mirror of
https://github.com/openobserve/openobserve.git
synced 2026-11-06 00:09:22 +00:00
1d3618ad94
## Summary Implement automatic provisioning and lifecycle management of per-organization system service accounts for the AI-powered SRE Agent. These accounts serve as the identity for RCA (Root Cause Analysis) agent API interactions and are created automatically for each organization. ## Key Features ### Service Account Provisioning - Database migration creates SRE Agent accounts for all existing organizations - Deterministic email format: `o2-sre-agent.org-<ORG_ID>@openobserve.internal` - System accounts are automatically created on organization creation - Idempotent operations ensure safe re-runs and self-healing ### System Account Protection - API endpoints prevent modification/deletion of system service accounts (403 Forbidden) - User responses include `is_system` flag to identify system accounts - Protection enforced at HTTP handler layer ### RCA Agent Client Refactoring - Singleton pattern: global client initialized once at startup - Per-request user credential forwarding for better audit trails and scoping - Lazy initialization: returns None if agent service not configured - Updated all query methods to accept and forward auth credentials ### Incident Correlation Enhancement - Query `ServiceIdentityConfig` to get configured semantic dimension groups - Extract only `distinguish_by` fields from matched identity sets - Use parallel correlation execution (Service Discovery + semantic extraction) - Improved accuracy by using configured groups instead of fallback label extraction ### Improved Token Redaction - Consistent 12-character format: first 4 visible characters + 8 asterisks - Better security for token display in UI - Updated tests for new redaction format ## Technical Details ### Database Changes - New migration: `m20260331_000001_create_sys_rca_agent_service_accounts` - Creates accounts with organization and RUM tokens - Safe pagination (100 orgs at a time) with idempotency checks - System accounts use role type 6 (SreAgent, distinct from ServiceAccount) ### Authorization - System accounts added to OpenFGA with standard org membership tuples - SRE-specific read-only role for permission control - Self-healing: runtime ensures OpenFGA state is consistent with database state ### API Changes - GET /users: Returns `is_system` and `description` fields - PUT/DELETE /users: Reject modification/deletion of system accounts ## Test Coverage - Token redaction tests updated for new format - System service account protection verified - User list pagination tested with system accounts ## Feature Flag This is an enterprise feature gated behind `#[cfg(feature = "enterprise")]`. System accounts are always created, but RCA integration only works if the agent service is configured. ## Deployment - Zero-downtime: migration is additive - Opt-in for OSS deployments - Automatic provisioning on upgrade and org creation --------- Co-authored-by: Shrinath Rao <shnath@openobserve.ai> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Hengfei Yang <hengfei.yang@gmail.com>
web
This template should help get you started developing with Vue 3 in Vite.
Recommended IDE Setup
VSCode + Volar (and disable Vetur) + TypeScript Vue Plugin (Volar).
Type Support for .vue Imports in TS
TypeScript cannot handle type information for .vue imports by default, so we replace the tsc CLI with vue-tsc for type checking. In editors, we need TypeScript Vue Plugin (Volar) to make the TypeScript language service aware of .vue types.
If the standalone TypeScript plugin doesn't feel fast enough to you, Volar has also implemented a Take Over Mode that is more performant. You can enable it by the following steps:
- Disable the built-in TypeScript Extension
- Run
Extensions: Show Built-in Extensionsfrom VSCode's command palette - Find
TypeScript and JavaScript Language Features, right click and selectDisable (Workspace)
- Run
- Reload the VSCode window by running
Developer: Reload Windowfrom the command palette.
Customize configuration
See Vite Configuration Reference.
Project Setup
npm install
Compile and Hot-Reload for Development
For stand-alone UI development environment, create .env file and which contains below environment variable
VITE_OPENOBSERVE_ENDPOINT=http://localhost:5080/
npm run dev
Type-Check, Compile and Minify for Production
npm run build
Run Unit Tests with Vitest
npm run test:unit
Run End-to-End Tests with Cypress
npm run test:e2e:dev
This runs the end-to-end tests against the Vite development server. It is much faster than the production build.
But it's still recommended to test the production build with test:e2e before deploying (e.g. in CI environments):
npm run build
npm run test:e2e
Lint with ESLint
npm run lint