HTTPS sender

[iori-yja]

Requirement - what kind of business use case are you trying to solve?

Posting to a collector over the internet, TLS support is desired.

Usecase: Tracing AWS lambda outside of any VPC to talk a collector in a VPC.

cf: jaegertracing/jaeger#458

Problem - what in Jaeger blocks you from solving the requirement?

Currently, jaeger-collector doesn't support TLS. Besides the situation, it maybe possible to encrypt the communication by a sidecar. The problem is the reporter lacking TLS support, because the application is wanted not to have any sidecar in some of those circumstances.

Proposal - what do you suggest to solve the problem or improve the existing situation?

HttpSender uses OkHttp3 which has TLS support. So, in some sense, the solution is already in the middle of the way.
What it supposed to be good to have are:

• Explicit indication of use of TLS (like public Builder withTls(boolean))
• Trustable certificate injection (using CertificatePinner)

Any open questions to address

• More usecase (I don't know but client tracing can be made possible by this?)
• More straightforward implementation direction

[iori-yja]

On this README.md, there are no mention to HTTPS, but in the source code, the endpoint example is https-schemed, even though the same note on the document is in http.

Both of them are introduced in a same commit: 9c6d3a5.
Do you have any idea what the intention was?

[jpkrohling]

From what I remember, this should just work, as long as the cert is trusted by the JVM. Setting the JAEGER_ENDPOINT to an HTTPS schema should be sufficient. Are you facing any specific issues?

[iori-yja]

@jpkrohling Thank you. So, probably adding additional options to pin server certificate would increase the security when using self-signed certificate (communication between server application and its backend is one of few situations which self-signed certificates are acceptable, if it verifies its identity by another mean, including pinning).

I will work for adding pinning feature, but I am not sure how to verify client identity. Is bearer enough? Or do you have better idea?

[jpkrohling]

how to verify client identity

Not sure I follow -- we have already client auth support via basic auth and bearer tokens. See the documentation for the env vars JAEGER_AUTH_TOKEN, JAEGER_USER and JAEGER_PASSWORD.

[iori-yja]

OK, so the identification should be done on HTTP layer (like using token), not in transport layer.

[jpkrohling]

Do you mean, as opposed to a client cert auth? I would have nothing against a PR adding support for client cert auth.

[iori-yja]

Oh, sorry. I wasn't sure whether I should add client auth, but it seems that is negligible for now. Even though I thought I should care about client auth when I started this topic, I think they can be different topic. Concealing those authentication token and basic credentials should come first.

[iori-yja]

made a PR: #602