chore(geneva): make certificate authentication opt-in

[lalitb]

Summary

• Update geneva-uploader to the latest upstream commit.
• Add an opt-in geneva-certificate-auth feature.
• Keep PKCS#12 certificate authentication disabled by default.
• Reject certificate configuration early when the feature is disabled.
• Update Geneva documentation, examples, and tests.

Validation

• Focused tests passed with certificate authentication enabled and disabled.
• Formatting, sanity checks, markdownlint, and changelog validation passed.

[opentelemetry-pr-dashboard]

Pull request dashboard status

Merged · refreshed 2026-08-13 01:05 UTC

Status above doesn't look right?

• Anything look wrong? Report it with what you expected; it helps us improve the dashboard.

[Copilot]

Pull request overview

This PR makes Geneva PKCS#12 certificate authentication opt-in across the Rust OTAP-Dataflow Geneva exporter, so default builds avoid pulling in PKCS#12 parsing/crypto dependencies and reject certificate configs early unless explicitly enabled.

Changes:

• Introduces a geneva-certificate-auth feature and wires it through the workspace and contrib-nodes crate features.
• Adds early config validation (and tests) to reject auth.type: certificate when the opt-in feature is disabled.
• Updates Geneva exporter docs and example pipeline YAMLs to default to managed identity authentication.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
rust/otap-dataflow/crates/contrib-nodes/src/exporters/geneva_exporter/README.md	Documents the new opt-in certificate auth feature and clarifies supported auth modes in default builds.
rust/otap-dataflow/crates/contrib-nodes/src/exporters/geneva_exporter/otlp-geneva.yaml	Updates example to use managed identity instead of certificate auth by default.
rust/otap-dataflow/crates/contrib-nodes/src/exporters/geneva_exporter/otlp-geneva-set-table-name.yaml	Updates example auth config to managed identity.
rust/otap-dataflow/crates/contrib-nodes/src/exporters/geneva_exporter/otlp-geneva-set-routing-table-name.yaml	Updates example auth config to managed identity (multiple sections).
rust/otap-dataflow/crates/contrib-nodes/src/exporters/geneva_exporter/mod.rs	Adds validation and tests enforcing that certificate auth requires the opt-in feature.
rust/otap-dataflow/crates/contrib-nodes/Cargo.toml	Adds the geneva-certificate-auth feature and maps it to the upstream geneva-uploader feature.
rust/otap-dataflow/Cargo.toml	Bumps geneva-uploader git rev and adds a workspace-level geneva-certificate-auth feature.
rust/otap-dataflow/Cargo.lock	Updates lockfile to reflect the geneva-uploader rev bump and dependency graph changes.
rust/otap-dataflow/.chloggen/geneva-certificate-auth-opt-in.yaml	Adds a changelog entry describing the default behavior change and migration guidance.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[codecov]

Codecov Report

❌ Patch coverage is 84.00000% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 87.37%. Comparing base (61a49da) to head (c5e92e0).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3730      +/-   ##
==========================================
- Coverage   87.38%   87.37%   -0.01%     
==========================================
  Files         841      841              
  Lines      339106   339131      +25     
==========================================
+ Hits       296324   296326       +2     
- Misses      42250    42273      +23     
  Partials      532      532              

Components	Coverage Δ
otap-dataflow	88.46% <84.00%> (-0.01%)	⬇️
query_engine	89.46% <ø> (ø)
otel-arrow-go	52.39% <ø> (ø)
quiver	92.27% <ø> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[drewrelmas]

LGTM!