fix(otel): enable gzip and https OTLP export

[ericcurtin]

Summary

Enable gzip and https:// OTLP export. Both failed at startup.

Related Issue

Closes #3899

Changes

• Enable gzip-tonic, tls-aws-lc, tls-roots on opentelemetry-otlp.
• Trust platform roots for https:// endpoints (tonic trusts none by default).
• TLS and gzip option on the shared test collector, plus an end-to-end test.
• Docs: https:// and OTEL_EXPORTER_OTLP_COMPRESSION=gzip.

Testing

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated (if applicable)
• E2E tests added/updated (if applicable)

cargo fmt, cargo clippy and cargo test for openshell-otel, openshell-otel-test-support, and the Docker driver OTLP test. mise run docs passes. The new test fails with UnknownIssuer without the roots change.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[ericcurtin]

@johntmyers @elezar PTAL when you get a chance, and /ok to test 325922aaf025148eb23afe6eb48dd112c3172db9 if it looks good. Thank you!

[johntmyers]

@krishicks can you take a look?

[johntmyers]

/ok to test 325922a

[github-actions]

Label test:e2e applied for 325922a. Open Branch E2E Checks, find the run for commit 325922a, and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[johntmyers]

gator-agent

PR Review Status

The independent code review found no blocking findings in this focused fix for gzip and HTTPS OTLP export. The shared exporter, TLS/gzip collector test, and gateway configuration docs cover the intended change.

@ericcurtin, I checked your request to authorize testing and posted /ok to test for the current head. Branch Checks and E2E are now running on the refreshed mirror; Helm's required gate is green. The E2E label helper requested a rerun, but a fresh current-head E2E run started after the label was applied and its required gate is pending, so there is no completed E2E attempt to rerun yet.

Action required: A maintainer must approve Trivy Changes, which currently reports action_required, so the remaining required workflow can execute.

Blocking findings: None.

Carried findings: None.

Gator metadata

• Validation: Concentrated observability bug fix for bug: OTLP trace export fails to start with gzip compression or an https:// collector endpoint #3899.
• Docs: HTTPS certificate trust and gzip support documented in the existing gateway configuration page; no navigation change needed.
• Checks: DCO and vouch pass; Branch Checks running; Helm gate green; Trivy Changes requires workflow approval.
• E2E: test:e2e applied; current-head Branch E2E Checks run 38298758989 is in progress; E2E gate pending.
• Head SHA: 325922aaf025148eb23afe6eb48dd112c3172db9
• Base SHA: eeba0e7954c0fb4d8e9e2e29d1bfa68e290eb8b3
• Merge base SHA: eeba0e7954c0fb4d8e9e2e29d1bfa68e290eb8b3
• Patch ID: c8a3ceed89ff3ed1f4238bdba5b393a5c3625c96
• Gator payload: 12
• Review mode: initial
• Previous reviewed SHA: none
• Review budget exhausted: no
• Maintainer decision required: no convergence decision needed
• Next state: gator:blocked
• Blocked reason: workflow_approval_required

[ericcurtin]

Thanks @rhuss. Added a negative TLS test (untrusted server cert must fail to export) and shared the setup between the two tests. @johntmyers @krishicks PTAL, and /ok to test aecc4d248d1476af4a8ef9aaece839205578438d if it looks good. Thank you!

[johntmyers]

/ok to test aecc4d2

[johntmyers]

gator-agent

PR Review Status

The independent follow-up review found no blocking findings in the new TLS rejection test and shared test setup. @ericcurtin, I checked your update addressing the negative TLS test suggestion: the new case uses an unrelated signing CA and requires export to fail with no spans received, while the trusted TLS/gzip case still requires a successful export.

I posted /ok to test for the current head. Branch Checks, Helm Lint, and Branch E2E Checks are queued on the refreshed mirror with test:e2e already applied. The label helper's rerun instruction refers to the previous head; this new head has a fresh E2E run, so no rerun is needed for that older instruction.

Action required: A maintainer must approve Trivy Changes, which reports action_required, before the remaining required workflow can run.

Blocking findings: None.

Carried findings: None.

Gator metadata

• Validation: Concentrated observability bug fix for bug: OTLP trace export fails to start with gzip compression or an https:// collector endpoint #3899; current delta adds certificate-rejection coverage and shares test setup.
• Docs: Existing HTTPS trust and gzip documentation accepted in the previous review; this test-only delta needs no further docs or navigation changes.
• Checks: DCO passes; current-head Branch Checks and Helm Lint queued; Trivy Changes requires workflow approval. Maintainer PR approval remains missing.
• E2E: test:e2e retained; current-head Branch E2E Checks run 38302827805 queued after fresh mirror authorization.
• Head SHA: aecc4d248d1476af4a8ef9aaece839205578438d
• Base SHA: eeba0e7954c0fb4d8e9e2e29d1bfa68e290eb8b3
• Merge base SHA: eeba0e7954c0fb4d8e9e2e29d1bfa68e290eb8b3
• Patch ID: f3fa57ee5be786fa7c9bdcedda5b7599dc96ab7b
• Gator payload: 12
• Review mode: follow_up
• Previous reviewed SHA: 325922aaf025148eb23afe6eb48dd112c3172db9
• Review budget exhausted: no
• Maintainer decision required: no convergence decision needed
• Next state: gator:blocked
• Blocked reason: workflow_approval_required

[johntmyers]

@ericcurtin resolve comments if they have been addressed, then it should queue to merge

[johntmyers]

gator-agent

Monitoring Complete

Monitoring is complete because this PR has merged.

Final status: Gator found no blocking review findings, and maintainer approval was present before merge.

I removed the active gator:* label because there is nothing left for gator to monitor on this PR.

Gator metadata

• Head SHA: aecc4d248d1476af4a8ef9aaece839205578438d
• Gator payload: 12