Repository navigation
fix(collector): carry exporter auth, and stop --force from deleting it (#171) - #198
Merged
Merged
Conversation
#171) The agent and gateway templates share an exporters.otlp block with an endpoint and nothing else. Agent mode forwards "to a gateway or directly to a backend", and a backend rejects every unauthenticated batch; with retry and the sending queue on, the data sits in the queue and is then dropped. otelcol-contrib validate passes, so nothing flags it at generation time. Worse, /otel-collector --force had no preserve contract, and the receiver-auth guard only looked for `authenticator:`. A hand-added exporters.otlp.headers block was deleted on regeneration with no warning. - /otel-collector --force now reads the existing file first. Exporter headers/auth on an exporter the new config also has (otlp) are carried over verbatim; auth on an exporter the new config lacks stops the run unless --confirm-remove-exporter-auth is passed, the same shape as --confirm-remove-auth. A header value that is not an ${env:} reference is never printed. - New repeatable --exporter-header Name=${env:VAR} emits the headers block. Every value must be an environment reference; a literal is refused. The plugin does not hard-code header names per vendor: they are each backend's OTLP-ingest contract and are not verified in this repo. - Step 6 says when the generated exporter carries no credentials and what to do about it. - collector-topology gains an "Exporter auth (the outbound hop)" section. Adds a golden config with exporter headers, validated by tests/collector-validate.sh against otelcol-contrib 0.161.0 (with a check that every header value is an env reference, which fails on a literal), and tests/hooks/collector-exporter-auth.test.sh, wired into lint-hooks (10 of its 11 checks fail against the previous prose). Bumps to 0.8.17.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The generated Collector exporter carried no credentials, and
--forcesilently deleted hand-added exporter auth. Closes #171.What changed
/otel-collector --forcereads the existing file first:headers:/auth:on a same-named exporter are carried over verbatim; auth on an exporter the new config lacks stops the run unless--confirm-remove-exporter-authis passed--exporter-header 'Name=${env:VAR}'emits theheaders:block; every value must be an env reference and a literal is refused. Header names are not hard-coded per vendor (they are each vendor's OTLP-ingest contract and are not verified in this repo)collector-topologygains an "Exporter auth" sectionotelcol-agent-headers.yaml.snap, validated bytests/collector-validate.sh(which also fails if a header value is a literal), andtests/hooks/collector-exporter-auth.test.sh. Bumps to 0.8.17Test plan
All hook, snapshot, drift and e2e unit tests pass locally;
claude plugin validate . --strictpassestests/collector-validate.shpasses against otelcol-contrib 0.161.0, including the new golden; replacing an env reference with a literal makes it failTeeth: 10 of the 11
collector-exporter-authchecks fail against the previous proseVendor, SDK and semantic-convention facts were verified against the source, not recalled — linked where it isn't obvious.
Nothing hardcoded that has a single source of truth (
SEMCONV_VERSION,backends.txt,hooks/otel-paths.sh).