add tracing and refactor some api pkgs

internal/api/grpc/client/middleware/tracing.go

@@ -0,0 +1,38 @@
+package middleware
+
+import (
+	"context"
+	"strings"
+
+	"go.opencensus.io/plugin/ocgrpc"
+	"go.opencensus.io/trace"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/stats"
+
+	"github.com/caos/zitadel/internal/api"
+	"github.com/caos/zitadel/internal/tracing"
+)
+
+type GRPCMethod string
+
+func TracingStatsClient(ignoredMethods ...GRPCMethod) grpc.DialOption {
+	return grpc.WithStatsHandler(&tracingClientHandler{ignoredMethods, ocgrpc.ClientHandler{StartOptions: trace.StartOptions{Sampler: tracing.Sampler(), SpanKind: trace.SpanKindClient}}})
+}
+
+func DefaultTracingStatsClient() grpc.DialOption {
+	return TracingStatsClient(api.Healthz, api.Readiness, api.Validation)
+}
+
+type tracingClientHandler struct {
+	IgnoredMethods []GRPCMethod
+	ocgrpc.ClientHandler
+}
+
+func (s *tracingClientHandler) TagRPC(ctx context.Context, tagInfo *stats.RPCTagInfo) context.Context {
+	for _, method := range s.IgnoredMethods {
+		if strings.HasSuffix(tagInfo.FullMethodName, string(method)) {
+			return ctx
+		}
+	}
+	return s.ClientHandler.TagRPC(ctx, tagInfo)
+}

internal/api/grpc/server/gateway.go

@@ -0,0 +1,110 @@
+package server
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/grpc-ecosystem/grpc-gateway/runtime"
+	"google.golang.org/grpc"
+
+	"github.com/caos/logging"
+
+	client_middleware "github.com/caos/zitadel/internal/api/grpc/client/middleware"
+	http_util "github.com/caos/zitadel/internal/api/http"
+	http_mw "github.com/caos/zitadel/internal/api/http/middleware"
+)
+
+const (
+	defaultGatewayPort = "8080"
+	mimeWildcard       = "*/*"
+)
+
+var (
+	DefaultJSONMarshaler = &runtime.JSONPb{OrigName: false, EmitDefaults: false}
+
+	DefaultServeMuxOptions = []runtime.ServeMuxOption{
+		runtime.WithMarshalerOption(DefaultJSONMarshaler.ContentType(), DefaultJSONMarshaler),
+		runtime.WithMarshalerOption(mimeWildcard, DefaultJSONMarshaler),
+		runtime.WithMarshalerOption(runtime.MIMEWildcard, DefaultJSONMarshaler),
+		runtime.WithIncomingHeaderMatcher(runtime.DefaultHeaderMatcher),
+		runtime.WithOutgoingHeaderMatcher(runtime.DefaultHeaderMatcher),
+	}
+)
+
+type Gateway interface {
+	GRPCEndpoint() string
+	GatewayPort() string
+	Gateway() GatewayFunc
+}
+
+type GatewayFunc func(ctx context.Context, mux *runtime.ServeMux, endpoint string, opts []grpc.DialOption) error
+
+type gatewayCustomServeMuxOptions interface {
+	GatewayServeMuxOptions() []runtime.ServeMuxOption
+}
+type grpcGatewayCustomInterceptor interface {
+	GatewayHTTPInterceptor(http.Handler) http.Handler
+}
+
+type gatewayCustomCallOptions interface {
+	GatewayCallOptions() []grpc.DialOption
+}
+
+func StartGateway(ctx context.Context, g Gateway) {
+	mux := createMux(ctx, g)
+	serveGateway(ctx, mux, gatewayPort(g.GatewayPort()), g)
+}
+
+func createMux(ctx context.Context, g Gateway) *runtime.ServeMux {
+	muxOptions := DefaultServeMuxOptions
+	if customOpts, ok := g.(gatewayCustomServeMuxOptions); ok {
+		muxOptions = customOpts.GatewayServeMuxOptions()
+	}
+	mux := runtime.NewServeMux(muxOptions...)
+
+	opts := []grpc.DialOption{grpc.WithInsecure()}
+	opts = append(opts, client_middleware.DefaultTracingStatsClient())
+
+	if customOpts, ok := g.(gatewayCustomCallOptions); ok {
+		opts = append(opts, customOpts.GatewayCallOptions()...)
+	}
+	err := g.Gateway()(ctx, mux, g.GRPCEndpoint(), opts)
+	logging.Log("SERVE-7B7G0E").OnError(err).Panic("failed to create mux for grpc gateway")
+
+	return mux
+}
+
+func addInterceptors(handler http.Handler, g Gateway) http.Handler {
+	handler = http_mw.DefaultTraceHandler(handler)
+	if interceptor, ok := g.(grpcGatewayCustomInterceptor); ok {
+		handler = interceptor.GatewayHTTPInterceptor(handler)
+	}
+	return http_mw.CORSInterceptorOpts(http_mw.DefaultCORSOptions, handler)
+}
+
+func serveGateway(ctx context.Context, handler http.Handler, port string, g Gateway) {
+	server := &http.Server{
+		Handler: addInterceptors(handler, g),
+	}
+
+	listener := http_util.CreateListener(port)
+
+	go func() {
+		<-ctx.Done()
+		err := server.Shutdown(ctx)
+		logging.Log("SERVE-m7kBlq").OnError(err).Warn("error during graceful shutdown of grpc gateway")
+	}()
+
+	go func() {
+		err := server.Serve(listener)
+		logging.Log("SERVE-tBHR60").OnError(err).Panic("grpc gateway serve failed")
+	}()
+	logging.LogWithFields("SERVE-KHh0Cb", "port", port).Info("grpc gateway is listening")
+}
+
+func gatewayPort(port string) string {
+	if port == "" {
+		return defaultGatewayPort
+	}
+	return port
+}

internal/api/grpc/server/middleware/auth_interceptor.go

@@ -1,4 +1,4 @@
-package grpc
+package middleware
 
 import (
 	"context"
@@ -9,6 +9,7 @@ import (
 
 	"github.com/caos/zitadel/internal/api"
 	"github.com/caos/zitadel/internal/api/auth"
+	grpc_util "github.com/caos/zitadel/internal/api/grpc"
 )
 
 func AuthorizationInterceptor(verifier auth.TokenVerifier, authConfig *auth.Config, authMethods auth.MethodMapping) func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
@@ -18,12 +19,12 @@ func AuthorizationInterceptor(verifier auth.TokenVerifier, authConfig *auth.Conf
 			return handler(ctx, req)
 		}
 
-		authToken := GetAuthorizationHeader(ctx)
+		authToken := grpc_util.GetAuthorizationHeader(ctx)
 		if authToken == "" {
 			return nil, status.Error(codes.Unauthenticated, "auth header missing")
 		}
 
-		orgID := GetHeader(ctx, api.ZitadelOrgID)
+		orgID := grpc_util.GetHeader(ctx, api.ZitadelOrgID)
 
 		ctx, err := auth.CheckUserAuthorization(ctx, req, authToken, orgID, verifier, authConfig, authOpt)
 		if err != nil {

internal/api/grpc/server/middleware/error_interceptor.go

@@ -1,14 +1,16 @@
-package grpc
+package middleware
 
 import (
 	"context"
 
 	"google.golang.org/grpc"
+
+	grpc_util "github.com/caos/zitadel/internal/api/grpc"
 )
 
 func ErrorHandler() func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
 	return func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) {
 		resp, err := handler(ctx, req)
-		return resp, CaosToGRPCError(err)
+		return resp, grpc_util.CaosToGRPCError(err)
 	}
 }

internal/api/grpc/server/middleware/tracing.go

@@ -0,0 +1,33 @@
+package middleware
+
+import (
+	"context"
+	"strings"
+
+	"go.opencensus.io/plugin/ocgrpc"
+	"go.opencensus.io/trace"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/stats"
+
+	"github.com/caos/zitadel/internal/tracing"
+)
+
+type GRPCMethod string
+
+func TracingStatsServer(ignoredMethods ...GRPCMethod) grpc.ServerOption {
+	return grpc.StatsHandler(&tracingServerHandler{ignoredMethods, ocgrpc.ServerHandler{StartOptions: trace.StartOptions{Sampler: tracing.Sampler(), SpanKind: trace.SpanKindServer}}})
+}
+
+type tracingServerHandler struct {
+	IgnoredMethods []GRPCMethod
+	ocgrpc.ServerHandler
+}
+
+func (s *tracingServerHandler) TagRPC(ctx context.Context, tagInfo *stats.RPCTagInfo) context.Context {
+	for _, method := range s.IgnoredMethods {
+		if strings.HasSuffix(tagInfo.FullMethodName, string(method)) {
+			return ctx
+		}
+	}
+	return s.ServerHandler.TagRPC(ctx, tagInfo)
+}

internal/api/grpc/server/probes.go

@@ -1,4 +1,4 @@
-package grpc
+package server
 
 import (
 	"context"

internal/api/grpc/server/server.go

@@ -0,0 +1,53 @@
+package server
+
+import (
+	"context"
+	"net"
+
+	"github.com/caos/logging"
+	"google.golang.org/grpc"
+
+	"github.com/caos/zitadel/internal/api/http"
+)
+
+const (
+	defaultGrpcPort = "80"
+)
+
+type Server interface {
+	GRPCPort() string
+	GRPCServer() (*grpc.Server, error)
+}
+
+func StartServer(ctx context.Context, s Server) {
+	port := grpcPort(s.GRPCPort())
+	listener := http.CreateListener(port)
+	server := createGrpcServer(s)
+	serveServer(ctx, server, listener, port)
+}
+
+func createGrpcServer(s Server) *grpc.Server {
+	grpcServer, err := s.GRPCServer()
+	logging.Log("SERVE-k280HZ").OnError(err).Panic("failed to create grpc server")
+	return grpcServer
+}
+
+func serveServer(ctx context.Context, server *grpc.Server, listener net.Listener, port string) {
+	go func() {
+		<-ctx.Done()
+		server.GracefulStop()
+	}()
+
+	go func() {
+		err := server.Serve(listener)
+		logging.Log("SERVE-Ga3e94").OnError(err).Panic("grpc server serve failed")
+	}()
+	logging.LogWithFields("SERVE-bZ44QM", "port", port).Info("grpc server is listening")
+}
+
+func grpcPort(port string) string {
+	if port == "" {
+		return defaultGrpcPort
+	}
+	return port
+}

internal/api/header.go

@@ -2,7 +2,11 @@ package api
 
 const (
 	Authorization  = "authorization"
-	AcceptLanguage = "Accept-Language"
+	Accept         = "accept"
+	AcceptLanguage = "accept-language"
+	ContentType    = "content-type"
+	Location       = "location"
+	Origin         = "origin"
 
 	ZitadelOrgID = "x-zitadel-orgid"
 )

internal/api/http/listener.go

@@ -0,0 +1,21 @@
+package http
+
+import (
+	"net"
+	"strings"
+
+	"github.com/caos/logging"
+)
+
+func CreateListener(endpoint string) net.Listener {
+	l, err := net.Listen("tcp", listenerEndpoint(endpoint))
+	logging.Log("SERVE-6vasef").OnError(err).Fatal("creating listener failed")
+	return l
+}
+
+func listenerEndpoint(endpoint string) string {
+	if strings.Contains(endpoint, ":") {
+		return endpoint
+	}
+	return ":" + endpoint
+}

internal/api/http/middleware/cors_interceptor.go

@@ -0,0 +1,47 @@
+package middleware
+
+import (
+	"net/http"
+
+	"github.com/rs/cors"
+
+	"github.com/caos/zitadel/internal/api"
+)
+
+var (
+	DefaultCORSOptions = cors.Options{
+		AllowCredentials: true,
+		AllowedHeaders: []string{
+			api.Origin,
+			api.ContentType,
+			api.Accept,
+			api.AcceptLanguage,
+			api.Authorization,
+			api.ZitadelOrgID,
+			"x-grpc-web", //TODO: needed
+		},
+		AllowedMethods: []string{
+			http.MethodOptions,
+			http.MethodGet,
+			http.MethodHead,
+			http.MethodPost,
+			http.MethodPut,
+			http.MethodPatch,
+			http.MethodDelete,
+		},
+		ExposedHeaders: []string{
+			api.Location,
+		},
+		AllowedOrigins: []string{
+			"http://localhost:*",
+		},
+	}
+)
+
+func CORSInterceptorOpts(opts cors.Options, h http.Handler) http.Handler {
+	return cors.New(opts).Handler(h)
+}
+
+func CORSInterceptor(h http.Handler) http.Handler {
+	return CORSInterceptorOpts(DefaultCORSOptions, h)
+}

internal/api/http/middleware/trace_interceptor.go

@@ -0,0 +1,12 @@
+package middleware
+
+import (
+	"net/http"
+
+	"github.com/caos/zitadel/internal/api"
+	"github.com/caos/zitadel/internal/tracing"
+)
+
+func DefaultTraceHandler(handler http.Handler) http.Handler {
+	return tracing.TraceHandler(handler, api.Probes...)
+}

internal/api/probes.go

@@ -0,0 +1,11 @@
+package api
+
+const (
+	Healthz    = "/Healthz"
+	Readiness  = "/Ready"
+	Validation = "/Validate"
+)
+
+var (
+	Probes = []string{Healthz, Readiness, Validation}
+)

internal/tracing/caller.go

@@ -0,0 +1,24 @@
+package tracing
+
+import (
+	"runtime"
+
+	"github.com/caos/logging"
+)
+
+func GetCaller() string {
+	fpcs := make([]uintptr, 1)
+
+	n := runtime.Callers(3, fpcs)
+	if n == 0 {
+		logging.Log("HELPE-rWjfC").Debug("no caller")
+	}
+
+	caller := runtime.FuncForPC(fpcs[0] - 1)
+	if caller == nil {
+		logging.Log("HELPE-25POw").Debug("caller was nil")
+	}
+
+	// Print the name of the function
+	return caller.Name()
+}

internal/tracing/config/config.go

@@ -0,0 +1,61 @@
+package config
+
+import (
+	"encoding/json"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/caos/zitadel/internal/tracing"
+	tracing_g "github.com/caos/zitadel/internal/tracing/google"
+	tracing_log "github.com/caos/zitadel/internal/tracing/log"
+)
+
+type TracingConfig struct {
+	Type   string
+	Config tracing.Config
+}
+
+var tracer = map[string]func() tracing.Config{
+	"google": func() tracing.Config { return &tracing_g.Config{} },
+	"log":    func() tracing.Config { return &tracing_log.Config{} },
+}
+
+func (c *TracingConfig) UnmarshalJSON(data []byte) error {
+	var rc struct {
+		Type   string
+		Config json.RawMessage
+	}
+
+	if err := json.Unmarshal(data, &rc); err != nil {
+		return status.Errorf(codes.Internal, "%v parse config: %v", "TRACE-vmjS", err)
+	}
+
+	c.Type = rc.Type
+
+	var err error
+	c.Config, err = newTracingConfig(c.Type, rc.Config)
+	if err != nil {
+		return status.Errorf(codes.Internal, "%v parse config: %v", "TRACE-Ws9E", err)
+	}
+
+	return c.Config.NewTracer()
+}
+
+func newTracingConfig(tracerType string, configData []byte) (tracing.Config, error) {
+	t, ok := tracer[tracerType]
+	if !ok {
+		return nil, status.Errorf(codes.Internal, "%v No config: %v", "TRACE-HMEJ", tracerType)
+	}
+
+	tracingConfig := t()
+	if len(configData) == 0 {
+		return tracingConfig, nil
+	}
+
+	if err := json.Unmarshal(configData, tracingConfig); err != nil {
+		return nil, status.Errorf(codes.Internal, "%v Could not read conifg: %v", "TRACE-1tSS", err)
+	}
+
+	return tracingConfig, nil
+}

internal/tracing/generate.go

@@ -0,0 +1,3 @@
+package tracing
+
+//go:generate mockgen -package mock -destination mock/tracing_mock.go github.com/caos/zitadel/internal/tracing Tracer

internal/tracing/google/config.go

@@ -0,0 +1,25 @@
+package google
+
+import (
+	"go.opencensus.io/trace"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/caos/zitadel/internal/tracing"
+)
+
+type Config struct {
+	ProjectID    string
+	MetricPrefix string
+	Fraction     float64
+}
+
+func (c *Config) NewTracer() error {
+	if !envIsSet() {
+		return status.Error(codes.InvalidArgument, "env not properly set, GOOGLE_APPLICATION_CREDENTIALS is misconfigured or missing")
+	}
+
+	tracing.T = &Tracer{projectID: c.ProjectID, metricPrefix: c.MetricPrefix, sampler: trace.ProbabilitySampler(c.Fraction)}
+
+	return tracing.T.Start()
+}

internal/tracing/google/googletracing.go

@@ -0,0 +1,95 @@
+package google
+
+import (
+	"context"
+	"net/http"
+	"os"
+	"strings"
+
+	"contrib.go.opencensus.io/exporter/stackdriver"
+	"go.opencensus.io/plugin/ocgrpc"
+	"go.opencensus.io/plugin/ochttp"
+	"go.opencensus.io/stats/view"
+	"go.opencensus.io/trace"
+
+	"github.com/caos/zitadel/internal/errors"
+	"github.com/caos/zitadel/internal/tracing"
+)
+
+type Tracer struct {
+	Exporter     *stackdriver.Exporter
+	projectID    string
+	metricPrefix string
+	sampler      trace.Sampler
+}
+
+func (t *Tracer) Start() (err error) {
+	t.Exporter, err = stackdriver.NewExporter(stackdriver.Options{
+		ProjectID:    t.projectID,
+		MetricPrefix: t.metricPrefix,
+	})
+	if err != nil {
+		return errors.ThrowInternal(err, "GOOGL-4dCnX", "unable to start exporter")
+	}
+
+	views := append(ocgrpc.DefaultServerViews, ocgrpc.DefaultClientViews...)
+	views = append(views, ochttp.DefaultClientViews...)
+	views = append(views, ochttp.DefaultServerViews...)
+
+	if err = view.Register(views...); err != nil {
+		return errors.ThrowInternal(err, "GOOGL-Q6L6w", "unable to register view")
+	}
+
+	trace.RegisterExporter(t.Exporter)
+	trace.ApplyConfig(trace.Config{DefaultSampler: t.sampler})
+
+	return nil
+}
+
+func (t *Tracer) Sampler() trace.Sampler {
+	return t.sampler
+}
+
+func (t *Tracer) NewServerInterceptorSpan(ctx context.Context, name string) (context.Context, *tracing.Span) {
+	return t.newSpanFromName(ctx, name, trace.WithSpanKind(trace.SpanKindServer))
+}
+
+func (t *Tracer) NewServerSpan(ctx context.Context, caller string) (context.Context, *tracing.Span) {
+	return t.newSpan(ctx, caller, trace.WithSpanKind(trace.SpanKindServer))
+}
+
+func (t *Tracer) NewClientInterceptorSpan(ctx context.Context, name string) (context.Context, *tracing.Span) {
+	return t.newSpanFromName(ctx, name, trace.WithSpanKind(trace.SpanKindClient))
+}
+
+func (t *Tracer) NewClientSpan(ctx context.Context, caller string) (context.Context, *tracing.Span) {
+	return t.newSpan(ctx, caller, trace.WithSpanKind(trace.SpanKindClient))
+}
+
+func (t *Tracer) NewSpan(ctx context.Context, caller string) (context.Context, *tracing.Span) {
+	return t.newSpan(ctx, caller)
+}
+
+func (t *Tracer) newSpan(ctx context.Context, caller string, options ...trace.StartOption) (context.Context, *tracing.Span) {
+	return t.newSpanFromName(ctx, caller, options...)
+}
+
+func (t *Tracer) newSpanFromName(ctx context.Context, name string, options ...trace.StartOption) (context.Context, *tracing.Span) {
+	ctx, span := trace.StartSpan(ctx, name, options...)
+	return ctx, tracing.CreateSpan(span)
+}
+
+func (t *Tracer) NewSpanHTTP(r *http.Request, caller string) (*http.Request, *tracing.Span) {
+	ctx, span := t.NewSpan(r.Context(), caller)
+	r = r.WithContext(ctx)
+	return r, span
+}
+
+func envIsSet() bool {
+	gAuthCred := os.Getenv("GOOGLE_APPLICATION_CREDENTIALS")
+	return strings.Contains(gAuthCred, ".json")
+}
+
+func (t *Tracer) SetErrStatus(span *trace.Span, code int32, err error, obj ...string) {
+	span.SetStatus(trace.Status{Code: code, Message: err.Error() + strings.Join(obj, ", ")})
+}

internal/tracing/http_handler.go

@@ -0,0 +1,30 @@
+package tracing
+
+import (
+	"net/http"
+	"strings"
+
+	"go.opencensus.io/plugin/ochttp"
+	"go.opencensus.io/trace"
+)
+
+func TraceHandler(handler http.Handler, ignoredMethods ...string) http.Handler {
+	healthEndpoints := strings.Join(ignoredMethods, ";;")
+
+	return &ochttp.Handler{
+		Handler: handler,
+		FormatSpanName: func(r *http.Request) string {
+			host := r.URL.Host
+			if host == "" {
+				host = r.Host
+			}
+			return host + r.URL.Path
+		},
+
+		StartOptions: trace.StartOptions{Sampler: Sampler()},
+		IsHealthEndpoint: func(r *http.Request) bool {
+			n := strings.Contains(healthEndpoints, r.URL.RequestURI())
+			return n
+		},
+	}
+}

internal/tracing/log/config.go

@@ -0,0 +1,21 @@
+package log
+
+import (
+	"go.opencensus.io/trace"
+
+	"github.com/caos/zitadel/internal/tracing"
+)
+
+type Config struct {
+	Fraction float64
+}
+
+func (c *Config) NewTracer() error {
+	if c.Fraction < 1 {
+		c.Fraction = 1
+	}
+
+	tracing.T = &Tracer{trace.ProbabilitySampler(c.Fraction)}
+
+	return tracing.T.Start()
+}

internal/tracing/log/logTracing.go

@@ -0,0 +1,74 @@
+package log
+
+import (
+	"context"
+	"net/http"
+
+	"go.opencensus.io/examples/exporter"
+	"go.opencensus.io/plugin/ocgrpc"
+	"go.opencensus.io/plugin/ochttp"
+	"go.opencensus.io/stats/view"
+	"go.opencensus.io/trace"
+
+	"github.com/caos/zitadel/internal/errors"
+	"github.com/caos/zitadel/internal/tracing"
+)
+
+type Tracer struct {
+	sampler trace.Sampler
+}
+
+func (t *Tracer) Start() error {
+	trace.RegisterExporter(&exporter.PrintExporter{})
+
+	views := append(ocgrpc.DefaultServerViews, ocgrpc.DefaultClientViews...)
+	views = append(views, ochttp.DefaultClientViews...)
+	views = append(views, ochttp.DefaultServerViews...)
+
+	if err := view.Register(views...); err != nil {
+		return errors.ThrowInternal(err, "LOG-PoFiB", "unable to register view")
+	}
+
+	trace.ApplyConfig(trace.Config{DefaultSampler: t.sampler})
+
+	return nil
+}
+
+func (t *Tracer) Sampler() trace.Sampler {
+	return t.sampler
+}
+
+func (t *Tracer) NewServerInterceptorSpan(ctx context.Context, name string) (context.Context, *tracing.Span) {
+	return t.newSpanFromName(ctx, name, trace.WithSpanKind(trace.SpanKindServer))
+}
+
+func (t *Tracer) NewServerSpan(ctx context.Context, caller string) (context.Context, *tracing.Span) {
+	return t.newSpan(ctx, caller, trace.WithSpanKind(trace.SpanKindServer))
+}
+
+func (t *Tracer) NewClientInterceptorSpan(ctx context.Context, name string) (context.Context, *tracing.Span) {
+	return t.newSpanFromName(ctx, name, trace.WithSpanKind(trace.SpanKindClient))
+}
+
+func (t *Tracer) NewClientSpan(ctx context.Context, caller string) (context.Context, *tracing.Span) {
+	return t.newSpan(ctx, caller, trace.WithSpanKind(trace.SpanKindClient))
+}
+
+func (t *Tracer) NewSpan(ctx context.Context, caller string) (context.Context, *tracing.Span) {
+	return t.newSpan(ctx, caller)
+}
+
+func (t *Tracer) newSpan(ctx context.Context, caller string, options ...trace.StartOption) (context.Context, *tracing.Span) {
+	return t.newSpanFromName(ctx, caller, options...)
+}
+
+func (t *Tracer) newSpanFromName(ctx context.Context, name string, options ...trace.StartOption) (context.Context, *tracing.Span) {
+	ctx, span := trace.StartSpan(ctx, name, options...)
+	return ctx, tracing.CreateSpan(span)
+}
+
+func (t *Tracer) NewSpanHTTP(r *http.Request, caller string) (*http.Request, *tracing.Span) {
+	ctx, span := t.NewSpan(r.Context(), caller)
+	r = r.WithContext(ctx)
+	return r, span
+}

internal/tracing/mock/tracing_mock.go

@@ -0,0 +1,155 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/caos/zitadel/internal/tracing (interfaces: Tracer)
+
+// Package mock is a generated GoMock package.
+package mock
+
+import (
+	context "context"
+	tracing "github.com/caos/zitadel/internal/tracing"
+	gomock "github.com/golang/mock/gomock"
+	trace "go.opencensus.io/trace"
+	http "net/http"
+	reflect "reflect"
+)
+
+// MockTracer is a mock of Tracer interface
+type MockTracer struct {
+	ctrl     *gomock.Controller
+	recorder *MockTracerMockRecorder
+}
+
+// MockTracerMockRecorder is the mock recorder for MockTracer
+type MockTracerMockRecorder struct {
+	mock *MockTracer
+}
+
+// NewMockTracer creates a new mock instance
+func NewMockTracer(ctrl *gomock.Controller) *MockTracer {
+	mock := &MockTracer{ctrl: ctrl}
+	mock.recorder = &MockTracerMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use
+func (m *MockTracer) EXPECT() *MockTracerMockRecorder {
+	return m.recorder
+}
+
+// NewClientInterceptorSpan mocks base method
+func (m *MockTracer) NewClientInterceptorSpan(arg0 context.Context, arg1 string) (context.Context, *tracing.Span) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "NewClientInterceptorSpan", arg0, arg1)
+	ret0, _ := ret[0].(context.Context)
+	ret1, _ := ret[1].(*tracing.Span)
+	return ret0, ret1
+}
+
+// NewClientInterceptorSpan indicates an expected call of NewClientInterceptorSpan
+func (mr *MockTracerMockRecorder) NewClientInterceptorSpan(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "NewClientInterceptorSpan", reflect.TypeOf((*MockTracer)(nil).NewClientInterceptorSpan), arg0, arg1)
+}
+
+// NewClientSpan mocks base method
+func (m *MockTracer) NewClientSpan(arg0 context.Context, arg1 string) (context.Context, *tracing.Span) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "NewClientSpan", arg0, arg1)
+	ret0, _ := ret[0].(context.Context)
+	ret1, _ := ret[1].(*tracing.Span)
+	return ret0, ret1
+}
+
+// NewClientSpan indicates an expected call of NewClientSpan
+func (mr *MockTracerMockRecorder) NewClientSpan(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "NewClientSpan", reflect.TypeOf((*MockTracer)(nil).NewClientSpan), arg0, arg1)
+}
+
+// NewServerInterceptorSpan mocks base method
+func (m *MockTracer) NewServerInterceptorSpan(arg0 context.Context, arg1 string) (context.Context, *tracing.Span) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "NewServerInterceptorSpan", arg0, arg1)
+	ret0, _ := ret[0].(context.Context)
+	ret1, _ := ret[1].(*tracing.Span)
+	return ret0, ret1
+}
+
+// NewServerInterceptorSpan indicates an expected call of NewServerInterceptorSpan
+func (mr *MockTracerMockRecorder) NewServerInterceptorSpan(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "NewServerInterceptorSpan", reflect.TypeOf((*MockTracer)(nil).NewServerInterceptorSpan), arg0, arg1)
+}
+
+// NewServerSpan mocks base method
+func (m *MockTracer) NewServerSpan(arg0 context.Context, arg1 string) (context.Context, *tracing.Span) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "NewServerSpan", arg0, arg1)
+	ret0, _ := ret[0].(context.Context)
+	ret1, _ := ret[1].(*tracing.Span)
+	return ret0, ret1
+}
+
+// NewServerSpan indicates an expected call of NewServerSpan
+func (mr *MockTracerMockRecorder) NewServerSpan(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "NewServerSpan", reflect.TypeOf((*MockTracer)(nil).NewServerSpan), arg0, arg1)
+}
+
+// NewSpan mocks base method
+func (m *MockTracer) NewSpan(arg0 context.Context, arg1 string) (context.Context, *tracing.Span) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "NewSpan", arg0, arg1)
+	ret0, _ := ret[0].(context.Context)
+	ret1, _ := ret[1].(*tracing.Span)
+	return ret0, ret1
+}
+
+// NewSpan indicates an expected call of NewSpan
+func (mr *MockTracerMockRecorder) NewSpan(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "NewSpan", reflect.TypeOf((*MockTracer)(nil).NewSpan), arg0, arg1)
+}
+
+// NewSpanHTTP mocks base method
+func (m *MockTracer) NewSpanHTTP(arg0 *http.Request, arg1 string) (*http.Request, *tracing.Span) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "NewSpanHTTP", arg0, arg1)
+	ret0, _ := ret[0].(*http.Request)
+	ret1, _ := ret[1].(*tracing.Span)
+	return ret0, ret1
+}
+
+// NewSpanHTTP indicates an expected call of NewSpanHTTP
+func (mr *MockTracerMockRecorder) NewSpanHTTP(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "NewSpanHTTP", reflect.TypeOf((*MockTracer)(nil).NewSpanHTTP), arg0, arg1)
+}
+
+// Sampler mocks base method
+func (m *MockTracer) Sampler() trace.Sampler {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Sampler")
+	ret0, _ := ret[0].(trace.Sampler)
+	return ret0
+}
+
+// Sampler indicates an expected call of Sampler
+func (mr *MockTracerMockRecorder) Sampler() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Sampler", reflect.TypeOf((*MockTracer)(nil).Sampler))
+}
+
+// Start mocks base method
+func (m *MockTracer) Start() error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Start")
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// Start indicates an expected call of Start
+func (mr *MockTracerMockRecorder) Start() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Start", reflect.TypeOf((*MockTracer)(nil).Start))
+}

internal/tracing/mock/tracing_mock_impl.go

@@ -0,0 +1,20 @@
+package mock
+
+import (
+	"context"
+	"testing"
+
+	"github.com/golang/mock/gomock"
+
+	"github.com/caos/zitadel/internal/tracing"
+)
+
+func NewSimpleMockTracer(t *testing.T) *MockTracer {
+	return NewMockTracer(gomock.NewController(t))
+}
+
+func ExpectServerSpan(ctx context.Context, mock interface{}) {
+	m := mock.(*MockTracer)
+	any := gomock.Any()
+	m.EXPECT().NewServerSpan(any, any).AnyTimes().Return(ctx, &tracing.Span{})
+}

internal/tracing/span.go

@@ -0,0 +1,89 @@
+package tracing
+
+import (
+	"fmt"
+	"strconv"
+
+	"go.opencensus.io/trace"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+type Span struct {
+	span       *trace.Span
+	attributes []trace.Attribute
+}
+
+func CreateSpan(span *trace.Span) *Span {
+	return &Span{span: span, attributes: []trace.Attribute{}}
+}
+
+func (s *Span) End() {
+	if s.span == nil {
+		return
+	}
+	s.span.AddAttributes(s.attributes...)
+	s.span.End()
+}
+
+func (s *Span) EndWithError(err error) {
+	s.SetStatusByError(err)
+	s.End()
+}
+
+func (s *Span) SetStatusByError(err error) {
+	if s.span == nil {
+		return
+	}
+	s.span.SetStatus(statusFromError(err))
+}
+
+func statusFromError(err error) trace.Status {
+	if statusErr, ok := status.FromError(err); ok {
+		return trace.Status{Code: int32(statusErr.Code()), Message: statusErr.Message()}
+	}
+	return trace.Status{Code: int32(codes.Unknown), Message: "Unknown"}
+}
+
+// AddAnnotation creates an annotation. The annotation will not be added to the tracing use Annotate(msg) afterwards
+func (s *Span) AddAnnotation(key string, value interface{}) *Span {
+	attribute, err := toTraceAttribute(key, value)
+	if err != nil {
+		return s
+	}
+	s.attributes = append(s.attributes, attribute)
+	return s
+}
+
+// Annotate creates an annotation in tracing. Before added annotations will be set
+func (s *Span) Annotate(message string) *Span {
+	if s.span == nil {
+		return s
+	}
+	s.span.Annotate(s.attributes, message)
+	s.attributes = []trace.Attribute{}
+	return s
+}
+
+func (s *Span) Annotatef(format string, addiations ...interface{}) *Span {
+	s.Annotate(fmt.Sprintf(format, addiations...))
+	return s
+}
+
+func toTraceAttribute(key string, value interface{}) (attr trace.Attribute, err error) {
+	switch value := value.(type) {
+	case bool:
+		return trace.BoolAttribute(key, value), nil
+	case string:
+		return trace.StringAttribute(key, value), nil
+	}
+	if valueInt, err := convertToInt64(value); err == nil {
+		return trace.Int64Attribute(key, valueInt), nil
+	}
+	return attr, status.Error(codes.InvalidArgument, "Attribute is not of type bool, string or int64")
+}
+
+func convertToInt64(value interface{}) (int64, error) {
+	valueString := fmt.Sprintf("%v", value)
+	return strconv.ParseInt(valueString, 10, 64)
+}

internal/tracing/tracing.go

@@ -0,0 +1,74 @@
+package tracing
+
+import (
+	"context"
+	"net/http"
+
+	"go.opencensus.io/trace"
+)
+
+type Tracer interface {
+	Start() error
+	NewSpan(ctx context.Context, caller string) (context.Context, *Span)
+	NewClientSpan(ctx context.Context, caller string) (context.Context, *Span)
+	NewServerSpan(ctx context.Context, caller string) (context.Context, *Span)
+	NewClientInterceptorSpan(ctx context.Context, name string) (context.Context, *Span)
+	NewServerInterceptorSpan(ctx context.Context, name string) (context.Context, *Span)
+	NewSpanHTTP(r *http.Request, caller string) (*http.Request, *Span)
+	Sampler() trace.Sampler
+}
+
+type Config interface {
+	NewTracer() error
+}
+
+var T Tracer
+
+func Sampler() trace.Sampler {
+	if T == nil {
+		return trace.NeverSample()
+	}
+	return T.Sampler()
+}
+
+func NewSpan(ctx context.Context) (context.Context, *Span) {
+	if T == nil {
+		return ctx, CreateSpan(nil)
+	}
+	return T.NewSpan(ctx, GetCaller())
+}
+
+func NewClientSpan(ctx context.Context) (context.Context, *Span) {
+	if T == nil {
+		return ctx, CreateSpan(nil)
+	}
+	return T.NewClientSpan(ctx, GetCaller())
+}
+
+func NewServerSpan(ctx context.Context) (context.Context, *Span) {
+	if T == nil {
+		return ctx, CreateSpan(nil)
+	}
+	return T.NewServerSpan(ctx, GetCaller())
+}
+
+func NewClientInterceptorSpan(ctx context.Context, name string) (context.Context, *Span) {
+	if T == nil {
+		return ctx, CreateSpan(nil)
+	}
+	return T.NewClientInterceptorSpan(ctx, name)
+}
+
+func NewServerInterceptorSpan(ctx context.Context, name string) (context.Context, *Span) {
+	if T == nil {
+		return ctx, CreateSpan(nil)
+	}
+	return T.NewServerInterceptorSpan(ctx, name)
+}
+
+func NewSpanHTTP(r *http.Request) (*http.Request, *Span) {
+	if T == nil {
+		return r, CreateSpan(nil)
+	}
+	return T.NewSpanHTTP(r, GetCaller())
+}