feat: implement support for OAuth2 authentication in the OTLP output

.env

@@ -18,6 +18,8 @@ ENV_GORELEASER_VERSION=v1.23.0
 ENV_FLUENTBIT_EXPORTER_IMAGE="europe-docker.pkg.dev/kyma-project/prod/directory-size-exporter:v20251210-3d7f23ad"
 ENV_FLUENTBIT_IMAGE="europe-docker.pkg.dev/kyma-project/prod/external/fluent/fluent-bit:4.2.2"
 ENV_OTEL_COLLECTOR_IMAGE="europe-docker.pkg.dev/kyma-project/prod/kyma-otel-collector:0.141.0-main"
+# ENV_OTEL_COLLECTOR_CONTRIB_IMAGE is used for OAuth2 E2E tests only, since they require the OIDC extension, which is not needed in production code.
+ENV_OTEL_COLLECTOR_CONTRIB_IMAGE="otel/opentelemetry-collector-contrib:latest"
 ENV_SELFMONITOR_IMAGE="europe-docker.pkg.dev/kyma-project/prod/tpi/telemetry-self-monitor:3.8.0-3d7f23a"
 ENV_TEST_TELEMETRYGEN_IMAGE="ghcr.io/open-telemetry/opentelemetry-collector-contrib/telemetrygen:v0.141.0"
 ENV_ALPINE_IMAGE="europe-docker.pkg.dev/kyma-project/prod/external/library/alpine:3.23.2"

apis/telemetry/v1alpha1/shared_types.go

@@ -41,6 +41,7 @@ const (
 
 // OTLPOutput OTLP output configuration
 // +kubebuilder:validation:XValidation:rule="(has(self.path) && size(self.path) > 0) ? self.protocol == 'http' : true",message="Path is only available with HTTP protocol"
+// +kubebuilder:validation:XValidation:rule="(has(self.authentication) && has(self.authentication.oauth2) && self.protocol == 'grpc' && has(self.tls)) ? !(has(self.tls.insecure) && self.tls.insecure == true) : true",message="OAuth2 authentication requires TLS when using gRPC protocol"
 type OTLPOutput struct {
 	// Protocol defines the OTLP protocol (`http` or `grpc`). Default is `grpc`.
 	// +kubebuilder:validation:Optional
@@ -63,10 +64,15 @@ type OTLPOutput struct {
 	TLS *OTLPTLS `json:"tls,omitempty"`
 }
 
+// AuthenticationOptions OTLP output authentication options
+// +kubebuilder:validation:XValidation:rule="!(has(self.basic) && has(self.oauth2))",message="Only one authentication method can be specified"
 type AuthenticationOptions struct {
 	// Basic activates `Basic` authentication for the destination providing relevant Secrets.
 	// +kubebuilder:validation:Optional
 	Basic *BasicAuthOptions `json:"basic,omitempty"`
+	// OAuth2 activates `OAuth2` authentication for the destination providing relevant Secrets.
+	// +kubebuilder:validation:Optional
+	OAuth2 *OAuth2Options `json:"oauth2,omitempty"`
 }
 
 type BasicAuthOptions struct {
@@ -78,6 +84,26 @@ type BasicAuthOptions struct {
 	Password ValueType `json:"password"`
 }
 
+// OAuth2Options contains OAuth2 authentication options.
+type OAuth2Options struct {
+	// TokenURL contains the OAuth2 token endpoint URL or a Secret reference.
+	// +kubebuilder:validation:XValidation:rule="(self.value != '' ) || (has(self.valueFrom))", message="tokenURL' missing"
+	// +kubebuilder:validation:XValidation:rule="(self.value != '' ) ? (isURL(self.value)) : true", message="'tokenURL' must be a valid URL"
+	TokenURL ValueType `json:"tokenURL"`
+	// ClientID contains the OAuth2 client ID or a Secret reference.
+	// +kubebuilder:validation:XValidation:rule="(self.value != '' ) || (has(self.valueFrom))", message="'clientID' missing"
+	ClientID ValueType `json:"clientID"`
+	// ClientSecret contains the OAuth2 client secret or a Secret reference.
+	// +kubebuilder:validation:XValidation:rule="(self.value != '' ) || (has(self.valueFrom))", message="clientSecret' missing"
+	ClientSecret ValueType `json:"clientSecret"`
+	// Scopes contains optional OAuth2 scopes.
+	// +kubebuilder:validation:Optional
+	Scopes []string `json:"scopes,omitempty"`
+	// Params contains optional additional OAuth2 parameters that are sent to the token endpoint.
+	// +kubebuilder:validation:Optional
+	Params map[string]string `json:"params,omitempty"`
+}
+
 type Header struct {
 	// Defines the header value.
 	ValueType `json:",inline"`

apis/telemetry/v1beta1/shared_types.go

@@ -43,6 +43,7 @@ const (
 
 // OTLPOutput OTLP output configuration
 // +kubebuilder:validation:XValidation:rule="(has(self.path) && size(self.path) > 0) ? self.protocol == 'http' : true",message="Path is only available with HTTP protocol"
+// +kubebuilder:validation:XValidation:rule="(has(self.authentication) && has(self.authentication.oauth2) && self.protocol == 'grpc' && has(self.tls)) ? !(has(self.tls.insecure) && self.tls.insecure == true) : true",message="OAuth2 authentication requires TLS when using gRPC protocol"
 type OTLPOutput struct {
 	// Protocol defines the OTLP protocol (`http` or `grpc`). Default is `grpc`.
 	// +kubebuilder:validation:Optional
@@ -65,10 +66,15 @@ type OTLPOutput struct {
 	TLS *OutputTLS `json:"tls,omitempty"`
 }
 
+// AuthenticationOptions OTLP output authentication options
+// +kubebuilder:validation:XValidation:rule="!(has(self.basic) && has(self.oauth2))",message="Only one authentication method can be specified"
 type AuthenticationOptions struct {
 	// Basic activates `Basic` authentication for the destination providing relevant Secrets.
 	// +kubebuilder:validation:Optional
 	Basic *BasicAuthOptions `json:"basic,omitempty"`
+	// OAuth2 activates `OAuth2` authentication for the destination providing relevant Secrets.
+	// +kubebuilder:validation:Optional
+	OAuth2 *OAuth2Options `json:"oauth2,omitempty"`
 }
 
 type BasicAuthOptions struct {
@@ -80,6 +86,24 @@ type BasicAuthOptions struct {
 	Password ValueType `json:"password"`
 }
 
+type OAuth2Options struct {
+	// TokenURL contains the OAuth2 token endpoint URL or a Secret reference.
+	// +kubebuilder:validation:Required
+	TokenURL ValueType `json:"tokenURL"`
+	// ClientID contains the OAuth2 client ID or a Secret reference.
+	// +kubebuilder:validation:Required
+	ClientID ValueType `json:"clientID"`
+	// ClientSecret contains the OAuth2 client secret or a Secret reference.
+	// +kubebuilder:validation:Required
+	ClientSecret ValueType `json:"clientSecret"`
+	// Scopes contains optional OAuth2 scopes.
+	// +kubebuilder:validation:Optional
+	Scopes []string `json:"scopes,omitempty"`
+	// Params contains optional additional OAuth2 parameters that are sent to the token endpoint.
+	// +kubebuilder:validation:Optional
+	Params map[string]string `json:"params,omitempty"`
+}
+
 type Header struct {
 	// Defines the header value.
 	ValueType `json:",inline"`

dependencies/populateimages/main.go

@@ -18,8 +18,9 @@ var templates = map[string]string{
 package testkit
 
 const (
-	DefaultTelemetryGenImage  = "{{ .ENV_TEST_TELEMETRYGEN_IMAGE }}"
-	DefaultOTelCollectorImage = "{{ .ENV_OTEL_COLLECTOR_IMAGE }}"
+	DefaultTelemetryGenImage         = "{{ .ENV_TEST_TELEMETRYGEN_IMAGE }}"
+	DefaultOTelCollectorContribImage = "{{ .ENV_OTEL_COLLECTOR_CONTRIB_IMAGE }}"
+	DefaultOTelCollectorImage        = "{{ .ENV_OTEL_COLLECTOR_IMAGE }}"
 )
 `,
 }

docs/user/integrate-otlp-backend/README.md

@@ -40,7 +40,7 @@ Ensure the port in your endpoint URL is correct for the chosen protocol.
 
 ## Set Up Authentication
 
-For each pipeline, add authentication details (like user names, passwords, certificates, or tokens) to connect securely to your observability backend. You can use mutual TLS (mTLS), custom headers, or Basic Authentication.
+For each pipeline, add authentication details (like user names, passwords, certificates, or tokens) to connect securely to your observability backend. You can use mutual TLS (mTLS), custom headers, OAuth2, or Basic Authentication.
 
 While you can choose to add your authentication details from plain text, it’s recommended to store these sensitive details in a Kubernetes `Secret` and reference the Secret's keys in your pipeline configuration. When you rotate the `Secret` and update its values, Telemetry Manager detects the changes and applies the new `Secret` to your setup.
 
@@ -88,6 +88,43 @@ While you can choose to add your authentication details from plain text, it’s
                 key: token
   ```
 
+- To use OAuth2 for authentication, configure the `authentication.oauth2` section.
+
+  ```yaml
+    ...
+    output:
+      otlp:
+        endpoint:
+          valueFrom:
+            secretKeyRef:
+                name: backend
+                namespace: default
+                key: endpoint
+        authentication:
+          oauth2:
+            clientId:
+              valueFrom:
+                secretKeyRef:
+                  name: backend
+                  namespace: default
+                  key: clientId
+            clientSecret:
+              valueFrom:
+                secretKeyRef:
+                  name: backend
+                  namespace: default
+                  key: clientSecret
+            tokenUrl:
+              valueFrom:
+                secretKeyRef:
+                  name: backend
+                  namespace: default
+                  key: tokenUrl
+  ```
+
+> [!NOTE]
+> If you want to use OAuth2 with gRPC, you must configure TLS for your backend connection as well.
+
 - To use a username and password for authentication, configure the `authentication.basic` section.
 
   ```yaml