[service/telemetry] Enable OIDC authentication for internal telemetry

[dpaasman00]

Component(s)

service

Is your feature request related to a problem? Please describe.

We want to send the collector's internal telemetry to a backend that uses OIDC authentication. Right now the internal telemetry exporter does not have support for OIDC authentication.

Describe the solution you'd like

I'm looking for the ability to configure the exporter used for internal telemetry to use OIDC authentication.

Describe alternatives you've considered

There is a OIDC auth extension in contrib but this is only applicable to pipelines the collector is running, not the internal telemetry it is producing. The collector could scrape itself but it seems like it'd be better to have the collector's internal telemetry go directly to the backend rather than re-ingest the telemetry through a pipeline.

Additional context

Has anyone ran into this use case before? If so, what solution did you use?

The configuration and exporter used for internal telemetry comes from the OTel Go SDK. Specifically the configuration is here and the specific exporter used is here (either the HTTP or gRPC exporters depending on configuration, regardless of which the issue applies to both).

Tip

_{React with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding +1 or me too, to help us triage it. Learn more here.}

[axw]

Related: #13778

I haven't personally run into a need for this (yet), but I can certainly understand the need and value. I think the way to solve this at the moment is to send the telemetry to another collector, and have that use the OIDC auth extension.

IMO it makes sense for the SDKs to support this natively. Sending to another collector feels a bit overkill just to do token exchange.

[dmathieu]

I already replied on the SDK issue, but while I agree it makes sense for the SDK to support this natively, I also believe this needs a proper specification, as we probably want to have a generic mechanism that can be extended to support any authentication mechanism.