Add telemetry-to-caas kind for CaaS (Collector as a Service) support by vkozyura · Pull Request #436 · cap-js/telemetry

vkozyura · 2026-06-22T14:15:38Z

Add telemetry-to-caas kind definition in package.json
Add getCredsForCaaS() to extract credentials from caas-service binding
Add augmentCaaSCreds() to configure OTLP endpoint URL
Handle CaaS in tracing and metrics exporters

Note: CaaS requires mTLS authentication with SAP-signed certificates. The certificate must be obtained separately via BTP Certificate Service.

- Add telemetry-to-caas kind definition in package.json - Add getCredsForCaaS() to extract credentials from caas-service binding - Add augmentCaaSCreds() to configure OTLP endpoint URL - Handle CaaS in tracing and metrics exporters Note: CaaS requires mTLS authentication with SAP-signed certificates. The certificate must be obtained separately via BTP Certificate Service.

hyperspace-pr-bot

The PR is generally well-structured, but has one logic bug: when only a gRPC OTLP endpoint is present in the CaaS binding, credentials.url is set to undefined (the falsy http value), silently breaking the exporter. Please address the flagged issues before merging.

PR Bot Information

Version: 1.26.5

Event Trigger: pull_request.opened
LLM: anthropic--claude-4.6-sonnet
Correlation ID: be7942dc-b11a-457c-a83d-2aafac5eb2c3
File Content Strategy: Full file content

This file should not be committed to the feature branch.

hyperspace-pr-bot · 2026-06-30T12:41:37Z

Summary

The following content is AI-generated and provides a summary of the pull request:

Add `telemetry-to-caas` Kind for CaaS (Collector as a Service) Support

New Features

✨ Introduces a new telemetry-to-caas predefined kind that enables exporting traces and metrics to CaaS (Collector as a Service) — a managed OpenTelemetry Collector that can route telemetry to downstream backends like SAP Cloud Logging. The integration uses OTLP HTTP/protobuf and supports mTLS authentication with SAP-signed certificates.

Changes

package.json: Added the telemetry-to-caas kind definition with caas-service VCAP binding label, mtls_service_pattern default (caas-mtls|caas-cert), and OTLP protobuf exporters for both traces and metrics.
lib/utils.js: Added getCredsForCaaSMtls() to locate mTLS credentials from a user-provided VCAP service matching the configured pattern, and augmentCaaSCreds() to extract the OTLP HTTP endpoint and configure httpAgentOptions (cert/key) for mTLS. Both functions are exported.
lib/tracing/index.js: Imported augmentCaaSCreds and added a to-caas handler that applies CaaS credentials, sets OTEL_EXPORTER_OTLP_ENDPOINT, and configures the trace exporter URL (/v1/traces) with mTLS agent options.
lib/metrics/index.js: Imported augmentCaaSCreds and added a to-caas handler that applies CaaS credentials, sets OTEL_EXPORTER_OTLP_ENDPOINT, and configures the metrics exporter URL (/v1/metrics) with mTLS agent options.
README.md: Added telemetry-to-caas to the table of contents, updated predefined kinds count to six, and added a dedicated section documenting setup steps including mTLS certificate binding and user-provided service configuration.
CHANGELOG.md: Added entry for telemetry-to-caas kind support.
test/caas.test.js: Added unit tests for augmentCaaSCreds covering URL extraction, mTLS option setup, error on missing OTLP endpoint, idempotency guard, and missing mTLS credentials scenario.

🔄 Regenerate and Update Summary
✏️ Insert as PR Description (deletes this comment)
🗑️ Delete comment

PR Bot Information

Version: 1.26.11

Event Trigger: pull_request.ready_for_review
Output Template: Default Template
Correlation ID: 66d6ae55-ae8a-46ec-9f81-f076100fcf4a
LLM: anthropic--claude-4.6-sonnet
Summary Prompt: Default Prompt
File Content Strategy: Full file content

hyperspace-pr-bot

The PR adds the telemetry-to-caas kind with reasonable structure, but there are several correctness issues that need attention: the shared OTEL_EXPORTER_OTLP_ENDPOINT env var is clobbered by both signal exporters (traces and metrics overwrite each other), invalid base64 mTLS data is silently accepted before failing at TLS handshake time, and an unsanitised user-provided regex pattern can crash the process at startup.

PR Bot Information

Version: 1.26.11

LLM: anthropic--claude-4.6-sonnet
Event Trigger: pull_request.ready_for_review
Correlation ID: 66d6ae55-ae8a-46ec-9f81-f076100fcf4a
File Content Strategy: Full file content

sjvans · 2026-08-06T13:26:24Z

+    // Set OTLP env vars to binding credentials (prevents stale env values from taking precedence)
+    process.env.OTEL_EXPORTER_OTLP_ENDPOINT = credentials.baseUrl


Suggested change

// Set OTLP env vars to binding credentials (prevents stale env values from taking precedence)

process.env.OTEL_EXPORTER_OTLP_ENDPOINT = credentials.baseUrl

they should take precedence and should not be altered

@sjvans: The forced override is intentional for certificate renewal. During renewal the CaaS service is unbound/rebound and the app is restaged. After cf restage, stale OTEL_EXPORTER_OTLP_ENDPOINT values can persist in the environment while the binding credentials contain the current correct endpoint. Without forcing the binding value, the app would use the stale endpoint, causing connection failures with the renewed certificates.

@sjvans: I tested certificate renewal as described in https://github.tools.sap/D051920/test_caas/blob/main/assets/CLI_GUIDE.md. It works also without this assignment above. Suggested changes are applied.

sjvans · 2026-08-06T13:28:10Z

+    // Set OTLP env vars to binding credentials (prevents stale env values from taking precedence)
+    process.env.OTEL_EXPORTER_OTLP_ENDPOINT = credentials.baseUrl


Suggested change

// Set OTLP env vars to binding credentials (prevents stale env values from taking precedence)

process.env.OTEL_EXPORTER_OTLP_ENDPOINT = credentials.baseUrl

@sjvans: same as above

sjvans · 2026-08-06T13:28:37Z

+    // Set OTLP env vars to binding credentials (prevents stale env values from taking precedence)
+    process.env.OTEL_EXPORTER_OTLP_ENDPOINT = credentials.baseUrl


Suggested change

// Set OTLP env vars to binding credentials (prevents stale env values from taking precedence)

process.env.OTEL_EXPORTER_OTLP_ENDPOINT = credentials.baseUrl

@sjvans: same as above

sjvans · 2026-08-06T13:30:37Z

+  // Also set url for backwards compatibility (without path - exporter will append it)
+  credentials.url = credentials.otlp.http


who needs this backwards compat?

sjvans · 2026-08-06T13:43:11Z

+
+  // Check for mTLS credentials (cert + key) in user-provided service
+  const mtlsCreds = getCredsForCaaSMtls()
+  if (mtlsCreds && mtlsCreds.cert && mtlsCreds.key) {


Suggested change

if (mtlsCreds && mtlsCreds.cert && mtlsCreds.key) {

if (mtlsCreds) {

mtlsCreds is only truthy if cert and key were available in getCredsForCaaSMtls

sjvans · 2026-08-06T13:44:52Z

+      LOG._error && LOG.error('Failed to configure CaaS mTLS:', err.message)
+    }
+  } else {
+    LOG._warn && LOG.warn('CaaS requires mTLS authentication. No mTLS credentials found. Bind a user-provided service with cert and key (base64 encoded).')


outdated warning text

sjvans · 2026-08-06T13:48:20Z

+1. **Bind the CaaS service** to your app with subject/issuer configuration:
+```yaml
+# mta.yaml
+requires:
+  - name: my-caas-instance
+    parameters:
+      config:
+        subject: "CN=my-app,..."
+        issuer: "CN=SAP PKI Certificate Service Client CA,..."
+```
+
+2. **Obtain and bind mTLS credentials** via a user-provided service containing `cert` and `key` (base64 encoded):
+```bash
+cf create-user-provided-service caas-mtls-creds -p '{"cert":"<base64>","key":"<base64>"}'
+cf bind-service my-app caas-mtls-creds
+```
+
+The mTLS certificate must be created (e.g., via `openssl`) and signed through SAP BTP Certificate Service. The certificate must be renewed periodically (typically every 7 days).
+
+> Note: The user-provided service name must match the pattern configured in `mtls_service_pattern` (default: `caas-mtls|caas-cert`).


Co-authored-by: sjvans <30337871+sjvans@users.noreply.github.com>

vkozyura marked this pull request as draft June 22, 2026 14:15

vkozyura had a problem deploying to hana June 22, 2026 14:15 — with GitHub Actions Failure

hyperspace-pr-bot Bot reviewed Jun 22, 2026

View reviewed changes

Comment thread lib/utils.js Outdated

Comment thread lib/utils.js

Comment thread lib/tracing/index.js Outdated

Add certificate-service detection for CaaS mTLS

79eaadc

vkozyura had a problem deploying to hana June 22, 2026 14:32 — with GitHub Actions Failure

Add mTLS support for CaaS via caas-mtls-creds user-provided service

12223ce

vkozyura had a problem deploying to hana June 22, 2026 15:04 — with GitHub Actions Failure

Fix mTLS config - use httpAgentOptions

2da163c

vkozyura had a problem deploying to hana June 22, 2026 15:08 — with GitHub Actions Failure

Monkey-patch https.request for CaaS mTLS

46b0129

vkozyura had a problem deploying to hana June 22, 2026 15:14 — with GitHub Actions Failure

github-advanced-security AI found potential problems Jun 22, 2026

View reviewed changes

Comment thread lib/utils.js Fixed

Comment thread lib/utils.js Fixed

Comment thread lib/utils.js Fixed

Remove package-lock.json from tracking

a10eb6b

This file should not be committed to the feature branch.

vkozyura had a problem deploying to hana June 22, 2026 16:08 — with GitHub Actions Failure

vkozyura had a problem deploying to hana June 23, 2026 06:52 — with GitHub Actions Failure

vkozyura and others added 5 commits June 30, 2026 12:15

Merge branch 'main' into feature/caas-support

d592028

rem hard-coded names and debug logs

7aca1b4

fix env vars

a3d0f5e

add readme, changelog and test

00c635d

small fix

e4dbdf6

vkozyura marked this pull request as ready for review June 30, 2026 12:41

vkozyura requested a review from sjvans June 30, 2026 12:41

hyperspace-pr-bot Bot reviewed Jun 30, 2026

View reviewed changes

Comment thread lib/utils.js

Comment thread lib/tracing/index.js Outdated

Comment thread lib/metrics/index.js Outdated

Comment thread lib/utils.js Outdated

Comment thread lib/utils.js Outdated

vkozyura added 4 commits July 21, 2026 16:26

use cds.env.requires.telemetry.x509 for certificate

11efddb

add logging

8d2eb24

add tracing to package.json

7c02946

fix test

e74ef96

sjvans requested changes Aug 6, 2026

View reviewed changes

vkozyura and others added 12 commits August 17, 2026 12:09

Merge branch 'main' into feature/caas-support

a7cfae0

Update lib/tracing/index.js

67a1488

Co-authored-by: sjvans <30337871+sjvans@users.noreply.github.com>

Update lib/metrics/index.js

566a6bb

Co-authored-by: sjvans <30337871+sjvans@users.noreply.github.com>

Update lib/logging/index.js

f7e4e68

Co-authored-by: sjvans <30337871+sjvans@users.noreply.github.com>

Update lib/utils.js

4c8624e

Co-authored-by: sjvans <30337871+sjvans@users.noreply.github.com>

remove backwars compat for credentials

51cd815

simplify mtlsCreds check

6e883e2

update warning

a86df66

readme

7a39ade

testing certificate renewal w/o re-assigning env vars

e5bff75

fix test

9967e8c

fix if no logging lib

0e61476

		// Set OTLP env vars to binding credentials (prevents stale env values from taking precedence)
		process.env.OTEL_EXPORTER_OTLP_ENDPOINT = credentials.baseUrl

		// Also set url for backwards compatibility (without path - exporter will append it)
		credentials.url = credentials.otlp.http

	if (mtlsCreds && mtlsCreds.cert && mtlsCreds.key) {
	if (mtlsCreds) {

Uh oh!

Conversation

vkozyura commented Jun 22, 2026

Uh oh!

hyperspace-pr-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hyperspace-pr-bot Bot commented Jun 30, 2026

Summary

Add telemetry-to-caas Kind for CaaS (Collector as a Service) Support

New Features

Changes

Uh oh!

hyperspace-pr-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Add `telemetry-to-caas` Kind for CaaS (Collector as a Service) Support