Skip to content

Add initial audit logging pipeline (API, SDK, OTLP exporter, and autoconfigure)#7

Open
hilmarf wants to merge 38 commits into
mainfrom
auditing
Open

Add initial audit logging pipeline (API, SDK, OTLP exporter, and autoconfigure)#7
hilmarf wants to merge 38 commits into
mainfrom
auditing

Conversation

@hilmarf

@hilmarf hilmarf commented Apr 28, 2026

Copy link
Copy Markdown
Member

Summary

This PR introduces an initial end-to-end audit logging pipeline for OpenTelemetry Java, including new API and SDK modules, OTLP HTTP export support, and autoconfiguration wiring.

What changed

  • Added a new Audit API module with core audit types and contracts, including:
    • provider and global provider access
    • logger and logger builder
    • audit record builder and receipt model
    • actor/outcome semantics and delivery exception handling
  • Added a new Audit SDK module with runtime implementation, including:
    • SDK audit provider and logger implementations
    • read/write record model
    • exporter and processor contracts
    • processor implementations (simple, batch, multi, noop)
    • in-memory exporter for testing scenarios
  • Added a new OTLP HTTP audit exporter module:
    • OTLP audit record data adapter
    • HTTP exporter and builder for audit records
  • Added autoconfigure integration for audit:
    • audit provider configuration bootstrap
    • audit exporter selection and SPI loading
    • new SPI interface for configurable audit exporters
  • Wired new modules into the build:
    • included new projects in settings
    • added audit SDK to the sdk aggregate module
  • Added a GitHub workflow for fork synchronization:
    • sync-fork.yaml

Configuration behavior

  • New property: otel.audit.exporter
  • Default exporter: otlp
  • Special value: none (disables audit exporting)
  • Validation: configuration fails if none is combined with other exporters or if an unknown exporter name is configured

Why

This lays the foundation for first-class audit logging support in OpenTelemetry Java with:

  • clear API/SDK separation
  • pluggable exporter model
  • out-of-the-box OTLP export path
  • autoconfigure-based runtime setup

Notes

  • This change is primarily additive and introduces new modules and integration points.
  • No existing tracing/metrics/logging APIs are replaced by this PR.

@apeirora-bot

apeirora-bot Bot commented Jun 9, 2026

Copy link
Copy Markdown

⚠️ API changes detected — additional maintainer review required

@jack-berg @jkwatson

This PR modifies the public API surface area of the following module(s):

  • opentelemetry-api
  • opentelemetry-common
  • opentelemetry-context
  • opentelemetry-exporter-common
  • opentelemetry-exporter-logging
  • opentelemetry-exporter-logging-otlp
  • opentelemetry-exporter-zipkin
  • opentelemetry-extension-kotlin
  • opentelemetry-extension-trace-propagators
  • opentelemetry-opentracing-shim
  • opentelemetry-sdk
  • opentelemetry-sdk-extension-autoconfigure-spi

Please review the changes in docs/apidiffs/current_vs_latest/ carefully before approving.

@hilmarf hilmarf moved this from Backlog to In progress in OTel-Audit-Logging Jun 9, 2026
hilmarf added 10 commits June 10, 2026 14:52
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
#9)

* Add REUSE compliance: LICENSES/, .reuse/dep5, and fix invalid SPDX expressions

- Add LICENSES/Apache-2.0.txt (copy of LICENSE) as required by REUSE spec
- Add .reuse/dep5 to provide copyright/license info for files without inline headers
- Fix invalid SPDX expressions in OtelImplJavadocTest and OtelInternalJavadocTest
  by wrapping embedded SPDX-License-Identifier strings in REUSE-IgnoreStart/End
  comments to prevent the REUSE linter from treating test fixture content as
  actual license declarations

* reuse convert-dep5

Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>

---------

Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
eu.apeirora.opentelemetry → io.opentelemetry

Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
hilmarf added 9 commits June 10, 2026 14:54
- API
- SDK
- OTLP exporter
- autoconfigure

Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
…ld config

- Add unit tests for SdkAuditProvider, SimpleAuditRecordProcessor,
  BatchAuditRecordProcessor, and AuditLogRecordDataAdapter
- Fix OtlpHttpAuditRecordExporter/Builder to use otlp.internal HTTP classes
  instead of removed exporter.internal.http package
- Fix Checkstyle import order in SimpleAuditRecordProcessorTest
- Update build.gradle.kts dependencies for audit exporter tests
- Refresh apidiffs to compare against 1.63.0 baseline
- Disable Gradle parallel/caching/config-cache for reproducible local builds

Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
@hilmarf hilmarf force-pushed the main branch 2 times, most recently from 6e99b21 to e768afa Compare June 10, 2026 15:15
hilmarf and others added 16 commits June 10, 2026 18:31
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
…est (open-telemetry#8460)

Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
…8466)

Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
notes

Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
AuditRecordData extends LogRecordData. AutoValue generates constructor
parameters for all abstract (non-default) getter methods. The previous
code passed arguments in the wrong order and included fields (body,
InstrumentationScopeInfo, etc.) that AutoValue did not expect.

- Add default implementations in AuditRecordData for LogRecordData
  fields not applicable to audit: InstrumentationScopeInfo, SpanContext,
  Severity, SeverityText, Body, TotalAttributeCount
- Declare getEventName() abstract in AuditRecordData so AutoValue
  generates a field for it
- Fix argument order in SdkAuditRecordData.create() and
  SdkReadWriteAuditRecord.toAuditRecordData() to match AutoValue order
- Remove unused body field from SdkReadWriteAuditRecord; setBody() in
  SdkAuditRecordBuilder is now a no-op per spec (body travels via
  AuditRecordData.getBodyValue() default)
- Update tests to use combined API methods setActor(), setTarget(),
  setSource() instead of the removed individual setActorId() etc.

Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
@CLAassistant

CLAassistant commented Jun 10, 2026

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 3 committers have signed the CLA.

✅ hilmarf
❌ jaydeluca
❌ jack-berg
You have signed the CLA already but the status is still pending? Let us recheck it.

@jkwatson

Copy link
Copy Markdown

I think you probably don't want to be running all of the core github actions on your fork....

Signed-off-by: Hilmar Falkenberg <hilmar.falkenberg@sap.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: In progress

Development

Successfully merging this pull request may close these issues.

5 participants