feat: implement support for OAuth2 authentication in the OTLP output #2706
Conversation
TeodorSAP
added
area/logs
github-actions
bot
added
the
kind/feature
NHingerl
added
area/documentation
|
Must add this to DITA (probably) for takt 11b publication. |
TeodorSAP
removed
the
do-not-merge/hold
TeodorSAP
added
do-not-merge/hold
.env
Outdated
| ENV_FLUENTBIT_EXPORTER_IMAGE="europe-docker.pkg.dev/kyma-project/prod/directory-size-exporter:v20250910-86122076" | ||
| ENV_FLUENTBIT_IMAGE="europe-docker.pkg.dev/kyma-project/prod/external/fluent/fluent-bit:4.1.1" | ||
| ENV_OTEL_COLLECTOR_IMAGE="europe-docker.pkg.dev/kyma-project/prod/kyma-otel-collector:0.139.0-main" | ||
| ENV_OTEL_COLLECTOR_CONTRIB_IMAGE="otel/opentelemetry-collector-contrib:0.139.0" |
There was a problem hiding this comment.
This is now required, since the oidc OTel extension is used as part of the e2e tests (on the receiving/backend side), but we don't use it nor want to have it in the production-ready version (i.e. add it to OCC). Thus, we use the official opentelemetry-collector-contrib image for building tests' image only.
There was a problem hiding this comment.
should we move it to our registry. If we our tests get rate-limited by docker ?
There was a problem hiding this comment.
What about the version number.. will we keep it on the old version for ever or will we update it together with the otel upgrade or do we use latest?
| namespace: default | ||
| key: tokenUrl | ||
| ``` | ||
|
|
There was a problem hiding this comment.
Should we add a note about this: DISCLAIMER: GRPC output without TLS configuration is not supported by the OTel collector when OAuth2 is enabled. ?
There was a problem hiding this comment.
Is there a way to express this in active voice and more user-centric?
Like "If you want to use OAuth2 with gRPC, you must configure TLS."
There was a problem hiding this comment.
Yes, I will add it. The user will also get a straight-forward message from the CRD validation if they try configuring it without TLS. But might be good to add it to the documentation as well.
| errorMsg: "Can define either both 'cert' and 'key', or neither", | ||
| field: "spec.output.otlp.tls", | ||
| }, | ||
| { |
There was a problem hiding this comment.
we can add one more test where one of the 3 mandatory fields is missing then it rejects creation ?
| errorMsg: "Can define either both 'cert' and 'key', or neither", | ||
| field: "spec.output.otlp.tls", | ||
| }, | ||
| { |
There was a problem hiding this comment.
add more rejection tests see comment above
6 participants
Description
Changes proposed in this pull request (what was done and why):
oauth2clientextension to support OAuth2 in the OTLP outputLeft TODO:
Changes refer to particular issues, PRs or documents:
Traceability
Related Issuessection.