From f5f9a66fa8d5d4e0c1c914e98f14a3456d7237c7 Mon Sep 17 00:00:00 2001
From: Alexander Zobnin <alexanderzobnin@gmail.com>
Date: Fri, 9 Jan 2026 10:16:06 +0100
Subject: [PATCH] Zanzana: Instrument legacy reconciler (#116018)

---
 .../accesscontrol/dualwrite/collectors.go     |  7 +++++++
 .../dualwrite/resource_reconciler.go          | 21 ++++++++++++++++++-
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/pkg/services/accesscontrol/dualwrite/collectors.go b/pkg/services/accesscontrol/dualwrite/collectors.go
index 28ebd1edb02..87d00f0224b 100644
--- a/pkg/services/accesscontrol/dualwrite/collectors.go
+++ b/pkg/services/accesscontrol/dualwrite/collectors.go
@@ -4,6 +4,8 @@ import (
 	"context"
 
 	openfgav1 "github.com/openfga/api/proto/openfga/v1"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/trace"
 
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/infra/db"
@@ -435,6 +437,11 @@ func anonymousRoleBindingsCollector(cfg *setting.Cfg, store db.DB) legacyTupleCo
 
 func zanzanaCollector(relations []string) zanzanaTupleCollector {
 	return func(ctx context.Context, client zanzana.Client, object string, namespace string) (map[string]*openfgav1.TupleKey, error) {
+		ctx, span := tracer.Start(ctx, "accesscontrol.dualwrite.resourceReconciler.zanzanaTupleCollector",
+			trace.WithAttributes(attribute.String("namespace", namespace)),
+		)
+		defer span.End()
+
 		// list will use continuation token to collect all tuples for object and relation
 		list := func(relation string) ([]*openfgav1.Tuple, error) {
 			first, err := client.Read(ctx, &authzextv1.ReadRequest{
diff --git a/pkg/services/accesscontrol/dualwrite/resource_reconciler.go b/pkg/services/accesscontrol/dualwrite/resource_reconciler.go
index 0adf365ebde..c51e6a771c7 100644
--- a/pkg/services/accesscontrol/dualwrite/resource_reconciler.go
+++ b/pkg/services/accesscontrol/dualwrite/resource_reconciler.go
@@ -6,6 +6,8 @@ import (
 	"strings"
 
 	openfgav1 "github.com/openfga/api/proto/openfga/v1"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/trace"
 
 	claims "github.com/grafana/authlib/types"
 
@@ -48,6 +50,12 @@ func newResourceReconciler(name string, legacy legacyTupleCollector, zanzanaColl
 }
 
 func (r resourceReconciler) reconcile(ctx context.Context, namespace string) error {
+	ctx, span := tracer.Start(ctx, "accesscontrol.dualwrite.resourceReconciler.reconcile",
+		trace.WithAttributes(attribute.String("namespace", namespace)),
+		trace.WithAttributes(attribute.String("reconciler", r.name)),
+	)
+	defer span.End()
+
 	info, err := claims.ParseNamespace(namespace)
 	if err != nil {
 		return err
@@ -63,7 +71,12 @@ func (r resourceReconciler) reconcile(ctx context.Context, namespace string) err
 	}
 
 	// 1. Fetch grafana resources stored in grafana db.
-	res, err := r.legacy(ctx, info.OrgID)
+	legacyCtx, legacySpan := tracer.Start(ctx, "accesscontrol.dualwrite.resourceReconciler.legacyCollector",
+		trace.WithAttributes(attribute.String("namespace", namespace)),
+		trace.WithAttributes(attribute.String("reconciler", r.name)),
+	)
+	res, err := r.legacy(legacyCtx, info.OrgID)
+	legacySpan.End()
 	if err != nil {
 		return fmt.Errorf("failed to collect legacy tuples for %s: %w", r.name, err)
 	}
@@ -211,6 +224,12 @@ func (r resourceReconciler) collectOrphanDeletes(
 }
 
 func (r resourceReconciler) readAllTuples(ctx context.Context, namespace string) ([]*authzextv1.Tuple, error) {
+	ctx, span := tracer.Start(ctx, "accesscontrol.dualwrite.resourceReconciler.zanzana.readAllTuples",
+		trace.WithAttributes(attribute.String("namespace", namespace)),
+		trace.WithAttributes(attribute.String("reconciler", r.name)),
+	)
+	defer span.End()
+
 	var (
 		out           []*authzextv1.Tuple
 		continueToken string