feat(otlp): support INSECURE environment variables for gRPC

[bryantbiggs]

Summary

Add support for 4 INSECURE environment variables per the OTLP exporter specification (SHOULD-level):

• OTEL_EXPORTER_OTLP_INSECURE (generic)
• OTEL_EXPORTER_OTLP_TRACES_INSECURE
• OTEL_EXPORTER_OTLP_METRICS_INSECURE
• OTEL_EXPORTER_OTLP_LOGS_INSECURE

Per the spec, INSECURE only applies to gRPC (not HTTP — HTTP security is determined by URL scheme). There is intentionally no programmatic builder method — this is env-var-only per spec.

Behavior

When an endpoint has no explicit scheme (e.g., collector.example.com:4317):

• INSECURE=true → prepends http:// (plaintext)
• INSECURE=false (default) → prepends https:// and auto-applies ClientTlsConfig::new() when TLS features are enabled

Endpoints with an explicit http:// or https:// scheme are unaffected (scheme detection is case-insensitive).

Signal-specific env var takes precedence over generic; "true" (case-insensitive) = insecure, anything else = secure.

Breaking behavior change

Schemeless endpoints (e.g., collector.example.com:4317) now default to https:// instead of being passed as-is to Channel::from_shared. Users with schemeless endpoints connecting to plaintext gRPC servers should set OTEL_EXPORTER_OTLP_INSECURE=true. Endpoints with an explicit http:// scheme (including the default http://localhost:4317) are unaffected.

Test plan

• cargo clippy -p opentelemetry-otlp --all-targets --all-features -- -D warnings passes
• cargo test -p opentelemetry-otlp --all-features — 117 unit + 2 integration + 21 doc-tests pass
• 5 unit tests for resolve_insecure(): signal overrides generic, default is false, case-insensitive, non-true values return false, falls back to generic
• 4 integration tests for build_channel with INSECURE: schemeless+secure errors without TLS, schemeless+insecure succeeds, schemeless defaults to https, explicit http:// ignores INSECURE env
• All tests use temp_env::with_var_unset for signal-specific var to prevent parallel test interference

Resolves: #774
Resolves: #984

[codecov]

Codecov Report

❌ Patch coverage is 99.16667% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 82.9%. Comparing base (2571776) to head (2307ea7).

Files with missing lines	Patch %	Lines
opentelemetry-otlp/src/exporter/tonic/mod.rs	98.0%	1 Missing ⚠️

Additional details and impacted files

@@          Coverage Diff           @@
##            main   #3365    +/-   ##
======================================
  Coverage   82.9%   82.9%            
======================================
  Files        130     130            
  Lines      27350   27463   +113     
======================================
+ Hits       22675   22787   +112     
- Misses      4675    4676     +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[scottgerring]

Hey @bryantbiggs thanks for this one and sorry for very slow turnaround - it'll help with OTLP stabilisation!

Some comments inline but I reckon it's almost there 🚢

[scottgerring]

LGTM pending build completing!
@cijothomas it would be great to get this in in the quest for OTLP stabilisation

[Copilot]

Pull request overview

This PR adds OTLP/gRPC support for the spec-defined OTEL_EXPORTER_OTLP*_INSECURE environment variables by interpreting schemeless endpoints as either http:// (plaintext) or https:// (TLS) based on env var values, and updates tests/docs/scripts to validate behavior across feature combinations.

Changes:

• Add generic + signal-specific *_INSECURE env vars, and apply them when building tonic (gRPC) channels for schemeless endpoints.
• Update docs/exports/changelog to surface the new env vars and the (intentional) default-to-https:// breaking behavior for schemeless endpoints.
• Strengthen test execution across feature combinations and adjust test cfg/tokio usage to avoid feature-matrix blind spots.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
scripts/test.sh	Adds curated opentelemetry-otlp feature-matrix test runs to catch feature-gated compilation/execution gaps.
opentelemetry-otlp/src/span.rs	Introduces OTEL_EXPORTER_OTLP_TRACES_INSECURE const and switches default-transport test to #[tokio::test].
opentelemetry-otlp/src/metric.rs	Introduces OTEL_EXPORTER_OTLP_METRICS_INSECURE const and switches default-transport test to #[tokio::test].
opentelemetry-otlp/src/logs.rs	Introduces OTEL_EXPORTER_OTLP_LOGS_INSECURE const and switches default-transport test to #[tokio::test].
opentelemetry-otlp/src/lib.rs	Documents and re-exports new INSECURE env vars (generic + per-signal).
opentelemetry-otlp/src/exporter/tonic/mod.rs	Applies INSECURE-driven scheme prefixing for schemeless gRPC endpoints and adds related unit/integration tests.
opentelemetry-otlp/src/exporter/mod.rs	Adds OTEL_EXPORTER_OTLP_INSECURE + resolve_insecure() and associated unit tests.
opentelemetry-otlp/src/exporter/http/trace.rs	Gating of protobuf-specific tests to http-proto feature.
opentelemetry-otlp/src/exporter/http/mod.rs	Tightens test cfg gating to avoid compiling tests under incompatible HTTP feature sets.
opentelemetry-otlp/src/exporter/http/metrics.rs	Gating of protobuf-specific tests to http-proto feature.
opentelemetry-otlp/src/exporter/http/logs.rs	Gating of protobuf-specific tests to http-proto feature.
opentelemetry-otlp/CHANGELOG.md	Adds vNext entry documenting new env vars and breaking default scheme behavior for schemeless endpoints.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.