Add support for gRPC OpenTelemetry over TLS

Cargo.toml

@@ -46,8 +46,9 @@ opentelemetry_sdk = { version = "0.27.1", optional = true, features = [
 ] }
 opentelemetry = { version = "0.27.1", optional = true }
 opentelemetry-otlp = { version = "0.27.0", optional = true, features = [
-  "tonic",
+  "tonic", "tls"
 ] }
+tonic = { version = "0.12.3", optional = true, features = ["tls-roots"] }
 
 tui-markdown = "0.3.1"
 uuid = { version = "1.11.0", features = ["v4"] }
@@ -128,6 +129,7 @@ default = ["otel"]
   "dep:opentelemetry_sdk",
   "dep:opentelemetry",
   "dep:opentelemetry-otlp",
+  "dep:tonic",
 ]
 
 

kwaak.toml

@@ -1,16 +1,17 @@
 language = "rust"
 
 tavily_api_key = "env:TAVILY_API_KEY"
-github_api_key = "env:KWAAK_GITHUB_TOKEN"
-openai_api_key = "env:KWAAK_OPENAI_API_KEY"
+github_api_key = "env:GITHUB_TOKEN"
+openai_api_key = "env:OPENAI_API_KEY"
 
 tool_executor = "docker"
 otel_enabled = true
+skip_indexing = true
 
 [commands]
 test = "RUST_LOG=kwaak=debug,swiftide=debug RUST_BACKTRACE=1 cargo nextest run --no-fail-fast --color=never"
 coverage = "cargo +nightly llvm-cov nextest --no-clean --summary-only"
-lint_and_fix = "cargo clippy --fix --allow-dirty --allow-staged; cargo fmt"
+# lint_and_fix = "cargo clippy --fix --allow-dirty --allow-staged; cargo fmt"
 
 [git]
 owner = "bosun-ai"

src/kwaak_tracing.rs

@@ -96,11 +96,33 @@ use opentelemetry_sdk::trace::TracerProvider;
 
 #[cfg(feature = "otel")]
 fn init_otel() -> TracerProvider {
+    use opentelemetry_otlp::WithTonicConfig;
     use opentelemetry_sdk::runtime;
     use opentelemetry_sdk::trace::TracerProvider;
 
-    let exporter = opentelemetry_otlp::SpanExporter::builder()
-        .with_tonic()
+    let mut exporter_builder = opentelemetry_otlp::SpanExporter::builder().with_tonic();
+
+    let endpoint = std::env::var("OTEL_EXPORTER_OTLP_ENDPOINT").unwrap_or_default();
+    let insecure = std::env::var("OTEL_EXPORTER_OTLP_INSECURE").unwrap_or_default();
+
+    // This logic is based on https://opentelemetry.io/docs/specs/otel/protocol/exporter/
+    let needs_tls = if endpoint.starts_with("https:") {
+        true
+    } else if endpoint.starts_with("http:") {
+        false
+    } else if insecure == "true" {
+        false
+    } else {
+        true
+    };
+
+    if needs_tls {
+        // TODO: This only supports native roots. We should support custom TLS certificates as well.
+        exporter_builder = exporter_builder
+            .with_tls_config(tonic::transport::ClientTlsConfig::new().with_native_roots());
+    }
+
+    let exporter = exporter_builder
         .build()
         .expect("failed to create otlp exporter");