[PR] feat(opa): propagate traceparent to the OPA server [apisix]

["GitNimay (via GitHub)" <gi...@apache.org>]

GitNimay opened a new pull request, #14059:
URL: https://github.com/apache/apisix/pull/14059

   ### Description
   
   The `opa` plugin sends its decision request to OPA with only a `Content-Type` header. So with distributed tracing enabled, OPA never gets the W3C trace context, and its spans start a new trace instead of joining the APISIX request trace. The incoming `traceparent` is visible to OPA only inside the JSON input (`input.request.headers`), which OPA does not use for tracing (see open-policy-agent/opa#6905).
   
   This PR forwards the request's current `traceparent` header on the call to OPA. When the `opentelemetry` plugin is enabled, its rewrite phase has already put the APISIX span into that header, so OPA's spans become children of the APISIX span. If the header is missing, nothing extra is sent.
   
   ```mermaid
   sequenceDiagram
       participant C as Client
       participant A as APISIX (opentelemetry + opa)
       participant O as OPA
       C->>A: GET /hello (traceparent: 00-T-client-01)
       Note over A: opentelemetry starts span S and<br/>injects traceparent 00-T-S-xx
       A->>O: POST /v1/data/<policy> (traceparent: 00-T-S-xx)
       Note over O: OPA span is a child of S in trace T
   ```
   
   I used a plain header rather than a schema option because OPA ignores `traceparent` when its tracing is off, so forwarding it is harmless. I can put it behind an option (e.g. `propagate_trace_context`) if reviewers prefer.
   
   #### Which issue(s) this PR fixes:
   
   Fixes #14051
   
   ### Tests
   
   New `t/plugin/opa4.t` runs a mock OPA endpoint in the test server that denies every request and echoes back the `traceparent` it received:
   
   - TEST 2: a client `traceparent` is forwarded to OPA.
   - TEST 3: no `traceparent` is sent when the request has none.
   - TEST 5: with `opentelemetry` enabled, OPA gets the same trace id but the APISIX span id, not the client's.
   
   Without the fix, TEST 2 and TEST 5 fail (OPA gets no header). With the fix, the file passes. `luacheck` and `lj-releng` are clean on `apisix/plugins/opa.lua`.
   
   ### Checklist
   
   - [x] I have explained the need for this PR and the problem it solves
   - [x] I have explained the changes or the new features added to this PR
   - [x] I have added tests corresponding to this change
   - [x] I have updated the documentation to reflect this change
   - [x] I have verified that this change is backward compatible (If not, please discuss on the [APISIX mailing list](https://github.com/apache/apisix/tree/master#community) first)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org