Internal Telemetry Authenticator Extension Support #13779
Conversation
marcsnid
force-pushed
the
authenticators_internal_telemetry
branch
from
c4095a1 to
7fffba3
Compare
marcsnid
force-pushed
the
authenticators_internal_telemetry
branch
from
7fffba3 to
bdbb3db
Compare
| type DefaultAuthenticatorProvider struct { | ||
| httpClient extensionauth.HTTPClient | ||
| grpcClient extensionauth.GRPCClient | ||
| } |
There was a problem hiding this comment.
Should be able to replace this type with an unexported form.
type authenticatorProvider struct {
extensionauth.ClientRoundTripperFunc
extensionauth.ClientPerRPCCredentialsFunc
}
Reviewers, see this evidently-stalled RFC on the topic of how we construct these default implementations: #13263
| // GetHTTPRoundTripper implements AuthenticatorProvider. | ||
| func (p *DefaultAuthenticatorProvider) GetHTTPRoundTripper(base http.RoundTripper) (http.RoundTripper, error) { | ||
| if p.httpClient == nil { | ||
| return base, nil | ||
| } | ||
| return p.httpClient.RoundTripper(base) | ||
| } | ||
|
|
||
| // GetGRPCCredentials implements AuthenticatorProvider. | ||
| func (p *DefaultAuthenticatorProvider) GetGRPCCredentials() (credentials.PerRPCCredentials, error) { | ||
| if p.grpcClient == nil { | ||
| return nil, nil | ||
| } | ||
| return p.grpcClient.PerRPCCredentials() | ||
| } |
There was a problem hiding this comment.
The suggestion above means we can remove all this.
|
I think it's a worthy problem to solve, but I'm not convinced this is the right solution. In my ideal world, SDK exporters would be able to use OIDC/OAuth2 (workload identity federation), SigV4, reload bearer tokens from a file, mTLS with certificate reloading on rotation, etc. That would come for free to internal telemetry since it uses the SDK. If the SDK authenticator interface were made generic enough, then it could be used by the collector's exporters too. See #13778 (comment) Also related: |
3 participants
Description
Adding authentication support for internal telemetry exports. This feature allows users to specify an authenticator extension in their telemetry configuration to secure internal telemetry exports (traces, metrics, and logs) sent to external endpoints.
Link to tracking issue
Fixes #13778
Testing
Documentation