Add Cloud Run service log destination#44720
Conversation
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #44720 +/- ##
==========================================
- Coverage 66.68% 66.67% -0.01%
==========================================
Files 2651 2652 +1
Lines 213531 213687 +156
Branches 9613 9615 +2
==========================================
+ Hits 142395 142484 +89
- Misses 58172 58231 +59
- Partials 12964 12972 +8
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Pull request overview
Adds a new cloudrun_service logging destination so Fleet can send osquery status/result logs and audit logs directly to a Cloud Run service, alongside config/API/frontend/docs support for that option.
Changes:
- Added backend logging support for
cloudrun_service, including optional Google ID token audiences and per-log raw JSON POST delivery. - Wired the new destination through server config loading,
servelogger setup, and app-config/logging API exposure. - Updated frontend log-destination typing and docs to mention the new plugin.
Reviewed changes
Copilot reviewed 10 out of 12 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| server/service/testing_utils.go | Added test config helper for Cloud Run logging. |
| server/service/service_appconfig.go | Exposed Cloud Run logging config in app config responses. |
| server/service/service_appconfig_test.go | Added LoggingConfig coverage for Cloud Run plugin. |
| server/logging/logging.go | Registered cloudrun_service in logger factory/config. |
| server/logging/cloudrun_service.go | Implemented Cloud Run log writer with optional ID token auth. |
| server/logging/cloudrun_service_test.go | Added unit tests for basic Cloud Run writer behavior. |
| server/fleet/app.go | Added API-facing Cloud Run logging config type. |
| server/config/config.go | Added Fleet config fields/flags/env loading for Cloud Run logging. |
| frontend/interfaces/config.ts | Added cloudrun_service to frontend log destination type union. |
| docs/Get started/FAQ.md | Documented new plugin in FAQ list of log destinations. |
| docs/Configuration/fleet-server-configuration.md | Documented Cloud Run logging plugin and related config keys. |
| cmd/fleet/serve.go | Passed Cloud Run config into status/result/audit logger setup. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
WalkthroughAdds Cloud Run service logging support across the codebase. Introduces a new CloudRunServiceConfig (status/result/audit URL and audience pairs), extends FleetConfig and logging Configs, and exposes a matching JSON-serializable type. Implements cloudRunServiceLogWriter to POST JSON log entries to Cloud Run endpoints with optional ID-token authentication and enforces a per-entry size limit. Integrates the plugin into JSON logger construction and server initialization, updates service app config and tests, and adds "cloudrun_service" to the frontend LogDestination type. 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@server/logging/cloudrun_service_test.go`:
- Around line 24-40: The test TestCloudRunServiceSendsEachRawLog references an
undefined variable logs causing a compile error; add a local declaration for
logs (e.g., match other tests in the package by declaring var logs
[]json.RawMessage or logs := []json.RawMessage{...} with the expected entries)
before calling makeCloudRunServiceWriterWithClient and writer.Write so the
subsequent require.Equal(t, logs, bodies) can compare against the sent payloads.
In `@server/logging/cloudrun_service.go`:
- Around line 33-36: In NewCloudRunServiceLogWriter validate the serviceURL
format up front: parse serviceURL (e.g., using url.Parse or url.ParseRequestURI)
and ensure it yields a non-empty Scheme and Host; if parsing fails or
scheme/host are missing, return an error immediately instead of deferring
failure to Write; this ensures malformed URLs are caught at logger
initialization and references the serviceURL parameter and
NewCloudRunServiceLogWriter constructor for where to add the check.
- Around line 73-93: The success path currently calls resp.Body.Close() without
draining, preventing reliable HTTP connection reuse; change the success branch
(the block around w.client.Do, the resp variable, and the final
resp.Body.Close()) to explicitly drain the response before closing — e.g.
read/discard up to a small limit or copy to io.Discard (handle/ignore read
errors) and then call resp.Body.Close(); keep the existing logging
(w.logger.DebugContext and platformhttp.MaskSecretURLParams(w.url)) and error
return behavior unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: fcde6969-557f-4ab6-81d8-444c7a84a616
⛔ Files ignored due to path filters (2)
docs/Configuration/fleet-server-configuration.mdis excluded by!**/*.mddocs/Get started/FAQ.mdis excluded by!**/*.md
📒 Files selected for processing (10)
cmd/fleet/serve.gofrontend/interfaces/config.tsserver/config/config.goserver/fleet/app.goserver/logging/cloudrun_service.goserver/logging/cloudrun_service_test.goserver/logging/logging.goserver/service/service_appconfig.goserver/service/service_appconfig_test.goserver/service/testing_utils.go
Summary
cloudrun_servicelog destination for osquery status logs, osquery result logs, and audit logs.Why
Fleet already supports AWS Lambda as a direct serverless log destination. This adds the analogous Cloud Run service path without changing the existing webhook behavior, which uses an envelope payload and best-effort delivery.
AI usage
This PR was implemented with AI assistance and human reviewed by Robbie Trencheny.
Testing
go test ./server/logginggo test ./server/service -run TestService_LoggingConfiggo test ./server/configgo test ./cmd/fleet -run '^$'make lint-go-incrementalNote: full
go test ./cmd/fleetwas not runnable locally because tests require themysql_testservice.Summary by CodeRabbit
New Features
Tests