route

type Config struct {
	Routes []Route `json:"routes"`
}

type Destination struct {
	Name       string
	Namespaces []string
	Exporter   Exporter
}

type Exporter interface {
	ExportLogs(ctx context.Context, ld plog.Logs) error
	ExportMetrics(ctx context.Context, md pmetric.Metrics) error
}

type Route struct {
	// Name labels the route in metrics/logs.
	Name string `json:"name"`
	// Namespaces are glob patterns matched against k8s.namespace.name
	// (path.Match syntax: "team-a-*", "prod").
	Namespaces []string `json:"namespaces"`
	// Endpoint overrides the OTLP destination (empty = the default endpoint,
	// useful for header-only tenant routing).
	Endpoint string `json:"endpoint,omitempty"`
	// Headers are extra headers for this route (e.g. X-Scope-OrgID).
	Headers map[string]string `json:"headers,omitempty"`

	// Credentials for this route's destination. They are not optional
	// decoration for a route that names its OWN endpoint: such a route does
	// NOT inherit the default chain's BearerTokenFile / CA / client
	// certificate, because those authenticate this deployment to ITS
	// collector and the route is a different destination — frequently a
	// different tenant's, sometimes a different organization's. Inheriting them
	// presented the default collector's credentials to whatever host the route
	// named, which is a credential disclosure to a third party rather than a
	// convenience.
	//
	// A route with no endpoint, or one repeating -otlp-endpoint, IS the
	// default destination (reached with extra headers — the header-only
	// tenancy case): it inherits everything, and any of these fields it sets
	// wins over the inherited value, exactly as an export.<signal> override
	// without an endpoint of its own. One derivation serves both
	// (otlpexport.ExportConfig.RouteConfig).
	BearerTokenFile string `json:"bearerTokenFile,omitempty"`
	ClientCertFile  string `json:"clientCertFile,omitempty"`
	ClientKeyFile   string `json:"clientKeyFile,omitempty"`
	CAFile          string `json:"caFile,omitempty"`
	// Insecure allows plaintext gRPC to this route (for HTTP the scheme in
	// Endpoint decides). Unset (nil) INHERITS the merged flag base's
	// -otlp-insecure — the ExportOverride pattern, and what every route
	// written before this field existed relied on: a plain bool's zero value
	// flipped those routes to TLS on upgrade, turning a working plaintext
	// destination into an endless transient export failure with no startup
	// signal. Plaintext-ness is transport to the named host, not a credential,
	// so inheriting it is not the disclosure the fields above guard against.
	Insecure *bool `json:"insecure,omitempty"`
	// InsecureSkipVerify skips verifying the route destination's TLS
	// certificate. Unlike Insecure it is NOT inherited when the route names its
	// own endpoint: -otlp-tls-insecure-skip-verify is a trust decision about
	// the deployment's OWN collector, and carrying it over sent this route's
	// bearer token and client certificate to a peer whose certificate nobody
	// checked — the carryover the export section's per-signal overrides drop
	// for the same reason. Unset = verify on an own-endpoint route, and the
	// inherited flag on a route that IS the default destination (no endpoint,
	// or -otlp-endpoint repeated), where a value set here wins like the
	// credentials above.
	InsecureSkipVerify *bool `json:"insecureSkipVerify,omitempty"`
}

type Router struct {
	// contains filtered or unexported fields
}

type TracesExporter interface {
	ExportTraces(ctx context.Context, td ptrace.Traces) error
}