feat(server): Make storage-cogs opt-in and slim the cross build image (#730)

`objectstore-server` always enables `storage-cogs`, so every server
build compiles librdkafka. Local builds, `test-python`, and the
cross-build image all need cmake and libcurl headers for a feature they
don't use. The cross image doesn't have cmake, so it currently fails to
build.

This PR adds a `storage-cogs` feature to `objectstore-server`. It is off
by default and only enabled for release builds in `build.yml`. With the
feature off, the `storage_cogs` config is compiled out and ignored.
`Dockerfile.cross` and `test-python` drop the build deps that librdkafka
needed.

---------

Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com>
Co-authored-by: Jan Michael Auer <jan.auer@sentry.io>

Author: sentry-junior[bot]

.github/workflows/build.yml

@@ -32,8 +32,7 @@ jobs:
       - name: Install dependencies
         run: |
           sudo apt-get update
-          # libcurl4-openssl-dev: librdkafka is built from source and links against libcurl,
-          # whose headers are not on the runner by default.
+          # Workaround: rdkafka-sys requires always curl headers, fixed with librdkafka >=2.15.0.
           sudo apt-get install -y llvm libcurl4-openssl-dev
 
       - name: Install sentry-cli
@@ -51,7 +50,7 @@ jobs:
 
       - name: Build Binary
         run: |
-          cargo build --release --locked --target=${{ matrix.target }} --bin objectstore --features profiling
+          cargo build --release --locked --target=${{ matrix.target }} --bin objectstore --features profiling,storage-cogs
           cp target/${{ matrix.target }}/release/objectstore ./objectstore
 
       - name: Split Debug Info

.github/workflows/ci.yml

@@ -23,8 +23,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      # librdkafka is built from source and links against libcurl, whose headers are not
-      # on the runner by default. Needed by anything that builds the `kafka` feature.
+      # Workaround: rdkafka-sys requires always curl headers, fixed with librdkafka >=2.15.0.
       - name: Install libcurl-dev
         run: |
           sudo apt-get update
@@ -78,8 +77,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      # librdkafka is built from source and links against libcurl, whose headers are not
-      # on the runner by default. Needed by anything that builds the `kafka` feature.
+      # Workaround: rdkafka-sys requires always curl headers, fixed with librdkafka >=2.15.0.
       - name: Install libcurl-dev
         run: |
           sudo apt-get update
@@ -147,13 +145,6 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      # librdkafka is built from source and links against libcurl, whose headers are not
-      # on the runner by default. Needed by anything that builds the `kafka` feature.
-      - name: Install libcurl-dev
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y libcurl4-openssl-dev
-
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Install Rust Toolchain
@@ -190,8 +181,7 @@ jobs:
       id-token: write
 
     steps:
-      # librdkafka is built from source and links against libcurl, whose headers are not
-      # on the runner by default. Needed by anything that builds the `kafka` feature.
+      # Workaround: rdkafka-sys requires always curl headers, fixed with librdkafka >=2.15.0.
       - name: Install libcurl-dev
         run: |
           sudo apt-get update

Dockerfile.cross

@@ -4,14 +4,13 @@ FROM rust:slim-bookworm
 RUN dpkg --add-architecture amd64 \
     && apt-get update -qq \
     && apt-get upgrade -y \
-    && apt-get install -y --no-install-recommends make pkg-config git libssl-dev:amd64 libcurl4-openssl-dev:amd64 gcc-x86-64-linux-gnu g++-x86-64-linux-gnu \
+    && apt-get install -y --no-install-recommends make git libssl-dev:amd64 gcc-x86-64-linux-gnu \
     && rm -rf /var/lib/apt/lists/*
 
 RUN rustup target add x86_64-unknown-linux-gnu
 
 ENV CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER=x86_64-linux-gnu-gcc
 ENV CC=x86_64-linux-gnu-gcc
-ENV PKG_CONFIG_ALLOW_CROSS=1
 ENV OPENSSL_LIB_DIR=/usr/lib/x86_64-linux-gnu
 ENV OPENSSL_INCLUDE_DIR=/usr/include
 

objectstore-server/Cargo.toml

@@ -33,7 +33,7 @@ num_cpus = { workspace = true }
 objectstore-log = { workspace = true, features = ["init", "sentry"] }
 objectstore-metrics = { workspace = true }
 objectstore-options = { workspace = true }
-objectstore-service = { workspace = true, features = ["storage-cogs"] }
+objectstore-service = { workspace = true }
 objectstore-types = { workspace = true }
 papaya = { workspace = true }
 pin-project-lite = { workspace = true }
@@ -59,6 +59,9 @@ tikv-jemalloc-ctl = { workspace = true }
 
 [features]
 profiling = ["dep:jemalloc_pprof", "tikv-jemallocator/profiling"]
+# Publishes the storage COGS change stream to Kafka. Off by default because it builds
+# librdkafka from source; release builds enable it.
+storage-cogs = ["objectstore-service/storage-cogs"]
 
 [dev-dependencies]
 nix = { workspace = true, features = ["signal"] }

objectstore-server/docs/architecture.md

@@ -128,7 +128,8 @@ Key configuration sections:
 - `service` — storage service parameters (backend concurrency limit)
 - `killswitches` — traffic blocking rules
 - `storage_cogs` — where backends publish their cost-tracking change stream; corresponds
-  to config on each backend. See [`change_stream`](objectstore_service::change_stream).
+  to config on each backend. Requires the `storage-cogs` Cargo feature. See
+  [`change_stream`](objectstore_service::change_stream).
 - `usecases` — per-use-case properties (expiration policy constraints)
 - `runtime` — worker threads, metrics interval
 - `sentry` / `metrics` / `logging` — observability

objectstore-server/src/config.rs

@@ -65,6 +65,7 @@ use anyhow::Result;
 use bytes::Bytes;
 use figment::providers::{Env, Format, Serialized, Yaml};
 use objectstore_service::backend::local_fs::FileSystemConfig;
+#[cfg(feature = "storage-cogs")]
 use objectstore_service::change_stream::CostTrackerConfig;
 use objectstore_service::encryption::Cipher;
 use objectstore_types::auth::Permission;
@@ -543,6 +544,9 @@ pub struct Config {
     /// - `OS__STORAGE_COGS__TOPIC=shared-resources-inventory`
     /// - `OS__STORAGE_COGS__BOOTSTRAP_SERVERS=kafka:9092`
     /// - `OS__STORAGE_COGS__OVERRIDE_PARAMS__<PROPERTY>=<value>`
+    ///
+    /// Requires the `storage-cogs` Cargo feature.
+    #[cfg(feature = "storage-cogs")]
     #[serde(default)]
     pub storage_cogs: Option<CostTrackerConfig>,
 
@@ -852,6 +856,7 @@ impl Default for Config {
                 cogs: None,
             }),
 
+            #[cfg(feature = "storage-cogs")]
             storage_cogs: None,
             runtime: Runtime::default(),
             logging: LoggingConfig::default(),
@@ -1166,6 +1171,7 @@ mod tests {
     }
 
     #[test]
+    #[cfg(feature = "storage-cogs")]
     fn storage_cogs_via_env() {
         figment::Jail::expect_with(|jail| {
             jail.set_env("OS__STORAGE__TYPE", "bigtable");
@@ -1213,6 +1219,7 @@ mod tests {
             };
             let stream = storage.cogs.as_ref().expect("change stream");
             assert_eq!(stream.sample_rate, 1.0, "reports everything by default");
+            #[cfg(feature = "storage-cogs")]
             assert!(
                 config.storage_cogs.is_none(),
                 "no transport is configured by default"
@@ -1223,6 +1230,7 @@ mod tests {
     }
 
     #[test]
+    #[cfg(feature = "storage-cogs")]
     fn serde_var_yaml_references() {
         let secrets = tempfile::tempdir().unwrap();
         let absolute_secret = secrets.path().join("kafka-password");

objectstore-server/src/state.rs

@@ -64,11 +64,14 @@ impl Services {
         tokio::spawn(track_allocator_metrics(config.runtime.metrics_interval));
 
         // Absent config means no transport, and therefore no reporting.
+        #[cfg(feature = "storage-cogs")]
         let streams = config
             .storage_cogs
             .as_ref()
             .map(ChangeStreamFactory::new)
             .unwrap_or_default();
+        #[cfg(not(feature = "storage-cogs"))]
+        let streams = ChangeStreamFactory::default();
         let cipher = match config.service.cipher()? {
             Some(cipher) => cipher,
             None => {