Skip to content

Commit 5b99c12

Browse files
rubenvp8510rubenvp8510
committed
Add watcher to TLS certificates
Signed-off-by: Ruben Vargas <[email protected]>
1 parent 023701d commit 5b99c12

File tree

13 files changed

+784
-121
lines changed

13 files changed

+784
-121
lines changed

‎README.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,8 @@ Usage of ./observatorium-api:
113113
File containing the TLS client certificates to authenticate against upstream logs servers. Leave blank to disable mTLS.
114114
-logs.tls.key-file string
115115
File containing the TLS client key to authenticate against upstream logs servers. Leave blank to disable mTLS.
116+
-logs.tls.watch-certs
117+
Watch for certificate changes and reload
116118
-logs.write-timeout duration
117119
The HTTP write timeout for proxied requests to the logs endpoint. (default 10m0s)
118120
-logs.write.endpoint string
@@ -133,6 +135,8 @@ Usage of ./observatorium-api:
133135
File containing the TLS client certificates to authenticate against upstream logs servers. Leave blank to disable mTLS.
134136
-metrics.tls.key-file string
135137
File containing the TLS client key to authenticate against upstream metrics servers. Leave blank to disable mTLS.
138+
-metrics.tls.watch-certs
139+
Watch for certificate changes and reload
136140
-metrics.write-timeout duration
137141
The HTTP write timeout for proxied requests to the metrics endpoint. (default 2m0s)
138142
-metrics.write.endpoint string
@@ -193,6 +197,8 @@ Usage of ./observatorium-api:
193197
File containing the TLS client certificates to authenticate against upstream logs servers. Leave blank to disable mTLS.
194198
-traces.tls.key-file string
195199
File containing the TLS client key to authenticate against upstream traces servers. Leave blank to disable mTLS.
200+
-traces.tls.watch-certs
201+
Watch for certificate changes and reload
196202
-traces.write-timeout duration
197203
The HTTP write timeout for proxied requests to the traces endpoint. (default 2m0s)
198204
-traces.write.otlpgrpc.endpoint string

‎api/logs/v1/http.go

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22
package http
33

44
import (
5-
stdtls "crypto/tls"
65
"net"
76
"net/http"
87
"net/http/httputil"
@@ -145,7 +144,7 @@ func (n nopInstrumentHandler) NewHandler(labels prometheus.Labels, handler http.
145144
return handler.ServeHTTP
146145
}
147146

148-
func NewHandler(read, tail, write, rules *url.URL, rulesReadOnly bool, upstreamCA []byte, upstreamCert *stdtls.Certificate, opts ...HandlerOption) http.Handler {
147+
func NewHandler(read, tail, write, rules *url.URL, rulesReadOnly bool, tlsOptions *tls.UpstreamOptions, opts ...HandlerOption) http.Handler {
149148
c := &handlerConfiguration{
150149
logger: log.NewNopLogger(),
151150
registry: prometheus.NewRegistry(),
@@ -172,7 +171,7 @@ func NewHandler(read, tail, write, rules *url.URL, rulesReadOnly bool, upstreamC
172171
DialContext: (&net.Dialer{
173172
Timeout: dialTimeout,
174173
}).DialContext,
175-
TLSClientConfig: tls.NewClientConfig(upstreamCA, upstreamCert),
174+
TLSClientConfig: tlsOptions.NewClientConfig(),
176175
}
177176

178177
proxyRead = &httputil.ReverseProxy{
@@ -240,7 +239,7 @@ func NewHandler(read, tail, write, rules *url.URL, rulesReadOnly bool, upstreamC
240239
DialContext: (&net.Dialer{
241240
Timeout: dialTimeout,
242241
}).DialContext,
243-
TLSClientConfig: tls.NewClientConfig(upstreamCA, upstreamCert),
242+
TLSClientConfig: tlsOptions.NewClientConfig(),
244243
}
245244

246245
proxyReadRules = &httputil.ReverseProxy{
@@ -340,7 +339,7 @@ func NewHandler(read, tail, write, rules *url.URL, rulesReadOnly bool, upstreamC
340339
DialContext: (&net.Dialer{
341340
Timeout: dialTimeout,
342341
}).DialContext,
343-
TLSClientConfig: tls.NewClientConfig(upstreamCA, upstreamCert),
342+
TLSClientConfig: tlsOptions.NewClientConfig(),
344343
}
345344

346345
tailRead = &httputil.ReverseProxy{
@@ -376,7 +375,7 @@ func NewHandler(read, tail, write, rules *url.URL, rulesReadOnly bool, upstreamC
376375
DialContext: (&net.Dialer{
377376
Timeout: dialTimeout,
378377
}).DialContext,
379-
TLSClientConfig: tls.NewClientConfig(upstreamCA, upstreamCert),
378+
TLSClientConfig: tlsOptions.NewClientConfig(),
380379
}
381380

382381
proxyWrite = &httputil.ReverseProxy{

‎api/metrics/legacy/http.go

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
package legacy
22

33
import (
4-
stdtls "crypto/tls"
54
"net"
65
"net/http"
76
"net/http/httputil"
@@ -102,7 +101,7 @@ func (n nopInstrumentHandler) NewHandler(_ prometheus.Labels, handler http.Handl
102101
return handler.ServeHTTP
103102
}
104103

105-
func NewHandler(url *url.URL, upstreamCA []byte, upstreamCert *stdtls.Certificate, opts ...HandlerOption) http.Handler {
104+
func NewHandler(url *url.URL, tlsOptions *tls.UpstreamOptions, opts ...HandlerOption) http.Handler {
106105
c := &handlerConfiguration{
107106
logger: log.NewNopLogger(),
108107
registry: prometheus.NewRegistry(),
@@ -130,7 +129,7 @@ func NewHandler(url *url.URL, upstreamCA []byte, upstreamCert *stdtls.Certificat
130129
DialContext: (&net.Dialer{
131130
Timeout: dialTimeout,
132131
}).DialContext,
133-
TLSClientConfig: tls.NewClientConfig(upstreamCA, upstreamCert),
132+
TLSClientConfig: tlsOptions.NewClientConfig(),
134133
}
135134

136135
legacyProxy = &httputil.ReverseProxy{

‎api/metrics/v1/http.go

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
package v1
22

33
import (
4-
stdtls "crypto/tls"
54
"net"
65
"net/http"
76
"net/http/httputil"
@@ -174,7 +173,7 @@ type Endpoints struct {
174173

175174
// NewHandler creates the new metrics v1 handler.
176175
// nolint:funlen
177-
func NewHandler(endpoints Endpoints, upstreamCA []byte, upstreamCert *stdtls.Certificate, opts ...HandlerOption) http.Handler {
176+
func NewHandler(endpoints Endpoints, tlsOptions *tls.UpstreamOptions, opts ...HandlerOption) http.Handler {
178177
c := &handlerConfiguration{
179178
logger: log.NewNopLogger(),
180179
registry: prometheus.NewRegistry(),
@@ -258,7 +257,7 @@ func NewHandler(endpoints Endpoints, upstreamCA []byte, upstreamCert *stdtls.Cer
258257
DialContext: (&net.Dialer{
259258
Timeout: dialTimeout,
260259
}).DialContext,
261-
TLSClientConfig: tls.NewClientConfig(upstreamCA, upstreamCert),
260+
TLSClientConfig: tlsOptions.NewClientConfig(),
262261
}
263262

264263
proxyRead = &httputil.ReverseProxy{
@@ -345,7 +344,7 @@ func NewHandler(endpoints Endpoints, upstreamCA []byte, upstreamCert *stdtls.Cer
345344
)
346345

347346
t := http.DefaultTransport.(*http.Transport)
348-
t.TLSClientConfig = tls.NewClientConfig(upstreamCA, upstreamCert)
347+
t.TLSClientConfig = tlsOptions.NewClientConfig()
349348

350349
uiProxy = &httputil.ReverseProxy{
351350
Director: middlewares,
@@ -384,7 +383,7 @@ func NewHandler(endpoints Endpoints, upstreamCA []byte, upstreamCert *stdtls.Cer
384383
DialContext: (&net.Dialer{
385384
Timeout: dialTimeout,
386385
}).DialContext,
387-
TLSClientConfig: tls.NewClientConfig(upstreamCA, upstreamCert),
386+
TLSClientConfig: tlsOptions.NewClientConfig(),
388387
}
389388

390389
proxyWrite = &httputil.ReverseProxy{
@@ -469,7 +468,7 @@ func NewHandler(endpoints Endpoints, upstreamCA []byte, upstreamCert *stdtls.Cer
469468
DialContext: (&net.Dialer{
470469
Timeout: dialTimeout,
471470
}).DialContext,
472-
TLSClientConfig: tls.NewClientConfig(upstreamCA, upstreamCert),
471+
TLSClientConfig: tlsOptions.NewClientConfig(),
473472
}
474473

475474
proxyAlertmanager = &httputil.ReverseProxy{

‎api/traces/v1/api.go

Lines changed: 7 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@ package v1
22

33
import (
44
"context"
5-
stdtls "crypto/tls"
65
"time"
76

87
"github.com/go-kit/log"
@@ -18,9 +17,8 @@ import (
1817
const TraceRoute = "/opentelemetry.proto.collector.trace.v1.TraceService/Export"
1918

2019
type connOptions struct {
21-
logger log.Logger
22-
tracesUpstreamCert *stdtls.Certificate
23-
tracesUpstreamCA []byte
20+
logger log.Logger
21+
tlsOptions *tls.UpstreamOptions
2422
}
2523

2624
// ClientOption modifies the connection's configuration.
@@ -33,15 +31,14 @@ func WithLogger(logger log.Logger) ClientOption {
3331
}
3432
}
3533

36-
func WithUpstreamTLS(tracesUpstreamCA []byte, tracesUpstreamCert *stdtls.Certificate) ClientOption {
34+
func WithUpstreamTLSOptions(tlsOptions *tls.UpstreamOptions) ClientOption {
3735
return func(h *connOptions) {
38-
h.tracesUpstreamCA = tracesUpstreamCA
39-
h.tracesUpstreamCert = tracesUpstreamCert
36+
h.tlsOptions = tlsOptions
4037
}
4138
}
4239

43-
func newCredentials(upstreamCA []byte, upstreamCert *stdtls.Certificate) credentials.TransportCredentials {
44-
tlsConfig := tls.NewClientConfig(upstreamCA, upstreamCert)
40+
func newCredentials(tlsOptions *tls.UpstreamOptions) credentials.TransportCredentials {
41+
tlsConfig := tlsOptions.NewClientConfig()
4542
if tlsConfig == nil {
4643
return insecure.NewCredentials()
4744
}
@@ -70,5 +67,5 @@ func NewOTelConnection(write string, opts ...ClientOption) (*grpc.ClientConn, er
7067
// because the codec we need to register is also deprecated. A better fix, is the newer
7168
// version of mwitkow/grpc-proxy, but that version doesn't (currently) work with OTel protocol.
7269
grpc.WithCodec(grpcproxy.Codec()), // nolint: staticcheck
73-
grpc.WithTransportCredentials(newCredentials(c.tracesUpstreamCA, c.tracesUpstreamCert)))
70+
grpc.WithTransportCredentials(newCredentials(c.tlsOptions)))
7471
}

‎api/traces/v1/http.go

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ import (
44
"bytes"
55
"compress/flate"
66
"compress/gzip"
7-
stdtls "crypto/tls"
87
"fmt"
98
"io"
109
"net"
@@ -109,7 +108,7 @@ func (n nopInstrumentHandler) NewHandler(labels prometheus.Labels, handler http.
109108
// The web UI handler is able to rewrite
110109
// HTML to change the <base> attribute so that it works with the Observatorium-style
111110
// "/api/v1/traces/{tenant}/" URLs.
112-
func NewV2Handler(read *url.URL, readTemplate string, tempo *url.URL, writeOTLPHttp *url.URL, upstreamCA []byte, upstreamCert *stdtls.Certificate, opts ...HandlerOption) http.Handler {
111+
func NewV2Handler(read *url.URL, readTemplate string, tempo *url.URL, writeOTLPHttp *url.URL, tlsOptions *tls.UpstreamOptions, opts ...HandlerOption) http.Handler {
113112

114113
if read == nil && readTemplate == "" && tempo == nil {
115114
panic("missing Jaeger read url")
@@ -152,7 +151,7 @@ func NewV2Handler(read *url.URL, readTemplate string, tempo *url.URL, writeOTLPH
152151
DialContext: (&net.Dialer{
153152
Timeout: dialTimeout,
154153
}).DialContext,
155-
TLSClientConfig: tls.NewClientConfig(upstreamCA, upstreamCert),
154+
TLSClientConfig: tlsOptions.NewClientConfig(),
156155
}
157156

158157
proxyRead = &httputil.ReverseProxy{
@@ -203,7 +202,7 @@ func NewV2Handler(read *url.URL, readTemplate string, tempo *url.URL, writeOTLPH
203202
DialContext: (&net.Dialer{
204203
Timeout: dialTimeout,
205204
}).DialContext,
206-
TLSClientConfig: tls.NewClientConfig(upstreamCA, upstreamCert),
205+
TLSClientConfig: tlsOptions.NewClientConfig(),
207206
}
208207

209208
proxyOTLP := &httputil.ReverseProxy{
@@ -229,7 +228,7 @@ func NewV2Handler(read *url.URL, readTemplate string, tempo *url.URL, writeOTLPH
229228
DialContext: (&net.Dialer{
230229
Timeout: dialTimeout,
231230
}).DialContext,
232-
TLSClientConfig: tls.NewClientConfig(upstreamCA, upstreamCert),
231+
TLSClientConfig: tlsOptions.NewClientConfig(),
233232
}
234233

235234
middlewares := proxy.Middlewares(

‎go.mod

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ require (
3535
github.com/prometheus/common v0.53.0
3636
github.com/prometheus/prometheus v0.50.1
3737
github.com/redis/rueidis v1.0.37
38+
github.com/stretchr/testify v1.9.0
3839
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.52.0
3940
go.opentelemetry.io/contrib/propagators/jaeger v1.26.0
4041
go.opentelemetry.io/otel v1.27.0
@@ -159,7 +160,6 @@ require (
159160
github.com/schollz/closestmatch v2.1.0+incompatible // indirect
160161
github.com/sirupsen/logrus v1.9.3 // indirect
161162
github.com/spf13/pflag v1.0.5 // indirect
162-
github.com/stretchr/testify v1.9.0 // indirect
163163
github.com/tchap/go-patricia/v2 v2.3.1 // indirect
164164
github.com/tdewolff/minify/v2 v2.12.9 // indirect
165165
github.com/tdewolff/parse/v2 v2.6.8 // indirect

0 commit comments

Comments
 (0)