[GitNimay]

Description

The opa plugin sends its decision request to OPA with only a Content-Type header. So with distributed tracing enabled, OPA never gets the W3C trace context, and its spans start a new trace instead of joining the APISIX request trace. The incoming traceparent is visible to OPA only inside the JSON input (input.request.headers), which OPA does not use for tracing (see open-policy-agent/opa#6905).

This PR forwards the request's current traceparent header on the call to OPA. When the opentelemetry plugin is enabled, its rewrite phase has already put the APISIX span into that header, so OPA's spans become children of the APISIX span. If the header is missing, nothing extra is sent.

sequenceDiagram
    participant C as Client
    participant A as APISIX (opentelemetry + opa)
    participant O as OPA
    C->>A: GET /hello (traceparent: 00-T-client-01)
    Note over A: opentelemetry starts span S and<br/>injects traceparent 00-T-S-xx
    A->>O: POST /v1/data/<policy> (traceparent: 00-T-S-xx)
    Note over O: OPA span is a child of S in trace T

Loading

I used a plain header rather than a schema option because OPA ignores traceparent when its tracing is off, so forwarding it is harmless. I can put it behind an option (e.g. propagate_trace_context) if reviewers prefer.

Which issue(s) this PR fixes:

Fixes #14051

Tests

New t/plugin/opa4.t runs a mock OPA endpoint in the test server that denies every request and echoes back the traceparent it received:

• TEST 2: a client traceparent is forwarded to OPA.
• TEST 3: no traceparent is sent when the request has none.
• TEST 5: with opentelemetry enabled, OPA gets the same trace id but the APISIX span id, not the client's.

Without the fix, TEST 2 and TEST 5 fail (OPA gets no header). With the fix, the file passes. luacheck and lj-releng are clean on apisix/plugins/opa.lua.

Checklist

• I have explained the need for this PR and the problem it solves
• I have explained the changes or the new features added to this PR
• I have added tests corresponding to this change
• I have updated the documentation to reflect this change
• I have verified that this change is backward compatible (If not, please discuss on the APISIX mailing list first)