[codex][otel] support mtls configuration

[apanasenko-oai]

fix for #6153

supports mTLS configuration and includes TLS features in the library build to enable secure HTTPS connections with custom root certificates.

grpc: https://docs.rs/tonic/0.13.1/src/tonic/transport/channel/endpoint.rs.html#63
https: https://docs.rs/reqwest/0.12.23/src/reqwest/async_impl/client.rs.html#516

[chatgpt-codex-connector]

Codex Review: Something went wrong. Try again later by commenting “@codex review”.

An unknown error occurred

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[apanasenko-oai]

@haivanka could you check this branch against your endpoint?

Thanks

[etraut-openai]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[etraut-openai]

This looks good to me, but I admit that I have no experience with otel. If there's someone else on the team (or in the community) with more experience, you might want to ask for their review. It's probably also a good idea to wait to give community members a chance to test this branch before merging.

[haivanka]

@haivanka could you check this branch against your endpoint?

Thanks

@apanasenko-oai it didn’t work for me. The TCP connection was established but closed immediately without a TLS handshake or any data being sent. But I think this might be an issue with my endpoint, it might not support ALPN or something like that.

Here’s the patch that got encrypted otel data working for me, in case it’s of any help:

diff --git a/codex-rs/otel/Cargo.toml b/codex-rs/otel/Cargo.toml
index ea518c2e..bea5dce3 100644
--- a/codex-rs/otel/Cargo.toml
+++ b/codex-rs/otel/Cargo.toml
@@ -29,6 +29,8 @@ opentelemetry-otlp = { workspace = true, features = [
     "http-json",
     "reqwest",
     "reqwest-rustls",
+    "tls",
+    "tls-roots",
 ], optional = true }
 opentelemetry-semantic-conventions = { workspace = true }
 opentelemetry_sdk = { workspace = true, features = [
diff --git a/codex-rs/otel/src/otel_provider.rs b/codex-rs/otel/src/otel_provider.rs
index 222322a2..f577d035 100644
--- a/codex-rs/otel/src/otel_provider.rs
+++ b/codex-rs/otel/src/otel_provider.rs
@@ -63,6 +63,11 @@ impl OtelProvider {
                     .with_tonic()
                     .with_endpoint(endpoint)
                     .with_metadata(MetadataMap::from_headers(header_map))
+                    .with_tls_config(
+                        tonic::transport::ClientTlsConfig::new()
+                            .with_enabled_roots()
+                            .assume_http2(true),
+                    )
                     .build()?;
 
                 builder = builder.with_batch_exporter(exporter);

[apanasenko-oai]

@haivanka thanks for your feedback, updated branch, could you check once again, please?

Thanks

[haivanka]

Thanks! I checked it again and it works for me now.