Add support to TLSSetting to not only read from file path, but from memory #7676

erikbaranowski · 2023-05-15T19:41:27Z

Description: This implements a version of the proposed changes requested in the linked issue.

Related: A PR accomplishing similar was accepted into Prometheus recently.

Link to tracking Issue: #7313

Testing: Added tests for a variety of scenarios around filepath vs in memory certs.

Documentation: Added new parameters to the README

Signed-off-by: erikbaranowski <39704712+erikbaranowski@users.noreply.github.com>

linux-foundation-easycla · 2023-05-15T19:41:31Z

The committers listed above are authorized under a signed CLA.

✅ login: erikbaranowski / name: Erik Baranowski (b27d57c, 1f6075e, f52858a)

config/configtls/README.md

erikbaranowski · 2023-05-16T13:55:51Z

I have been poking at the unit test issue and I noticed this isn't the only PR getting it.

#7486
https://github.com/open-telemetry/opentelemetry-collector/actions/runs/4983229007/jobs/8919996685

EDIT: I can recreate with go test -race -timeout 120s -run TestErrorRecordedIfFileDeleted

erikbaranowski · 2023-05-16T14:01:54Z

Found the related issue I think #7537

jpkrohling

This looks good to me. I feel like there's an opportunity to optimize the periodic reloading of certs if the PEM-encoded string was provided, but I recognize that this PR solves a concrete problem already.

jpkrohling · 2023-05-16T16:33:55Z

config/configtls/configtls.go

+
+	switch {
+	case c.hasCAFile() && c.hasCAPem():
+		return nil, fmt.Errorf("failed to load CA CertPool: CA File and PEM cannot both be provided")


It would be nice to get a native speaker to check this wording, as it sounds a bit strange to my ears. I would use something like:

failed to load CA CertPool: provide either a CA file or the PEM-encoded string, but not both

I updated some of the verbiage to match the suggested pattern. Let me know if you think more needs to be changed. It's no big deal on my end.

Signed-off-by: erikbaranowski <39704712+erikbaranowski@users.noreply.github.com>

mx-psi · 2023-05-17T11:24:26Z

Tests need fixing (not related to #7537 AFAICT)

--- FAIL: TestOptionsToConfig (0.02s)
    --- FAIL: TestOptionsToConfig/should_fail_with_missing_TLS_KeyFile (0.00s)
        configtls_test.go:236: 
            	Error Trace:	/home/runner/work/opentelemetry-collector/opentelemetry-collector/config/configtls/configtls_test.go:236
            	Error:      	"failed to load TLS cert and key: for auth via TLS, provide both certificate and key, or neither" does not contain "both certificate and key must be supplied"
            	Test:       	TestOptionsToConfig/should_fail_with_missing_TLS_KeyFile
    --- FAIL: TestOptionsToConfig/should_fail_with_missing_TLS_Cert (0.00s)
        configtls_test.go:236: 
            	Error Trace:	/home/runner/work/opentelemetry-collector/opentelemetry-collector/config/configtls/configtls_test.go:236
            	Error:      	"failed to load TLS cert and key: for auth via TLS, provide both certificate and key, or neither" does not contain "both certificate and key must be supplied"
            	Test:       	TestOptionsToConfig/should_fail_with_missing_TLS_Cert
    --- FAIL: TestOptionsToConfig/should_fail_Cert_file_and_PEM_both_provided (0.00s)
        configtls_test.go:236: 
            	Error Trace:	/home/runner/work/opentelemetry-collector/opentelemetry-collector/config/configtls/configtls_test.go:236
            	Error:      	"failed to load TLS cert and key: for auth via TLS, provide either a certificate or the PEM-encoded string, but not both" does not contain "for auth via TLS, certificate file and PEM cannot both be provided"
            	Test:       	TestOptionsToConfig/should_fail_Cert_file_and_PEM_both_provided
    --- FAIL: TestOptionsToConfig/should_fail_Key_file_and_PEM_both_provided (0.00s)
        configtls_test.go:236: 
            	Error Trace:	/home/runner/work/opentelemetry-collector/opentelemetry-collector/config/configtls/configtls_test.go:236
            	Error:      	"failed to load TLS cert and key: for auth via TLS, provide either a key or the PEM-encoded string, but not both" does not contain "for auth via TLS, key file and PEM cannot both be provided"
            	Test:       	TestOptionsToConfig/should_fail_Key_file_and_PEM_both_provided
    --- FAIL: TestOptionsToConfig/should_fail_with_missing_TLS_KeyPem (0.00s)
        configtls_test.go:236: 
            	Error Trace:	/home/runner/work/opentelemetry-collector/opentelemetry-collector/config/configtls/configtls_test.go:236
            	Error:      	"failed to load TLS cert and key: for auth via TLS, provide both certificate and key, or neither" does not contain "both certificate and key must be supplied"
            	Test:       	TestOptionsToConfig/should_fail_with_missing_TLS_KeyPem
    --- FAIL: TestOptionsToConfig/should_fail_with_missing_TLS_Cert_PEM (0.00s)
        configtls_test.go:236: 
            	Error Trace:	/home/runner/work/opentelemetry-collector/opentelemetry-collector/config/configtls/configtls_test.go:236
            	Error:      	"failed to load TLS cert and key: for auth via TLS, provide both certificate and key, or neither" does not contain "both certificate and key must be supplied"
            	Test:       	TestOptionsToConfig/should_fail_with_missing_TLS_Cert_PEM

config/configtls/configtls.go

Signed-off-by: erikbaranowski <39704712+erikbaranowski@users.noreply.github.com>

codecov · 2023-05-18T15:39:15Z

Codecov Report

Patch coverage: 97.84% and project coverage change: -0.30 ⚠️

Comparison is base (6542100) 91.31% compared to head (762fe16) 91.02%.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7676      +/-   ##
==========================================
- Coverage   91.31%   91.02%   -0.30%     
==========================================
  Files         296      295       -1     
  Lines       14485    14617     +132     
==========================================
+ Hits        13227    13305      +78     
- Misses        995     1048      +53     
- Partials      263      264       +1

Impacted Files	Coverage Δ
config/configtls/configtls.go	`97.34% <97.84%> (-0.23%)`	⬇️

... and 294 files with indirect coverage changes

☔ View full report in Codecov by Sentry.
📢 Do you have feedback about the report comment? Let us know in this issue.

mx-psi · 2023-05-19T06:51:53Z

Tests are failing on Windows:

--- FAIL: TestHTTPServerSettingsError (0.00s)
    --- FAIL: TestHTTPServerSettingsError/failed_to_load_client_CA_CertPool:_failed_to_load_CA_/doesnt/exist:_open_/doesnt/exist: (0.00s)
        confighttp_test.go:443: 
            	Error Trace:	D:/a/opentelemetry-collector/opentelemetry-collector/config/confighttp/confighttp_test.go:443
            	Error:      	Expect "failed to load client CA CertPool: failed to load CA /doesnt/exist: open \doesnt\exist: The system cannot find the path specified." to match "failed to load client CA CertPool: failed to load CA /doesnt/exist: open /doesnt/exist:"

Now using configopaque

bogdandrutu · 2023-05-22T13:21:25Z

Need a fix on windows.

Signed-off-by: Erik Baranowski <39704712+erikbaranowski@users.noreply.github.com>

erikbaranowski · 2023-05-22T17:37:18Z

Fixed test in windows

github-actions · 2023-06-06T03:16:44Z

This PR was marked stale due to lack of activity. It will be closed in 14 days.

erikbaranowski · 2023-06-06T19:08:21Z

hey all, is there anything else needed on this PR before merge?

erikbaranowski added 3 commits May 15, 2023 15:25

Add in memory support to TLSSetting

b27d57c

Signed-off-by: erikbaranowski <39704712+erikbaranowski@users.noreply.github.com>

Add changelog

1f6075e

Signed-off-by: erikbaranowski <39704712+erikbaranowski@users.noreply.github.com>

Add documentation

f52858a

Signed-off-by: erikbaranowski <39704712+erikbaranowski@users.noreply.github.com>

erikbaranowski marked this pull request as ready for review May 15, 2023 19:47

erikbaranowski requested a review from a team as a code owner May 15, 2023 19:47

erikbaranowski requested a review from mx-psi May 15, 2023 19:47

mx-psi reviewed May 16, 2023

View reviewed changes

config/configtls/README.md Show resolved Hide resolved

jpkrohling approved these changes May 16, 2023

View reviewed changes

Update some message verbiage

be8bde0

Signed-off-by: erikbaranowski <39704712+erikbaranowski@users.noreply.github.com>

jpkrohling approved these changes May 16, 2023

View reviewed changes

mx-psi mentioned this pull request May 17, 2023

Deprecate tls::*_file in favor of tls::*_pem #7691

Closed

mx-psi approved these changes May 17, 2023

View reviewed changes

mx-psi previously requested changes May 17, 2023

View reviewed changes

config/configtls/configtls.go Outdated Show resolved Hide resolved

erikbaranowski added 3 commits May 18, 2023 11:21

Fix up test error messages

1ff5b75

Signed-off-by: erikbaranowski <39704712+erikbaranowski@users.noreply.github.com>

swap PEM properties to confiqopaque.String instead of []byte

1867541

Signed-off-by: erikbaranowski <39704712+erikbaranowski@users.noreply.github.com>

make linter happy

65e61c7

Signed-off-by: erikbaranowski <39704712+erikbaranowski@users.noreply.github.com>

Fix unit test for windows

762fe16

Signed-off-by: Erik Baranowski <39704712+erikbaranowski@users.noreply.github.com>

mx-psi approved these changes May 22, 2023

View reviewed changes

github-actions bot added the Stale label Jun 6, 2023

github-actions bot removed the Stale label Jun 7, 2023

bogdandrutu merged commit 07262f2 into open-telemetry:main Jun 7, 2023
29 checks passed

github-actions bot added this to the next release milestone Jun 7, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support to TLSSetting to not only read from file path, but from memory #7676

Add support to TLSSetting to not only read from file path, but from memory #7676

erikbaranowski commented May 15, 2023 •

edited

linux-foundation-easycla bot commented May 15, 2023 •

edited

erikbaranowski commented May 16, 2023 •

edited

erikbaranowski commented May 16, 2023

jpkrohling left a comment

jpkrohling May 16, 2023

erikbaranowski May 16, 2023

mx-psi commented May 17, 2023

codecov bot commented May 18, 2023 •

edited

mx-psi commented May 19, 2023

bogdandrutu commented May 22, 2023

erikbaranowski commented May 22, 2023

github-actions bot commented Jun 6, 2023

erikbaranowski commented Jun 6, 2023

Add support to TLSSetting to not only read from file path, but from memory #7676

Add support to TLSSetting to not only read from file path, but from memory #7676

Conversation

erikbaranowski commented May 15, 2023 • edited

linux-foundation-easycla bot commented May 15, 2023 • edited

erikbaranowski commented May 16, 2023 • edited

erikbaranowski commented May 16, 2023

jpkrohling left a comment

Choose a reason for hiding this comment

jpkrohling May 16, 2023

Choose a reason for hiding this comment

erikbaranowski May 16, 2023

Choose a reason for hiding this comment

mx-psi commented May 17, 2023

codecov bot commented May 18, 2023 • edited

Codecov Report

mx-psi commented May 19, 2023

bogdandrutu commented May 22, 2023

erikbaranowski commented May 22, 2023

github-actions bot commented Jun 6, 2023

erikbaranowski commented Jun 6, 2023

erikbaranowski commented May 15, 2023 •

edited

linux-foundation-easycla bot commented May 15, 2023 •

edited

erikbaranowski commented May 16, 2023 •

edited

codecov bot commented May 18, 2023 •

edited