Skip to content

fix(opamp): omit fluentforward receiver when collector auth is enforced #3547

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
CG-5228 wants to merge 1 commit into from
+56 −5
Closed

fix(opamp): omit fluentforward receiver when collector auth is enforced #3547

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .changeset/disable-fluentforward-when-auth-enforced.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
"@hyperdx/api": patch
---

fix(opamp): omit unauthenticated fluentforward receiver when collector authentication is enforced
39 changes: 39 additions & 0 deletions packages/api/src/opamp/controllers/__tests__/opampController.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,6 +169,45 @@ describe('opampController', () => {
});
});

describe('buildOtelCollectorConfig fluentforward receiver', () => {
it('enables the fluentforward receiver when no teams exist', () => {
const cfg = buildOtelCollectorConfig([]);

expect(cfg.receivers.fluentforward).toEqual({
endpoint: '0.0.0.0:24225',
});
expect(cfg.service.pipelines['logs/in'].receivers).toEqual([
'fluentforward',
]);
});

it('enables the fluentforward receiver when collector authentication is not enforced', () => {
const cfg = buildOtelCollectorConfig([
{ apiKey: 'k1', collectorAuthenticationEnforced: false },
]);

expect(cfg.receivers.fluentforward).toEqual({
endpoint: '0.0.0.0:24225',
});
expect(cfg.service.pipelines['logs/in'].receivers).toEqual([
'fluentforward',
'otlp/hyperdx',
]);
});

it('omits the fluentforward receiver when collector authentication is enforced', () => {
const cfg = buildOtelCollectorConfig([
{ apiKey: 'k1', collectorAuthenticationEnforced: true },
]);

expect(cfg.receivers.fluentforward).toBeUndefined();
expect(cfg.service.pipelines['logs/in'].receivers).toEqual([
'nop',
'otlp/hyperdx',
]);
});
});

describe('buildOtelCollectorConfig datadog receiver', () => {
it('omits the datadog receiver when the flag is off (default)', () => {
configState.ENABLE_DATADOG_RECEIVER = false;
Expand Down
17 changes: 12 additions & 5 deletions packages/api/src/opamp/controllers/opampController.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -236,9 +236,13 @@ export const buildOtelCollectorConfig = (
],
},
},
fluentforward: {
endpoint: '0.0.0.0:24225',
},
...(collectorAuthenticationEnforced

@github-actions github-actions Bot Nov 4, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 major — This turns off Fluentd/Fluent Bit log ingestion for nearly every self-hosted deployment, with no warning, docs or way to opt back in

Every team created through registration has collectorAuthenticationEnforced: true (packages/api/src/routers/api/root.ts:104-107, and the createTeam default in packages/api/src/controllers/team.ts:45). So after this patch, every non-local install closes port 24225. Yet docker-compose.yml:41 still publishes 24225:24225 # fluentd receiver, and packages/otel-collector/README.md:66 still lists the OpAMP controller as a user of fluentforward. Anyone shipping logs with Fluentd or Fluent Bit loses them silently after a patch-level upgrade. Fix: either add an opt-in env flag in the style of ENABLE_DATADOG_RECEIVER (for example ENABLE_UNAUTHENTICATED_FLUENTFORWARD) that keeps the receiver even when auth is enforced, or at minimum bump the changeset to minor, call out the breaking change, and update the README row and the docker-compose port comment.

Nothing blocks merge automatically, but a maintainer will expect this fixed if it is a real defect in code this PR changes. If it is about surrounding code, reply and say so instead of patching. Do not widen the PR. How to respond

? {}
: {
fluentforward: {
endpoint: '0.0.0.0:24225',
},
}),
},
connectors: {
'routing/logs': {
Expand Down Expand Up @@ -318,8 +322,11 @@ export const buildOtelCollectorConfig = (
exporters: ['clickhouse'],
},
'logs/in': {
// TODO: fluentforward needs to be authenticated
receivers: ['fluentforward'],
// The upstream fluentforwardreceiver has no auth setting, so omit it
// when collector authentication is enforced.
receivers: [
collectorAuthenticationEnforced ? 'nop' : 'fluentforward',
],
exporters: ['routing/logs'],
},
'logs/out-default': {
Expand Down
Loading