Specify MeterProvider configurable cardinality limits

CHANGELOG.md

@@ -74,6 +74,9 @@ release.
   ([#3184](https://github.com/open-telemetry/opentelemetry-specification/pull/3184))
 - Add metric requirement levels "Required", "Recommended", and "Opt-In".
   ([#3237](https://github.com/open-telemetry/opentelemetry-specification/pull/3237))
+- Recommended cardinality limits to protect metrics pipelines against
+  excessive data production from a single instrument.
+  ([#2960](https://github.com/open-telemetry/opentelemetry-specification/pull/2960))
 
 ### Logs
 

specification/metrics/sdk.md

@@ -30,6 +30,9 @@ linkTitle: SDK
         * [Use the maximum scale for single measurements](#use-the-maximum-scale-for-single-measurements)
         * [Maintain the ideal scale](#maintain-the-ideal-scale)
   * [Observations inside asynchronous callbacks](#observations-inside-asynchronous-callbacks)
+  * [Cardinality limits](#cardinality-limits)
+    + [Synchronous instrument cardinality limits](#synchronous-instrument-cardinality-limits)
+    + [Asynchronous instrument cardinality limits](#asynchronous-instrument-cardinality-limits)
 - [Meter](#meter)
   * [Duplicate instrument registration](#duplicate-instrument-registration)
   * [Instrument name](#instrument-name)
@@ -234,6 +237,12 @@ are the inputs:
     `exemplar_reservoir` (optional) to use for storing exemplars. This should be
     a factory or callback similar to aggregation which allows different
     reservoirs to be chosen by the aggregation.
+  * **Status**: [Experimental](../document-status.md) - the
+    `cardinality_limit` (optional) associated with the view.  This
+    should be an positive integer to be taken as a hard limit on the
+    number of data points that will be emitted during a single
+    collection by a single instrument.  See [cardinality limits](#cardinality-limits),
+    below.
 
 In order to avoid conflicts, views which specify a name SHOULD have an
 instrument selector that selects at most one instrument. For the registration
@@ -581,6 +590,50 @@ execution.
 The implementation MUST complete the execution of all callbacks for a
 given instrument before starting a subsequent round of collection.
 
+### Cardinality limits
+
+**Status**: [Experimental](../document-status.md)
+
+Views SHOULD support being configured with a cardinality limit to be
+applied to all aggregators not configured by a specific view.
+
+View configuration SHOULD support applying per-view cardinality limits.
+
+The cardinality limit is taken as an exact, hard limit on the number
+of data points that can be written per collection.  Each view MUST NOT
+output more than the configured cardinality limit number of data points
+per period.
+
+The RECOMMENDED default cardinality limit is 2000.
+
+An overflow attribute is defined, named `otel.metric.overflow` having
+(boolean) value `true`, used to report a synthetic aggregation of the
+metric events that could not be independently aggregated because of
+the limit.  The overflow attribute set MUST be included in the limit
+calculation, thus the maximum number of distinct, non-overflow
+attributes is one less than the limit.
+
+#### Synchronous instrument cardinality limits
+
+Views of synchronous instruments with cumulative aggregation
+temporality MUST continue export the all attribute sets that were
+observed prior to the beginning of overflow.  Metric events
+corresponding with attribute sets that were not observed prior to the
+overflow will be reflected in a single data point described by (only)
+the overflow attribute.
+
+Views of synchronous instruments with delta aggregation temporality
+can choose an arbitrary subset of attributes to output.  Regardless of
+aggregation temporality, the SDK is SHOULD ensure that every output
+data point is correct, the same result that would be achieved by
+filtering all attribute keys.
+
+#### Asynchronous instrument cardinality limits
+
+Views of asynchronous instruments SHOULD prefer the first-observed
+attributes in the callback when limiting cardinality, regardless of
+aggregation temporality.
+
 ## Meter
 
 Distinct meters MUST be treated as separate namespaces for the purposes of detecting