feat(telemetry): set authority and enable TLS for telemetry backends by codefromthecrypt · Pull Request #7904 · envoyproxy/gateway

codefromthecrypt · 2026-01-09T05:29:10Z

What type of PR is this?
feat(telemetry): set authority and enable TLS for telemetry backends

What this PR does / why we need it:
Sets proper gRPC authority from Service/Backend metadata and enables TLS for Backend resources used by telemetry (metrics, tracing, access logs).

This allows direct use of cloud OTLP endpoints like Elastic Cloud, Datadog, etc. without an intermediate collector.

Which issue(s) this PR fixes:
Fixes #

Release Notes: Yes

Testing

See examples/otel-headers for a working example with commented-out TLS config.

Ran otel-tui on a different port to make sure it can't accidentally receive anything

$ AUTH_TOKEN=fake otel-tui --grpc 14317

Used ngrok to route a public TLS endpoint to it

$ ngrok http --upstream-protocol=http2 14317

Changed the example yaml to point to that instead of plain text and ran all steps

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: Backend
metadata:
  name: otel-collector
spec:
  endpoints:
    - fqdn:
        hostname: unconcentratedly-nonvintage-mirta.ngrok-free.dev
        port: 443
  tls:
    wellKnownCACertificates: System

Noticed connections coming to ngrok

Verified in otel-tui

netlify · 2026-01-09T05:29:16Z

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Name	Link
🔨 Latest commit	`418664c`
🔍 Latest deploy log	https://app.netlify.com/projects/cerulean-figolla-1f9435/deploys/6968a0686dca1e00080ec41f
😎 Deploy Preview	https://deploy-preview-7904--cerulean-figolla-1f9435.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

codefromthecrypt · 2026-01-09T05:42:05Z

will buff out some platform differences and put ready for review

codecov · 2026-01-09T06:47:54Z

Codecov Report

❌ Patch coverage is 90.37037% with 13 lines in your changes missing coverage. Please review.
✅ Project coverage is 72.78%. Comparing base (de5d9ac) to head (418664c).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/gatewayapi/listener.go	89.39%	4 Missing and 3 partials ⚠️
internal/xds/bootstrap/bootstrap.go	87.50%	2 Missing and 2 partials ⚠️
internal/utils/cert/cert.go	66.66%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7904      +/-   ##
==========================================
+ Coverage   72.75%   72.78%   +0.02%     
==========================================
  Files         235      237       +2     
  Lines       35380    35467      +87     
==========================================
+ Hits        25742    25813      +71     
- Misses       7801     7811      +10     
- Partials     1837     1843       +6

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

codefromthecrypt · 2026-01-09T07:13:31Z

cc @zirain @arkodg hopefully this is the last big one at least for gRPC cloud otel endpoints.. next will be trying integrated auth and whatever might not work properly with that and/or metadata required to be consistent across such as service name.

internal/gatewayapi/backendtlspolicy.go

codefromthecrypt · 2026-01-13T23:54:49Z

hi folks. I am planning to do a talk at ElasticON on Envoy AI Gateway being able to export data directly to a TLS endpoint (in this case Elastic Cloud). However, until I know if this will merge or not, I can't finalize my outline for the organizers. Can I get a yes or no on this to save insecurity on direction? cc @arkodg

internal/infrastructure/host/proxy_infra.go

zhaohuabing · 2026-01-14T02:22:35Z

internal/gatewayapi/listener.go

+		}
+		// Set GRPC protocol for OTLP
+		for _, d := range ds {
+			d.Protocol = ir.GRPC


Nit, non-blocking: it might be helpful to add a comment to the API to clarify that OTLP is only supported over gRPC.

I adjusted the code comment. d.Protocol, I might be wrong but is used besides for telemetry, so not sure how to phrase this. we can do that in another PR or you can feel free to push a commit if you can think of a way!

Also once this is released to Envoy we should be able to implement http transport here. the example yaml there uses logs, metrics and traced, just like the gRPC here does envoyproxy/envoy#43001

I adjusted the code comment. d.Protocol, I might be wrong but is used besides for telemetry, so not sure how to phrase this. we can do that in another PR or you can feel free to push a commit if you can think of a way!

I mean in the API, not the internal code. Just nit picking, not blocking.

zhaohuabing

LGTM, with some small non-blocking nits. Thanks so much for your patience and for contributing to this essential feature 🙌

…metrics, tracing, access logs) Sets proper gRPC authority from Service/Backend metadata and enables TLS for Backend resources used by telemetry (metrics, tracing, access logs). This allows direct use of cloud OTLP endpoints like Elastic Cloud, Datadog, etc. without an intermediate collector. Signed-off-by: Adrian Cole <adrian@tetrate.io>

Signed-off-by: Adrian Cole <adrian@tetrate.io>

Route backends need AutoSNI to use the Host header for SNI. Telemetry backends (metrics, tracing, access logs) have no Host header and need SNI inferred from the FQDN endpoint. Move SNI inference to the telemetry-specific code in processBackendRefs so route backends get AutoSNI while telemetry backends get inferred SNI. Signed-off-by: Adrian Cole <adrian@tetrate.io>

Signed-off-by: Adrian Cole <adrian@tetrate.io>

codefromthecrypt · 2026-01-15T08:08:26Z

adding a preparatory PR to aigw in case we can get this merged at least I can test off main branch all things work envoyproxy/ai-gateway#1774

arkodg · 2026-01-15T20:50:03Z

internal/gatewayapi/listener.go

 	return rate
 }

+// getAuthorityFromDestination extracts the gRPC authority from a destination setting.


@zhaohuabing @zirain what about a BTLSP attaching to a Service

…nvoyproxy#7904) * feat(telemetry): set authority and enable TLS for Backend resources (metrics, tracing, access logs) Sets proper gRPC authority from Service/Backend metadata and enables TLS for Backend resources used by telemetry (metrics, tracing, access logs). This allows direct use of cloud OTLP endpoints like Elastic Cloud, Datadog, etc. without an intermediate collector. Signed-off-by: Adrian Cole <adrian@tetrate.io> * feedback Signed-off-by: Adrian Cole <adrian@tetrate.io> * fix: move SNI inference to telemetry-specific code path Route backends need AutoSNI to use the Host header for SNI. Telemetry backends (metrics, tracing, access logs) have no Host header and need SNI inferred from the FQDN endpoint. Move SNI inference to the telemetry-specific code in processBackendRefs so route backends get AutoSNI while telemetry backends get inferred SNI. Signed-off-by: Adrian Cole <adrian@tetrate.io> * feedback Signed-off-by: Adrian Cole <adrian@tetrate.io> * update-comment Signed-off-by: Adrian Cole <adrian@tetrate.io> --------- Signed-off-by: Adrian Cole <adrian@tetrate.io> Signed-off-by: Sadmi Bouhafs <sadmibouhafs@gmail.com>

codefromthecrypt requested a review from a team as a code owner January 9, 2026 05:29

codefromthecrypt changed the title ~~feat(telemetry): enable TLS for OTLP exports using system CA trust store~~ feat(telemetry): enable TLS for Backend (telemetry) resources (metrics, tracing, access logs) Jan 9, 2026

codefromthecrypt marked this pull request as draft January 9, 2026 05:41

codefromthecrypt changed the title ~~feat(telemetry): enable TLS for Backend (telemetry) resources (metrics, tracing, access logs)~~ feat(telemetry): enable TLS for Backend resources (metrics, tracing, access logs) Jan 9, 2026

codefromthecrypt force-pushed the feat/otel-metrics-tls branch from 24ad81d to 9a121a3 Compare January 9, 2026 06:28

codefromthecrypt changed the title ~~feat(telemetry): enable TLS for Backend resources (metrics, tracing, access logs)~~ feat(telemetry): set authority and enable TLS for Backend resources (metrics, tracing, access logs) Jan 9, 2026

codefromthecrypt force-pushed the feat/otel-metrics-tls branch from 9a121a3 to 515c74c Compare January 9, 2026 06:37

codefromthecrypt marked this pull request as ready for review January 9, 2026 07:12

zirain reviewed Jan 9, 2026

View reviewed changes

internal/gatewayapi/backendtlspolicy.go Outdated Show resolved Hide resolved

codefromthecrypt changed the title ~~feat(telemetry): set authority and enable TLS for Backend resources (metrics, tracing, access logs)~~ feat(telemetry): set authority and enable TLS for telemetry backends Jan 10, 2026

arkodg added this to the v1.7.0-rc.1 Release milestone Jan 10, 2026

arkodg requested review from guydc and zhaohuabing January 10, 2026 22:04

codefromthecrypt force-pushed the feat/otel-metrics-tls branch from 22e960b to 523bfd9 Compare January 13, 2026 23:52

zirain previously approved these changes Jan 14, 2026

View reviewed changes

zhaohuabing reviewed Jan 14, 2026

View reviewed changes

internal/infrastructure/host/proxy_infra.go Show resolved Hide resolved

zhaohuabing reviewed Jan 14, 2026

View reviewed changes

zhaohuabing previously approved these changes Jan 14, 2026

View reviewed changes

codefromthecrypt added 4 commits January 14, 2026 17:00

feedback

f4033db

Signed-off-by: Adrian Cole <adrian@tetrate.io>

feedback

28322d9

Signed-off-by: Adrian Cole <adrian@tetrate.io>

codefromthecrypt dismissed stale reviews from zhaohuabing and zirain via 28322d9 January 14, 2026 08:01

codefromthecrypt force-pushed the feat/otel-metrics-tls branch from 523bfd9 to 28322d9 Compare January 14, 2026 08:01

codefromthecrypt and others added 2 commits January 14, 2026 17:15

update-comment

41bc90c

Signed-off-by: Adrian Cole <adrian@tetrate.io>

Merge branch 'main' into feat/otel-metrics-tls

418664c

zhaohuabing approved these changes Jan 15, 2026

View reviewed changes

zirain approved these changes Jan 15, 2026

View reviewed changes

zirain merged commit 001137e into envoyproxy:main Jan 15, 2026
36 checks passed

arkodg reviewed Jan 15, 2026

View reviewed changes

Conversation

codefromthecrypt commented Jan 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Testing

Uh oh!

netlify bot commented Jan 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for cerulean-figolla-1f9435 ready!

Uh oh!

codefromthecrypt commented Jan 9, 2026

Uh oh!

codecov bot commented Jan 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

codefromthecrypt commented Jan 9, 2026

Uh oh!

Uh oh!

codefromthecrypt commented Jan 13, 2026

Uh oh!

Uh oh!

zhaohuabing Jan 14, 2026

Choose a reason for hiding this comment

Uh oh!

codefromthecrypt Jan 14, 2026

Choose a reason for hiding this comment

Uh oh!

codefromthecrypt Jan 14, 2026

Choose a reason for hiding this comment

Uh oh!

zhaohuabing Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

zhaohuabing left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codefromthecrypt commented Jan 15, 2026

Uh oh!

Uh oh!

arkodg Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

codefromthecrypt commented Jan 9, 2026 •

edited

Loading

netlify bot commented Jan 9, 2026 •

edited

Loading

codecov bot commented Jan 9, 2026 •

edited

Loading

zhaohuabing left a comment •

edited

Loading