Add credentials environment variables to let ChannelCredentials and Session be injected

CHANGELOG.md

@@ -14,6 +14,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Add experimental composite samplers
   ([#4714](https://github.com/open-telemetry/opentelemetry-python/pull/4714))
+- Add new environment variables to the SDK `OTEL_PYTHON_EXPORTER_OTLP_{METRICS/TRACES/LOGS}_CREDENTIAL_PROVIDER` that can be used to
+inject a `requests.Session` or `grpc.ChannelCredentials` object into OTLP exporters created during auto instrumentation [#4689](https://github.com/open-telemetry/opentelemetry-python/pull/4689).
 - Filter duplicate logs out of some internal `logger`'s logs on the export logs path that might otherwise endlessly log or cause a recursion depth exceeded issue in cases where logging itself results in an exception.
   ([#4695](https://github.com/open-telemetry/opentelemetry-python/pull/4695)).
 - docs: linked the examples with their github source code location and added Prometheus example

dev-requirements.txt

@@ -17,4 +17,4 @@ psutil==5.9.6
 GitPython==3.1.41
 pre-commit==3.7.0; python_version >= '3.9'
 pre-commit==3.5.0; python_version < '3.9'
-ruff==0.6.9
+ruff==0.6.9

exporter/opentelemetry-exporter-otlp-proto-grpc/src/opentelemetry/exporter/otlp/proto/grpc/__init__.py

@@ -29,6 +29,7 @@
 - :envvar:`OTEL_EXPORTER_OTLP_TRACES_HEADERS`
 - :envvar:`OTEL_EXPORTER_OTLP_TRACES_ENDPOINT`
 - :envvar:`OTEL_EXPORTER_OTLP_TRACES_COMPRESSION`
+- :envvar:`OTEL_PYTHON_EXPORTER_OTLP_CREDENTIAL_PROVIDER`
 - :envvar:`OTEL_EXPORTER_OTLP_TRACES_CERTIFICATE`
 - :envvar:`OTEL_EXPORTER_OTLP_TIMEOUT`
 - :envvar:`OTEL_EXPORTER_OTLP_PROTOCOL`

exporter/opentelemetry-exporter-otlp-proto-grpc/src/opentelemetry/exporter/otlp/proto/grpc/_log_exporter/__init__.py

@@ -40,6 +40,7 @@
     OTEL_EXPORTER_OTLP_LOGS_HEADERS,
     OTEL_EXPORTER_OTLP_LOGS_INSECURE,
     OTEL_EXPORTER_OTLP_LOGS_TIMEOUT,
+    OTEL_PYTHON_EXPORTER_OTLP_LOGS_CREDENTIAL_PROVIDER,
 )
 
 
@@ -73,6 +74,7 @@ def __init__(
         ):
             credentials = _get_credentials(
                 credentials,
+                OTEL_PYTHON_EXPORTER_OTLP_LOGS_CREDENTIAL_PROVIDER,
                 OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE,
                 OTEL_EXPORTER_OTLP_LOGS_CLIENT_KEY,
                 OTEL_EXPORTER_OTLP_LOGS_CLIENT_CERTIFICATE,

exporter/opentelemetry-exporter-otlp-proto-grpc/src/opentelemetry/exporter/otlp/proto/grpc/exporter.py

@@ -69,10 +69,12 @@
     OTEL_EXPORTER_OTLP_HEADERS,
     OTEL_EXPORTER_OTLP_INSECURE,
     OTEL_EXPORTER_OTLP_TIMEOUT,
+    OTEL_PYTHON_EXPORTER_OTLP_CREDENTIAL_PROVIDER,
 )
 from opentelemetry.sdk.metrics.export import MetricsData
 from opentelemetry.sdk.resources import Resource as SDKResource
 from opentelemetry.sdk.trace import ReadableSpan
+from opentelemetry.util._importlib_metadata import entry_points
 from opentelemetry.util.re import parse_env_headers
 
 _RETRYABLE_ERROR_CODES = frozenset(
@@ -169,12 +171,36 @@ def _load_credentials(
 
 def _get_credentials(
     creds: Optional[ChannelCredentials],
+    credential_entry_point_env_key: str,
     certificate_file_env_key: str,
     client_key_file_env_key: str,
     client_certificate_file_env_key: str,
 ) -> ChannelCredentials:
     if creds is not None:
         return creds
+    credential_env = environ.get(credential_entry_point_env_key)
+    if credential_env:
+        try:
+            maybe_channel_creds = next(
+                iter(
+                    entry_points(
+                        group="opentelemetry_otlp_credential_provider",
+                        name=credential_env,
+                    )
+                )
+            ).load()()
+        except StopIteration:
+            raise RuntimeError(
+                f"Requested component '{credential_env}' not found in "
+                f"entry point 'opentelemetry_otlp_credential_provider'"
+            )
+        if isinstance(maybe_channel_creds, ChannelCredentials):
+            return maybe_channel_creds
+        else:
+            raise RuntimeError(
+                f"Requested component '{credential_env}' is of type {type(maybe_channel_creds)}"
+                f" must be of type `grpc.ChannelCredentials`."
+            )
 
     certificate_file = environ.get(certificate_file_env_key)
     if certificate_file:
@@ -278,15 +304,16 @@ def __init__(
                 options=self._channel_options,
             )
         else:
-            credentials = _get_credentials(
+            self._credentials = _get_credentials(
                 credentials,
+                OTEL_PYTHON_EXPORTER_OTLP_CREDENTIAL_PROVIDER,
                 OTEL_EXPORTER_OTLP_CERTIFICATE,
                 OTEL_EXPORTER_OTLP_CLIENT_KEY,
                 OTEL_EXPORTER_OTLP_CLIENT_CERTIFICATE,
             )
             self._channel = secure_channel(
                 self._endpoint,
-                credentials,
+                self._credentials,
                 compression=compression,
                 options=self._channel_options,
             )

exporter/opentelemetry-exporter-otlp-proto-grpc/src/opentelemetry/exporter/otlp/proto/grpc/metric_exporter/__init__.py

@@ -51,6 +51,7 @@
     OTEL_EXPORTER_OTLP_METRICS_HEADERS,
     OTEL_EXPORTER_OTLP_METRICS_INSECURE,
     OTEL_EXPORTER_OTLP_METRICS_TIMEOUT,
+    OTEL_PYTHON_EXPORTER_OTLP_METRICS_CREDENTIAL_PROVIDER,
 )
 from opentelemetry.sdk.metrics._internal.aggregation import Aggregation
 from opentelemetry.sdk.metrics.export import (  # noqa: F401
@@ -118,6 +119,7 @@ def __init__(
         ):
             credentials = _get_credentials(
                 credentials,
+                OTEL_PYTHON_EXPORTER_OTLP_METRICS_CREDENTIAL_PROVIDER,
                 OTEL_EXPORTER_OTLP_METRICS_CERTIFICATE,
                 OTEL_EXPORTER_OTLP_METRICS_CLIENT_KEY,
                 OTEL_EXPORTER_OTLP_METRICS_CLIENT_CERTIFICATE,

exporter/opentelemetry-exporter-otlp-proto-grpc/src/opentelemetry/exporter/otlp/proto/grpc/trace_exporter/__init__.py

@@ -54,6 +54,7 @@
     OTEL_EXPORTER_OTLP_TRACES_HEADERS,
     OTEL_EXPORTER_OTLP_TRACES_INSECURE,
     OTEL_EXPORTER_OTLP_TRACES_TIMEOUT,
+    OTEL_PYTHON_EXPORTER_OTLP_TRACES_CREDENTIAL_PROVIDER,
 )
 from opentelemetry.sdk.trace import ReadableSpan
 from opentelemetry.sdk.trace.export import SpanExporter, SpanExportResult
@@ -106,6 +107,7 @@ def __init__(
         ):
             credentials = _get_credentials(
                 credentials,
+                OTEL_PYTHON_EXPORTER_OTLP_TRACES_CREDENTIAL_PROVIDER,
                 OTEL_EXPORTER_OTLP_TRACES_CERTIFICATE,
                 OTEL_EXPORTER_OTLP_TRACES_CLIENT_KEY,
                 OTEL_EXPORTER_OTLP_TRACES_CLIENT_CERTIFICATE,

exporter/opentelemetry-exporter-otlp-proto-grpc/tests/test_otlp_exporter_mixin.py

@@ -28,7 +28,7 @@
 from google.rpc.error_details_pb2 import (  # pylint: disable=no-name-in-module
     RetryInfo,
 )
-from grpc import Compression, StatusCode, server
+from grpc import ChannelCredentials, Compression, StatusCode, server
 
 from opentelemetry.exporter.otlp.proto.common.trace_encoder import (
     encode_spans,
@@ -50,6 +50,7 @@
 )
 from opentelemetry.sdk.environment_variables import (
     OTEL_EXPORTER_OTLP_COMPRESSION,
+    OTEL_PYTHON_EXPORTER_OTLP_CREDENTIAL_PROVIDER,
 )
 from opentelemetry.sdk.trace import ReadableSpan, _Span
 from opentelemetry.sdk.trace.export import (
@@ -60,6 +61,15 @@
 logger = getLogger(__name__)
 
 
+class IterEntryPoint:
+    def __init__(self, name, class_type):
+        self.name = name
+        self.class_type = class_type
+
+    def load(self):
+        return self.class_type
+
+
 # The below tests use this test SpanExporter and Spans, but are testing the
 # underlying behavior in the mixin. A MetricExporter or LogExporter could
 # just as easily be used.
@@ -276,6 +286,47 @@ def test_otlp_exporter_otlp_compression_unspecified(
             ),
         )
 
+    @patch.dict(
+        "os.environ",
+        {OTEL_PYTHON_EXPORTER_OTLP_CREDENTIAL_PROVIDER: "credential_provider"},
+    )
+    @patch("opentelemetry.exporter.otlp.proto.grpc.exporter.entry_points")
+    def test_that_credential_gets_passed_to_exporter(self, mock_entry_points):
+        credential = ChannelCredentials(None)
+
+        def f():
+            return credential
+
+        mock_entry_points.configure_mock(
+            return_value=[IterEntryPoint("custom_credential", f)]
+        )
+        exporter = OTLPSpanExporterForTesting(insecure=False)
+        # pylint: disable=protected-access
+        assert exporter._credentials is credential
+
+    @patch.dict(
+        "os.environ",
+        {OTEL_PYTHON_EXPORTER_OTLP_CREDENTIAL_PROVIDER: "credential_provider"},
+    )
+    def test_that_missing_entry_point_raises_exception(self):
+        with self.assertRaises(RuntimeError):
+            OTLPSpanExporterForTesting(insecure=False)
+
+    @patch.dict(
+        "os.environ",
+        {OTEL_PYTHON_EXPORTER_OTLP_CREDENTIAL_PROVIDER: "credential_provider"},
+    )
+    @patch("opentelemetry.exporter.otlp.proto.grpc.exporter.entry_points")
+    def test_that_entry_point_returning_bad_type_raises_exception(self, mock_entry_points):
+        def f():
+            return 1
+
+        mock_entry_points.configure_mock(
+            return_value=[IterEntryPoint("custom_credential", f)]
+        )
+        with self.assertRaises(RuntimeError):
+            OTLPSpanExporterForTesting(insecure=False)
+
     # pylint: disable=no-self-use, disable=unused-argument
     @patch(
         "opentelemetry.exporter.otlp.proto.grpc.exporter.ssl_channel_credentials"

exporter/opentelemetry-exporter-otlp-proto-http/src/opentelemetry/exporter/otlp/proto/http/_common/__init__.py

@@ -12,12 +12,58 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+from os import environ
+from typing import Literal, Optional
+
 import requests
 
+from opentelemetry.sdk.environment_variables import (
+    OTEL_PYTHON_EXPORTER_OTLP_CREDENTIAL_PROVIDER,
+    OTEL_PYTHON_EXPORTER_OTLP_LOGS_CREDENTIAL_PROVIDER,
+    OTEL_PYTHON_EXPORTER_OTLP_METRICS_CREDENTIAL_PROVIDER,
+    OTEL_PYTHON_EXPORTER_OTLP_TRACES_CREDENTIAL_PROVIDER,
+)
+from opentelemetry.util._importlib_metadata import entry_points
+
 
 def _is_retryable(resp: requests.Response) -> bool:
     if resp.status_code == 408:
         return True
     if resp.status_code >= 500 and resp.status_code <= 599:
         return True
     return False
+
+
+def _load_session_from_envvar(
+    cred_envvar: Literal[
+        OTEL_PYTHON_EXPORTER_OTLP_LOGS_CREDENTIAL_PROVIDER,
+        OTEL_PYTHON_EXPORTER_OTLP_TRACES_CREDENTIAL_PROVIDER,
+        OTEL_PYTHON_EXPORTER_OTLP_METRICS_CREDENTIAL_PROVIDER,
+    ],
+) -> Optional[requests.Session]:
+    credential_env = environ.get(
+        OTEL_PYTHON_EXPORTER_OTLP_CREDENTIAL_PROVIDER
+    ) or environ.get(cred_envvar)
+    if credential_env:
+        try:
+            maybe_session = next(
+                iter(
+                    entry_points(
+                        group="opentelemetry_otlp_credential_provider",
+                        name=credential_env,
+                    )
+                )
+            ).load()()
+        except StopIteration:
+            raise RuntimeError(
+                f"Requested component '{credential_env}' not found in "
+                f"entry point 'opentelemetry_otlp_credential_provider'"
+            )
+        if isinstance(maybe_session, requests.Session):
+            return maybe_session
+        else:
+            raise RuntimeError(
+                f"Requested component '{credential_env}' is of type {type(maybe_session)}"
+                f" must be of type `requests.Session`."
+            )
+    return None

exporter/opentelemetry-exporter-otlp-proto-http/src/opentelemetry/exporter/otlp/proto/http/_log_exporter/__init__.py

@@ -32,6 +32,7 @@
 )
 from opentelemetry.exporter.otlp.proto.http._common import (
     _is_retryable,
+    _load_session_from_envvar,
 )
 from opentelemetry.sdk._logs import LogData
 from opentelemetry.sdk._logs.export import (
@@ -54,6 +55,7 @@
     OTEL_EXPORTER_OTLP_LOGS_HEADERS,
     OTEL_EXPORTER_OTLP_LOGS_TIMEOUT,
     OTEL_EXPORTER_OTLP_TIMEOUT,
+    OTEL_PYTHON_EXPORTER_OTLP_LOGS_CREDENTIAL_PROVIDER,
 )
 from opentelemetry.util.re import parse_env_headers
 
@@ -120,7 +122,14 @@ def __init__(
             )
         )
         self._compression = compression or _compression_from_env()
-        self._session = session or requests.Session()
+        self._session = (
+            session
+            or _load_session_from_envvar(
+                OTEL_PYTHON_EXPORTER_OTLP_LOGS_CREDENTIAL_PROVIDER
+            )
+            or requests.Session()
+        )
+        self._session.headers.update(self._headers)
         self._session.headers.update(_OTLP_HTTP_HEADERS)
         # let users override our defaults
         self._session.headers.update(self._headers)

exporter/opentelemetry-exporter-otlp-proto-http/src/opentelemetry/exporter/otlp/proto/http/metric_exporter/__init__.py

@@ -49,6 +49,7 @@
 )
 from opentelemetry.exporter.otlp.proto.http._common import (
     _is_retryable,
+    _load_session_from_envvar,
 )
 from opentelemetry.proto.collector.metrics.v1.metrics_service_pb2 import (  # noqa: F401
     ExportMetricsServiceRequest,
@@ -80,6 +81,7 @@
     OTEL_EXPORTER_OTLP_METRICS_HEADERS,
     OTEL_EXPORTER_OTLP_METRICS_TIMEOUT,
     OTEL_EXPORTER_OTLP_TIMEOUT,
+    OTEL_PYTHON_EXPORTER_OTLP_METRICS_CREDENTIAL_PROVIDER,
 )
 from opentelemetry.sdk.metrics._internal.aggregation import Aggregation
 from opentelemetry.sdk.metrics.export import (  # noqa: F401
@@ -159,7 +161,14 @@ def __init__(
             )
         )
         self._compression = compression or _compression_from_env()
-        self._session = session or requests.Session()
+        self._session = (
+            session
+            or _load_session_from_envvar(
+                OTEL_PYTHON_EXPORTER_OTLP_METRICS_CREDENTIAL_PROVIDER
+            )
+            or requests.Session()
+        )
+        self._session.headers.update(self._headers)
         self._session.headers.update(_OTLP_HTTP_HEADERS)
         # let users override our defaults
         self._session.headers.update(self._headers)

exporter/opentelemetry-exporter-otlp-proto-http/src/opentelemetry/exporter/otlp/proto/http/trace_exporter/__init__.py

@@ -34,6 +34,7 @@
 )
 from opentelemetry.exporter.otlp.proto.http._common import (
     _is_retryable,
+    _load_session_from_envvar,
 )
 from opentelemetry.sdk.environment_variables import (
     OTEL_EXPORTER_OTLP_CERTIFICATE,
@@ -50,6 +51,7 @@
     OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,
     OTEL_EXPORTER_OTLP_TRACES_HEADERS,
     OTEL_EXPORTER_OTLP_TRACES_TIMEOUT,
+    OTEL_PYTHON_EXPORTER_OTLP_TRACES_CREDENTIAL_PROVIDER,
 )
 from opentelemetry.sdk.trace import ReadableSpan
 from opentelemetry.sdk.trace.export import SpanExporter, SpanExportResult
@@ -115,7 +117,14 @@ def __init__(
             )
         )
         self._compression = compression or _compression_from_env()
-        self._session = session or requests.Session()
+        self._session = (
+            session
+            or _load_session_from_envvar(
+                OTEL_PYTHON_EXPORTER_OTLP_TRACES_CREDENTIAL_PROVIDER
+            )
+            or requests.Session()
+        )
+        self._session.headers.update(self._headers)
         self._session.headers.update(_OTLP_HTTP_HEADERS)
         # let users override our defaults
         self._session.headers.update(self._headers)