elastic / elastic/apm-agent-nodejs
avoid instrumenting some Node.js apps when `NODE_OPTIONS=-r elastic-apm-node/start` is being used
- Dominant language
- JavaScript
- Stars
- 594
- Forks
- 244
- Avg merge
- 1d 8h
- Merged PRs (30d)
- 16
Description
When `NODE_OPTIONS=-r elastic-apm-node/start` is being used, e.g. in Kubernetes via the apm-k8s-attacher.git Helm chart, the APM agent will be instrumenting *every* Node.js app in the k8s Pod. That might be casting too wide of a net.
For example, I was testing apm-k8s-attacher on a k8s service with a Node.js app that started with `npm start`. The result was that first `npm` itself was instrumented (before it found the "start" script in "package.json" and executed `node app.js`):
```
{"log.level":"warn","@timestamp":"2024-01-11T00:47:13.173Z","log.logger":"elastic-apm-node","ecs.version":"8.10.0","message":"could not infer serviceName: could not find package.json up from /usr/local/bin"}
{"log.level":"info","@timestamp":"2024-01-11T00:47:13.176Z",...,"serviceName":{"source":"default","value":"unknown-nodejs-service","commonName":"service_name"}},"activationMethod":"k8s-attach","message":"Elastic APM Node.js Agent v4.3.0"}
> example-app-auto@1.0.0 start
> node app.js
{"log.level":"info","@timestamp":"2024-01-11T00:47:13.782Z",...,"serviceName":{"source":"default","value":"example-app-auto","commonName":"service_name"},"serviceVersion":{"source":"default","value":"1.0.0","commonName":"service_version"}},"activationMethod":"k8s-attach","message":"Elastic APM Node.js Agent v4.3.0"}
...
```
There isn't great harm in this case, but it will mean some requests (and possible tracing data) sent to APM server. And it results in some log spam that might confuse.
The Java APM agent has something similar: https://github.com/elastic/apm-agent-java/blob/main/elastic-apm-agent-premain/src/main/java/co/elastic/apm/agent/premain/ExcludeJvmBootstrapCheck.java#L32
`ELASTIC_APM_BOOTSTRAP_ALLOWLIST` and `ELASTIC_APM_BOOTSTRAP_EXCLUDE_LIST` config vars for controlling this. IIUC they don't have a default value. I'm not sure if we'd want to make some attempt to exclude `npm` itself by default.
I think this is low priority. Just noting it now while I noticed it.
Contributor guide
Assessment
This issue has not been assessed yet.