Update dskit (#7698)

* Update dskit

Signed-off-by: Marco Pracucci <marco@pracucci.com>

* Updated doc and CHANGELOG

Signed-off-by: Marco Pracucci <marco@pracucci.com>

* Update doc

Signed-off-by: Marco Pracucci <marco@pracucci.com>

* Bumped dskit version

Signed-off-by: Marco Pracucci <marco@pracucci.com>

* Hide -server.grpc.stats-tracking-enabled and -server.grpc.recv-buffer-pools-enabled from auto-generated config

Signed-off-by: Marco Pracucci <marco@pracucci.com>

* Mark -server.proxy-protocol-enabled experimental

Signed-off-by: Marco Pracucci <marco@pracucci.com>

---------

Signed-off-by: Marco Pracucci <marco@pracucci.com>

CHANGELOG.md

@@ -10,6 +10,7 @@
 * [FEATURE] Continuous-test: now runable as a module with `mimir -target=continuous-test`. #7747
 * [FEATURE] Store-gateway: Allow specific tenants to be enabled or disabled via `-store-gateway.enabled-tenants` or `-store-gateway.disabled-tenants` CLI flags or their corresponding YAML settings. #7653
 * [FEATURE] New `-<prefix>.s3.bucket-lookup-type` flag configures lookup style type, used to access bucket in s3 compatible providers. #7684
+* [FEATURE] Server: added experimental [PROXY protocol support](https://www.haproxy.org/download/2.3/doc/proxy-protocol.txt). The PROXY protocol support can be enabled via `-server.proxy-protocol-enabled=true`. When enabled, the support is added both to HTTP and gRPC listening ports. #7698
 * [ENHANCEMENT] Store-gateway: merge series from different blocks concurrently. #7456
 * [ENHANCEMENT] Store-gateway: Add `stage="wait_max_concurrent"` to `cortex_bucket_store_series_request_stage_duration_seconds` which records how long the query had to wait for its turn for `-blocks-storage.bucket-store.max-concurrent`. #7609
 * [ENHANCEMENT] Querier: add `cortex_querier_federation_upstream_query_wait_duration_seconds` to observe time from when a querier picks up a cross-tenant query to when work begins on its single-tenant counterparts. #7209

cmd/mimir/config-descriptor.json

@@ -212,6 +212,17 @@
           "fieldType": "int",
           "fieldCategory": "advanced"
         },
+        {
+          "kind": "field",
+          "name": "proxy_protocol_enabled",
+          "required": false,
+          "desc": "Enables PROXY protocol.",
+          "fieldValue": null,
+          "fieldDefaultValue": false,
+          "fieldFlag": "server.proxy-protocol-enabled",
+          "fieldType": "boolean",
+          "fieldCategory": "experimental"
+        },
         {
           "kind": "field",
           "name": "tls_cipher_suites",

cmd/mimir/help-all.txt.tmpl

@@ -2655,6 +2655,8 @@ Usage of ./cmd/mimir/mimir:
     	Regex for matching the source IPs. Only used if server.log-source-ips-enabled is true. If not set the default Forwarded, X-Real-IP and X-Forwarded-For headers are used
   -server.path-prefix string
     	Base path to serve all API routes from (e.g. /v1/)
+  -server.proxy-protocol-enabled
+    	[experimental] Enables PROXY protocol.
   -server.register-instrumentation
     	Register the intrumentation handlers (/metrics etc). (default true)
   -server.report-grpc-codes-in-instrumentation-label-enabled

cmd/mimir/main_test.go

@@ -20,7 +20,7 @@ import (
 	"gopkg.in/yaml.v3"
 
 	"github.com/grafana/mimir/pkg/mimir"
-	"github.com/grafana/mimir/pkg/util/fieldcategory"
+	"github.com/grafana/mimir/pkg/util/configdoc"
 	"github.com/grafana/mimir/pkg/util/test"
 )
 
@@ -443,7 +443,7 @@ func TestParseConfigFileParameter(t *testing.T) {
 
 func TestFieldCategoryOverridesNotStale(t *testing.T) {
 	overrides := make(map[string]struct{})
-	fieldcategory.VisitOverrides(func(s string) {
+	configdoc.VisitCategoryOverrides(func(s string) {
 		overrides[s] = struct{}{}
 	})
 

docs/sources/mimir/configure/about-versioning.md

@@ -170,6 +170,9 @@ The following features are currently experimental:
   - `-ingester.use-ingester-owned-series-for-limits`
   - `-ingester.track-ingester-owned-series`
   - `-ingester.owned-series-update-interval`
+- Server
+  - [PROXY protocol](https://www.haproxy.org/download/2.3/doc/proxy-protocol.txt) support
+    - `-server.proxy-protocol-enabled`
 
 ## Deprecated features
 

docs/sources/mimir/configure/configuration-parameters/index.md

@@ -524,6 +524,10 @@ The `server` block configures the HTTP and gRPC server of the launched service(s
 # CLI flag: -server.grpc-conn-limit
 [grpc_listen_conn_limit: <int> | default = 0]
 
+# (experimental) Enables PROXY protocol.
+# CLI flag: -server.proxy-protocol-enabled
+[proxy_protocol_enabled: <boolean> | default = false]
+
 # Comma-separated list of cipher suites to use. If blank, the default Go cipher
 # suites is used.
 # CLI flag: -server.tls-cipher-suites

go.mod

@@ -20,7 +20,7 @@ require (
 	github.com/golang/snappy v0.0.4
 	github.com/google/gopacket v1.1.19
 	github.com/gorilla/mux v1.8.1
-	github.com/grafana/dskit v0.0.0-20240311184239-73feada6c0d7
+	github.com/grafana/dskit v0.0.0-20240327155200-7bd314b462b2
 	github.com/grafana/e2e v0.1.2-0.20240118170847-db90b84177fc
 	github.com/hashicorp/golang-lru v1.0.2 // indirect
 	github.com/json-iterator/go v1.1.12
@@ -104,6 +104,7 @@ require (
 	github.com/hashicorp/go-version v1.6.0 // indirect
 	github.com/hashicorp/hcl v1.0.1-vault-5 // indirect
 	github.com/pierrec/lz4/v4 v4.1.19 // indirect
+	github.com/pires/go-proxyproto v0.7.0 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0 // indirect
 	k8s.io/apimachinery v0.29.3 // indirect

go.sum

@@ -496,8 +496,8 @@ github.com/gosimple/slug v1.1.1 h1:fRu/digW+NMwBIP+RmviTK97Ho/bEj/C9swrCspN3D4=
 github.com/gosimple/slug v1.1.1/go.mod h1:ER78kgg1Mv0NQGlXiDe57DpCyfbNywXXZ9mIorhxAf0=
 github.com/grafana-tools/sdk v0.0.0-20220919052116-6562121319fc h1:PXZQA2WCxe85Tnn+WEvr8fDpfwibmEPgfgFEaC87G24=
 github.com/grafana-tools/sdk v0.0.0-20220919052116-6562121319fc/go.mod h1:AHHlOEv1+GGQ3ktHMlhuTUwo3zljV3QJbC0+8o2kn+4=
-github.com/grafana/dskit v0.0.0-20240311184239-73feada6c0d7 h1:yd9yoNgEOtp8O0MbtqXoMVqr+ZbU4oZFE8a04z8WXFE=
-github.com/grafana/dskit v0.0.0-20240311184239-73feada6c0d7/go.mod h1:RpTvZ9nkdXqyQro5DULQHJl9B6vwvEj95Dk6WIXqTLQ=
+github.com/grafana/dskit v0.0.0-20240327155200-7bd314b462b2 h1:OeJyXL3PaAl1eWWIYEOJjIXbfvheCX9of6oCYac1Qwc=
+github.com/grafana/dskit v0.0.0-20240327155200-7bd314b462b2/go.mod h1:HvSf3uf8Ps2vPpzHeAFyZTdUcbVr+Rxpq1xcx7J/muc=
 github.com/grafana/e2e v0.1.2-0.20240118170847-db90b84177fc h1:BW+LjKJDz0So5LI8UZfW5neWeKpSkWqhmGjQFzcFfLM=
 github.com/grafana/e2e v0.1.2-0.20240118170847-db90b84177fc/go.mod h1:JVmqPBe8A/pZWwRoJW5ZjyALeY5OXMzPl7LrVXOdZAI=
 github.com/grafana/goautoneg v0.0.0-20231010094147-47ce5e72a9ae h1:Yxbw9jKGJVC6qAK5Ubzzb/qZwM6rRMMqaDc/d4Vp3pM=
@@ -758,6 +758,8 @@ github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCko
 github.com/pelletier/go-toml/v2 v2.0.5/go.mod h1:OMHamSCAODeSsVrwwvcJOaoN0LIUIaFVNZzmWyNfXas=
 github.com/pierrec/lz4/v4 v4.1.19 h1:tYLzDnjDXh9qIxSTKHwXwOYmm9d887Y7Y1ZkyXYHAN4=
 github.com/pierrec/lz4/v4 v4.1.19/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
+github.com/pires/go-proxyproto v0.7.0 h1:IukmRewDQFWC7kfnb66CSomk2q/seBuilHBYFwyq0Hs=
+github.com/pires/go-proxyproto v0.7.0/go.mod h1:Vz/1JPY/OACxWGQNIRY2BeyDmpoaWmEP40O9LbuiFR4=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=

pkg/mimir/mimir.go

@@ -759,6 +759,10 @@ func New(cfg Config, reg prometheus.Registerer) (*Mimir, error) {
 			"/schedulerpb.SchedulerForQuerier/NotifyQuerierShutdown",
 		})
 
+	// Do not allow to configure potentially unsafe options until we've properly tested them in Mimir.
+	// These configuration options are hidden in the auto-generated documentation (see pkg/util/configdoc).
+	cfg.Server.GRPCServerRecvBufferPoolsEnabled = false
+
 	// Inject the registerer in the Server config too.
 	cfg.Server.Registerer = reg
 

pkg/util/fieldcategory/overrides.go → pkg/util/configdoc/fieldcategory.go

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 
-package fieldcategory
+package configdoc
 
 import "fmt"
 
@@ -34,8 +34,8 @@ func (c Category) String() string {
 
 // Fields are primarily categorized via struct tags, but this can be impossible when third party libraries are involved
 // Only categorize fields here when you can't otherwise, since struct tags are less likely to become stale
-var overrides = map[string]Category{
-	// weaveworks/common/server in server.Config
+var categoryOverrides = map[string]Category{
+	// Defined in grafana/dskit/server.Config
 	"server.graceful-shutdown-timeout":                  Advanced,
 	"server.grpc-conn-limit":                            Advanced,
 	"server.grpc-listen-network":                        Advanced,
@@ -69,25 +69,26 @@ var overrides = map[string]Category{
 	"server.path-prefix":                                Advanced,
 	"server.register-instrumentation":                   Advanced,
 	"server.log-request-at-info-level-enabled":          Advanced,
+	"server.proxy-protocol-enabled":                     Experimental,
 
 	// main.go global flags
 	"config.file":       Basic,
 	"config.expand-env": Basic,
 }
 
-func AddOverrides(o map[string]Category) {
+func AddCategoryOverrides(o map[string]Category) {
 	for n, c := range o {
-		overrides[n] = c
+		categoryOverrides[n] = c
 	}
 }
 
-func GetOverride(fieldName string) (category Category, ok bool) {
-	category, ok = overrides[fieldName]
+func GetCategoryOverride(fieldName string) (category Category, ok bool) {
+	category, ok = categoryOverrides[fieldName]
 	return
 }
 
-func VisitOverrides(f func(name string)) {
-	for override := range overrides {
+func VisitCategoryOverrides(f func(name string)) {
+	for override := range categoryOverrides {
 		f(override)
 	}
 }

pkg/util/configdoc/hidden.go

@@ -0,0 +1,14 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+
+package configdoc
+
+var hiddenOverrides = map[string]bool{
+	// Defined in grafana/dskit/server.Config
+	"server.grpc.stats-tracking-enabled":    true,
+	"server.grpc.recv-buffer-pools-enabled": true,
+}
+
+func GetHiddenOverride(fieldName string) (isHidden, ok bool) {
+	isHidden, ok = hiddenOverrides[fieldName]
+	return
+}

pkg/util/usage/usage.go

@@ -12,7 +12,7 @@ import (
 	"github.com/grafana/dskit/flagext"
 
 	"github.com/grafana/mimir/pkg/ingester/activeseries"
-	"github.com/grafana/mimir/pkg/util/fieldcategory"
+	"github.com/grafana/mimir/pkg/util/configdoc"
 )
 
 // Usage prints command-line usage.
@@ -30,7 +30,7 @@ func Usage(printAll bool, configs ...interface{}) error {
 	fmt.Fprintf(fs.Output(), "Usage of %s:\n", os.Args[0])
 	fs.VisitAll(func(fl *flag.Flag) {
 		v := reflect.ValueOf(fl.Value)
-		fieldCat := fieldcategory.Basic
+		fieldCat := configdoc.Basic
 		var field reflect.StructField
 		var hasField bool
 
@@ -41,30 +41,30 @@ func Usage(printAll bool, configs ...interface{}) error {
 		if v.Kind() == reflect.Ptr {
 			ptr := v.Pointer()
 			field, hasField = fields[ptr]
-			if hasField && isFieldHidden(field) {
+			if hasField && isFieldHidden(field, fl.Name) {
 				// Don't print help for this flag since it's hidden
 				return
 			}
 		}
 
-		if override, ok := fieldcategory.GetOverride(fl.Name); ok {
+		if override, ok := configdoc.GetCategoryOverride(fl.Name); ok {
 			fieldCat = override
 		} else if hasField {
 			catStr := field.Tag.Get("category")
 			switch catStr {
 			case "advanced":
-				fieldCat = fieldcategory.Advanced
+				fieldCat = configdoc.Advanced
 			case "experimental":
-				fieldCat = fieldcategory.Experimental
+				fieldCat = configdoc.Experimental
 			case "deprecated":
-				fieldCat = fieldcategory.Deprecated
+				fieldCat = configdoc.Deprecated
 			}
 		} else {
 			// The field is neither an override nor has been parsed, so we'll skip it.
 			return
 		}
 
-		if fieldCat != fieldcategory.Basic && !printAll {
+		if fieldCat != configdoc.Basic && !printAll {
 			// Don't print help for this flag since we're supposed to print only basic flags
 			return
 		}
@@ -81,9 +81,9 @@ func Usage(printAll bool, configs ...interface{}) error {
 		// for both 4- and 8-space tab stops.
 		b.WriteString("\n    \t")
 		switch fieldCat {
-		case fieldcategory.Experimental:
+		case configdoc.Experimental:
 			b.WriteString("[experimental] ")
-		case fieldcategory.Deprecated:
+		case configdoc.Deprecated:
 			b.WriteString("[deprecated] ")
 		}
 		b.WriteString(strings.ReplaceAll(fl.Usage, "\n", "\n    \t"))
@@ -152,7 +152,7 @@ func parseStructure(structure interface{}, fields map[uintptr]reflect.StructFiel
 		fields[fieldValue.Addr().Pointer()] = field
 
 		// Recurse if a struct
-		if field.Type.Kind() != reflect.Struct || isFieldHidden(field) || ignoreStructType(field.Type) || !field.IsExported() {
+		if field.Type.Kind() != reflect.Struct || isFieldHidden(field, "") || ignoreStructType(field.Type) || !field.IsExported() {
 			continue
 		}
 
@@ -231,7 +231,11 @@ func getFlagName(fl *flag.Flag) string {
 	return "value"
 }
 
-func isFieldHidden(f reflect.StructField) bool {
+func isFieldHidden(f reflect.StructField, name string) bool {
+	if hidden, ok := configdoc.GetHiddenOverride(name); ok {
+		return hidden
+	}
+
 	return getDocTagFlag(f, "hidden")
 }
 

tools/doc-generator/parse/parser.go

@@ -25,7 +25,7 @@ import (
 
 	"github.com/grafana/mimir/pkg/ingester/activeseries"
 	"github.com/grafana/mimir/pkg/storage/tsdb"
-	"github.com/grafana/mimir/pkg/util/fieldcategory"
+	"github.com/grafana/mimir/pkg/util/configdoc"
 	"github.com/grafana/mimir/pkg/util/validation"
 )
 
@@ -155,7 +155,7 @@ func config(block *ConfigBlock, cfg interface{}, flags map[uintptr]*flag.Flag, r
 		fieldValue := v.FieldByIndex(field.Index)
 
 		// Skip fields explicitly marked as "hidden" in the doc
-		if isFieldHidden(field) {
+		if isFieldHidden(field, "") {
 			continue
 		}
 
@@ -293,6 +293,12 @@ func config(block *ConfigBlock, cfg interface{}, flags map[uintptr]*flag.Flag, r
 			continue
 		}
 
+		// The config field has a CLI flag registered. We should check again if the field is hidden,
+		// to ensure any CLI flag override is honored too.
+		if isFieldHidden(field, fieldFlag.Name) {
+			continue
+		}
+
 		block.Add(&ConfigEntry{
 			Kind:          kind,
 			Name:          fieldName,
@@ -606,7 +612,7 @@ func getCustomFieldEntry(cfg interface{}, field reflect.StructField, fieldValue
 }
 
 func getFieldCategory(field reflect.StructField, name string) string {
-	if category, ok := fieldcategory.GetOverride(name); ok {
+	if category, ok := configdoc.GetCategoryOverride(name); ok {
 		return category.String()
 	}
 	return field.Tag.Get("category")
@@ -620,7 +626,10 @@ func getFieldDefault(field reflect.StructField, fallback string) string {
 	return fallback
 }
 
-func isFieldHidden(f reflect.StructField) bool {
+func isFieldHidden(f reflect.StructField, name string) bool {
+	if hidden, ok := configdoc.GetHiddenOverride(name); ok {
+		return hidden
+	}
 	return getDocTagFlag(f, "hidden")
 }