Skip to content

Authenticate OTLP exports with the instance JWT, refreshed on fork #316

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
archandatta merged 13 commits into from
Jul 29, 2026
Merged

Authenticate OTLP exports with the instance JWT, refreshed on fork #316

Show file tree
Hide file tree
Changes from 7 commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
5be369e
Add in-VM OTLP telemetry export sink
archandatta Jul 7, 2026
bfda873
Address review: BTEL_OTLP_* env prefix, non-fatal sink init
archandatta Jul 9, 2026
e132c09
Make OTLP batch-queue drops observable (review E1)
archandatta Jul 10, 2026
ff3f848
Update config test for OTLP path/service-name defaults
archandatta Jul 10, 2026
23546c0
Bound OTLP export request size (Bugbot: batch exceeds body cap)
archandatta Jul 13, 2026
8f83406
Send instance name as x-api-key to the OTLP relay
archandatta Jul 14, 2026
ec5597d
Merge remote-tracking branch 'origin/main' into pr316
archandatta Jul 22, 2026
7468e28
Merge remote-tracking branch 'origin/main' into pr316
archandatta Jul 23, 2026
df9da0d
Align OTLP exporter test to the x-api-key relay contract
archandatta Jul 23, 2026
a6d280d
Keep OTLP exporter on the instance JWT, refreshed on fork
archandatta Jul 24, 2026
3c9a8e5
Add OTLP export e2e: bearer JWT round-trip + fork-identity refresh
archandatta Jul 24, 2026
1d5acf1
Refresh OTLP resource identity on fork; harden credential provider
archandatta Jul 24, 2026
77b3f29
Merge branch 'main' into archand/kernel-1612/otlp-exporter-contract
archandatta Jul 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions server/cmd/api/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,9 +136,12 @@ func main() {
// Optional OTLP export sink. Independent of S2; both can run together.
var otlpWriter *events.OTLPStorageWriter
if config.OTLPEndpoint != "" {
// The relay authenticates the VM by its instance name (checked against
// active sessions), mirroring the capmonster/hcaptcha relays. Sent as
// x-api-key, not a bearer token.
headers := map[string]string{}
if config.InstanceJWT != "" {
headers["Authorization"] = "Bearer " + config.InstanceJWT
if config.InstanceName != "" {
headers["x-api-key"] = config.InstanceName
Comment thread
cursor[bot] marked this conversation as resolved.
Outdated
}
slogger.Info("OTLP export enabled", "endpoint", config.OTLPEndpoint, "path", config.OTLPPath)
otlpWriter = events.NewOTLPStorageWriter(eventStream, events.OTLPConfig{
Expand Down
15 changes: 5 additions & 10 deletions server/cmd/config/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,11 +60,11 @@ type Config struct {
OTLPPath string `envconfig:"BTEL_OTLP_PATH" default:"/v1/logs"`
OTLPInsecure bool `envconfig:"BTEL_OTLP_INSECURE" default:"false"`
OTLPServiceName string `envconfig:"BTEL_OTLP_SERVICE_NAME" default:"kernel-browser"`
// Platform-injected identity, reused to stamp the OTLP Resource. These are
// the same envs the VM already receives.
InstanceJWT string `envconfig:"KERNEL_INSTANCE_JWT" default:""`
InstanceName string `envconfig:"INST_NAME" default:""`
MetroName string `envconfig:"METRO_NAME" default:""`
// Platform-injected identity: InstanceName is sent to the relay as x-api-key
// and, with MetroName, stamps the OTLP Resource. Same envs the VM already
// receives.
InstanceName string `envconfig:"INST_NAME" default:""`
MetroName string `envconfig:"METRO_NAME" default:""`
}

// LogValue implements slog.LogValuer, redacting secret fields.
Expand All @@ -73,10 +73,6 @@ func (c *Config) LogValue() slog.Value {
if c.S2AccessToken != "" {
s2AccessToken = "[redacted]"
}
otlpJWT := ""
if c.InstanceJWT != "" {
otlpJWT = "[redacted]"
}
return slog.GroupValue(
slog.Int("port", c.Port),
slog.Int("metrics_port", c.MetricsPort),
Expand All @@ -99,7 +95,6 @@ func (c *Config) LogValue() slog.Value {
slog.String("otlp_endpoint", c.OTLPEndpoint),
slog.String("otlp_path", c.OTLPPath),
slog.Bool("otlp_insecure", c.OTLPInsecure),
slog.String("otlp_instance_jwt", otlpJWT),
Comment thread
cursor[bot] marked this conversation as resolved.
slog.String("otlp_service_name", c.OTLPServiceName),
slog.String("otlp_instance_name", c.InstanceName),
slog.String("otlp_metro", c.MetroName),
Expand Down
Loading