fix(telemetry): merge resource attrs onto wrapper-installed TracerProvider

[AshishThakurSAP]

Description

When auto_instrument() runs on a Python process whose OTel TracerProvider was already installed by an upstream auto-instrumentation wrapper (e.g. an OpenTelemetry-Operator-injected init-container, common on managed-Kubernetes runtimes — SAP App Foundation's runtime is one such environment, see App Foundation runtime trigger path below for the trigger path), Traceloop.init's set_tracer_provider call silently no-ops because OTel's _TRACER_PROVIDER_SET_ONCE guard is already tripped (first set wins, no override parameter exists upstream). The resource attrs we pass to Traceloop.init never reach the globally active provider, so sap.cloud_sdk.*, sap.solution_area, mlflow.experiment_id, sap.cld.*, deployment.environment.name, and cloud.region are missing from emitted spans.

This PR adds a _merge_resource_attrs_into_active_provider_if_wrapper_installed(...) helper called from auto_instrument() immediately after Traceloop.init. It detects the wrapper-installed provider via the standard upstream marker telemetry.auto.version on its Resource, and merges the sap-cloud-sdk resource attrs onto it via provider._resource = provider.resource.merge(Resource.create(sap_attrs)). Right-side wins on collisions, so SAP-supplied keys (e.g. service.name from APPFND_CONHOS_APP_NAME) override colliding operator-supplied keys.

When no wrapper is detected (proxy default, or a self-installed TracerProvider without the marker), the helper is a no-op — existing single-tenant flows are unchanged. No new public API; no parameter additions to auto_instrument(). Existing callers pick up the fix transparently on upgrade.

App Foundation runtime trigger path

The wrapper injection that triggers this bug for SAP App Foundation tenants follows this chain. Tracking ticket on the platform side: AFSDK-2840.

1. CI label injection. ci-cd-workflow/.github/actions/detect-otel-runtime/detect.py auto-detects Python from pyproject.toml / requirements.txt, then inject-otel-app-yaml/inject.py:39-47 stamps otel.instrumentation/enabled: python onto the workload CR's metadata.labels. Default-on for every Python workload.
2. Chart label propagation. helm-templates/charts/agent/templates/_helpers.tpl:170-193 propagates the CR label onto both the rendered Deployment.metadata.labels and the Deployment.spec.template.metadata.labels. The chart comment explicitly says "Kyverno matches Deployment labels".
3. Cluster mutation + operator injection. A Kyverno ClusterPolicy otel-inject-python-pod matches the pod label and triggers the OpenTelemetry-Operator webhook to attach an init-container that copies its bundled OTel Python SDK to /otel-auto-instrumentation-python, prepends that path to PYTHONPATH, and stamps telemetry.auto.version on the active TracerProvider's Resource. By the time auto_instrument() runs, set_tracer_provider has already been called — and the bug above kicks in.

The fix in this PR neutralises step 3's effect on resource attrs without requiring any change at steps 1–2 (which are platform-owned and out of scope for this repo).

Related Issue

Closes #81

Type of Change

Please check the relevant option:

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Code refactoring
• Dependency update

How to Test

Unit tests:

1. git checkout fix/telemetry-merge-resource-with-wrapper-provider
2. uv run pytest tests/core/unit/telemetry/test_auto_instrument.py -v
3. Expected: 18 passed (15 existing + 3 new — test_auto_instrument_merges_resource_when_wrapper_installed, test_auto_instrument_skips_merge_when_no_wrapper_marker, test_auto_instrument_merge_overrides_colliding_service_name).

End-to-end on a wrapper-injected pod (e.g. App Foundation runtime):

1. Deploy any sap-cloud-sdk-using Python agent to a cluster where the OpenTelemetry-Operator (or equivalent) auto-injects an instrumentation.opentelemetry.io/inject-python init-container.
2. Call sap_cloud_sdk.core.telemetry.auto_instrument() from the agent's startup path (as usual).
3. Read trace.get_tracer_provider().resource.attributes — e.g. via a /_debug/tracing route or a print statement.
4. Expected: the active provider's Resource carries both the operator-supplied attrs (telemetry.auto.version, k8s.*, service.namespace, …) and sap-cloud-sdk's full enrichment (sap.cloud_sdk.*, sap.solution_area, mlflow.experiment_id, sap.cld.*, deployment.environment.name, cloud.region). Colliding service.name is won by SAP side. Validated on a deployed App Foundation buyer-agent — see Additional Notes below for the before/after JSON.

Lint, format, type-check, coverage:

• uv run ruff check . — clean.
• uv run ruff format --check --diff . — clean (tests/ excluded per the existing pyproject.toml [tool.ruff].exclude).
• uv run ty check --output-format github --python-version 3.11 . — exit 0.
• uv run pytest -m "not integration" --cov=src/sap_cloud_sdk — 1160 passed, 80 deselected, total coverage 93%; auto_instrument.py at 93%.

Checklist

Before submitting your PR, please review and check the following:

• I have read the Contributing Guidelines
• I have verified that my changes solve the issue (validated end-to-end on a deployed pod — see Additional Notes)
• I have added/updated automated tests to cover my changes (3 new tests in test_auto_instrument.py)
• All tests pass locally (1160 passed)
• I have verified that my code follows the Code Guidelines
• I have updated documentation (if applicable) — N/A; no public API change, no user-facing knob to document
• I have added type hints for all public APIs (helper is private; type-hinted regardless: sap_attrs: dict -> None)
• My code does not contain sensitive information (credentials, tokens, etc.)
• I have followed Conventional Commits for commit messages — fix(telemetry): merge resource attrs onto wrapper-installed TracerProvider

Breaking Changes

None. The merge is auto-detected via the upstream telemetry.auto.version marker, which is only present when an OTel-Operator-class wrapper has installed the active provider. Self-installed user providers don't carry this marker, so the helper short-circuits and behaviour is identical to today. auto_instrument()'s signature is unchanged.

Additional Notes

Validation evidence — before/after on a wrapper-active pod

Resource Attributes on a deployed App Foundation Kyma pod with OpenTelemetry-Operator-injected auto-instrumentation active.

Before — auto_instrument() ran but resource attrs were dropped (15 attrs, no SAP enrichment):

{
  "resource_attribute_count": 15,
  "resource_attributes": {
    "telemetry.sdk.language": "python",
    "telemetry.sdk.name": "opentelemetry",
    "telemetry.sdk.version": "1.41.1",
    "service.version": "0.0.1",
    "sap.service.display_name": "buyer-agent-evals-fina",
    "k8s.container.name": "buyer-agent-evals-fina",
    "k8s.deployment.name": "buyer-agent-evals-fina-deployment",
    "k8s.namespace.name": "buyer-agent-evals-fsmcba",
    "k8s.node.name": "ip-10-250-152-52.eu-central-1.compute.internal",
    "k8s.pod.name": "buyer-agent-evals-fina-deployment-97d4f6795-7r2vz",
    "k8s.replicaset.name": "buyer-agent-evals-fina-deployment-97d4f6795",
    "service.instance.id": "buyer-agent-evals-fsmcba.buyer-agent-evals-fina-deployment-97d4f6795-7r2vz.buyer-agent-evals-fina",
    "service.namespace": "buyer-agent-evals-fsmcba",
    "service.name": "buyer-agent-evals-fina-deployment",
    "telemetry.auto.version": "0.62b1"
  }
}

mlflow.experiment_id, sap.cloud_sdk.*, sap.solution_area, sap.cld.*, deployment.environment.name, cloud.region — all absent. service.name is the operator's OTEL_SERVICE_NAME value (<appname>-deployment) rather than APPFND_CONHOS_APP_NAME.

After — same pod, with this PR's merge fix applied (24 attrs, full SAP enrichment):

{
  "resource_attribute_count": 24,
  "resource_attributes": {
    "telemetry.sdk.language": "python",
    "telemetry.sdk.name": "opentelemetry",
    "telemetry.sdk.version": "1.41.1",
    "service.version": "0.0.1",
    "sap.service.display_name": "buyer-agent-evals-fina",
    "k8s.container.name": "buyer-agent-evals-fina",
    "k8s.deployment.name": "buyer-agent-evals-fina-deployment",
    "k8s.namespace.name": "buyer-agent-evals-fsmcba",
    "k8s.node.name": "ip-10-250-84-103.eu-central-1.compute.internal",
    "k8s.pod.name": "buyer-agent-evals-fina-deployment-7746997958-rbh6z",
    "k8s.replicaset.name": "buyer-agent-evals-fina-deployment-7746997958",
    "service.instance.id": "buyer-agent-evals-fina-deployment-7746997958-rbh6z",
    "service.namespace": "buyer-agent-evals-fsmcba",
    "service.name": "buyer-agent-evals-fina",
    "telemetry.auto.version": "0.62b1",
    "deployment.environment.name": "canary",
    "cloud.region": "eu12",
    "sap.cld.subaccount_id": "ac5d447e-af4b-4c64-abf5-90e71f770c07",
    "sap.cld.system_role": "unknown",
    "sap.cloud_sdk.name": "SAP Cloud SDK for Python",
    "sap.cloud_sdk.language": "python",
    "sap.cloud_sdk.version": "0.11.6",
    "sap.solution_area": "fina",
    "mlflow.experiment_id": "1635264705567712"
  }
}

Operator-supplied k8s.*, service.namespace, service.version, sap.service.display_name, telemetry.* all preserved. SAP attrs added on top. service.name collision won by SAP side — buyer-agent-evals-fina from APPFND_CONHOS_APP_NAME drops the redundant -deployment suffix the operator picked up from the k8s deployment name.

Design notes for reviewers

• Traceloop.init still runs. Even when the merge will fire, we keep the Traceloop.init call above untouched — it's the only way to install Traceloop's third-party autoinstrumentation hooks (langchain, openai, …) which emit spans via trace.get_tracer(...) and flow through whichever provider is globally active. Cost in the wrapper-active case is one orphaned TracerProvider allocation at startup; acceptable.

Files changed

• src/sap_cloud_sdk/core/telemetry/auto_instrument.py — adds Mapping and Resource imports; calls the new helper after Traceloop.init; defines _merge_resource_attrs_into_active_provider_if_wrapper_installed.
• tests/core/unit/telemetry/test_auto_instrument.py — three new tests covering merge-fires, marker-absent-skip, and SAP-side-wins-on-collision.
• pyproject.toml + uv.lock — version 0.11.6 → 0.11.7 (required by check-version-bump.yaml when src/ changes).

[cla-assistant]

All committers have signed the CLA.

[jeanscherf]

LGTM

[LucasAlvesSoares]