[bug][otel]: OpenTelemetry gRPC exporter sends unencrypted data to HTTPS endpoint

Root Cause Analysis

codex-otel builds opentelemetry-otlp without its tls feature. The TLS path in the tonic exporter is behind #[cfg(feature = "tls")] (see opentelemetry-otlp/src/exporter/tonic/mod.rs, also discussed in open-telemetry/opentelemetry-rust#3182). Without that feature, the exporter can’t create a TLS channel and falls back to cleartext, creating the security vulnerability reported.

Proposed Fix

The fix is a one-line change to codex-otel/Cargo.toml to enable the required feature:

--- a/codex-otel/Cargo.toml
+++ b/codex-otel/Cargo.toml
@@ -25,6 +25,7 @@
     "reqwest",
   	 "reqwest-rustls",
+    "tls", # <-- This is the fix to enable TLS for the gRPC (Tonic) exporter
 ], optional = true }
 opentelemetry-semantic-conventions = { workspace = true }
 opentelemetry_sdk = { workspace = true, features = [

@haivanka @codex-maintainers can you please assign this to me?

@haivanka, thanks for the bug report.

@vyalamar, thanks for the confirmation and analysis. We're interested in a fix if you'd like to post a PR.

@etraut-openai
I’ll prepare a PR for this shortly.

The patch will add the missing tls feature flag in codex-otel/Cargo.toml:

opentelemetry-otlp = { workspace = true, features = [
    "grpc-tonic",
    "http-proto",
    "http-json",
    "reqwest",
    "reqwest-rustls",
+   "tls",
], optional = true }

Will share the test results as well.

@vyalamar I did test it like that but it didn't work. Managed to get it working with this approach https://github.com/tensorzero/tensorzero/pull/3708.

@haivanka Great catch — thanks for linking the Tensorzero diff.

Looks like both layers are needed:

• Compile-time: enable opentelemetry-otlp/tls and tls-roots so the tonic TLS client can build.
• Runtime: explicitly apply ClientTlsConfig::new().with_enabled_roots() when constructing the exporter (as in your linked PR).

I’ll adjust the PR to include both so the HTTPS OTLP path is fully encrypted out of the box.

@etraut-openai Fixed formatting issues.