkeeper:
    image: oryd/oathkeeper:latest
    container_name: oathkeeper
    restart: unless-stopped
    depends_on:
      - timescaledb
    command: serve --config=/etc/config/oathkeeper/oathkeeper.yml
    environment:
      - LOG_LEVEL=debug
      - LOG_LEAK_SENSITIVE_VALUES="true"
      - TRACING_PROVIDER=jaeger
      - TRACING_SERVICE_NAME=Oathkeeper
      - TRACING_PROVIDER_JAEGER_SAMPLING_SERVER_URL=http://jaeger:5778/sampling
      - TRACING_PROVIDER_JAEGER_LOCAL_AGENT_ADDRESS=jaeger:6831
      - TRACING_PROVIDER_JAEGER_SAMPLING_TYPE=const
      - TRACING_PROVIDER_JAEGER_SAMPLING_VALUE=1
    volumes:
      - type: bind
        source: ./docker/configs/ory/oathkeeper
        target: /etc/config/oathkeeper
    ports:
      - 4455:4455
      - 4456:4456
    networks:
      - dev

  jaeger:
    image: jaegertracing/all-in-one:1.22
    container_name: jaeger
    ports:
      - 16686:16686
    networks:
      - dev

  otel-collector:
    image: otel/opentelemetry-collector:latest
    container_name: otel-collector
    command: [ "--config=/etc/otel-collector-config.yaml" ]
    volumes:
      - ./docker/configs/otel-collector/otel-collector-config.yaml:/etc/otel-collector-config.yaml
    ports:
      - "4317:4317"
      - "4318:4318"
      - "1234:1234"
    networks:
      - dev

  openfga_migrate:
    image: openfga/openfga
    container_name: openfga-migrate
    depends_on:
      timescaledb:
        condition: service_healthy
    command: |
      migrate
    environment:
      - OPENFGA_DATASTORE_ENGINE=postgres
      - OPENFGA_DATASTORE_URI=postgres://postgres:password@timescaledb:5432/openfga
    networks:
      - dev

  openfga:
    image: openfga/openfga:latest
    container_name: openfga
    depends_on:
      - openfga_migrate
      - otel-collector
    command: run
    environment:
      - OPENFGA_DATASTORE_ENGINE=postgres
      - OPENFGA_DATASTORE_URI=postgres://postgres:password@timescaledb:5432/openfga
      - OPENFGA_TRACE_ENABLED=true
      - OPENFGA_TRACE_SAMPLE_RATIO=1
      - OPENFGA_TRACE_OTLP_ENDPOINT=otel-collector:4317
    ports:
      - "8082:8080"
      - "3000:3000"
    networks:
      - dev

networks:
  dev:

Version

latest

On which operating system are you observing this issue?

Windows

In which environment are you deploying?

Locally

Additional Context

No response

alnr commented

Does this problem persist with v0.40.2?

alnr commented

There's a typo in your config:

      - TRACING_PROVIDER_JAEGER_SAMPLING_SERVER_URL=http://jaeger:5778/sampling
      - TRACING_PROVIDER_JAEGER_LOCAL_AGENT_ADDRESS=jaeger:6831
      - TRACING_PROVIDER_JAEGER_SAMPLING_TYPE=const
      - TRACING_PROVIDER_JAEGER_SAMPLING_VALUE=1

Should be

      - TRACING_PROVIDERS_JAEGER_SAMPLING_SERVER_URL=http://jaeger:5778/sampling
      - TRACING_PROVIDERS_JAEGER_LOCAL_AGENT_ADDRESS=jaeger:6831
      - TRACING_PROVIDERS_JAEGER_SAMPLING_TYPE=const
      - TRACING_PROVIDERS_JAEGER_SAMPLING_VALUE=1

You might want to consider using the JSON config file rather than env vars, which gets you schema validation. Admittedly the error message isn't brilliant.

Please reopen if this still doesn't work.

Ah my bad, kinda confusing that there are two prefixes TRACING_PROVIDER and TRACING_PROVIDERS it might make sense to rename TRACING_PROVIDERS to just JAEGER maybe... or maybe I'm just an idiot :P