refactor(otlp): deprecate tls feature in favor of explicit tls-ring and tls-aws-lc #3323
+21
−14
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The generic tls feature currently enables tonic/tls-ring, which implicitly selects the ring rustls crypto provider.
This makes it difficult or impossible for downstream users to use alternative rustls providers such as aws-lc, and can lead to feature unification conflicts when combined with other TLS-enabled dependencies.
This PR deprecates the generic tls feature and introduces explicit tls-ring and tls-aws-lc features, exposing both underlying tonic TLS options and allowing consumers to consistently select a single rustls crypto provider.
Motivation
Rustls 0.23 requires a single, unambiguous crypto provider (ring or aws-lc).
Because Cargo features are additive, the existing tls feature could silently force ring even when users explicitly opted into aws-lc elsewhere, resulting in runtime panics during TLS initialization.
Providing explicit TLS feature flags avoids this class of failure and aligns with tonic’s provider model.
Changes
Migration
Users currently relying on tls should switch to one of:
or
The deprecated tls feature remains temporarily for compatibility but should not be used in new configurations.
Caveat
The feature
tls-rootsandtls-webpki-rootscan no longer explicitly enabletls. This could lead to issues with users that relied on this impicit feature map.Merge requirement checklist
CHANGELOG.mdfiles updated for non-trivial, user-facing changes