[13.1] Use `WithHttpsCertificateConfiguration` to configure tls cert for Otel Collector by afscrome · Pull Request #1058 · CommunityToolkit/Aspire

afscrome · 2025-12-11T19:34:12Z

Closes #981

Use the new WithHttpsCertificateConfiguration apis in 13.1 rather than the previous custom implementation of exporting the dev cert.

Added some telemetry generator resources to the otel collector's playground app to generate some dummy otel, as well as to test telemetry for container --> container.

PR Checklist

Created a feature/dev branch in your fork (vs. submitting directly from a commit on main)
Based off latest main branch of toolkit
PR doesn't include merge commits (always rebase on top of our main, if needed)
Code follows all style conventions

Other information

martinjt

I don't think we need the TelemetryGen as part of this change.

afscrome · 2025-12-15T21:18:05Z

I'll see what I can do tomorrow - reason I added telemetry generator is that I needed something that generated container from a container as I wanted to make sure the cert was being trusted both in host --> container scenarios
(as was already covered by the playground project) and container --> container scenarios

Copilot

Pull request overview

This PR modernizes the OpenTelemetry Collector integration by adopting Aspire 13.1's new WithHttpsCertificateConfiguration API for TLS certificate management, replacing a custom dev certificate export implementation. The change simplifies the codebase by leveraging built-in Aspire functionality.

Replaced custom dev certificate export logic with WithHttpsCertificateConfiguration API
Removed DevCertHostingExtensions.cs shared utility file and associated tests
Enhanced the example app with telemetry generators to demonstrate container-to-container communication

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
src/CommunityToolkit.Aspire.Hosting.OpenTelemetryCollector/OpenTelemetryCollectorExtensions.cs	Refactored certificate configuration to use new Aspire 13.1 API instead of custom implementation
src/CommunityToolkit.Aspire.Hosting.OpenTelemetryCollector/CommunityToolkit.Aspire.Hosting.OpenTelemetryCollector.csproj	Removed reference to shared DevCertHostingExtensions.cs file
src/Shared/DevCertHostingExtensions.cs	Deleted entire custom dev certificate hosting extensions utility
tests/CommunityToolkit.Aspire.Hosting.OpenTelemetryCollector.Tests/ResourceCreationTests.cs	Removed tests specific to custom dev certificate export implementation
examples/opentelemetry-collector/CommunityToolkit.Aspire.Hosting.OpenTelemetryCollector.AppHost/AppHost.cs	Added telemetry generator containers to demonstrate collector functionality

Copilot · 2025-12-15T21:28:53Z

+            var scheme = useHttpsForRecievers ? "https" : "http";
+            resourceBuilder.WithEndpoint(targetPort: port, name: protocol, scheme: scheme);
+
+            if (!useHttpsForRecievers)


The variable name has a spelling error: "Recievers" should be "Receivers" (the 'i' and 'e' are transposed).

Copilot · 2025-12-15T21:28:54Z

+        .WithArgs(signal,
+            "--duration", "inf",
+            "--otlp-endpoint", collector.GetEndpoint("grpc").Property(EndpointProperty.HostAndPort))
+        .WithArgs(args)


The variable args is not defined in the scope of the AddTelemetryGenerator method. This appears to be a bug as it references the command-line arguments from the Main method which are not accessible here. This line should likely be removed since the necessary arguments are already added on lines 21-23.

Suggested change

.WithArgs(args)

Copilot · 2025-12-15T21:28:54Z

-        if (!settings.ForceNonSecureReceiver && isHttpsEnabled && builder.ExecutionContext.IsRunMode)
-        {
-            resourceBuilder.RunWithHttpsDevCertificate();
+        var useHttpsForRecievers = !settings.ForceNonSecureReceiver && url.StartsWith("https", StringComparison.OrdinalIgnoreCase);


The variable name has a spelling error: "Recievers" should be "Receivers" (the 'i' and 'e' are transposed).

Copilot · 2025-12-15T21:28:55Z

+
+        void ConfigureReceiver(int port, string protocol)
+        {
+            var scheme = useHttpsForRecievers ? "https" : "http";


The variable name has a spelling error: "Recievers" should be "Receivers" (the 'i' and 'e' are transposed).

Copilot · 2025-12-15T21:28:55Z

+                ctx.Arguments.Add(ReferenceExpression.Create($@"--config=yaml:receivers::otlp::protocols::{protocol}::tls::cert_file: ""{ctx.CertificatePath}"""));
+                ctx.Arguments.Add(ReferenceExpression.Create($@"--config=yaml:receivers::otlp::protocols::{protocol}::tls::key_file: ""{ctx.KeyPath}"""));


Default 'ToString()': ReferenceExpression inherits 'ToString()' from 'Object', and so is not suitable for printing.

Suggested change

ctx.Arguments.Add(ReferenceExpression.Create($@"--config=yaml:receivers::otlp::protocols::{protocol}::tls::cert_file: ""{ctx.CertificatePath}"""));

ctx.Arguments.Add(ReferenceExpression.Create($@"--config=yaml:receivers::otlp::protocols::{protocol}::tls::key_file: ""{ctx.KeyPath}"""));

ctx.Arguments.Add($@"--config=yaml:receivers::otlp::protocols::{protocol}::tls::cert_file: ""{ctx.CertificatePath}""");

ctx.Arguments.Add($@"--config=yaml:receivers::otlp::protocols::{protocol}::tls::key_file: ""{ctx.KeyPath}""");

ReferenceExpression is absolutely required here as certificate and key paths cannot be resolve until after the app host starts.

Copilot · 2025-12-15T21:28:55Z

+                ctx.Arguments.Add(ReferenceExpression.Create($@"--config=yaml:receivers::otlp::protocols::{protocol}::tls::cert_file: ""{ctx.CertificatePath}"""));
+                ctx.Arguments.Add(ReferenceExpression.Create($@"--config=yaml:receivers::otlp::protocols::{protocol}::tls::key_file: ""{ctx.KeyPath}"""));


Default 'ToString()': ReferenceExpression inherits 'ToString()' from 'Object', and so is not suitable for printing.

Suggested change

ctx.Arguments.Add(ReferenceExpression.Create($@"--config=yaml:receivers::otlp::protocols::{protocol}::tls::cert_file: ""{ctx.CertificatePath}"""));

ctx.Arguments.Add(ReferenceExpression.Create($@"--config=yaml:receivers::otlp::protocols::{protocol}::tls::key_file: ""{ctx.KeyPath}"""));

ctx.Arguments.Add($@"--config=yaml:receivers::otlp::protocols::{protocol}::tls::cert_file: ""{ctx.CertificatePath}""");

ctx.Arguments.Add($@"--config=yaml:receivers::otlp::protocols::{protocol}::tls::key_file: ""{ctx.KeyPath}""");

ReferenceExpression is absolutely required here as certificate and key paths cannot be resolve until after the app host starts.

Use the new `WithHttpsCertificateConfiguration` apis in 13.1 rather than the previous custom implementation of exporting the dev cert.

afscrome · 2026-01-05T17:13:27Z

@aaronpowell Can you reopen this. @martinjt Do you mind re-reviewing?

martinjt · 2026-01-12T13:00:27Z

The only question I have is how this will work for people using the latest CommunityToolkit against not .NET 10, and whether that will actually break things now.

…nTelemetryCollectorExtensions.cs Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

afscrome · 2026-01-13T22:49:11Z

Everything should work the same way. dotnet runtime version doesn't matter. All that matters is whether you have a dev cert available. If one is available, it will will be injected. (And as the dashboard defaults to https, you likely do have a dev cert avaialble)

If your dev cert is not version 3 or higher (produced by .net 9 sdk or higher), then the cert will be injected, but it won't be trusted as the cert won't contain host.docker.internal.
If the aspire tunnel is enabled and your cert is not version 4 or higher (produced by .net 10 sdk), the cert will be set up, but apps likely won't trust it as the cert won't contain *.dev.localhost and *.dev.internal.

But these two scenarios aren't really any different from the existing implementation which would also have injected the dev cert, but apps may not have ended up trusting it.

afscrome requested a review from martinjt as a code owner December 11, 2025 19:34

afscrome changed the title ~~Use WithHttpsCertificateConfiguration to configure tls cert for the…~~ [13.1] Use WithHttpsCertificateConfiguration to configure tls cert for Otel Collector Dec 11, 2025

martinjt requested changes Dec 15, 2025

View reviewed changes

Copilot AI review requested due to automatic review settings December 15, 2025 21:18

Copilot started reviewing on behalf of afscrome December 15, 2025 21:18 View session

Copilot AI reviewed Dec 15, 2025

View reviewed changes

Use the new WithHttpsCertificateConfiguration apis for Otel Collector

163148e

Use the new `WithHttpsCertificateConfiguration` apis in 13.1 rather than the previous custom implementation of exporting the dev cert.

afscrome force-pushed the otel-tls-injection2 branch from 04e47c4 to 163148e Compare December 17, 2025 22:30

github-actions Bot added the Stale label Dec 23, 2025

github-actions Bot closed this Dec 26, 2025

aaronpowell reopened this Jan 12, 2026

aaronpowell removed the Stale label Jan 12, 2026

Update src/CommunityToolkit.Aspire.Hosting.OpenTelemetryCollector/Ope…

2a294da

…nTelemetryCollectorExtensions.cs Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

aaronpowell deleted the branch CommunityToolkit:aspire-13.1 January 14, 2026 04:35

aaronpowell closed this Jan 14, 2026

afscrome mentioned this pull request Jan 20, 2026

Use WithHttpsCertificateConfiguration to configure tls cert for Otel Collector #1115

Merged

6 tasks

		ctx.Arguments.Add(ReferenceExpression.Create($@"--config=yaml:receivers::otlp::protocols::{protocol}::tls::cert_file: ""{ctx.CertificatePath}"""));
		ctx.Arguments.Add(ReferenceExpression.Create($@"--config=yaml:receivers::otlp::protocols::{protocol}::tls::key_file: ""{ctx.KeyPath}"""));

Conversation

afscrome commented Dec 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Checklist

Other information

Uh oh!

martinjt left a comment

Choose a reason for hiding this comment

Uh oh!

afscrome commented Dec 15, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

afscrome Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

afscrome Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

afscrome commented Jan 5, 2026

Uh oh!

martinjt commented Jan 12, 2026

Uh oh!

afscrome commented Jan 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

afscrome commented Dec 11, 2025 •

edited

Loading