From 0f801c645ffa3660f4437a336efb0cb62ee92935 Mon Sep 17 00:00:00 2001 From: atlas Date: Wed, 19 Aug 2026 13:59:04 +0200 Subject: [PATCH] otel: build the hive tier's collector from contrib MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The hive tier has to *present* a credential to the swarm tier, and the upstream collector build ships no auth extensions at all — `oauth2client` exists only in contrib. So this is what makes authenticated egress expressible, not a preference between two equivalent packages. It also matches the swarm tier, which has been on contrib since it was written. Two tiers of the same pipeline built from different component sets is a difference nobody would predict from reading either module. Not a build-farm cost: contrib is fetched, not compiled. No behaviour change on its own — nothing names an extension yet. The config that does lands separately, because that is the commit whose failure mode needs a running collector to detect: `otelcol validate` accepts a receiver naming an absent extension and the process then dies at startup, so a green build proves nothing about it. --- nix/host-modules/otel.nix | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/nix/host-modules/otel.nix b/nix/host-modules/otel.nix index 53d43329..a3024641 100644 --- a/nix/host-modules/otel.nix +++ b/nix/host-modules/otel.nix @@ -224,6 +224,22 @@ in services.opentelemetry-collector = { enable = true; + # Contrib, matching the swarm tier (./swarm-otel.nix). The upstream + # default build has no auth extensions at all, and this tier has to + # *present* a credential to the swarm tier — `oauth2client` lives + # only in contrib, so the package choice is what makes authenticated + # egress expressible rather than a preference. + # + # Not a build-farm cost: contrib is fetched, not compiled. + # + # ⚠️ Read the note directly below before adding any extension here. + # It describes precisely the trap this package unlocks: naming an + # extension the build lacks passes `validate` and then kills the + # collector at startup. With contrib the extensions exist — but the + # gap it warns about (a green build proving nothing about whether + # the process starts) is exactly why this module's auth wiring is + # gated by a probe that runs both collectors, not by eval. + package = pkgs.opentelemetry-collector-contrib; # `validateConfigFile` defaults to `isStorePath configFile`, # and `configFile` is null on the `settings` path — so the # upstream default is OFF for exactly the way this module