-
Notifications
You must be signed in to change notification settings - Fork 44
Java agent layer #460
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Java agent layer #460
Changes from 14 commits
Commits
Show all changes
22 commits
Select commit
Hold shift + click to select a range
5a71996
create java-agent layer publish scripts
obenkenobi 830c7f5
Fix slim layer not instrumenting lambdas
obenkenobi a81f06d
Java Agent Layer publish
obenkenobi c390773
optimize to publish single layer
obenkenobi 19467fe
clean dist tye
obenkenobi be07e54
restructure publlish script
obenkenobi 71aecf4
fix incorrect serverless mode env var
obenkenobi 264fe2e
Check jvm version, wrap logs, new handler name
obenkenobi ea854d9
Merge branch 'master' of github.com:newrelic/newrelic-lambda-layers i…
obenkenobi bd6f3a7
update chmod permissions
obenkenobi 29a85dd
Make java handlers executables
obenkenobi 4b69047
Merge branch 'java-agent-layer' of github.com:newrelic/newrelic-lambd…
obenkenobi e0ae37e
write agent logs to /tmp/logs
obenkenobi 62d99e2
Add readme explaining how to build/publish locally
obenkenobi b4c6691
tweak readme
obenkenobi 7714a42
serverless mode configurable
obenkenobi bb30d2c
Revert change
obenkenobi 92e8714
clean up dockerfile
obenkenobi 9315d5f
Fixed unbound variable
obenkenobi cee00f4
Fix typos and double quotes
obenkenobi 8a48d8d
Add agent version text file
obenkenobi 0cb2057
undo deletion
obenkenobi File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Some comments aren't visible on the classic Files Changed page.
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| name: Publish Java Agent Layers | ||
|
|
||
| on: | ||
| push: | ||
| tags: | ||
| - v**_java-agent | ||
|
|
||
| jobs: | ||
| publish-java-agent: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Check Tag | ||
| id: java-agent-check-tag | ||
| run: | | ||
| if [[ ${{ github.event.ref }} =~ ^refs/tags/v[0-9]+(\.[0-9]+)*_java-agent ]]; then | ||
| echo "match=true" >> $GITHUB_OUTPUT | ||
| fi | ||
| - uses: actions/checkout@v4 | ||
| - name: Set up QEMU | ||
| uses: docker/setup-qemu-action@v3 | ||
| with: | ||
| platforms: arm64, amd64 | ||
| - name: Publish Java Agent Layer | ||
| if: steps.java-agent-check-tag.outputs.match == 'true' | ||
| env: | ||
| AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} | ||
| AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | ||
| run: | | ||
| cd java-agent | ||
| ./publish-layers.sh | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,48 @@ | ||
| # Java Agent Lambda Layer | ||
|
|
||
| ## Description | ||
|
|
||
| Deployment scripts for deploying a lambda layer that attatches the New Relic Java Agent with serverless mode enabled. | ||
obenkenobi marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
| ## How to build & publish locally | ||
|
|
||
| First make sure you are in the java-agent directory. Run `cd java-agent`. | ||
|
|
||
| ### Updating versions.sh (Skip if using a local agent jar) | ||
| First go into `versions.sh` and check the Java Agent version. Make sure it is the correct one you will use as you will download it from the downloads site. | ||
|
|
||
| For example, to use agent version `9.1.0`, set this in `versions.sh`: | ||
| ``` | ||
| NEWRELIC_AGENT_VERSION=9.1.0 | ||
| ``` | ||
|
|
||
| ### Building locally | ||
|
|
||
| If you are downloading the agent from downloads site, run `./build-layers.sh`. | ||
| If you are using a locally built agent Jar, run `./build-layers.sh /path/to/agent/jar` where `/path/to/agent/jar` is your path to the agent jar. | ||
|
|
||
| You will see a `/dist` directory created with zip files for each lambda layer deployed: | ||
|
|
||
| - java-agent.x86_64.zip | ||
| - java-agent.arm64.zip | ||
| - java-agent-slim.x86_64.zip | ||
| - java-agent-slim.arm64.zip | ||
|
|
||
| You can manually upload them to your AWS console and deploy them into your lambda provided they are using a supported Java Version. | ||
|
|
||
| ### Building locally | ||
obenkenobi marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||
|
|
||
| The `publish-layers.sh` script builds and publishes your lambda layers. | ||
|
|
||
| To publish your lambda layers, you need to follow the steps in the [local testing guide](https://newrelic.atlassian.net/wiki/spaces/APM/pages/5337088128/New+Relic+Lambda+Layers+-+Local+Testing+Guide) to set up your AWS account and the libBuild.sh script. **Make sure your AWS account has the correct IAM permissions needed to follow these steps as well.** | ||
|
|
||
| If you are publishing using the agent from downloads site, run `./publish-layers.sh`. | ||
| If you are publishing using a locally built agent Jar, run `./publish-layers.sh /path/to/agent/jar` where `/path/to/agent/jar` is your path to the agent jar. | ||
|
|
||
| **Important:** You may have to comment out sections of the publish scripts that deploy to an architecture unsupported on your machine. For example, X86_64 machines may have to comment out sections that deploy arm64 layers. Vice versa with ARM64 machines. | ||
|
|
||
| You will then see the following deployed lambda layers in your AWS console: | ||
| - NewRelicAgentJava | ||
| - NewRelicAgentJavaARM64 | ||
| - NewRelicAgentJava-slim | ||
| - NewRelicAgentJavaARM64-slim | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| #!/usr/bin/env bash | ||
|
|
||
| set -Eeuo pipefail | ||
|
|
||
| AGENT_PATH=$1 | ||
obenkenobi marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||
| export AGENT_JAR=newrelic.jar | ||
|
|
||
| export AGENT_DIR=newrelic | ||
| export DIST_DIR=dist | ||
| export EXEC_WRAPPER=newrelic-java-handler | ||
| export LIB_HANDLER=lib-handler.sh | ||
|
|
||
| export JAVA_AGENT_DIST_X86_64=$DIST_DIR/java-agent.x86_64.zip | ||
| export JAVA_AGENT_DIST_ARM64=$DIST_DIR/java-agent.arm64.zip | ||
|
|
||
| export JAVA_AGENT_SLIM_DIST_X86_64=$DIST_DIR/java-agent-slim.x86_64.zip | ||
| export JAVA_AGENT_SLIM_DIST_ARM64=$DIST_DIR/java-agent-slim.arm64.zip | ||
|
|
||
| parent_path=$( cd "$(dirname "${BASH_SOURCE[0]}")" ; pwd -P ) | ||
|
|
||
| source ../libBuild.sh | ||
| source versions.sh | ||
obenkenobi marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
| function build-java-agent { | ||
| distribution_file=$1 | ||
| arch=$2 | ||
| agent_path=$3 | ||
| java_handler_path=$4 | ||
| echo "Building New Relic layer for the Java Agent ($arch)" | ||
| rm -rf $AGENT_DIR $distribution_file | ||
| mkdir -p $DIST_DIR | ||
| get_agent $agent_path | ||
| download_extension $arch | ||
| cp $java_handler_path ./$EXEC_WRAPPER | ||
| zip -rq $distribution_file $EXTENSION_DIST_DIR $EXTENSION_DIST_PREVIEW_FILE ./$EXEC_WRAPPER $AGENT_DIR $LIB_HANDLER | ||
| rm -rf $AGENT_DIR $EXTENSION_DIST_DIR $EXTENSION_DIST_PREVIEW_FILE ./$EXEC_WRAPPER | ||
| echo "Build complete: ${distribution_file}" | ||
| } | ||
|
|
||
| function get_agent { | ||
| agent_path=$1 | ||
| rm -rf $AGENT_JAR | ||
|
|
||
| if [[ -n "$agent_path" ]]; then | ||
| echo "Copying agent from $agent_path" | ||
| cp ${agent_path} $AGENT_JAR | ||
| else | ||
| url="https://download.newrelic.com/newrelic/java-agent/newrelic-agent/${NEWRELIC_AGENT_VERSION}/newrelic-agent-${NEWRELIC_AGENT_VERSION}.jar" | ||
| echo "Downloading agent from $url" | ||
| curl -L $url -o $AGENT_JAR | ||
| fi | ||
|
|
||
| mkdir -p $AGENT_DIR | ||
| mv $AGENT_JAR $AGENT_DIR/$AGENT_JAR | ||
| rm -f $AGENT_JAR | ||
| } | ||
|
|
||
| build-java-agent $JAVA_AGENT_DIST_X86_64 x86_64 $AGENT_PATH ./java-handler-full | ||
| build-java-agent $JAVA_AGENT_DIST_ARM64 arm64 $AGENT_PATH ./java-handler-full | ||
| build-java-agent $JAVA_AGENT_SLIM_DIST_X86_64 x86_64 $AGENT_PATH ./java-handler-slim | ||
| build-java-agent $JAVA_AGENT_SLIM_DIST_ARM64 arm64 $AGENT_PATH ./java-handler-slim | ||
obenkenobi marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
obenkenobi marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| #!/bin/bash | ||
|
|
||
| set -ef -o pipefail | ||
|
|
||
| source /opt/lib-handler.sh | ||
|
|
||
| ARGS=("$@") | ||
| EXTRA_ARGS=() | ||
|
|
||
| setup_agent $ARGS $EXTRA_ARGS | ||
|
|
||
| ARGS=("${ARGS[0]}" "${EXTRA_ARGS[@]}" "${ARGS[@]:1}") | ||
|
|
||
| exec "${ARGS[@]}" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| #!/bin/bash | ||
|
|
||
| set -ef -o pipefail | ||
|
|
||
| source /opt/lib-handler.sh | ||
| ARGS=("$@") | ||
| EXTRA_ARGS=() | ||
|
|
||
| setup_agent $ARGS $EXTRA_ARGS | ||
|
|
||
| export NEW_RELIC_LITE_MODE=true | ||
| log_debug "Always setting NEW_RELIC_LITE_MODE to be true" | ||
|
|
||
| if [ -z "${NEW_RELIC_CLASS_TRANSFORMER_AWS_LAMBDA_JAVA_CORE_ENABLED}" ]; then | ||
| export NEW_RELIC_CLASS_TRANSFORMER_AWS_LAMBDA_JAVA_CORE_ENABLED=true | ||
| log_debug "Setting NEW_RELIC_CLASS_TRANSFORMER_AWS_LAMBDA_JAVA_CORE_ENABLED to be true" | ||
| fi | ||
|
|
||
| ARGS=("${ARGS[0]}" "${EXTRA_ARGS[@]}" "${ARGS[@]:1}") | ||
|
|
||
| exec "${ARGS[@]}" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,80 @@ | ||
| #!/bin/bash | ||
|
|
||
| set -ef -o pipefail | ||
|
|
||
| function log_debug { | ||
| if [[ "$NEW_RELIC_EXTENSION_LOG_LEVEL" == "DEBUG" ]]; then | ||
| echo "[NR_JAVA_HANDLER] DEBUG $1" | ||
| fi | ||
| } | ||
|
|
||
| function log { | ||
| echo "[NR_JAVA_HANDLER] $1" | ||
| } | ||
|
|
||
| function setup_agent { | ||
| log "Begin detecting java version" | ||
| if type -p java; then | ||
| log found java executable in PATH | ||
| _java=java | ||
| elif [[ -n "$JAVA_HOME" ]] && [[ -x "$JAVA_HOME/bin/java" ]]; then | ||
| log found java executable in JAVA_HOME | ||
| _java="$JAVA_HOME/bin/java" | ||
obenkenobi marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| else | ||
| log "No java version detected" | ||
| fi | ||
|
|
||
| if [[ "$_java" ]]; then | ||
| version=$("$_java" -version 2>&1 | awk -F '"' '/version/ {print $2}') | ||
| log "Verifying JVM version is compatable. Only JVMs versions 17 and up are supported." | ||
| log "Java version $version detected" | ||
| if [[ "$version" > "17" ]] || [[ "$version" == "17" ]]; then | ||
obenkenobi marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| export JAVA_TOOL_OPTIONS="-javaagent:/opt/newrelic/newrelic.jar ${JAVA_TOOL_OPTIONS}" | ||
| log "Attatched New Relic Java Agent" | ||
| else | ||
| log version is less than 17, will not attatch the New Relic Java Agent | ||
| fi | ||
| else | ||
| export JAVA_TOOL_OPTIONS="-javaagent:/opt/newrelic/newrelic.jar ${JAVA_TOOL_OPTIONS}" | ||
| log "Attatched New Relic Java Agent" | ||
obenkenobi marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
obenkenobi marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||
| fi | ||
|
|
||
| ######################################## | ||
|
|
||
| if [ -z "${NEW_RELIC_APPLICATION_LOGGING_FORWARDING_ENABLED}" ]; then | ||
| export NEW_RELIC_APPLICATION_LOGGING_FORWARDING_ENABLED=false | ||
| log_debug "Setting NEW_RELIC_APPLICATION_LOGGING_FORWARDING_ENABLED to be false" | ||
| fi | ||
|
|
||
| if [ -z "${NEW_RELIC_CROSS_APPLICATION_TRACER_ENABLED}" ]; then | ||
| export NEW_RELIC_CROSS_APPLICATION_TRACER_ENABLED=false | ||
| log_debug "Setting NEW_RELIC_CROSS_APPLICATION_TRACER_ENABLED to be false" | ||
| fi | ||
|
|
||
| if [ -z "${NEW_RELIC_SPAN_EVENTS_COLLECT_SPAN_EVENTS}" ]; then | ||
| export NEW_RELIC_SPAN_EVENTS_COLLECT_SPAN_EVENTS=true | ||
| log_debug "Setting NEW_RELIC_SPAN_EVENTS_COLLECT_SPAN_EVENTS to be true" | ||
| fi | ||
|
|
||
| if [ -z "${NEW_RELIC_TRANSACTION_TRACER_COLLECT_TRACES}" ]; then | ||
| export NEW_RELIC_TRANSACTION_TRACER_COLLECT_TRACES=true | ||
| log_debug "Setting NEW_RELIC_TRANSACTION_TRACER_COLLECT_TRACES to be true" | ||
| fi | ||
|
|
||
| if [ -z "${NEW_RELIC_APP_NAME}" ]; then | ||
| export NEW_RELIC_APP_NAME=lambda-function | ||
| log_debug "Setting NEW_RELIC_APP_NAME to be lambda-function" | ||
| fi | ||
|
|
||
| if [ -z "${NEW_RELIC_LOG_FILE_PATH}" ]; then | ||
| mkdir -p /tmp/logs | ||
| export NEW_RELIC_LOG_FILE_PATH=/tmp/logs/ | ||
| log_debug "Setting NEW_RELIC_LOG_FILE_PATH to be /tmp/logs/" | ||
| fi | ||
|
|
||
| export NEW_RELIC_SERVERLESS_MODE_ENABLED=true | ||
| log_debug "Always setting NEW_RELIC_SERVERLESS_MODE_ENABLED to be true" | ||
|
|
||
| export NEW_RELIC_ENABLE_AUTO_APP_NAMING=false | ||
| log_debug "Always setting NEW_RELIC_ENABLE_AUTO_APP_NAMING to be false" | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| #!/usr/bin/env bash | ||
|
|
||
| set -Eeuo pipefail | ||
|
|
||
| source ./build-layers.sh | ||
|
|
||
| function publish-java-agent { | ||
| distribution_file=$1 | ||
| arch=$2 | ||
| slim=$3 | ||
| if [[ $slim != "slim" ]]; then | ||
| slim="" | ||
| fi | ||
| if [ ! -f $distribution_file ]; then | ||
obenkenobi marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||
| echo "Package not found: ${distribution_file}" | ||
| exit 1 | ||
| fi | ||
|
|
||
| for region in "${REGIONS[@]}"; do | ||
| echo "Publishing $slim java agent layer in region $region" | ||
| publish_layer $distribution_file $region java $arch $NEWRELIC_AGENT_VERSION $slim | ||
| done | ||
|
|
||
| publish_docker_ecr $distribution_file java $arch $slim | ||
| } | ||
|
|
||
| publish-java-agent $JAVA_AGENT_DIST_X86_64 x86_64 "" | ||
| publish-java-agent $JAVA_AGENT_DIST_ARM64 arm64 "" | ||
|
|
||
| publish-java-agent $JAVA_AGENT_SLIM_DIST_X86_64 x86_64 slim | ||
| publish-java-agent $JAVA_AGENT_SLIM_DIST_ARM64 arm64 slim | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| NEWRELIC_AGENT_VERSION=9.1.0 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Copilot Autofix
AI 19 days ago
In general, the problem is fixed by defining explicit
permissionsfor the workflow or specific job, limiting theGITHUB_TOKENto only what is required. For this workflow, the steps only need to read repository contents (foractions/checkout) and do not require any write operations viaGITHUB_TOKEN. Therefore, we can safely setcontents: readas the job (or workflow) permissions.The best minimal change without altering functionality is to add a
permissions:block at the job level forpublish-java-agent. This keeps the change tightly scoped and clearly associated with the job CodeQL flagged. We will insert:directly under
runs-on: ubuntu-latestin.github/workflows/publish-java-agent.yml. No additional imports or methods are required, because this is purely a YAML configuration change for GitHub Actions.