feat: enable cross-app distributed tracing for v2 APIs (#11453)

backend/v3/instrumentation/tracing.go

@@ -20,8 +20,9 @@ import (
 )
 
 type TraceConfig struct {
-	Fraction float64
-	Exporter ExporterConfig
+	Fraction         float64
+	Exporter         ExporterConfig
+	TrustRemoteSpans bool
 }
 
 // TODO: remove for v5 release

cmd/defaults.yaml

@@ -2,6 +2,9 @@ Instrumentation:
   ServiceName: "zitadel" # ZITADEL_INSTRUMENTATION_SERVICENAME
   Trace:
     Fraction: 1.0 # ZITADEL_INSTRUMENTATION_TRACE_FRACTION
+    # Trust incoming trace context from remote services for distributed tracing.
+    # Enable only in controlled environments; defaults to false for security.
+    TrustRemoteSpans: false # ZITADEL_INSTRUMENTATION_TRACE_TRUSTREMOTESPANS
     Exporter:
       # The following exporter types are supported:
       # "none": Disables trace exporting

cmd/mirror/defaults.yaml

@@ -2,6 +2,9 @@ Instrumentation:
   ServiceName: "zitadel-mirror" # ZITADEL_INSTRUMENTATION_SERVICENAME
   Trace:
     Fraction: 1.0 # ZITADEL_INSTRUMENTATION_TRACE_FRACTION
+    # Trust incoming trace context from remote services for distributed tracing.
+    # Enable only in controlled environments; defaults to false for security.
+    TrustRemoteSpans: false # ZITADEL_INSTRUMENTATION_TRACE_TRUSTREMOTESPANS
     Exporter:
       # The following exporter types are supported:
       # "none": Disables trace exporting

cmd/setup/steps.yaml

@@ -2,6 +2,9 @@ Instrumentation:
   ServiceName: "zitadel-setup" # ZITADEL_INSTRUMENTATION_SERVICENAME
   Trace:
     Fraction: 1.0 # ZITADEL_INSTRUMENTATION_TRACE_FRACTION
+    # Trust incoming trace context from remote services for distributed tracing.
+    # Enable only in controlled environments; defaults to false for security.
+    TrustRemoteSpans: false # ZITADEL_INSTRUMENTATION_TRACE_TRUSTREMOTESPANS
     Exporter:
       # The following exporter types are supported:
       # "none": Disables trace exporting

cmd/start/start.go

@@ -480,6 +480,7 @@ func startAPIs(
 		limitingAccessInterceptor,
 		keys.Target,
 		translator,
+		config.Instrumentation.Trace.TrustRemoteSpans,
 	)
 	if err != nil {
 		return nil, fmt.Errorf("error creating api %w", err)

internal/api/api.go

@@ -110,6 +110,7 @@ func New(
 	accessInterceptor *http_mw.AccessInterceptor,
 	targetEncryptionAlgorithm crypto.EncryptionAlgorithm,
 	translator *i18n.Translator,
+	trustRemoteSpans bool,
 ) (_ *API, err error) {
 	api := &API{
 		port:                      port,
@@ -132,12 +133,16 @@ func New(
 	if err != nil {
 		return nil, err
 	}
-	api.connectOTELInterceptor, err = otelconnect.NewInterceptor(
+	otelOpts := []otelconnect.Option{
 		otelconnect.WithTracerProvider(otel.GetTracerProvider()),
 		otelconnect.WithMeterProvider(otel.GetMeterProvider()),
 		otelconnect.WithPropagator(otel.GetTextMapPropagator()),
 		otelconnect.WithoutServerPeerAttributes(),
-	)
+	}
+	if trustRemoteSpans {
+		otelOpts = append(otelOpts, otelconnect.WithTrustRemote())
+	}
+	api.connectOTELInterceptor, err = otelconnect.NewInterceptor(otelOpts...)
 	if err != nil {
 		return nil, err
 	}