Skip to content

fix: Remove Netty as an agent dependency #1206

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 4 commits into from
Closed

fix: Remove Netty as an agent dependency #1206

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
956c7fb
fix: Remove Netty as an agent dependency
lukeina2z Sep 19, 2025
5826379
add changelog.
lukeina2z Sep 19, 2025
b597ecd
Merge branch 'main' into awssdk-pr
lukeina2z Sep 19, 2025
2d55830
Merge branch 'main' into awssdk-pr
lukeina2z Oct 1, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,4 +18,6 @@ If your change does not need a CHANGELOG entry, add the "skip changelog" label t
- Support X-Ray Trace Id extraction from Lambda Context object, and respect user-configured OTEL_PROPAGATORS in AWS Lamdba instrumentation
([#1191](https://github.com/aws-observability/aws-otel-java-instrumentation/pull/1191)) ([#1218](https://github.com/aws-observability/aws-otel-java-instrumentation/pull/1218))
- Adaptive Sampling improvements: Ensure propagation of sampling rule across services and AWS accounts. Remove unnecessary B3 propagator.
([#1201](https://github.com/aws-observability/aws-otel-java-instrumentation/pull/1201))
([#1201](https://github.com/aws-observability/aws-otel-java-instrumentation/pull/1201))
- fix: Remove Netty as an agent dependency
([#1206](https://github.com/aws-observability/aws-otel-java-instrumentation/pull/1206))
4 changes: 2 additions & 2 deletions appsignals-tests/contract-tests/build.gradle.kts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,8 +52,8 @@ dependencies {
testImplementation("org.testcontainers:junit-jupiter")
testImplementation("io.opentelemetry.contrib:opentelemetry-aws-xray")
testImplementation("org.testcontainers:localstack")
testImplementation("software.amazon.awssdk:s3")
testImplementation("software.amazon.awssdk:sts")
testImplementation("software.amazon.awssdk:s3:2.33.11")
testImplementation("software.amazon.awssdk:sts:2.33.11")
testImplementation(kotlin("test"))
implementation(project(":appsignals-tests:images:grpc:grpc-base"))
testImplementation("org.testcontainers:kafka:1.21.3")
Expand Down
1 change: 0 additions & 1 deletion awsagentprovider/build.gradle.kts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,6 @@ dependencies {
compileOnly("io.opentelemetry:opentelemetry-exporter-otlp-common")

// For OtlpAwsExporter SigV4 Authentication
runtimeOnly("software.amazon.awssdk:sts")
Copy link
Contributor

@liustve liustve Sep 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This dependency cannot be removed. It is required for customers using the Sigv4 exporters: #1101

Copy link
Contributor Author

@lukeina2z lukeina2z Sep 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why the build and Unit Test not fail after removing it? Do you know which API Agent uses?

Copy link
Contributor

@liustve liustve Sep 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This dependency is managed by the AWS SDK and is used internally in the the AWS SDK authentication libraries to retrieve credentials from all sources. This is already well tested by upstream which is why we don't have unit tests here.

To validate this you have to just check one of these paths work:
https://docs.aws.amazon.com/sdkref/latest/guide/feature-assume-role-credentials.html#feature-assume-role-credentials-settings

Copy link
Contributor Author

@lukeina2z lukeina2z Oct 1, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tested this PR with this document. Both trace and log are working.

Exporting collector-less telemetry using AWS Distro for OpenTelemetry (ADOT) SDK
https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-OTLP-UsingADOT.html

May I ask why you believe the SigV4 projects need STS? Are you trying to obtain an AWS access token from STS? If so, which AWS account, user, or role are you using? I wasn’t able to find the code.

Copy link
Contributor

@liustve liustve Oct 1, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you, Luke! Yes, SigV4 requires STS. This request comes from users who rely on this feature but are unable to explicitly set or hardcode their credentials in their environment. Instead, these environments use the STS library to automatically retrieve and authenticate credentials on their behalf.

Copy link
Contributor

@liustve liustve Oct 1, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

see: #1101

implementation("software.amazon.awssdk:auth")
implementation("software.amazon.awssdk:http-auth-aws")

Expand Down
8 changes: 3 additions & 5 deletions dependencyManagement/build.gradle.kts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,16 +40,11 @@ val dependencyBoms = listOf(
"com.google.protobuf:protobuf-bom:3.25.1",
"com.linecorp.armeria:armeria-bom:1.26.4",
"io.grpc:grpc-bom:1.59.1",
// netty-bom is a fix for CVE-2025-58056 (https://github.com/advisories/GHSA-fghv-69vj-qj49).
// Remove once https://github.com/aws/aws-sdk-java-v2/pull/6398 and https://github.com/aws/aws-sdk-java/pull/3192
// are both merged and released, and we update the corresponding dependencies.
"io.netty:netty-bom:4.1.126.Final",
"io.opentelemetry.instrumentation:opentelemetry-instrumentation-bom-alpha:$otelAlphaVersion",
"org.apache.logging.log4j:log4j-bom:2.21.1",
"org.junit:junit-bom:5.10.1",
"org.springframework.boot:spring-boot-dependencies:2.7.17",
"org.testcontainers:testcontainers-bom:1.19.3",
"software.amazon.awssdk:bom:2.30.17",
)

val dependencySets = listOf(
Expand Down Expand Up @@ -103,6 +98,9 @@ dependencies {
for (dependency in dependencyLists) {
api(dependency)
}

api("software.amazon.awssdk:auth:2.33.11")
api("software.amazon.awssdk:aws-core:2.33.11")
Copy link
Contributor

@liustve liustve Sep 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does adding aws-core dependency include sts? If it does can ignore my previous comment. Also would you help test the Sigv4 path to ensure that sts still works?

Copy link
Contributor Author

@lukeina2z lukeina2z Sep 19, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we have any UTs for Sigv4 work? Core does not include STS.

Copy link
Contributor

@liustve liustve Sep 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

see above

}
}

Expand Down
4 changes: 2 additions & 2 deletions sample-apps/spark/build.gradle.kts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,8 @@ dependencies {
implementation("com.squareup.okhttp3:okhttp")
implementation("io.opentelemetry:opentelemetry-api")
implementation("org.apache.logging.log4j:log4j-core")
implementation("software.amazon.awssdk:s3")
implementation("software.amazon.awssdk:sts")
implementation("software.amazon.awssdk:s3:2.33.11")
implementation("software.amazon.awssdk:sts:2.33.11")

runtimeOnly("org.apache.logging.log4j:log4j-slf4j-impl")
}
Expand Down
4 changes: 2 additions & 2 deletions sample-apps/springboot/build.gradle.kts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,8 +10,8 @@ dependencies {
implementation("org.springframework.boot:spring-boot-starter-web")
implementation("org.springframework.boot:spring-boot-starter")
implementation("com.squareup.okhttp3:okhttp")
implementation("software.amazon.awssdk:s3")
implementation("software.amazon.awssdk:sts")
implementation("software.amazon.awssdk:s3:2.33.11")
implementation("software.amazon.awssdk:sts:2.33.11")
implementation("io.opentelemetry:opentelemetry-api")
}

Expand Down
Loading