feat(otlp): support INSECURE environment variables for gRPC (#3365)

Co-authored-by: Scott Gerring <scottgerring@users.noreply.github.com>
Co-authored-by: Cijo Thomas <cijo.thomas@gmail.com>

Author: 3 people

opentelemetry-otlp/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## vNext
 
+- Add support for INSECURE environment variables for gRPC (env-var-only, no builder method, per spec):
+  `OTEL_EXPORTER_OTLP_INSECURE` (generic), `OTEL_EXPORTER_OTLP_TRACES_INSECURE`,
+  `OTEL_EXPORTER_OTLP_METRICS_INSECURE`, `OTEL_EXPORTER_OTLP_LOGS_INSECURE`.
+  Per the spec, these only apply to gRPC connections. When an endpoint has no explicit scheme,
+  `INSECURE=true` uses `http://`, `INSECURE=false` (default) uses `https://` with auto-TLS.
+  **Breaking:** Schemeless endpoints (e.g., `collector.example.com:4317`) now default to `https://`  
+  instead of being passed as-is. Set `OTEL_EXPORTER_OTLP_INSECURE=true` for plaintext connections.
+  Endpoints with an explicit scheme (e.g., `http://`, `https://`, `unix://`) are unaffected.
+  [#774](https://github.com/open-telemetry/opentelemetry-rust/issues/774)
+  [#984](https://github.com/open-telemetry/opentelemetry-rust/issues/984)
+
 ## 0.32.0
 
 Released 2026-May-08

opentelemetry-otlp/src/exporter/http/logs.rs

@@ -81,6 +81,7 @@ fn handle_partial_success(response_body: &[u8], protocol: Protocol) {
 mod tests {
     use super::*;
 
+    #[cfg(feature = "http-proto")]
     #[test]
     fn test_handle_invalid_protobuf() {
         // Corrupted/invalid protobuf data
@@ -90,6 +91,7 @@ mod tests {
         handle_partial_success(&invalid, Protocol::HttpBinary);
     }
 
+    #[cfg(feature = "http-proto")]
     #[test]
     fn test_handle_empty_response() {
         let empty = vec![];

opentelemetry-otlp/src/exporter/http/metrics.rs

@@ -77,6 +77,7 @@ fn handle_partial_success(response_body: &[u8], protocol: Protocol) {
 mod tests {
     use super::*;
 
+    #[cfg(feature = "http-proto")]
     #[test]
     fn test_handle_invalid_protobuf() {
         // Corrupted/invalid protobuf data
@@ -86,6 +87,7 @@ mod tests {
         handle_partial_success(&invalid, Protocol::HttpBinary);
     }
 
+    #[cfg(feature = "http-proto")]
     #[test]
     fn test_handle_empty_response() {
         let empty = vec![];

opentelemetry-otlp/src/exporter/http/mod.rs

@@ -1131,6 +1131,7 @@ mod tests {
         use opentelemetry_http::{Bytes, HttpClient};
         use std::io::Read;
 
+        #[cfg(feature = "http-proto")]
         #[test]
         fn test_gzip_compression_and_decompression() {
             let client = OtlpHttpClient::new(
@@ -1163,7 +1164,7 @@ mod tests {
             assert_ne!(compressed_body, test_data.to_vec());
         }
 
-        #[cfg(feature = "zstd-http")]
+        #[cfg(all(feature = "http-proto", feature = "zstd-http"))]
         #[test]
         fn test_zstd_compression_and_decompression() {
             let client = OtlpHttpClient::new(
@@ -1194,6 +1195,7 @@ mod tests {
             assert_ne!(compressed_body, test_data.to_vec());
         }
 
+        #[cfg(feature = "http-proto")]
         #[test]
         fn test_no_compression_when_disabled() {
             let client = OtlpHttpClient::new(
@@ -1216,7 +1218,7 @@ mod tests {
             assert_eq!(content_encoding, None);
         }
 
-        #[cfg(not(feature = "gzip-http"))]
+        #[cfg(all(feature = "http-proto", not(feature = "gzip-http")))]
         #[test]
         fn test_gzip_error_when_feature_disabled() {
             let client = OtlpHttpClient::new(
@@ -1240,7 +1242,7 @@ mod tests {
                 .contains("gzip-http feature not enabled"));
         }
 
-        #[cfg(not(feature = "zstd-http"))]
+        #[cfg(all(feature = "http-proto", not(feature = "zstd-http")))]
         #[test]
         fn test_zstd_error_when_feature_disabled() {
             let client = OtlpHttpClient::new(
@@ -1352,7 +1354,7 @@ mod tests {
             }
         }
 
-        #[cfg(feature = "trace")]
+        #[cfg(all(feature = "trace", feature = "http-proto"))]
         #[test]
         fn test_build_trace_export_body_binary_protocol() {
             let client = create_test_client(crate::Protocol::HttpBinary, None);
@@ -1378,7 +1380,7 @@ mod tests {
             assert_eq!(content_encoding, None);
         }
 
-        #[cfg(all(feature = "trace", feature = "gzip-http"))]
+        #[cfg(all(feature = "http-proto", feature = "trace", feature = "gzip-http"))]
         #[test]
         fn test_build_trace_export_body_with_compression() {
             let client =
@@ -1400,7 +1402,7 @@ mod tests {
             LogBatch::new(&[])
         }
 
-        #[cfg(feature = "logs")]
+        #[cfg(all(feature = "http-proto", feature = "logs"))]
         #[test]
         fn test_build_logs_export_body_binary_protocol() {
             let client = create_test_client(crate::Protocol::HttpBinary, None);
@@ -1426,7 +1428,7 @@ mod tests {
             assert_eq!(content_encoding, None);
         }
 
-        #[cfg(all(feature = "logs", feature = "gzip-http"))]
+        #[cfg(all(feature = "http-proto", feature = "logs", feature = "gzip-http"))]
         #[test]
         fn test_build_logs_export_body_with_compression() {
             let client =
@@ -1440,7 +1442,7 @@ mod tests {
             assert_eq!(content_encoding, Some("gzip"));
         }
 
-        #[cfg(feature = "metrics")]
+        #[cfg(all(feature = "http-proto", feature = "metrics"))]
         #[test]
         fn test_build_metrics_export_body_binary_protocol() {
             use opentelemetry_sdk::metrics::data::ResourceMetrics;
@@ -1470,7 +1472,7 @@ mod tests {
             assert_eq!(content_encoding, None);
         }
 
-        #[cfg(all(feature = "metrics", feature = "gzip-http"))]
+        #[cfg(all(feature = "http-proto", feature = "metrics", feature = "gzip-http"))]
         #[test]
         fn test_build_metrics_export_body_with_compression() {
             use opentelemetry_sdk::metrics::data::ResourceMetrics;
@@ -1486,7 +1488,11 @@ mod tests {
             assert_eq!(content_encoding, Some("gzip"));
         }
 
-        #[cfg(all(feature = "metrics", not(feature = "gzip-http")))]
+        #[cfg(all(
+            feature = "http-proto",
+            feature = "metrics",
+            not(feature = "gzip-http")
+        ))]
         #[test]
         fn test_build_metrics_export_body_compression_error_returns_none() {
             use opentelemetry_sdk::metrics::data::ResourceMetrics;
@@ -1574,7 +1580,7 @@ mod tests {
             assert_eq!(retry_policy.jitter_ms, 50);
         }
 
-        #[cfg(feature = "experimental-http-retry")]
+        #[cfg(all(feature = "http-proto", feature = "experimental-http-retry"))]
         #[test]
         fn test_default_retry_policy_when_none_configured() {
             let client = create_test_client(crate::Protocol::HttpBinary, None);
@@ -1586,7 +1592,7 @@ mod tests {
             assert_eq!(client.retry_policy.jitter_ms, 100);
         }
 
-        #[cfg(feature = "experimental-http-retry")]
+        #[cfg(all(feature = "http-proto", feature = "experimental-http-retry"))]
         #[test]
         fn test_custom_retry_policy_used() {
             use crate::retry::RetryPolicy;

opentelemetry-otlp/src/exporter/http/trace.rs

@@ -82,6 +82,7 @@ fn handle_partial_success(response_body: &[u8], protocol: Protocol) {
 mod tests {
     use super::*;
 
+    #[cfg(feature = "http-proto")]
     #[test]
     fn test_handle_invalid_protobuf() {
         // Corrupted/invalid protobuf data
@@ -91,6 +92,7 @@ mod tests {
         handle_partial_success(&invalid, Protocol::HttpBinary);
     }
 
+    #[cfg(feature = "http-proto")]
     #[test]
     fn test_handle_empty_response() {
         let empty = vec![];

opentelemetry-otlp/src/exporter/mod.rs

@@ -38,6 +38,15 @@ pub const OTEL_EXPORTER_OTLP_PROTOCOL_HTTP_JSON: &str = "http/json";
 
 /// Max waiting time for the backend to process each signal batch, defaults to 10 seconds.
 pub const OTEL_EXPORTER_OTLP_TIMEOUT: &str = "OTEL_EXPORTER_OTLP_TIMEOUT";
+
+/// Whether to disable TLS for the exporter's gRPC connection.
+/// Per the [OTLP exporter spec](https://opentelemetry.io/docs/specs/otel/protocol/exporter/#configuration-options),
+/// this only applies to gRPC endpoints that have no explicit scheme; an endpoint
+/// with an explicit scheme is used as-is. HTTP security is determined by the
+/// endpoint URL scheme.
+/// There is intentionally no programmatic builder method — this is env-var-only.
+/// Default: `false` (TLS is used).
+pub const OTEL_EXPORTER_OTLP_INSECURE: &str = "OTEL_EXPORTER_OTLP_INSECURE";
 /// Default max waiting time for the backend to process each signal batch.
 pub const OTEL_EXPORTER_OTLP_TIMEOUT_DEFAULT: Duration = Duration::from_millis(10000);
 
@@ -195,6 +204,26 @@ fn resolve_compression_from_env(
     }
 }
 
+/// Resolve whether the connection should be insecure (no TLS).
+///
+/// Priority:
+/// 1. Signal-specific env var (e.g., `OTEL_EXPORTER_OTLP_TRACES_INSECURE`)
+/// 2. Generic `OTEL_EXPORTER_OTLP_INSECURE`
+/// 3. Default: `false` (secure/TLS)
+///
+/// Values: `"true"` (case-insensitive) = insecure, everything else = secure.
+/// Per the spec, this only applies to gRPC connections.
+#[cfg(feature = "grpc-tonic")]
+pub(crate) fn resolve_insecure(signal_insecure_var: &str) -> bool {
+    let value = std::env::var(signal_insecure_var)
+        .ok()
+        .or_else(|| std::env::var(OTEL_EXPORTER_OTLP_INSECURE).ok());
+    match value {
+        Some(val) => val.eq_ignore_ascii_case("true"),
+        None => false,
+    }
+}
+
 /// Returns the default protocol based on enabled features.
 ///
 /// Note: This does not consult environment variables. Protocol resolution
@@ -417,9 +446,11 @@ mod tests {
     async fn export_builder_error_invalid_grpc_endpoint() {
         use crate::{LogExporter, WithExportConfig};
 
+        // Use a URI with an explicit scheme but malformed host to ensure it
+        // fails URI parsing regardless of INSECURE scheme-prepending logic
         let exporter_result = LogExporter::builder()
             .with_tonic()
-            .with_endpoint("invalid_uri/something")
+            .with_endpoint("http://[invalid")
             .with_timeout(std::time::Duration::from_secs(10))
             .build();
 
@@ -460,7 +491,7 @@ mod tests {
             not(any(feature = "http-proto", feature = "http-json"))
         ))]
         {
-            assert_eq!(crate::exporter::default_protocol(), crate::Protocol::Grpc);
+            assert_eq!(crate::Protocol::default(), crate::Protocol::Grpc);
         }
     }
 
@@ -676,6 +707,21 @@ mod tests {
         );
     }
 
+    #[cfg(all(feature = "grpc-tonic", feature = "trace"))]
+    #[test]
+    fn test_resolve_insecure_signal_overrides_generic() {
+        run_env_test(
+            vec![
+                (crate::OTEL_EXPORTER_OTLP_TRACES_INSECURE, "true"),
+                (super::OTEL_EXPORTER_OTLP_INSECURE, "false"),
+            ],
+            || {
+                let insecure = super::resolve_insecure(crate::OTEL_EXPORTER_OTLP_TRACES_INSECURE);
+                assert!(insecure);
+            },
+        );
+    }
+
     #[cfg(feature = "http-proto")]
     #[test]
     fn test_resolve_protocol_code_overrides_all_envs() {
@@ -696,6 +742,21 @@ mod tests {
         );
     }
 
+    #[cfg(all(feature = "grpc-tonic", feature = "trace"))]
+    #[test]
+    fn test_resolve_insecure_default_is_false() {
+        temp_env::with_vars_unset(
+            [
+                crate::OTEL_EXPORTER_OTLP_TRACES_INSECURE,
+                super::OTEL_EXPORTER_OTLP_INSECURE,
+            ],
+            || {
+                let insecure = super::resolve_insecure(crate::OTEL_EXPORTER_OTLP_TRACES_INSECURE);
+                assert!(!insecure);
+            },
+        );
+    }
+
     #[cfg(all(feature = "grpc-tonic", feature = "http-proto"))]
     #[test]
     fn test_resolve_protocol_falls_back_to_generic_env() {
@@ -716,4 +777,53 @@ mod tests {
             assert_eq!(protocol, Protocol::feature_default());
         });
     }
+
+    #[cfg(all(feature = "grpc-tonic", feature = "trace"))]
+    #[test]
+    fn test_resolve_insecure_case_insensitive() {
+        run_env_test(
+            vec![(crate::OTEL_EXPORTER_OTLP_TRACES_INSECURE, "True")],
+            || {
+                let insecure = super::resolve_insecure(crate::OTEL_EXPORTER_OTLP_TRACES_INSECURE);
+                assert!(insecure);
+            },
+        );
+        run_env_test(
+            vec![(crate::OTEL_EXPORTER_OTLP_TRACES_INSECURE, "TRUE")],
+            || {
+                let insecure = super::resolve_insecure(crate::OTEL_EXPORTER_OTLP_TRACES_INSECURE);
+                assert!(insecure);
+            },
+        );
+    }
+
+    #[cfg(all(feature = "grpc-tonic", feature = "trace"))]
+    #[test]
+    fn test_resolve_insecure_falls_back_to_generic() {
+        temp_env::with_var_unset(crate::OTEL_EXPORTER_OTLP_TRACES_INSECURE, || {
+            run_env_test(vec![(super::OTEL_EXPORTER_OTLP_INSECURE, "true")], || {
+                let insecure = super::resolve_insecure(crate::OTEL_EXPORTER_OTLP_TRACES_INSECURE);
+                assert!(insecure);
+            });
+        });
+    }
+
+    #[cfg(all(feature = "grpc-tonic", feature = "trace"))]
+    #[test]
+    fn test_resolve_insecure_non_true_is_false() {
+        run_env_test(
+            vec![(crate::OTEL_EXPORTER_OTLP_TRACES_INSECURE, "false")],
+            || {
+                let insecure = super::resolve_insecure(crate::OTEL_EXPORTER_OTLP_TRACES_INSECURE);
+                assert!(!insecure);
+            },
+        );
+        run_env_test(
+            vec![(crate::OTEL_EXPORTER_OTLP_TRACES_INSECURE, "invalid")],
+            || {
+                let insecure = super::resolve_insecure(crate::OTEL_EXPORTER_OTLP_TRACES_INSECURE);
+                assert!(!insecure);
+            },
+        );
+    }
 }