Handle ELASTIC_OTEL_OPAMP_HEADERS env var (#411)

* distro: handle ELASTIC_OTEL_OPAMP_HEADERS env var

To set OpAMP client headers like authentication.

* Add docs

* Update docs/reference/edot-python/configuration.md

Author: xrmx

docs/reference/edot-python/configuration.md

@@ -39,7 +39,7 @@ Because the {{edot}} Python is an extension of OpenTelemetry Python, it supports
 
 ```{applies_to}
 serverless: unavailable
-stack: preview 9.1 
+stack: preview 9.1
 product:
   edot_python: preview 1.4.0
 ```
@@ -56,6 +56,21 @@ export ELASTIC_OTEL_OPAMP_ENDPOINT=http://localhost:4320/v1/opamp
 
 To deactivate central configuration, remove the `ELASTIC_OTEL_OPAMP_ENDPOINT` environment variable and restart the instrumented application.
 
+### Central configuration authentication
+
+```{applies_to}
+serverless: unavailable
+stack: preview 9.1
+product:
+  edot_python: preview 1.10.0
+```
+
+If the OpAMP server is configured to require authentication set the `ELASTIC_OTEL_OPAMP_HEADERS` environment variable.
+
+```
+export ELASTIC_OTEL_OPAMP_HEADERS="Authorization=ApiKey an_api_key"
+```
+
 ### Central configuration settings
 
 You can modify the following settings for EDOT Python through APM Agent Central Configuration:

src/elasticotel/distro/__init__.py

@@ -14,6 +14,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+from __future__ import annotations
+
 import logging
 import os
 from urllib.parse import urlparse, urlunparse
@@ -48,13 +50,15 @@
 )
 from opentelemetry.sdk.resources import OTELResourceDetector
 from opentelemetry.util._importlib_metadata import EntryPoint
+from opentelemetry.util.re import parse_env_headers
 from opentelemetry._opamp.agent import OpAMPAgent
 from opentelemetry._opamp.client import OpAMPClient
 from opentelemetry._opamp.proto import opamp_pb2 as opamp_pb2
 
 from elasticotel.distro import version
 from elasticotel.distro.environment_variables import (
     ELASTIC_OTEL_OPAMP_ENDPOINT,
+    ELASTIC_OTEL_OPAMP_HEADERS,
     ELASTIC_OTEL_SYSTEM_METRICS_ENABLED,
 )
 from elasticotel.distro.resource_detectors import get_cloud_resource_detectors
@@ -117,9 +121,17 @@ def _configure(self, **kwargs):
                 ):
                     agent_identifying_attributes["deployment.environment.name"] = deployment_environment_name
 
+                # handle headers for the OpAMP client from the environment variable
+                headers_env: str | None = os.environ.get(ELASTIC_OTEL_OPAMP_HEADERS)
+                if headers_env:
+                    headers = parse_env_headers(headers_env, liberal=True)
+                else:
+                    headers = None
+
                 opamp_client = OpAMPClient(
                     endpoint=endpoint_url,
                     agent_identifying_attributes=agent_identifying_attributes,
+                    headers=headers,
                 )
                 opamp_agent = OpAMPAgent(
                     interval=30,

src/elasticotel/distro/environment_variables.py

@@ -31,3 +31,12 @@
 
 **Default value:** ``not set``
 """
+
+ELASTIC_OTEL_OPAMP_HEADERS = "ELASTIC_OTEL_OPAMP_HEADERS"
+"""
+.. envvar:: ELASTIC_OTEL_OPAMP_HEADERS
+
+HTTP headers to be sento do the OpAMP endpoint.
+
+**Default value:** ``not set``
+"""

src/opentelemetry/_opamp/client.py

@@ -37,7 +37,7 @@
 
 _DEFAULT_OPAMP_TIMEOUT_MS = 1_000
 
-_OTLP_HTTP_HEADERS = {
+_OPAMP_HTTP_HEADERS = {
     "Content-Type": "application/x-protobuf",
     "User-Agent": "OTel-OpAMP-Python/" + __version__,
 }
@@ -66,7 +66,7 @@ def __init__(
 
         self._endpoint = endpoint
         headers = headers or {}
-        self._headers = {**_OTLP_HTTP_HEADERS, **headers}
+        self._headers = {**_OPAMP_HTTP_HEADERS, **headers}
 
         self._agent_description = messages._build_agent_description(
             identifying_attributes=agent_identifying_attributes,

tests/distro/test_distro.py

@@ -135,6 +135,7 @@ def test_configurator_sets_up_opamp_with_http_endpoint(self, client_mock, agent_
         client_mock.assert_called_once_with(
             endpoint="http://localhost:4320/v1/opamp",
             agent_identifying_attributes={"service.name": "service", "deployment.environment.name": "dev"},
+            headers=None,
         )
         agent_mock.assert_called_once_with(interval=30, message_handler=opamp_handler, client=client_mock)
         agent_mock.start.assert_called_once_with()
@@ -158,6 +159,32 @@ def test_configurator_sets_up_opamp_with_https_endpoint(self, client_mock, agent
         client_mock.assert_called_once_with(
             endpoint="https://localhost:4320/v1/opamp",
             agent_identifying_attributes={"service.name": "service", "deployment.environment.name": "dev"},
+            headers=None,
+        )
+        agent_mock.assert_called_once_with(interval=30, message_handler=opamp_handler, client=client_mock)
+        agent_mock.start.assert_called_once_with()
+
+    @mock.patch.dict(
+        "os.environ",
+        {
+            "ELASTIC_OTEL_OPAMP_ENDPOINT": "http://localhost:4320/v1/opamp",
+            "ELASTIC_OTEL_OPAMP_HEADERS": "Authorization=ApiKey foobar===",
+            "OTEL_RESOURCE_ATTRIBUTES": "service.name=service,deployment.environment.name=dev",
+        },
+        clear=True,
+    )
+    @mock.patch("elasticotel.distro.OpAMPAgent")
+    @mock.patch("elasticotel.distro.OpAMPClient")
+    def test_configurator_sets_up_opamp_with_headers_from_environment_variable(self, client_mock, agent_mock):
+        client_mock.return_value = client_mock
+        agent_mock.return_value = agent_mock
+
+        ElasticOpenTelemetryConfigurator()._configure()
+
+        client_mock.assert_called_once_with(
+            endpoint="http://localhost:4320/v1/opamp",
+            agent_identifying_attributes={"service.name": "service", "deployment.environment.name": "dev"},
+            headers={"authorization": "ApiKey foobar==="},
         )
         agent_mock.assert_called_once_with(interval=30, message_handler=opamp_handler, client=client_mock)
         agent_mock.start.assert_called_once_with()
@@ -181,6 +208,7 @@ def test_configurator_adds_path_to_opamp_endpoint_if_missing(self, client_mock,
         client_mock.assert_called_once_with(
             endpoint="https://localhost:4320/v1/opamp",
             agent_identifying_attributes={"service.name": "service", "deployment.environment.name": "dev"},
+            headers=None,
         )
         agent_mock.assert_called_once_with(interval=30, message_handler=opamp_handler, client=client_mock)
         agent_mock.start.assert_called_once_with()
@@ -204,6 +232,7 @@ def test_configurator_sets_up_opamp_without_deployment_environment_name(self, cl
         client_mock.assert_called_once_with(
             endpoint="https://localhost:4320/v1/opamp",
             agent_identifying_attributes={"service.name": "service"},
+            headers=None,
         )
         agent_mock.assert_called_once_with(interval=30, message_handler=opamp_handler, client=client_mock)
         agent_mock.start.assert_called_once_with()