First pass at tracing

docker-compose.yaml

@@ -16,6 +16,10 @@ services:
 
       # Explicitly tell AWS SDK where to find credentials
       AWS_SHARED_CREDENTIALS_FILE: /.aws/credentials
+
+      # OpenTelemetry exporter endpoint (Jaeger)
+      OTEL_EXPORTER_OTLP_ENDPOINT: http://jaeger:4318
+      OTEL_SERVICE_NAME: tag-page-rendering
     ports:
       - '9000:9000'
 
@@ -48,6 +52,13 @@ services:
     depends_on:
       tag-page-rendering:
         condition: service_healthy
+    volumes:
+      - ./tag-page-payload.json:/data/tag-page-payload.json:ro
     command: |
-      curl "https://www.theguardian.com/tone/minutebyminute.json?dcr=true" --silent > data.json && \
-        curl -X POST http://localhost:9000/TagPage -d @data.json -H "Content-Type: application/json"
+      curl -X POST http://tag-page-rendering:9000/TagPage -d @/data/tag-page-payload.json -H "Content-Type: application/json"
+
+  jaeger:
+    image: jaegertracing/jaeger:2.6.0
+    ports:
+      - '16686:16686'
+      - '4318:4318'

dotcom-rendering/cdk/lib/__snapshots__/renderingStack.test.ts.snap

@@ -8,6 +8,7 @@ exports[`The RenderingCDKStack matches the snapshot 1`] = `
       "GuAllowPolicy",
       "GuAllowPolicy",
       "GuAllowPolicy",
+      "GuAllowPolicy",
       "GuVpcParameter",
       "GuSubnetListParameter",
       "GuSubnetListParameter",
@@ -190,6 +191,32 @@ exports[`The RenderingCDKStack matches the snapshot 1`] = `
       },
       "Type": "AWS::IAM::Policy",
     },
+    "AllowPolicyXRay6A9BDA0E": {
+      "Properties": {
+        "PolicyDocument": {
+          "Statement": [
+            {
+              "Action": [
+                "xray:PutTraceSegments",
+                "xray:PutTelemetryRecords",
+                "xray:GetSamplingRules",
+                "xray:GetSamplingTargets",
+              ],
+              "Effect": "Allow",
+              "Resource": "*",
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "PolicyName": "AllowPolicyXRay6A9BDA0E",
+        "Roles": [
+          {
+            "Ref": "InstanceRoleArticlerendering0D4717E8",
+          },
+        ],
+      },
+      "Type": "AWS::IAM::Policy",
+    },
     "AutoScalingGroupArticlerenderingASG8488C3F1": {
       "Properties": {
         "HealthCheckGracePeriod": 120,
@@ -1623,6 +1650,7 @@ exports[`The RenderingCDKStack matches the snapshot for Tag Page Rendering CODE
       "GuAllowPolicy",
       "GuAllowPolicy",
       "GuAllowPolicy",
+      "GuAllowPolicy",
       "GuVpcParameter",
       "GuSubnetListParameter",
       "GuSubnetListParameter",
@@ -1823,6 +1851,35 @@ exports[`The RenderingCDKStack matches the snapshot for Tag Page Rendering CODE
       },
       "Type": "AWS::IAM::Policy",
     },
+    "AllowPolicyXRay6A9BDA0E": {
+      "Properties": {
+        "PolicyDocument": {
+          "Statement": [
+            {
+              "Action": [
+                "xray:PutTraceSegments",
+                "xray:PutTelemetryRecords",
+                "xray:GetSamplingRules",
+                "xray:GetSamplingTargets",
+              ],
+              "Effect": "Allow",
+              "Resource": "*",
+            },
+          ],
+          "Version": "2012-10-17",
+        },
+        "PolicyName": "AllowPolicyXRay6A9BDA0E",
+        "Roles": [
+          {
+            "Ref": "InstanceRoleTagpagerendering171BC2F9",
+          },
+          {
+            "Ref": "EcsTaskDefinitionTaskRoleB7B6D8DD",
+          },
+        ],
+      },
+      "Type": "AWS::IAM::Policy",
+    },
     "AutoScalingGroupTagpagerenderingASG7F7E0748": {
       "Properties": {
         "HealthCheckGracePeriod": 120,
@@ -1984,6 +2041,7 @@ exports[`The RenderingCDKStack matches the snapshot for Tag Page Rendering CODE
           "Type": "ECS",
         },
         "EnableECSManagedTags": false,
+        "EnableExecuteCommand": "true",
         "HealthCheckGracePeriodSeconds": 60,
         "LaunchType": "FARGATE",
         "LoadBalancers": [
@@ -2157,6 +2215,14 @@ exports[`The RenderingCDKStack matches the snapshot for Tag Page Rendering CODE
                 "Name": "GU_STACK",
                 "Value": "frontend",
               },
+              {
+                "Name": "OTEL_EXPORTER_OTLP_ENDPOINT",
+                "Value": "http://localhost:4318",
+              },
+              {
+                "Name": "OTEL_SERVICE_NAME",
+                "Value": "tag-page-rendering",
+              },
             ],
             "Essential": true,
             "Image": {
@@ -2244,6 +2310,32 @@ exports[`The RenderingCDKStack matches the snapshot for Tag Page Rendering CODE
             "ReadonlyRootFilesystem": true,
             "VersionConsistency": "disabled",
           },
+          {
+            "Command": [
+              "--config=/etc/ecs/ecs-default-config.yaml",
+            ],
+            "Cpu": 256,
+            "Essential": true,
+            "Image": "public.ecr.aws/aws-observability/aws-otel-collector:latest",
+            "LogConfiguration": {
+              "LogDriver": "awslogs",
+              "Options": {
+                "awslogs-group": {
+                  "Ref": "EcsTaskDefinitionadotcollectorLogGroup9B99E580",
+                },
+                "awslogs-region": "eu-west-1",
+                "awslogs-stream-prefix": "tag-page-rendering-adot",
+              },
+            },
+            "MemoryReservation": 256,
+            "Name": "adot-collector",
+            "PortMappings": [
+              {
+                "ContainerPort": 4318,
+                "Protocol": "tcp",
+              },
+            ],
+          },
         ],
         "Cpu": "1024",
         "ExecutionRoleArn": {
@@ -2380,6 +2472,19 @@ exports[`The RenderingCDKStack matches the snapshot for Tag Page Rendering CODE
                 ],
               },
             },
+            {
+              "Action": [
+                "logs:CreateLogStream",
+                "logs:PutLogEvents",
+              ],
+              "Effect": "Allow",
+              "Resource": {
+                "Fn::GetAtt": [
+                  "EcsTaskDefinitionadotcollectorLogGroup9B99E580",
+                  "Arn",
+                ],
+              },
+            },
           ],
           "Version": "2012-10-17",
         },
@@ -2453,6 +2558,31 @@ exports[`The RenderingCDKStack matches the snapshot for Tag Page Rendering CODE
       },
       "Type": "AWS::IAM::Role",
     },
+    "EcsTaskDefinitionadotcollectorLogGroup9B99E580": {
+      "DeletionPolicy": "Retain",
+      "Properties": {
+        "Tags": [
+          {
+            "Key": "gu:cdk:version",
+            "Value": "TEST",
+          },
+          {
+            "Key": "gu:repo",
+            "Value": "guardian/dotcom-rendering",
+          },
+          {
+            "Key": "Stack",
+            "Value": "frontend",
+          },
+          {
+            "Key": "Stage",
+            "Value": "CODE",
+          },
+        ],
+      },
+      "Type": "AWS::Logs::LogGroup",
+      "UpdateReplacePolicy": "Retain",
+    },
     "GetDistributablePolicyTagpagerendering346128E3": {
       "Properties": {
         "PolicyDocument": {

dotcom-rendering/cdk/lib/renderingStack.ts

@@ -17,6 +17,8 @@ import { Metric, Unit } from 'aws-cdk-lib/aws-cloudwatch';
 import { SnsAction } from 'aws-cdk-lib/aws-cloudwatch-actions';
 import type { InstanceType } from 'aws-cdk-lib/aws-ec2';
 import { Peer } from 'aws-cdk-lib/aws-ec2';
+import { ContainerImage, LogDrivers } from 'aws-cdk-lib/aws-ecs';
+import type { CfnService } from 'aws-cdk-lib/aws-ecs';
 import { ClusterSettings } from 'aws-cdk-lib/aws-ecs/mixins';
 import { Subscription, SubscriptionProtocol, Topic } from 'aws-cdk-lib/aws-sns';
 import { StringParameter } from 'aws-cdk-lib/aws-ssm';
@@ -239,6 +241,15 @@ export class RenderingCDKStack extends CDKStack {
 					actions: ['cloudwatch:*', 'logs:*'],
 					resources: ['*'],
 				}),
+				new GuAllowPolicy(this, 'AllowPolicyXRay', {
+					actions: [
+						'xray:PutTraceSegments',
+						'xray:PutTelemetryRecords',
+						'xray:GetSamplingRules',
+						'xray:GetSamplingTargets',
+					],
+					resources: ['*'],
+				}),
 				new GuAllowPolicy(this, 'AllowPolicyDescribeDecryptKms', {
 					actions: ['kms:Decrypt', 'kms:DescribeKey'],
 					resources: [
@@ -302,6 +313,8 @@ export class RenderingCDKStack extends CDKStack {
 				GU_STAGE: stage,
 				GU_APP: guApp,
 				GU_STACK: guStack,
+				OTEL_EXPORTER_OTLP_ENDPOINT: 'http://localhost:4318',
+				OTEL_SERVICE_NAME: guApp,
 			};
 
 			for (const [key, value] of Object.entries(ecsEnvVars)) {
@@ -311,12 +324,31 @@ export class RenderingCDKStack extends CDKStack {
 				);
 			}
 
+			// Enable us to "ssh" to the container
+			const ecsService = app.ecsService?.node.defaultChild as CfnService;
+			ecsService.addPropertyOverride('EnableExecuteCommand', 'true');
+
 			// TODO enable this at the pattern level in GuCDK
 			app.ecsService?.cluster.with(
 				new ClusterSettings([
 					{ name: 'containerInsights', value: 'enhanced' },
 				]),
 			);
+
+			// ADOT (AWS Distro for OpenTelemetry) sidecar to receive OTLP
+			// traces from the app and forward them to AWS X-Ray.
+			app.ecsService?.taskDefinition.addContainer('adot-collector', {
+				image: ContainerImage.fromRegistry(
+					'public.ecr.aws/aws-observability/aws-otel-collector:latest',
+				),
+				command: ['--config=/etc/ecs/ecs-default-config.yaml'],
+				logging: LogDrivers.awsLogs({
+					streamPrefix: `${guApp}-adot`,
+				}),
+				portMappings: [{ containerPort: 4318 }],
+				cpu: 256,
+				memoryReservationMiB: 256,
+			});
 		}
 
 		/**

dotcom-rendering/package.json

@@ -46,6 +46,11 @@
 		"@guardian/source-development-kitchen": "28.1.0",
 		"@guardian/support-dotcom-components": "10.1.0",
 		"@guardian/tsconfig": "catalog:",
+		"@opentelemetry/api": "1.9.1",
+		"@opentelemetry/context-async-hooks": "2.9.0",
+		"@opentelemetry/exporter-trace-otlp-http": "0.220.0",
+		"@opentelemetry/resources": "2.9.0",
+		"@opentelemetry/sdk-trace-base": "2.9.0",
 		"@playwright/test": "1.60.0",
 		"@sentry/browser": "10.52.0",
 		"@storybook/addon-a11y": "10.3.3",