fix: quote attribute/resource_attribute values in bundled-config templates by sfc-gh-zeningchen · Pull Request #338 · observeinc/observe-agent

sfc-gh-zeningchen · 2026-05-07T18:28:38Z

Summary

The bundled-config templates that render the operator's attributes: and resource_attributes: blocks into the otelcol attributes/resource processor configs emitted unquoted YAML scalars:

- key: {{ $key }}
  value: {{ $value }}            # bare scalar — string typing lost

When otelcol then loaded the rendered config, its YAML parser interpreted any value that happened to look like a typed scalar as that type. resourceprocessor.Action.Value is interface{}, so the typed value was stamped onto every span, metric, and log going through the affected pipelines.

The fix routes each value through the existing toYaml template helper (internal/utils/templatefuncs.go), which marshals through goccy/go-yaml and returns a canonical YAML scalar — guaranteed to be a valid scalar by construction, with proper handling of values that contain quotes, newlines, or other characters that need escaping.

Concrete cases observed (OB-60193)

Operator setting	Without fix → on signals	With fix → on signals
`service.version: "060520262036"`	`int64 6,530,622,494` (octal)	`"060520262036"` ✓
`service.version: "060520261956"`	`int64 60,520,261,956` (decimal, leading 0 stripped)	`"060520261956"` ✓
`team.name: "no"`	`bool false` (YAML 1.1 "Norway problem")	`"no"` ✓
`service.namespace: "1.0"`	`float64 1`	`"1.0"` ✓
Values with `:` `#` `[` `]` `{` `}` `,`	parse breaks / shape changes	preserved ✓

Affected pipelines

Anything using resource/observe_global_resource_attributes or attributes/observe_global_attributes:

traces / metrics / logs forward (forward.yaml.tmpl)
host & process metrics, host logs (Linux/Docker/Windows variants)
R.E.D metrics, self-monitoring, fleet heartbeat

So the same misrendered attribute lands wrong on every signal — not just one dataset.

Origin

Discovered during validation of 4 Java Spring Boot messaging apps where sample-app-validator sets a digit-only timestamp service.version. The empty Tracing/Deployment dataset led upstream to this template. See OB-60193 for the full investigation, including the Python SDK reproduction that isolated the bug to the agent (Observe backend correctly preserves strings that arrive intact on the wire).

Test plan

go test ./internal/... ./components/... — all packages PASS
Test_RenderOtelConfig — 14/14 snapshot tests PASS

Extended snap1-full-agent-config.yaml with regression fixtures covering each coercion class still active under YAML 1.2 (otelcol's confmap loader uses gopkg.in/yaml.v3, which dropped the YAML 1.1 yes/no/on/off boolean aliases — so the Norway-problem case from the bug report no longer manifests through this loader and was intentionally omitted as a test case):

Input	Without fix	With fix
`bool-attr: "true"`	`value: true` (bool)	`value: "true"` ✓
`digits-attr: "12345"`	`value: 12345` (int64)	`value: "12345"` ✓
`service.namespace: "1.0"`	`value: 1` (float→int)	`value: "1.0"` ✓
`service.version: "060520262300"`	`value: 6530622656` (octal int64)	`value: "060520262300"` ✓

Verified each of the four added cases is regression-catching: with the inputs in place, reverting just the template change produces a diff on every line above.
observe-agent config against /etc/observe-agent/observe-agent.yaml with digit-only service.version — rendered output now contains value: "060520262300" (verified manually before this PR).

orca-security-us

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0 0 0 0	View in Orca
Passed	SAST	0 0 0 0	View in Orca
Passed	Secrets	0 0 0 0	View in Orca
Passed	Vulnerabilities	0 0 0 0	View in Orca

obs-gh-mattcotter · 2026-05-07T18:52:37Z

    {{- range $key, $value := .Attributes }}
      - key: {{ $key }}
-        value: {{ $value }}
+        value: {{ printf "%q" $value }}


Nice find! Can this use the toYaml template function instead of printf? I don't know if %q is guaranteed to match the yaml format.

thanks, that's a good point! I just updated it to use toYaml

…lates The templates that render the operator's `attributes:` and `resource_attributes:` config blocks into the bundled otelcol `attributes`/`resource` processor configs emitted unquoted YAML scalars: - key: {{ $key }} value: {{ $value }} # bare scalar — string typing lost When otelcol then loaded the rendered config, its YAML parser interpreted any value that happened to look like a YAML 1.1 typed scalar (octal/decimal digits, booleans, dates, null, hex) as that type. The resourceprocessor.Action.Value field is `interface{}`, so the typed value was injected onto every span, metric, and log going through the affected pipelines. Concrete cases observed during validation (OB-60193): - service.version="060520262036" -> int64 6,530,622,494 (octal) - service.version="060520261956" -> int64 60,520,261,956 (decimal, leading zero dropped) - team.name="no" -> bool false (the YAML "Norway problem") - service.namespace="1.0" -> float64 1 - any value with `:` `#` `[` `,` etc. in flow-syntax position -> parse breaks The fix routes each value through the existing `toYaml` template helper (internal/utils/templatefuncs.go), which marshals through goccy/go-yaml and returns a canonical YAML scalar — guaranteed to be a valid scalar by construction, with proper handling of values that contain quotes, newlines, or other characters that need escaping. Snapshot test snap1 was extended with regression fixtures covering the distinct coercion classes that still fire under YAML 1.2 (otelcol's confmap loader uses gopkg.in/yaml.v3, which dropped the YAML 1.1 yes/no/on/off bool aliases — so the Norway-problem class observed in the bug report no longer manifests through this loader and was not added as a test case): attributes: bool-attr: "true" -> bool true (without fix) digits-attr: "12345" -> int64 12345 (without fix) resource_attributes: service.namespace: "1.0" -> float64 1 (without fix) service.version: "060520262300" -> int64 6530622656 (octal, without fix) The four snap1 output files (linux/macos/windows/docker) now show these values quoted; reverting just the template change makes each one diff back to the unquoted, type-coerced form. Affected pipelines (anything using `resource/observe_global_resource_attributes` or `attributes/observe_global_attributes`): - traces/metrics/logs forward - host/process metrics, host logs - R.E.D metrics - self-monitoring - fleet heartbeat The bug surfaced during validation of 4 Java Spring Boot messaging apps where `sample-app-validator` sets a digit-only timestamp service.version. With this fix, Tracing/Deployment indexing works correctly for all-digit version strings. Tested: - `go test ./internal/...` — all green - `Test_RenderOtelConfig` — 14 snapshot tests pass - Reverted just the template (kept expanded snap1 inputs) — each of the four added cases produces the expected coerced-value diff, confirming the regression coverage is real. - `observe-agent config` against /etc/observe-agent/observe-agent.yaml with digit-only service.version — rendered output now contains `value: "060520262300"`

orca-security-us Bot reviewed May 7, 2026

View reviewed changes

obs-gh-mattcotter reviewed May 7, 2026

View reviewed changes

sfc-gh-zeningchen force-pushed the fix/ob-60193-quote-resource-attribute-values branch 2 times, most recently from 9d7f23f to d7c6924 Compare May 7, 2026 21:17

sfc-gh-zeningchen force-pushed the fix/ob-60193-quote-resource-attribute-values branch from d7c6924 to 424d183 Compare May 7, 2026 21:25

Merge branch 'main' into fix/ob-60193-quote-resource-attribute-values

de9ad60

obs-gh-abhishekrao approved these changes Jun 1, 2026

View reviewed changes

Merge branch 'main' into fix/ob-60193-quote-resource-attribute-values

ecbf2b6

sfc-gh-zeningchen merged commit 6d78f67 into main Jun 1, 2026
14 checks passed

sfc-gh-zeningchen deleted the fix/ob-60193-quote-resource-attribute-values branch June 1, 2026 17:55

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: quote attribute/resource_attribute values in bundled-config templates#338

fix: quote attribute/resource_attribute values in bundled-config templates#338
sfc-gh-zeningchen merged 3 commits into
mainfrom
fix/ob-60193-quote-resource-attribute-values

sfc-gh-zeningchen commented May 7, 2026 •

edited

Loading

Uh oh!

orca-security-us Bot left a comment •

edited

Loading

Uh oh!

obs-gh-mattcotter May 7, 2026

Uh oh!

sfc-gh-zeningchen May 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

sfc-gh-zeningchen commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Concrete cases observed (OB-60193)

Affected pipelines

Origin

Test plan

Uh oh!

orca-security-us Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Orca Security Scan Summary

Uh oh!

obs-gh-mattcotter May 7, 2026

Choose a reason for hiding this comment

Uh oh!

sfc-gh-zeningchen May 7, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

sfc-gh-zeningchen commented May 7, 2026 •

edited

Loading

orca-security-us Bot left a comment •

edited

Loading