Skip to content

feat(otel-ext): add Generic OTel Collector service binding support with mTLS from credentials - #421

Draft
dimitarKiryakov wants to merge 22 commits into
SAP:mainfrom
dimitarKiryakov:feat/generic-otel-collector-binding
Draft

feat(otel-ext): add Generic OTel Collector service binding support with mTLS from credentials#421
dimitarKiryakov wants to merge 22 commits into
SAP:mainfrom
dimitarKiryakov:feat/generic-otel-collector-binding

Conversation

@dimitarKiryakov

Copy link
Copy Markdown

Summary

  • Introduces a Generic OTel Collector path in the OpenTelemetry agent extension: set sap.otel.collector.cf.binding.name to the name of any CF service instance (managed or user-provided) and the extension auto-configures the otlp exporter to send data there.
  • mTLS client credentials (tls.crt, tls.key) and an optional server CA (tls.ca.crt) are read directly from the service binding credentials — no external certificate service required.
  • Bearer token fallback: if no mTLS credentials are present, the optional token field is sent as Authorization: Bearer <token>.
  • Zero breaking changes: existing CaaS and Cloud Logging users require no changes; the new supplier is a no-op unless the new property is set.

Changes

Module What changed
ExtensionConfigurations New OTEL_COLLECTOR.BINDING_NAME config property
CloudFoundryServicesAdapter New findByName(String) method to locate a binding by instance name across all service labels
OtelCollectorServiceProvider Reads the binding name from config, delegates to CloudFoundryServicesAdapter.findByName()
OtelCollectorBindingPropertiesSupplier Resolves endpoint URL, writes PEM files for mTLS/CA, sets OTel exporter properties
CloudLoggingConfigurationCustomizerProvider Wires OtelCollectorBindingPropertiesSupplier as first entry in the supplier chain
README.md Documents the new feature; removes stale BTP Certificate Service sections

Test plan

  • Verify 241 existing module tests still pass: mvn test -pl cf-java-logging-support-opentelemetry-agent-extension
  • Verify shaded jar builds: mvn package -pl cf-java-logging-support-opentelemetry-agent-extension -DskipTests
  • Manual smoke test: bind a user-provided service with url, tls.crt, tls.key; confirm mTLS exporter properties are set at startup
  • Manual smoke test: bind a user-provided service with url and token only; confirm bearer header is set
  • Confirm that an app with only a Cloud Logging or CaaS binding and no sap.otel.collector.cf.binding.name property behaves identically to before

…omizer chain

- Add OtelCollectorBindingPropertiesSupplier as first supplier in the chain
- Make OtelCollectorBindingPropertiesSupplier and its no-arg constructor public for use outside package
- Add regression test for OtelCollectorBindingPropertiesSupplier visibility
- Maintains backward compatibility: new supplier is a no-op unless sap.otel.collector.cf.binding.name is set
@cla-assistant

cla-assistant Bot commented Aug 21, 2026

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

SERVICE_UAA constant, its case in parseServiceInstance, and the
keyPrefix parameter in populateCredentials were added without being
requested and served no documented use case. Remove them along with
the accompanying VCAP_WITH_CERT_SERVICE test fixture and
parsesUaaSiblingAsCredentialsPrefixedKeys test.
The populateCredentials(JsonParser, CloudFoundryCredentials.Builder)
refactor was introduced solely to support UAA credential merging
(two JSON blocks contributing to one builder with key prefixes).
That feature was removed; restore the simpler original form where
parseServiceCredentials creates the credentials builder internally.
- OtelCollectorBindingPropertiesSupplierTest: add tests for null-credentials
  and both-URLs-absent branches identified as uncovered by Opus review
- CaasBindingPropertiesSupplierTest: fix pre-existing assertion checking
  non-existent key 'client.cert' instead of 'client.certificate'
…add CaaS tests

- Fix MtlsClientCertHelper to buffer all TLS properties in a local map
  before merging into the output; a failed write no longer leaves a
  half-configured TLS state in the result map.
- Add CaaS test: partial IOException on client cert write yields no TLS keys.
- Add CaaS test: blank tls.crt skips server cert download and yields no TLS keys.
- Add Javadoc to all public methods and builder methods in pre-existing
  binding classes: CloudFoundryServicesAdapter, CloudLoggingBindingPropertiesSupplier,
  CloudLoggingServicesProvider, CaasServiceProvider, DynatraceServiceProvider,
  CloudFoundryServiceInstance, CloudFoundryCredentials,
  DefaultOtelBackendPropertiesSupplier.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants