diff --git a/.chloggen/service_telemetry_metrics_ca_cert.yaml b/.chloggen/service_telemetry_metrics_ca_cert.yaml new file mode 100644 index 00000000000..d99b32e5f11 --- /dev/null +++ b/.chloggen/service_telemetry_metrics_ca_cert.yaml @@ -0,0 +1,25 @@ +# Use this changelog template to create an entry for release notes. + +# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix' +change_type: enhancement + +# The name of the component, or a single word describing the area of concern, (e.g. otlpreceiver) +component: service + +# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`). +note: Add support for ca certificates in telemetry metrics otlp grpc exporter + +# One or more tracking issues or pull requests related to the change +issues: [11633] + +# (Optional) One or more lines of additional information to render under the primary note. +# These lines will be padded with 2 spaces and then inserted directly into the document. +# Use pipe (|) for multiline entries. +subtext: Before this change the Certificate value in config was silently ignored. + +# Optional: The change log or logs in which this entry should be included. +# e.g. '[user]' or '[user, api]' +# Include 'user' if the change is relevant to end users. +# Include 'api' if there is a change to a library API. +# Default: '[user]' +change_logs: [] diff --git a/service/go.mod b/service/go.mod index a07d88e8023..4f160c8bc97 100644 --- a/service/go.mod +++ b/service/go.mod @@ -60,6 +60,7 @@ require ( go.uber.org/multierr v1.11.0 go.uber.org/zap v1.27.0 gonum.org/v1/gonum v0.15.1 + google.golang.org/grpc v1.67.1 ) require ( @@ -120,7 +121,6 @@ require ( golang.org/x/text v0.20.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20241104194629-dd2ea8efbc28 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20241104194629-dd2ea8efbc28 // indirect - google.golang.org/grpc v1.67.1 // indirect google.golang.org/protobuf v1.35.2 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect ) diff --git a/service/telemetry/internal/otelinit/config.go b/service/telemetry/internal/otelinit/config.go index 402090675ac..bb75023f204 100644 --- a/service/telemetry/internal/otelinit/config.go +++ b/service/telemetry/internal/otelinit/config.go @@ -29,6 +29,7 @@ import ( sdkmetric "go.opentelemetry.io/otel/sdk/metric" "go.opentelemetry.io/otel/sdk/metric/metricdata" "go.opentelemetry.io/otel/sdk/resource" + "google.golang.org/grpc/credentials" semconv "go.opentelemetry.io/collector/semconv/v1.18.0" ) @@ -224,6 +225,12 @@ func initOTLPgRPCExporter(ctx context.Context, otlpConfig *config.OTLPMetric) (s opts = append(opts, otlpmetricgrpc.WithEndpoint(u.Host)) if u.Scheme == "http" { opts = append(opts, otlpmetricgrpc.WithInsecure()) + } else if otlpConfig.Certificate != nil { + creds, err := credentials.NewClientTLSFromFile(*otlpConfig.Certificate, "") + if err != nil { + return nil, fmt.Errorf("could not create client tls credentials: %w", err) + } + opts = append(opts, otlpmetricgrpc.WithTLSCredentials(creds)) } } diff --git a/service/telemetry/internal/otelinit/config_test.go b/service/telemetry/internal/otelinit/config_test.go index 02974fa11e4..5041a9d322c 100644 --- a/service/telemetry/internal/otelinit/config_test.go +++ b/service/telemetry/internal/otelinit/config_test.go @@ -6,7 +6,9 @@ package otelinit import ( "context" "errors" + "fmt" "net/url" + "path/filepath" "reflect" "sync" "testing" @@ -527,6 +529,46 @@ func TestMetricReader(t *testing.T) { }, wantErr: errors.New("unsupported temporality preference \"invalid\""), }, + { + name: "periodic/otlp-grpc-good-ca-certificate", + reader: config.MetricReader{ + Periodic: &config.PeriodicMetricReader{ + Exporter: config.MetricExporter{ + OTLP: &config.OTLPMetric{ + Protocol: "grpc/protobuf", + Endpoint: "https://localhost:4317", + Compression: strPtr("gzip"), + Timeout: intPtr(1000), + Certificate: strPtr(filepath.Join("testdata", "ca.crt")), + Headers: map[string]string{ + "test": "test1", + }, + }, + }, + }, + }, + wantReader: sdkmetric.NewPeriodicReader(otlpGRPCExporter), + }, + { + name: "periodic/otlp-grpc-bad-ca-certificate", + reader: config.MetricReader{ + Periodic: &config.PeriodicMetricReader{ + Exporter: config.MetricExporter{ + OTLP: &config.OTLPMetric{ + Protocol: "grpc/protobuf", + Endpoint: "https://localhost:4317", + Compression: strPtr("gzip"), + Timeout: intPtr(1000), + Certificate: strPtr(filepath.Join("testdata", "bad_cert.crt")), + Headers: map[string]string{ + "test": "test1", + }, + }, + }, + }, + }, + wantErr: fmt.Errorf("could not create client tls credentials: %w", errors.New("credentials: failed to append certificates")), + }, } for _, tt := range testCases { t.Run(tt.name, func(t *testing.T) { diff --git a/service/telemetry/internal/otelinit/testdata/bad_cert.crt b/service/telemetry/internal/otelinit/testdata/bad_cert.crt new file mode 100644 index 00000000000..e79f3ba5c04 --- /dev/null +++ b/service/telemetry/internal/otelinit/testdata/bad_cert.crt @@ -0,0 +1 @@ +This is intentionally not a PEM formatted cert file. \ No newline at end of file diff --git a/service/telemetry/internal/otelinit/testdata/ca.crt b/service/telemetry/internal/otelinit/testdata/ca.crt new file mode 100644 index 00000000000..2272f84e64d --- /dev/null +++ b/service/telemetry/internal/otelinit/testdata/ca.crt @@ -0,0 +1,20 @@ +-----BEGIN CERTIFICATE----- +MIIDNjCCAh4CCQC0I5IQT7eziDANBgkqhkiG9w0BAQsFADBdMQswCQYDVQQGEwJB +VTESMBAGA1UECAwJQXVzdHJhbGlhMQ8wDQYDVQQHDAZTeWRuZXkxEjAQBgNVBAoM +CU15T3JnTmFtZTEVMBMGA1UEAwwMTXlDb21tb25OYW1lMB4XDTIyMDgwMzA0MTky +MVoXDTMyMDczMTA0MTkyMVowXTELMAkGA1UEBhMCQVUxEjAQBgNVBAgMCUF1c3Ry +YWxpYTEPMA0GA1UEBwwGU3lkbmV5MRIwEAYDVQQKDAlNeU9yZ05hbWUxFTATBgNV +BAMMDE15Q29tbW9uTmFtZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB +AMhGP0dy3zvkdx9zI+/XVjPOWlER0OUp7Sgzidc3nLOk42+bH4ofIVNtOFVqlNKi +O1bImu238VdBhd6R5IZZ1ZdIMcCeDgSJYu2X9wA3m4PKz8IdXo5ly2OHghhmCvqG +WxgqDj5wPXiczQwuf1EcDMtRWbXJ6Z/XH1U68R/kRdNLkiZ2LwtjoQpis5XYckLL +CrdF+AL6GeDIe0Mh9QGs26Vux+2kvaOGNUWRPE6Wt4GkqyKqmzYfR9HbflJ4xHT2 +I+jE1lg+jMBeom7z8Z90RE4GGcHjO+Vens/88r5EAjTnFj1Kb5gL2deSHY1m/++R +Z/kRyg+zQJyw4fAzlAA4+VkCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAM3gRdTKX +eGwGYVmmKqA2vTxeigQYLHml7OSopcWj2wJfxfp49HXPRuvgpQn9iubxO3Zmhd83 +2X1E+T0A8oy5CfxgpAhHb3lY0jm3TjKXm6m+dSODwL3uND8tX+SqR8sRTFxPvPuo +pmvhdTZoRI3EzIiHLTgCuSU25JNP/vrVoKk0JvCkDYTU/WcVfj0v95DTMoWR4JGz +mtBwrgD0EM2XRw5ZMc7sMPli1gqmCbCQUrDZ+rPB78WDCBILBd8Cz75qYTUp98BY +akJyBckdJHAdyEQYDKa9HpmpexOO7IhSXCTEN1DEBgpZgEi/lBDRG/b0OzenUUgt +LUABtWt3pNQ9HA== +-----END CERTIFICATE-----