Add a new usage reporter (gravitational#18142)

* [draft] Add a new usage reporter

This adds a new usage reporter service to the auth server. It's
disabled by default in OSS and can only be turned on via startup hook
in Cloud / Enterprise. In OSS, the audit log wrapper is never
configured and any usage events are sent to a no-op discard reporter.

Usage events are defined in prehog and can be sent to the new
UsageReporter Service on the auth server. An audit event wrapper is
used to capture certain events that are otherwise difficult to hook.
Events are anonymized before submission, then held in a non-blocking
queue for batching and submission purposes.

* Remove dead code

* Add SubmitUsageEvent RPC to Auth.

This adds a new SubmitUsageEvent RPC to the Auth API that external
clients (e.g. the UI) can use to submit usage events externally.

* Slight refactor for unit testing

* Add Prometheus metrics and add initial working prehog submitter

* Add more metrics, tweak prehog client, and add unit tests

* Further tweak http transport settings based on Teleport defaults

* Add missing metrics

* Fix goimports

* Add new UI usage events

* Update e ref

* Add prehog directly for now. Improve logging.

* update prehog

* Add new prehog events; use username from request identity

* add HTTP server for user events

* Add username back to pre-onboard events

* unauthenticated user events

* Fix userevent build error

* Use event-provided username where appropriate

* Move barebones prehog reqs to lib/prehog and generate here.

Also, use prod tunable values.

* Fix license lints

* De-flake tests by adding unfortunate amounts of synchronization.

* Add missing license header

* Misc PR cleanup for review

* Update lib/events/usageevents/usageevents.go

Co-authored-by: Edoardo Spadolini <[email protected]>

* Address a batch of review comments

Adds `anonymizer.AnonymizeString` and parent loggers

* Update e ref

* Clean up comments

* Remove onboard prefix from recovery code event

* Address another batch of feedback

* Use defaults.HTTPClient()

* Remove a noisy log message

* Demote noisy log message to debug

* Temporarily revert e ref for merge

Co-authored-by: Michelle Bergquist <[email protected]>
Co-authored-by: Edoardo Spadolini <[email protected]>

Makefile

@@ -815,6 +815,7 @@ ADDLICENSE_ARGS := -c 'Gravitational, Inc' -l apache \
 		-ignore 'gitref.go' \
 		-ignore 'lib/srv/desktop/rdp/rdpclient/target/**' \
 		-ignore 'lib/teleterm/api/protogen/**' \
+		-ignore 'lib/prehog/gen/**' \
 		-ignore 'lib/web/build/**' \
 		-ignore 'version.go' \
 		-ignore 'webassets/**' \
@@ -947,17 +948,20 @@ protos/all: protos/build protos/lint protos/format
 protos/build: buf/installed
 	$(BUF) build
 	cd lib/teleterm && $(BUF) build
+	cd lib/prehog && $(BUF) build
 
 .PHONY: protos/format
 protos/format: buf/installed
 	$(BUF) format -w
 	cd lib/teleterm && $(BUF) format -w
+	cd lib/prehog && $(BUF) format -w
 
 .PHONY: protos/lint
 protos/lint: buf/installed
 	$(BUF) lint
 	cd api/proto && $(BUF) lint --config=buf-legacy.yaml
 	cd lib/teleterm && $(BUF) lint
+	cd lib/prehog && $(BUF) lint
 
 .PHONY: lint-protos
 lint-protos: protos/lint

api/client/client.go

@@ -2912,3 +2912,10 @@ func (c *Client) ChangePassword(ctx context.Context, req *proto.ChangePasswordRe
 	_, err := c.grpc.ChangePassword(ctx, req, c.callOpts...)
 	return trail.FromGRPC(err)
 }
+
+// SubmitUsageEvent submits an external usage event.
+func (c *Client) SubmitUsageEvent(ctx context.Context, req *proto.SubmitUsageEventRequest) error {
+	_, err := c.grpc.SubmitUsageEvent(ctx, req, c.callOpts...)
+
+	return trail.FromGRPC(err)
+}