Merge branch 'main' into fix_negative_uint_config

.chloggen/configopaque-implement-BinaryMarshaler.yaml

@@ -0,0 +1,25 @@
+# Use this changelog template to create an entry for release notes.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: breaking
+
+# The name of the component, or a single word describing the area of concern, (e.g. otlpreceiver)
+component: bug_fix
+
+# A brief description of the change.  Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: Implement `encoding.BinaryMarshaler` interface to prevent `configopaque` -> `[]byte` -> `string` conversions from leaking the value
+
+# One or more tracking issues or pull requests related to the change
+issues: [9279]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:
+
+# Optional: The change log or logs in which this entry should be included.
+# e.g. '[user]' or '[user, api]'
+# Include 'user' if the change is relevant to end users.
+# Include 'api' if there is a change to a library API.
+# Default: '[user]'
+change_logs: [api]

config/configopaque/opaque.go

@@ -36,3 +36,10 @@ var _ fmt.GoStringer = String("")
 func (s String) GoString() string {
 	return fmt.Sprintf("%#v", maskedString)
 }
+
+var _ encoding.BinaryMarshaler = String("")
+
+// MarshalBinary marshals the string `[REDACTED]` as []byte.
+func (s String) MarshalBinary() (text []byte, err error) {
+	return []byte(maskedString), nil
+}

config/configopaque/opaque_test.go

@@ -80,3 +80,12 @@ func TestStringFmt(t *testing.T) {
 		}
 	}
 }
+
+func TestStringMarshalBinary(t *testing.T) {
+	examples := []String{"opaque", "s", "veryveryveryveryveryveryveryveryveryverylong"}
+	for _, example := range examples {
+		opaque, err := example.MarshalBinary()
+		require.NoError(t, err)
+		assert.Equal(t, []byte("[REDACTED]"), opaque)
+	}
+}

examples/k8s/otel-config.yaml

@@ -206,7 +206,7 @@ spec:
                 apiVersion: v1
                 fieldPath: status.podIP
           - name: GOMEMLIMIT
-              value: 1600MiB
+            value: 1600MiB
         volumeMounts:
         - name: otel-collector-config-vol
           mountPath: /conf