[Configuration] Redact OTLP header configs in telemetry#8763
Open
bm1549 wants to merge 3 commits into
Open
Conversation
bm1549
added
the
AI Generated
This comment has been minimized.
This comment has been minimized.
BenchmarksBenchmark execution time: 2026-06-17 02:13:15 Comparing candidate commit 96d2e66 in PR branch Found 0 performance improvements and 0 performance regressions! Performance is the same for 72 metrics, 0 unstable metrics, 60 known flaky benchmarks, 66 flaky benchmarks without significant changes.
|
Execution-Time Benchmarks Report ⏱️Execution-time results for samples comparing This PR (8763) and master. ✅ No regressions detected - check the details below Full Metrics ComparisonFakeDbCommand
HttpMessageHandler
Comparison explanationExecution-time benchmarks measure the whole time it takes to execute a program, and are intended to measure the one-off costs. Cases where the execution time results for the PR are worse than latest master results are highlighted in **red**. The following thresholds were used for comparing the execution times:
Note that these results are based on a single point-in-time result for each branch. For full results, see the dashboard. Graphs show the p99 interval based on the mean and StdDev of the test run, as well as the mean value of the run (shown as a diamond below the graph). Duration chartsFakeDbCommand (.NET Framework 4.8)gantt
title Execution time (ms) FakeDbCommand (.NET Framework 4.8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8763) - mean (75ms) : 72, 79
master - mean (74ms) : 71, 78
section Bailout
This PR (8763) - mean (79ms) : 76, 81
master - mean (77ms) : 75, 80
section CallTarget+Inlining+NGEN
This PR (8763) - mean (1,099ms) : 1054, 1145
master - mean (1,102ms) : 1050, 1153
FakeDbCommand (.NET Core 3.1)gantt
title Execution time (ms) FakeDbCommand (.NET Core 3.1)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8763) - mean (117ms) : 111, 124
master - mean (116ms) : 110, 122
section Bailout
This PR (8763) - mean (116ms) : 113, 119
master - mean (115ms) : 111, 119
section CallTarget+Inlining+NGEN
This PR (8763) - mean (795ms) : 772, 818
master - mean (795ms) : 765, 824
FakeDbCommand (.NET 6)gantt
title Execution time (ms) FakeDbCommand (.NET 6)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8763) - mean (101ms) : 98, 104
master - mean (104ms) : 99, 109
section Bailout
This PR (8763) - mean (104ms) : 100, 109
master - mean (104ms) : 100, 109
section CallTarget+Inlining+NGEN
This PR (8763) - mean (954ms) : 900, 1008
master - mean (952ms) : 912, 992
FakeDbCommand (.NET 8)gantt
title Execution time (ms) FakeDbCommand (.NET 8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8763) - mean (99ms) : 96, 103
master - mean (100ms) : 97, 102
section Bailout
This PR (8763) - mean (101ms) : 97, 104
master - mean (103ms) : 99, 107
section CallTarget+Inlining+NGEN
This PR (8763) - mean (829ms) : 785, 872
master - mean (823ms) : 779, 868
HttpMessageHandler (.NET Framework 4.8)gantt
title Execution time (ms) HttpMessageHandler (.NET Framework 4.8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8763) - mean (200ms) : 195, 205
master - mean (201ms) : 195, 207
section Bailout
This PR (8763) - mean (205ms) : 199, 210
master - mean (204ms) : 196, 211
section CallTarget+Inlining+NGEN
This PR (8763) - mean (1,203ms) : 1150, 1257
master - mean (1,197ms) : 1153, 1241
HttpMessageHandler (.NET Core 3.1)gantt
title Execution time (ms) HttpMessageHandler (.NET Core 3.1)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8763) - mean (288ms) : 282, 295
master - mean (284ms) : 276, 291
section Bailout
This PR (8763) - mean (289ms) : 284, 294
master - mean (285ms) : 278, 291
section CallTarget+Inlining+NGEN
This PR (8763) - mean (967ms) : 933, 1000
master - mean (963ms) : 934, 993
HttpMessageHandler (.NET 6)gantt
title Execution time (ms) HttpMessageHandler (.NET 6)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8763) - mean (280ms) : 275, 286
master - mean (279ms) : 270, 288
section Bailout
This PR (8763) - mean (281ms) : 276, 286
master - mean (278ms) : 273, 284
section CallTarget+Inlining+NGEN
This PR (8763) - mean (1,165ms) : 1125, 1205
master - mean (1,157ms) : 1124, 1191
HttpMessageHandler (.NET 8)gantt
title Execution time (ms) HttpMessageHandler (.NET 8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8763) - mean (278ms) : 270, 286
master - mean (277ms) : 268, 285
section Bailout
This PR (8763) - mean (279ms) : 273, 286
master - mean (276ms) : 269, 284
section CallTarget+Inlining+NGEN
This PR (8763) - mean (1,042ms) : 996, 1088
master - mean (1,038ms) : 1000, 1077
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
bm1549
force-pushed
the
brian.marks/omit-sensitive-config-telemetry
branch
from
d3df1fa to
ca91b50
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ca91b501da
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| /// <param name="recordValue">If <c>true</c> the value should be recorded in telemetry. If not, the source value should be redacted</param> | ||
| /// <returns>The value of the setting, or <c>null</c> if not found.</returns> | ||
| ConfigurationResult<IDictionary<string, string>> GetDictionary(string key, IConfigurationTelemetry telemetry, Func<IDictionary<string, string>, bool>? validator, bool allowOptionalMappings, char separator); | ||
| ConfigurationResult<IDictionary<string, string>> GetDictionary(string key, IConfigurationTelemetry telemetry, Func<IDictionary<string, string>, bool>? validator, bool allowOptionalMappings, char separator, bool recordValue = true); |
There was a problem hiding this comment.
Because IConfigurationSource is public, changing this member's CLR signature from five arguments to six is a binary breaking change: an external custom configuration source or caller compiled against the previous GetDictionary(..., bool, char) member can fail with TypeLoadException/MissingMethodException when run with this assembly, even though the new recordValue parameter is optional in source. Preserve the existing member and add redaction via a separate overload/internal helper so older binaries still bind.
Useful? React with 👍 / 👎.
andrewlock
reviewed
Jun 10, 2026
| @@ -280,7 +280,7 @@ not null when string.Equals(x, "http/json", StringComparison.OrdinalIgnoreCase) | |||
|
|
|||
| OtlpMetricsHeaders = config | |||
Member
There was a problem hiding this comment.
ooooh no, just spotted that we are extracting the OtlpMetricsHeaders values as two different types - a string and a dictionary?! We should almost certainly consolidate those - these shouldn't exist on both exporter settings and TracerSettings...
…lemetry Redact the OTEL_EXPORTER_OTLP_HEADERS family (base, METRICS, TRACES, LOGS) in instrumentation configuration telemetry. The values are now recorded as <redacted> in the configuration array of app-started and app-client-configuration-change events. - Switch the OTLP header reads in ExporterSettings to AsRedactedString(). - Add AsRedactedDictionaryResult and thread a recordValue flag through the dictionary configuration sources so the OTLP metrics/logs header reads in TracerSettings are recorded as redacted. - Mark the four OTLP header variants with sensitive: true in supported-configurations.yaml and accept the attribute in the YAML reader. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… flag Capture the `sensitive` flag from supported-configurations.yaml through the source generator and emit a generated ConfigurationKeys.SensitiveKeys set (keys plus their aliases). ConfigurationTelemetry.Record gates recordValue on this set so a sensitive config's value is redacted regardless of the call site. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
bm1549
force-pushed
the
brian.marks/omit-sensitive-config-telemetry
branch
from
9bbc976 to
fa2afe1
Compare
After rebasing onto master (which added scope to ConfigurationEntry), the Aliases property changed type from string[]? to EquatableArray<string>. Call .AsArray() to convert when constructing ConfigEntry. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary of changes
Renders the OTLP exporter header configurations (
OTEL_EXPORTER_OTLP_HEADERS,OTEL_EXPORTER_OTLP_TRACES_HEADERS,OTEL_EXPORTER_OTLP_METRICS_HEADERS,OTEL_EXPORTER_OTLP_LOGS_HEADERS) as<redacted>in configuration telemetry.Reason for change
These configurations should not be included in configuration telemetry.
Implementation details
The reads use
AsRedactedString()/AsRedactedDictionaryResult(), and the four variants are markedsensitive: trueinsupported-configurations.yaml.Test coverage
Telemetry-level unit tests covering the redacted reads.
Other details
None.