-
Notifications
You must be signed in to change notification settings - Fork 501
Description
The Problem
There is no way to specify gRPC “call credentials” for the OTLP exporter. This is required when using short-lived tokens that must be refreshed which cannot be set at creation time using the metadata
option.
This is required by the Google Cloud OTLP endpoint that uses Access Token credentials.
Proposed Solution
I would like to add a credentials
option to OtlpGrpcClientOptions
that allows specifying a ChannelCredentials
object, rather than it being created in OtlpGrpcClient::MakeChannel
with either grpc::SslCredentials()
or grpc::InsecureChannelCredentials()
.
It would allow using a custom MetadataCredentialsPlugin
subclass to support arbitrary authentication methods, or an existing implementation like GoogleDefaultCredentials()
for use with GCP APIs.
This is similar to the solution used by OpenTelemetry Python – its OTLP exporters have a credentials
parameter.
Alternatives Considered
- Allow passing a gRPC channel into the exporter, rather than just its credentials. This would be similar to the Go implementation, and has the additional benefit of better supporting mocking the client for unit testing. However it’s slightly more effort for users, so could be added in addition to the credentials option?
- Support subclassing
OtlpGrpcClient
– currently there are novirtual
methods, and the method I’d like to overrideMakeChannel
is static. If it was madevirtual
, users could subclass the client to produce the gRPC channel however they need. However this could be harder to maintain compatilibity if the implementaiton of the client needs to change in the future. - Change existing exporter constructors from private to public, that allow passing a gRPC service stub. These are currently used in tests – I’m not sure what happens here if the
OtlpGrpcClient
is different to the stub actually used by the exporter. - Allow calling a function to generate headers like Java implementation. This is not easily compatible with gRPC credentials objects without boilerplate to extract from them and insert into metadata.