From b997a29e24d97d92bb3e57f4842184cff4e4b8fc Mon Sep 17 00:00:00 2001
From: Jeon Insoo <mumberrymountain@gmail.com>
Date: Sun, 5 Apr 2026 20:35:15 +0900
Subject: [PATCH 1/2] tracing: fix startup failure for insecure OTLP HTTP
 tracing

Signed-off-by: Jeon Insoo <mumberrymountain@gmail.com>
---
 tracing/tracing.go | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/tracing/tracing.go b/tracing/tracing.go
index 65418d1214..932fab92b6 100644
--- a/tracing/tracing.go
+++ b/tracing/tracing.go
@@ -207,6 +207,14 @@ func getClient(tracingCfg config.TracingConfig) (otlptrace.Client, error) {
 		opts := []otlptracehttp.Option{otlptracehttp.WithEndpoint(tracingCfg.Endpoint)}
 		if tracingCfg.Insecure {
 			opts = append(opts, otlptracehttp.WithInsecure())
+		} else {
+			// Use of TLS Credentials forces the use of TLS. Therefore it can
+			// only be set when `insecure` is set to false.
+			tlsConf, err := config_util.NewTLSConfig(&tracingCfg.TLSConfig)
+			if err != nil {
+				return nil, err
+			}
+			opts = append(opts, otlptracehttp.WithTLSClientConfig(tlsConf))
 		}
 		// Currently, OTEL supports only gzip compression.
 		if tracingCfg.Compression == config.GzipCompression {
@@ -219,12 +227,6 @@ func getClient(tracingCfg config.TracingConfig) (otlptrace.Client, error) {
 			opts = append(opts, otlptracehttp.WithTimeout(time.Duration(tracingCfg.Timeout)))
 		}
 
-		tlsConf, err := config_util.NewTLSConfig(&tracingCfg.TLSConfig)
-		if err != nil {
-			return nil, err
-		}
-		opts = append(opts, otlptracehttp.WithTLSClientConfig(tlsConf))
-
 		client = otlptracehttp.NewClient(opts...)
 	}
 

From 027b76396d376bcc26be6a578b0e51078e39589c Mon Sep 17 00:00:00 2001
From: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
Date: Tue, 7 Apr 2026 12:06:57 +0200
Subject: [PATCH 2/2] tracing: add regression test for HTTP insecure mode

Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
---
 tracing/tracing_test.go | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/tracing/tracing_test.go b/tracing/tracing_test.go
index 0840abafdf..da154326e6 100644
--- a/tracing/tracing_test.go
+++ b/tracing/tracing_test.go
@@ -117,6 +117,18 @@ func TestUninstallingTracerProvider(t *testing.T) {
 	require.Equal(t, noop.NewTracerProvider(), otel.GetTracerProvider())
 }
 
+func TestInstallingTracerProviderHTTPInsecure(t *testing.T) {
+	m := NewManager(promslog.NewNopLogger())
+	cfg := config.Config{
+		TracingConfig: config.TracingConfig{
+			Endpoint:   "localhost:4318",
+			ClientType: config.TracingClientHTTP,
+			Insecure:   true,
+		},
+	}
+	require.NoError(t, m.ApplyConfig(&cfg))
+}
+
 func TestTracerProviderShutdown(t *testing.T) {
 	m := NewManager(promslog.NewNopLogger())
 	cfg := config.Config{