Skip to content

Send instance name as x-api-key to the OTLP relay #316

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
archandatta wants to merge 7 commits into
base: main
Choose a base branch
from
+10 −12
Open

Send instance name as x-api-key to the OTLP relay #316

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
5be369e
Add in-VM OTLP telemetry export sink
archandatta Jul 7, 2026
bfda873
Address review: BTEL_OTLP_* env prefix, non-fatal sink init
archandatta Jul 9, 2026
e132c09
Make OTLP batch-queue drops observable (review E1)
archandatta Jul 10, 2026
ff3f848
Update config test for OTLP path/service-name defaults
archandatta Jul 10, 2026
23546c0
Bound OTLP export request size (Bugbot: batch exceeds body cap)
archandatta Jul 13, 2026
8f83406
Send instance name as x-api-key to the OTLP relay
archandatta Jul 14, 2026
ec5597d
Merge remote-tracking branch 'origin/main' into pr316
archandatta Jul 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions server/cmd/api/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,9 +136,12 @@ func main() {
// Optional OTLP export sink. Independent of S2; both can run together.
var otlpWriter *events.OTLPStorageWriter
if config.OTLPEndpoint != "" {
// The relay authenticates the VM by its instance name (checked against
// active sessions), mirroring the capmonster/hcaptcha relays. Sent as
// x-api-key, not a bearer token.
headers := map[string]string{}
if config.InstanceJWT != "" {
headers["Authorization"] = "Bearer " + config.InstanceJWT
if config.InstanceName != "" {
headers["x-api-key"] = config.InstanceName

@cursor cursor Bot Jul 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale OTLP auth after fork

High Severity

The new relay auth header is taken from config.InstanceName once at process start. In fork-identity-wait mode, kernel-images-api starts before identity apply and is intentionally not restarted, so x-api-key stays empty or wrong after the instance is bound and relay exports keep failing auth.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit ec5597d. Configure here.

}
slogger.Info("OTLP export enabled", "endpoint", config.OTLPEndpoint, "path", config.OTLPPath)
otlpWriter = events.NewOTLPStorageWriter(eventStream, events.OTLPConfig{
Expand Down
15 changes: 5 additions & 10 deletions server/cmd/config/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,11 +60,11 @@ type Config struct {
OTLPPath string `envconfig:"BTEL_OTLP_PATH" default:"/v1/logs"`
OTLPInsecure bool `envconfig:"BTEL_OTLP_INSECURE" default:"false"`
OTLPServiceName string `envconfig:"BTEL_OTLP_SERVICE_NAME" default:"kernel-browser"`
// Platform-injected identity, reused to stamp the OTLP Resource. These are
// the same envs the VM already receives.
InstanceJWT string `envconfig:"KERNEL_INSTANCE_JWT" default:""`
InstanceName string `envconfig:"INST_NAME" default:""`
MetroName string `envconfig:"METRO_NAME" default:""`
// Platform-injected identity: InstanceName is sent to the relay as x-api-key
// and, with MetroName, stamps the OTLP Resource. Same envs the VM already
// receives.
InstanceName string `envconfig:"INST_NAME" default:""`
MetroName string `envconfig:"METRO_NAME" default:""`
}

// LogValue implements slog.LogValuer, redacting secret fields.
Expand All @@ -73,10 +73,6 @@ func (c *Config) LogValue() slog.Value {
if c.S2AccessToken != "" {
s2AccessToken = "[redacted]"
}
otlpJWT := ""
if c.InstanceJWT != "" {
otlpJWT = "[redacted]"
}
return slog.GroupValue(
slog.Int("port", c.Port),
slog.Int("metrics_port", c.MetricsPort),
Expand All @@ -99,7 +95,6 @@ func (c *Config) LogValue() slog.Value {
slog.String("otlp_endpoint", c.OTLPEndpoint),
slog.String("otlp_path", c.OTLPPath),
slog.Bool("otlp_insecure", c.OTLPInsecure),
slog.String("otlp_instance_jwt", otlpJWT),
slog.String("otlp_service_name", c.OTLPServiceName),
slog.String("otlp_instance_name", c.InstanceName),
slog.String("otlp_metro", c.MetroName),
Expand Down
Loading