feat(otlp): added CORS support

Author: lucastemb

Cargo.lock

@@ -464,10 +464,6 @@ ways that are not yet fully characterized.
 | `otlp_config.receiver.protocols.grpc.tls.tpm.path`                                         | gRPC TLS TPM path                      |         |
 | `otlp_config.receiver.protocols.grpc.write_buffer_size`                                    | gRPC write buffer size                 |         |
 | `otlp_config.receiver.protocols.http.compression_algorithms`                               | HTTP compression algorithms            |         |
-| `otlp_config.receiver.protocols.http.cors.allowed_headers`                                 | HTTP CORS allowed headers              |         |
-| `otlp_config.receiver.protocols.http.cors.allowed_origins`                                 | HTTP CORS allowed origins              |         |
-| `otlp_config.receiver.protocols.http.cors.exposed_headers`                                 | HTTP CORS exposed headers              |         |
-| `otlp_config.receiver.protocols.http.cors.max_age`                                         | HTTP CORS max age                      |         |
 | `otlp_config.receiver.protocols.http.idle_timeout`                                         | HTTP idle timeout                      |         |
 | `otlp_config.receiver.protocols.http.include_metadata`                                     | HTTP include metadata in context       |         |
 | `otlp_config.receiver.protocols.http.keep_alives_enabled`                                  | HTTP keep-alives enabled               |         |
@@ -835,6 +831,10 @@ Both commands scrub recognized secret values before writing JSON to standard out
 | `otlp_config.receiver.protocols.grpc.endpoint`                 | otlp_config.receiver.protocols.grpc.endpoint       |
 | `otlp_config.receiver.protocols.grpc.max_recv_msg_size_mib`    | Max OTLP inbound gRPC message size (MiB)           |
 | `otlp_config.receiver.protocols.grpc.transport`                | otlp_config.receiver.protocols.grpc.transport      |
+| `otlp_config.receiver.protocols.http.cors.allowed_headers`     | HTTP CORS allowed headers                          |
+| `otlp_config.receiver.protocols.http.cors.allowed_origins`     | HTTP CORS allowed origins                          |
+| `otlp_config.receiver.protocols.http.cors.exposed_headers`     | HTTP CORS exposed headers                          |
+| `otlp_config.receiver.protocols.http.cors.max_age`             | HTTP CORS max age                                  |
 | `otlp_config.receiver.protocols.http.endpoint`                 | otlp_config.receiver.protocols.http.endpoint       |
 | `otlp_config.traces.enabled`                                   | otlp_config.traces.enabled                         |
 | `otlp_config.traces.internal_port`                             | otlp_config.traces.internal_port                   |

docs/agent-data-plane/configuration/configuration.md

@@ -1005,6 +1005,30 @@ impl DatadogConfigWitness for DatadogTranslator<'_> {
         self.config.domains.otlp.receiver.http.endpoint = value;
     }
 
+    fn consume_otlp_config_receiver_protocols_http_cors_allowed_headers(&mut self, value: Vec<String>) {
+        self.config.domains.otlp.receiver.http.cors.allowed_headers = value;
+    }
+
+    fn consume_otlp_config_receiver_protocols_http_cors_allowed_origins(&mut self, value: Vec<String>) {
+        self.config.domains.otlp.receiver.http.cors.allowed_origins = value;
+    }
+
+    fn consume_otlp_config_receiver_protocols_http_cors_exposed_headers(&mut self, value: Vec<String>) {
+        self.config.domains.otlp.receiver.http.cors.exposed_headers = value;
+    }
+
+    fn consume_otlp_config_receiver_protocols_http_cors_max_age(&mut self, value: Option<i64>) {
+        if let Some(v) = value {
+            match u64::try_from(v) {
+                Ok(max_age) => self.config.domains.otlp.receiver.http.cors.max_age = max_age,
+                Err(error) => self.record_error(TranslateError::new(
+                    "otlp_config.receiver.protocols.http.cors.max_age",
+                    error,
+                )),
+            }
+        }
+    }
+
     fn consume_otlp_config_traces_enabled(&mut self, value: bool) {
         self.config.domains.otlp.traces.enabled = value;
     }

lib/agent-data-plane-config-system/src/translators/datadog_translator.rs

@@ -240,6 +240,9 @@ pub struct HttpReceiver {
     /// Transport the HTTP receiver binds (for example, `tcp` or `unix`). (not in Datadog Agent
     /// config schema)
     pub transport: String,
+
+    /// CORS configuration for the HTTP receiver.
+    pub cors: Cors,
 }
 
 impl Default for HttpReceiver {
@@ -248,10 +251,38 @@ impl Default for HttpReceiver {
             // Witnessed; overwritten during drive.
             endpoint: String::new(),
             transport: "tcp".to_string(),
+            cors: Cors::default(),
         }
     }
 }
 
+/// CORS configuration for the OTLP HTTP receiver.
+#[derive(Clone, Debug, Default, PartialEq, Serialize)]
+pub struct Cors {
+    /// Origins allowed to make cross-origin requests. Allows for wildcard character when describing
+    /// domains (for example: "http://*.domains.com")
+    ///
+    /// Defaults to an empty list (disabling CORS).
+    pub allowed_origins: Vec<String>,
+
+    /// Headers allowed in CORS requests, in addition to the implicitly allowed `Accept`,
+    /// `Accept-Language`, `Content-Type`, and `Content-Language` headers.
+    ///
+    /// When empty, `X-Requested-With` is also implicitly allowed. Include `*` to allow any
+    /// request header. Defaults to an empty list.
+    pub allowed_headers: Vec<String>,
+
+    /// Headers safe to expose to the API of a CORS response.
+    ///
+    /// Sets the `Access-Control-Expose-Headers` response header. Defaults to an empty list.
+    pub exposed_headers: Vec<String>,
+
+    /// Number of seconds browsers should cache a CORS preflight response.
+    ///
+    /// Defaults to `0` (which prevents caching)
+    pub max_age: u64,
+}
+
 /// OTLP trace ingestion settings.
 #[derive(Clone, Debug, PartialEq, Serialize)]
 pub struct Traces {

lib/agent-data-plane-config/src/domains/otlp.rs

@@ -355,6 +355,50 @@ crate::declare_annotations! {
         test_json: None,
         pipeline_affinity: PipelineAffinity::Pipelines(&[Pipeline::Otlp]),
     };
+    /// `otlp_config.receiver.protocols.http.cors.allowed_headers`-HTTP CORS allowed headers
+    OTLP_CONFIG_RECEIVER_PROTOCOLS_HTTP_CORS_ALLOWED_HEADERS = SalukiAnnotation {
+        schema: &schema::OTLP_CONFIG_RECEIVER_PROTOCOLS_HTTP_CORS_ALLOWED_HEADERS,
+        support_level: SupportLevel::Full,
+        additional_yaml_paths: &[],
+        env_var_override: None,
+        used_by: &[structs::TYPED_CONFIG_SYSTEM],
+        value_type_override: None,
+        test_json: None,
+        pipeline_affinity: PipelineAffinity::Pipelines(&[Pipeline::Otlp]),
+    };
+    /// `otlp_config.receiver.protocols.http.cors.allowed_origins`-HTTP CORS allowed origins
+    OTLP_CONFIG_RECEIVER_PROTOCOLS_HTTP_CORS_ALLOWED_ORIGINS = SalukiAnnotation {
+        schema: &schema::OTLP_CONFIG_RECEIVER_PROTOCOLS_HTTP_CORS_ALLOWED_ORIGINS,
+        support_level: SupportLevel::Full,
+        additional_yaml_paths: &[],
+        env_var_override: None,
+        used_by: &[structs::TYPED_CONFIG_SYSTEM],
+        value_type_override: None,
+        test_json: None,
+        pipeline_affinity: PipelineAffinity::Pipelines(&[Pipeline::Otlp]),
+    };
+    /// `otlp_config.receiver.protocols.http.cors.exposed_headers`-HTTP CORS exposed headers
+    OTLP_CONFIG_RECEIVER_PROTOCOLS_HTTP_CORS_EXPOSED_HEADERS = SalukiAnnotation {
+        schema: &schema::OTLP_CONFIG_RECEIVER_PROTOCOLS_HTTP_CORS_EXPOSED_HEADERS,
+        support_level: SupportLevel::Full,
+        additional_yaml_paths: &[],
+        env_var_override: None,
+        used_by: &[structs::TYPED_CONFIG_SYSTEM],
+        value_type_override: None,
+        test_json: None,
+        pipeline_affinity: PipelineAffinity::Pipelines(&[Pipeline::Otlp]),
+    };
+    /// `otlp_config.receiver.protocols.http.cors.max_age`-HTTP CORS max age
+    OTLP_CONFIG_RECEIVER_PROTOCOLS_HTTP_CORS_MAX_AGE = SalukiAnnotation {
+        schema: &schema::OTLP_CONFIG_RECEIVER_PROTOCOLS_HTTP_CORS_MAX_AGE,
+        support_level: SupportLevel::Full,
+        additional_yaml_paths: &[],
+        env_var_override: None,
+        used_by: &[structs::TYPED_CONFIG_SYSTEM],
+        value_type_override: None,
+        test_json: None,
+        pipeline_affinity: PipelineAffinity::Pipelines(&[Pipeline::Otlp]),
+    };
     /// `tags`-Global tags for EKS Fargate OTLP metrics
     TAGS = SalukiAnnotation {
         schema: &schema::TAGS,

lib/datadog-agent/config-testing/src/config_registry/otlp.rs

@@ -583,6 +583,7 @@ fn permissivize(file: &mut syn::File) {
                 LeafKind::Number => "crate::cast_de::deserialize_f64",
                 LeafKind::Text => "crate::cast_de::deserialize_string",
                 LeafKind::OptionalText => "crate::cast_de::deserialize_optional_string",
+                LeafKind::OptionalInteger => "crate::cast_de::deserialize_optional_i64",
                 LeafKind::Exempt => continue,
                 LeafKind::Unknown => panic!(
                     "field `{}.{name}` has no declared coercion; classify its type in `leaf_kind` and \
@@ -604,6 +605,7 @@ enum LeafKind {
     Number,
     Text,
     OptionalText,
+    OptionalInteger,
     /// A nested section, or a leaf whose shape another pass or its own consumer handles.
     Exempt,
     Unknown,
@@ -620,6 +622,14 @@ fn leaf_kind(ty: &syn::Type, struct_names: &HashSet<String>) -> LeafKind {
     if option_inner(ty).is_some_and(is_plain_string) {
         return LeafKind::OptionalText;
     }
+    // An optional `integer` leaf uses the same permissive coercion as a plain `i64`, while an
+    // absent or null value stays `None`.
+    if option_inner(ty)
+        .and_then(plain_ident)
+        .is_some_and(|ident| ident == "i64")
+    {
+        return LeafKind::OptionalInteger;
+    }
     if is_vec_string(ty) || is_string_map_vec_string(ty) || is_json_container(ty) || is_duration(ty) {
         return LeafKind::Exempt;
     }

lib/datadog-agent/config/build/datadog_config_gen.rs

@@ -2344,20 +2344,40 @@ inventory:
     description: "HTTP compression algorithms"
 
   otlp_config.receiver.protocols.http.cors.allowed_headers:
-    support: unknown
+    support: full
+    pipelines: [otlp]
     description: "HTTP CORS allowed headers"
+    test_support:
+      used_by: [TypedConfigSystem]
+      additional_attributes:
+        config_registry_filename: otlp.rs
 
   otlp_config.receiver.protocols.http.cors.allowed_origins:
-    support: unknown
+    support: full
+    pipelines: [otlp]
     description: "HTTP CORS allowed origins"
+    test_support:
+      used_by: [TypedConfigSystem]
+      additional_attributes:
+        config_registry_filename: otlp.rs
 
   otlp_config.receiver.protocols.http.cors.exposed_headers:
-    support: unknown
+    support: full
+    pipelines: [otlp]
     description: "HTTP CORS exposed headers"
+    test_support:
+      used_by: [TypedConfigSystem]
+      additional_attributes:
+        config_registry_filename: otlp.rs
 
   otlp_config.receiver.protocols.http.cors.max_age:
-    support: unknown
+    support: full
+    pipelines: [otlp]
     description: "HTTP CORS max age"
+    test_support:
+      used_by: [TypedConfigSystem]
+      additional_attributes:
+        config_registry_filename: otlp.rs
 
   otlp_config.receiver.protocols.http.endpoint:
     support: full

lib/datadog-agent/config/schema/schema_overlay.yaml

@@ -144,6 +144,18 @@ where
     deserializer.deserialize_option(OptionalStringVisitor)
 }
 
+/// Deserializes an optional `integer` leaf, where an absent or null value stays `None`.
+///
+/// # Errors
+///
+/// Same as [`deserialize_i64`] for a present value.
+pub(crate) fn deserialize_optional_i64<'de, D>(deserializer: D) -> Result<Option<i64>, D::Error>
+where
+    D: Deserializer<'de>,
+{
+    deserializer.deserialize_option(OptionalI64Visitor)
+}
+
 struct BoolVisitor;
 
 impl Visitor<'_> for BoolVisitor {
@@ -314,6 +326,28 @@ impl<'de> Visitor<'de> for OptionalStringVisitor {
     }
 }
 
+struct OptionalI64Visitor;
+
+impl<'de> Visitor<'de> for OptionalI64Visitor {
+    type Value = Option<i64>;
+
+    fn expecting(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("an integer, a numeric string, a boolean, or null")
+    }
+
+    fn visit_none<E: de::Error>(self) -> Result<Option<i64>, E> {
+        Ok(None)
+    }
+
+    fn visit_unit<E: de::Error>(self) -> Result<Option<i64>, E> {
+        Ok(None)
+    }
+
+    fn visit_some<D: Deserializer<'de>>(self, deserializer: D) -> Result<Option<i64>, D::Error> {
+        deserializer.deserialize_any(I64Visitor).map(Some)
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use serde::Deserialize;

lib/datadog-agent/config/src/cast_de.rs

@@ -1629,6 +1629,9 @@ impl Default for OtlpConfigReceiverProtocolsGrpc {
 
 #[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
 pub struct OtlpConfigReceiverProtocolsHttp {
+    #[serde(default)]
+    pub cors: OtlpConfigReceiverProtocolsHttpCors,
+
     #[serde(
         default = "defaults::datadog_configuration_otlp_config_receiver_protocols_http_endpoint"
     )]
@@ -1639,11 +1642,42 @@ pub struct OtlpConfigReceiverProtocolsHttp {
 impl Default for OtlpConfigReceiverProtocolsHttp {
     fn default() -> Self {
         Self {
+            cors: Default::default(),
             endpoint: defaults::datadog_configuration_otlp_config_receiver_protocols_http_endpoint(),
         }
     }
 }
 
+#[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
+pub struct OtlpConfigReceiverProtocolsHttpCors {
+    #[serde(default, skip_serializing_if = "::std::vec::Vec::is_empty")]
+    #[serde(deserialize_with = "crate::list_de::deserialize_space_separated_or_seq")]
+    pub allowed_headers: Vec<String>,
+
+    #[serde(default, skip_serializing_if = "::std::vec::Vec::is_empty")]
+    #[serde(deserialize_with = "crate::list_de::deserialize_space_separated_or_seq")]
+    pub allowed_origins: Vec<String>,
+
+    #[serde(default, skip_serializing_if = "::std::vec::Vec::is_empty")]
+    #[serde(deserialize_with = "crate::list_de::deserialize_space_separated_or_seq")]
+    pub exposed_headers: Vec<String>,
+
+    #[serde(default, skip_serializing_if = "::std::option::Option::is_none")]
+    #[serde(deserialize_with = "crate::cast_de::deserialize_optional_i64")]
+    pub max_age: Option<i64>,
+}
+
+impl Default for OtlpConfigReceiverProtocolsHttpCors {
+    fn default() -> Self {
+        Self {
+            allowed_headers: Default::default(),
+            allowed_origins: Default::default(),
+            exposed_headers: Default::default(),
+            max_age: Default::default(),
+        }
+    }
+}
+
 #[derive(::serde::Deserialize, ::serde::Serialize, Clone, Debug)]
 pub struct OtlpConfigTraces {
     #[serde(default = "defaults::default_bool::<true>")]

lib/datadog-agent/config/src/generated/datadog_configuration.rs

@@ -835,6 +835,47 @@ pub static DATADOG_ENV_KEYS: &[EnvKey] = &[
         path: &["otlp_config", "receiver", "protocols", "grpc", "transport"],
         decode: EnvDecode::RawString,
     },
+    EnvKey {
+        env_vars: &["DD_OTLP_CONFIG_RECEIVER_PROTOCOLS_HTTP_CORS_ALLOWED_HEADERS"],
+        path: &[
+            "otlp_config",
+            "receiver",
+            "protocols",
+            "http",
+            "cors",
+            "allowed_headers",
+        ],
+        decode: EnvDecode::StringList,
+    },
+    EnvKey {
+        env_vars: &["DD_OTLP_CONFIG_RECEIVER_PROTOCOLS_HTTP_CORS_ALLOWED_ORIGINS"],
+        path: &[
+            "otlp_config",
+            "receiver",
+            "protocols",
+            "http",
+            "cors",
+            "allowed_origins",
+        ],
+        decode: EnvDecode::StringList,
+    },
+    EnvKey {
+        env_vars: &["DD_OTLP_CONFIG_RECEIVER_PROTOCOLS_HTTP_CORS_EXPOSED_HEADERS"],
+        path: &[
+            "otlp_config",
+            "receiver",
+            "protocols",
+            "http",
+            "cors",
+            "exposed_headers",
+        ],
+        decode: EnvDecode::StringList,
+    },
+    EnvKey {
+        env_vars: &["DD_OTLP_CONFIG_RECEIVER_PROTOCOLS_HTTP_CORS_MAX_AGE"],
+        path: &["otlp_config", "receiver", "protocols", "http", "cors", "max_age"],
+        decode: EnvDecode::Integer,
+    },
     EnvKey {
         env_vars: &["DD_OTLP_CONFIG_RECEIVER_PROTOCOLS_HTTP_ENDPOINT"],
         path: &["otlp_config", "receiver", "protocols", "http", "endpoint"],