opentelemetry-collector icon indicating copy to clipboard operation
opentelemetry-collector copied to clipboard

Reduce transitive dependencies of components regarding internal telemetry providers

Open atoulme opened this issue 2 months ago • 12 comments
trafficstars

Component(s)

No response

Describe the issue you're reporting

internal/telemetry is an internal module used to configure how a component can expose telemetry about itself.

This module aims to eventually become public - See #12405

2 issues arise from this module:

  • The module bundles together reading the telemetry configuration of the component and the creation of the metric/trace/log providers, therefore adding indirect dependencies to all modules downstream related to those. This becomes a problem when those dependencies bring CVEs, such as CVE-2023-45142 for the Go SDK.
  • The lifecycle by which the module allows to set their own telemetry attributes resets the existing traces/metric/log providers. It is better to set those late in the process of creating the component to avoid any resource allocation or potential leaks by initializing providers (sorry for the fear mongering, just want this as clean as possible).

Tip

React with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding +1 or me too, to help us triage it. Learn more here.

atoulme avatar Sep 15 '25 17:09 atoulme