By default, auto instrumentation ships process.command_args, which is very dangerous as a lot of java services pass in secrets via command line arguments. Example:
java \
-Dkeycloak.clientSecret="${KEYCLOAK_SECRET:-test}" \
-jar app.jar
I have opened an issue against the java auto instrumentation repo (open-telemetry/opentelemetry-java-instrumentation#10151), but I was pointed to https://opentelemetry.io/docs/specs/semconv/resource/process/ which indicates that the information I am asking to be made opt-in is marked "Conditionally Required" in the specification.
Does it make sense to give an out for languages where passing in secrets via command line arguments is common? Curious also if other languages have this problem and how they deal with it.
By default, auto instrumentation ships
process.command_args, which is very dangerous as a lot of java services pass in secrets via command line arguments. Example:I have opened an issue against the java auto instrumentation repo (open-telemetry/opentelemetry-java-instrumentation#10151), but I was pointed to https://opentelemetry.io/docs/specs/semconv/resource/process/ which indicates that the information I am asking to be made opt-in is marked "Conditionally Required" in the specification.
Does it make sense to give an out for languages where passing in secrets via command line arguments is common? Curious also if other languages have this problem and how they deal with it.