Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove TLS loading and replace with OTEL configtls #6345

Merged
merged 9 commits into from
Dec 13, 2024
Merged

Remove TLS loading and replace with OTEL configtls #6345

Show file tree
Hide file tree
Changes from 7 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
89c6cf9
remove-close
yurishkuro Dec 12, 2024
e2705c1
Merge branch 'main' into remove-watcher
yurishkuro Dec 13, 2024
99eac21
Upgrade agent grpc reporter
yurishkuro Dec 13, 2024
c1b6b1f
fix lint
yurishkuro Dec 13, 2024
f89ab4b
remove tls.Config()
yurishkuro Dec 13, 2024
06b8ab3
Fully delegate cert loading to OTEL
yurishkuro Dec 13, 2024
eee8a64
fix
yurishkuro Dec 13, 2024
c730406
add test
yurishkuro Dec 13, 2024
935f76a
fmt
yurishkuro Dec 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 8 additions & 11 deletions cmd/agent/app/reporter/grpc/builder.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ import (
"strings"

"github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/retry"
"go.opentelemetry.io/collector/config/configtls"
"go.uber.org/zap"
"google.golang.org/grpc"
"google.golang.org/grpc/connectivity"
Expand All @@ -19,7 +20,6 @@ import (
"google.golang.org/grpc/resolver/manual"

"github.com/jaegertracing/jaeger/cmd/agent/app/reporter"
"github.com/jaegertracing/jaeger/pkg/config/tlscfg"
"github.com/jaegertracing/jaeger/pkg/discovery"
"github.com/jaegertracing/jaeger/pkg/discovery/grpcresolver"
"github.com/jaegertracing/jaeger/pkg/metrics"
Expand All @@ -30,13 +30,11 @@ import (
type ConnBuilder struct {
// CollectorHostPorts is list of host:port Jaeger Collectors.
CollectorHostPorts []string `yaml:"collectorHostPorts"`

MaxRetry uint
TLS tlscfg.Options

DiscoveryMinPeers int
Notifier discovery.Notifier
Discoverer discovery.Discoverer
TLS *configtls.ClientConfig
MaxRetry uint
DiscoveryMinPeers int
Notifier discovery.Notifier
Discoverer discovery.Discoverer

AdditionalDialOptions []grpc.DialOption
}
Expand All @@ -50,13 +48,12 @@ func NewConnBuilder() *ConnBuilder {
func (b *ConnBuilder) CreateConnection(ctx context.Context, logger *zap.Logger, mFactory metrics.Factory) (*grpc.ClientConn, error) {
var dialOptions []grpc.DialOption
var dialTarget string
if b.TLS.Enabled { // user requested a secure connection
if b.TLS != nil { // user requested a secure connection
logger.Info("Agent requested secure grpc connection to collector(s)")
tlsConf, err := b.TLS.Config(logger)
tlsConf, err := b.TLS.LoadTLSConfig(ctx)
if err != nil {
return nil, fmt.Errorf("failed to load TLS config: %w", err)
}

creds := credentials.NewTLS(tlsConf)
dialOptions = append(dialOptions, grpc.WithTransportCredentials(creds))
} else { // insecure connection
Expand Down
73 changes: 39 additions & 34 deletions cmd/agent/app/reporter/grpc/builder_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ import (

"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"go.opentelemetry.io/collector/config/configtls"
"go.uber.org/zap"
"google.golang.org/grpc"
"google.golang.org/grpc/credentials"
Expand Down Expand Up @@ -151,9 +152,10 @@ func TestProxyBuilder(t *testing.T) {
name: "should fail with secure grpc connection and a CA file which does not exist",
grpcBuilder: &ConnBuilder{
CollectorHostPorts: []string{"localhost:0000"},
TLS: tlscfg.Options{
Enabled: true,
CAPath: testCertKeyLocation + "/not/valid",
TLS: &configtls.ClientConfig{
Config: configtls.Config{
CAFile: testCertKeyLocation + "/not/valid",
},
},
},
expectError: true,
Expand All @@ -162,11 +164,12 @@ func TestProxyBuilder(t *testing.T) {
name: "should pass with secure grpc connection and valid TLS Client settings",
grpcBuilder: &ConnBuilder{
CollectorHostPorts: []string{"localhost:0000"},
TLS: tlscfg.Options{
Enabled: true,
CAPath: testCertKeyLocation + "/wrong-CA-cert.pem",
CertPath: testCertKeyLocation + "/example-client-cert.pem",
KeyPath: testCertKeyLocation + "/example-client-key.pem",
TLS: &configtls.ClientConfig{
Config: configtls.Config{
CAFile: testCertKeyLocation + "/wrong-CA-cert.pem",
CertFile: testCertKeyLocation + "/example-client-cert.pem",
KeyFile: testCertKeyLocation + "/example-client-key.pem",
},
},
},
expectError: false,
Expand Down Expand Up @@ -197,7 +200,7 @@ func TestProxyBuilder(t *testing.T) {
func TestProxyClientTLS(t *testing.T) {
tests := []struct {
name string
clientTLS tlscfg.Options
clientTLS *configtls.ClientConfig
serverTLS tlscfg.Options
expectError bool
}{
Expand All @@ -207,7 +210,7 @@ func TestProxyClientTLS(t *testing.T) {
},
{
name: "should fail with TLS client to non-TLS server",
clientTLS: tlscfg.Options{Enabled: true},
clientTLS: &configtls.ClientConfig{},
expectError: true,
},
{
Expand All @@ -217,8 +220,7 @@ func TestProxyClientTLS(t *testing.T) {
CertPath: testCertKeyLocation + "/example-server-cert.pem",
KeyPath: testCertKeyLocation + "/example-server-key.pem",
},
clientTLS: tlscfg.Options{
Enabled: true,
clientTLS: &configtls.ClientConfig{
ServerName: "example.com",
},
expectError: true,
Expand All @@ -230,9 +232,10 @@ func TestProxyClientTLS(t *testing.T) {
CertPath: testCertKeyLocation + "/example-server-cert.pem",
KeyPath: testCertKeyLocation + "/example-server-key.pem",
},
clientTLS: tlscfg.Options{
Enabled: true,
CAPath: testCertKeyLocation + "/example-CA-cert.pem",
clientTLS: &configtls.ClientConfig{
Config: configtls.Config{
CAFile: testCertKeyLocation + "/example-CA-cert.pem",
},
},
expectError: true,
},
Expand All @@ -243,9 +246,10 @@ func TestProxyClientTLS(t *testing.T) {
CertPath: testCertKeyLocation + "/example-server-cert.pem",
KeyPath: testCertKeyLocation + "/example-server-key.pem",
},
clientTLS: tlscfg.Options{
Enabled: true,
CAPath: testCertKeyLocation + "/example-CA-cert.pem",
clientTLS: &configtls.ClientConfig{
Config: configtls.Config{
CAFile: testCertKeyLocation + "/example-CA-cert.pem",
},
ServerName: "example.com",
},
expectError: false,
Expand All @@ -258,9 +262,10 @@ func TestProxyClientTLS(t *testing.T) {
KeyPath: testCertKeyLocation + "/example-server-key.pem",
ClientCAPath: testCertKeyLocation + "/example-CA-cert.pem",
},
clientTLS: tlscfg.Options{
Enabled: true,
CAPath: testCertKeyLocation + "/example-CA-cert.pem",
clientTLS: &configtls.ClientConfig{
Config: configtls.Config{
CAFile: testCertKeyLocation + "/example-CA-cert.pem",
},
ServerName: "example.com",
},
expectError: true,
Expand All @@ -273,12 +278,13 @@ func TestProxyClientTLS(t *testing.T) {
KeyPath: testCertKeyLocation + "/example-server-key.pem",
ClientCAPath: testCertKeyLocation + "/wrong-CA-cert.pem", // NB: wrong CA
},
clientTLS: tlscfg.Options{
Enabled: true,
CAPath: testCertKeyLocation + "/example-CA-cert.pem",
clientTLS: &configtls.ClientConfig{
Config: configtls.Config{
CAFile: testCertKeyLocation + "/example-CA-cert.pem",
CertFile: testCertKeyLocation + "/example-client-cert.pem",
KeyFile: testCertKeyLocation + "/example-client-key.pem",
},
ServerName: "example.com",
CertPath: testCertKeyLocation + "/example-client-cert.pem",
KeyPath: testCertKeyLocation + "/example-client-key.pem",
},
expectError: true,
},
Expand All @@ -290,12 +296,13 @@ func TestProxyClientTLS(t *testing.T) {
KeyPath: testCertKeyLocation + "/example-server-key.pem",
ClientCAPath: testCertKeyLocation + "/example-CA-cert.pem",
},
clientTLS: tlscfg.Options{
Enabled: true,
CAPath: testCertKeyLocation + "/example-CA-cert.pem",
clientTLS: &configtls.ClientConfig{
Config: configtls.Config{
CAFile: testCertKeyLocation + "/example-CA-cert.pem",
CertFile: testCertKeyLocation + "/example-client-cert.pem",
KeyFile: testCertKeyLocation + "/example-client-key.pem",
},
ServerName: "example.com",
CertPath: testCertKeyLocation + "/example-client-cert.pem",
KeyPath: testCertKeyLocation + "/example-client-key.pem",
},
expectError: false,
},
Expand All @@ -308,12 +315,10 @@ func TestProxyClientTLS(t *testing.T) {
defer cancel()
var opts []grpc.ServerOption
if test.serverTLS.Enabled {
tlsCfg, err := test.serverTLS.Config(zap.NewNop())
tlsCfg, err := test.serverTLS.ToOtelServerConfig().LoadTLSConfig(ctx)
mahadzaryab1 marked this conversation as resolved.
Show resolved Hide resolved
require.NoError(t, err)
opts = []grpc.ServerOption{grpc.Creds(credentials.NewTLS(tlsCfg))}
}

defer test.serverTLS.Close()
spanHandler := &mockSpanHandler{}
s, addr := initializeGRPCTestServer(t, func(s *grpc.Server) {
api_v2.RegisterCollectorServiceServer(s, spanHandler)
Expand Down
16 changes: 6 additions & 10 deletions cmd/agent/app/reporter/grpc/collector_proxy.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,6 @@ package grpc
import (
"context"
"errors"
"io"

"go.uber.org/zap"
"google.golang.org/grpc"
Expand All @@ -19,10 +18,9 @@ import (

// ProxyBuilder holds objects communicating with collector
type ProxyBuilder struct {
reporter *reporter.ClientMetricsReporter
manager configmanager.ClientConfigManager
conn *grpc.ClientConn
tlsCloser io.Closer
reporter *reporter.ClientMetricsReporter
manager configmanager.ClientConfigManager
conn *grpc.ClientConn
}

// NewCollectorProxy creates ProxyBuilder
Expand All @@ -40,10 +38,9 @@ func NewCollectorProxy(ctx context.Context, builder *ConnBuilder, agentTags map[
MetricsFactory: mFactory,
})
return &ProxyBuilder{
conn: conn,
reporter: r3,
manager: configmanager.WrapWithMetrics(grpcManager.NewConfigManager(conn), grpcMetrics),
tlsCloser: &builder.TLS,
conn: conn,
reporter: r3,
manager: configmanager.WrapWithMetrics(grpcManager.NewConfigManager(conn), grpcMetrics),
}, nil
}

Expand All @@ -66,7 +63,6 @@ func (b ProxyBuilder) GetManager() configmanager.ClientConfigManager {
func (b ProxyBuilder) Close() error {
return errors.Join(
b.reporter.Close(),
b.tlsCloser.Close(),
b.GetConn().Close(),
)
}
5 changes: 4 additions & 1 deletion cmd/agent/app/reporter/grpc/flags.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,10 @@
if err != nil {
return b, fmt.Errorf("failed to process TLS options: %w", err)
}
b.TLS = tls
if tls.Enabled {
tlsConf := tls.ToOtelClientConfig()
b.TLS = &tlsConf
}

Check warning on line 50 in cmd/agent/app/reporter/grpc/flags.go

View check run for this annotation

Codecov / codecov/patch

cmd/agent/app/reporter/grpc/flags.go#L48-L50 

Added lines #L48 - L50 were not covered by tests
yurishkuro marked this conversation as resolved.
Show resolved Hide resolved
b.DiscoveryMinPeers = v.GetInt(discoveryMinPeers)
return b, nil
}
Loading
Loading