Skip to content

Commit b177541

Browse files
MrAliasAneurysm9
MrAlias
and
Aneurysm9
authored
Use host root CA set by default for OTLP exporter (#2432)
* Use host CA set by default for otlptrace * Remove test for invalid default certs * Default to host CA for otlpmetric * Add changes to changelog * Update CHANGELOG.md Co-authored-by: Anthony Mirabella <[email protected]> Co-authored-by: Anthony Mirabella <[email protected]>
1 parent 2b7c650 commit b177541

File tree

9 files changed

+73
-58
lines changed

9 files changed

+73
-58
lines changed

‎CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
2121
- Changed the project minimum supported Go version from 1.15 to 1.16. (#2412)
2222
- The `"go.opentelemetry.io/otel/exporter/otel/otlpmetric/otlpmetricgrpc".Client` now uses the underlying gRPC `ClientConn` to handle name resolution, TCP connection establishment (with retries and backoff) and TLS handshakes, and handling errors on established connections by re-resolving the name and reconnecting. (#2425)
2323
- The `"go.opentelemetry.io/otel/exporter/otel/otlpmetric/otlpmetricgrpc".RetrySettings` type is renamed to `RetryConfig`. (#2425)
24+
- The `go.opentelemetry.io/otel/exporter/otel/*` gRPC exporters now default to using the host's root CA set if none are provided by the user and `WithInsecure` is not specified. (#1584, #2432)
2425

2526
### Deprecated
2627

‎exporters/otlp/otlpmetric/internal/otlpconfig/envconfig.go

Lines changed: 7 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -28,24 +28,21 @@ import (
2828
"go.opentelemetry.io/otel"
2929
)
3030

31-
var httpSchemeRegexp = regexp.MustCompile(`(?i)^http://|https://`)
31+
var (
32+
httpSchemeRegexp = regexp.MustCompile(`(?i)^(http://|https://)`)
3233

33-
func ApplyGRPCEnvConfigs(cfg *Config) {
34-
e := EnvOptionsReader{
34+
DefaultEnvOptionsReader = EnvOptionsReader{
3535
GetEnv: os.Getenv,
3636
ReadFile: ioutil.ReadFile,
3737
}
38+
)
3839

39-
e.ApplyGRPCEnvConfigs(cfg)
40+
func ApplyGRPCEnvConfigs(cfg *Config) {
41+
DefaultEnvOptionsReader.ApplyGRPCEnvConfigs(cfg)
4042
}
4143

4244
func ApplyHTTPEnvConfigs(cfg *Config) {
43-
e := EnvOptionsReader{
44-
GetEnv: os.Getenv,
45-
ReadFile: ioutil.ReadFile,
46-
}
47-
48-
e.ApplyHTTPEnvConfigs(cfg)
45+
DefaultEnvOptionsReader.ApplyHTTPEnvConfigs(cfg)
4946
}
5047

5148
type EnvOptionsReader struct {

‎exporters/otlp/otlpmetric/internal/otlpconfig/options.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,10 +97,16 @@ func NewGRPCConfig(opts ...GRPCOption) Config {
9797
if cfg.ServiceConfig != "" {
9898
cfg.DialOptions = append(cfg.DialOptions, grpc.WithDefaultServiceConfig(cfg.ServiceConfig))
9999
}
100+
// Priroritize GRPCCredentials over Insecure (passing both is an error).
100101
if cfg.Metrics.GRPCCredentials != nil {
101102
cfg.DialOptions = append(cfg.DialOptions, grpc.WithTransportCredentials(cfg.Metrics.GRPCCredentials))
102103
} else if cfg.Metrics.Insecure {
103104
cfg.DialOptions = append(cfg.DialOptions, grpc.WithInsecure())
105+
} else {
106+
// Default to using the host's root CA.
107+
creds := credentials.NewTLS(nil)
108+
cfg.Metrics.GRPCCredentials = creds
109+
cfg.DialOptions = append(cfg.DialOptions, grpc.WithTransportCredentials(creds))
104110
}
105111
if cfg.Metrics.Compression == GzipCompression {
106112
cfg.DialOptions = append(cfg.DialOptions, grpc.WithDefaultCallOptions(grpc.UseCompressor(gzip.Name)))

‎exporters/otlp/otlpmetric/internal/otlpconfig/options_test.go

Lines changed: 23 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -189,6 +189,16 @@ func TestConfigs(t *testing.T) {
189189
},
190190

191191
// Certificate tests
192+
{
193+
name: "Test Default Certificate",
194+
asserts: func(t *testing.T, c *otlpconfig.Config, grpcOption bool) {
195+
if grpcOption {
196+
assert.NotNil(t, c.Metrics.GRPCCredentials)
197+
} else {
198+
assert.Nil(t, c.Metrics.TLSCfg)
199+
}
200+
},
201+
},
192202
{
193203
name: "Test With Certificate",
194204
opts: []otlpconfig.GenericOption{
@@ -380,27 +390,32 @@ func TestConfigs(t *testing.T) {
380390

381391
for _, tt := range tests {
382392
t.Run(tt.name, func(t *testing.T) {
383-
384-
e := otlpconfig.EnvOptionsReader{
393+
origEOR := otlpconfig.DefaultEnvOptionsReader
394+
otlpconfig.DefaultEnvOptionsReader = otlpconfig.EnvOptionsReader{
385395
GetEnv: tt.env.getEnv,
386396
ReadFile: tt.fileReader.readFile,
387397
}
398+
t.Cleanup(func() { otlpconfig.DefaultEnvOptionsReader = origEOR })
388399

389400
// Tests Generic options as HTTP Options
390401
cfg := otlpconfig.NewDefaultConfig()
391-
e.ApplyHTTPEnvConfigs(&cfg)
402+
otlpconfig.ApplyHTTPEnvConfigs(&cfg)
392403
for _, opt := range tt.opts {
393404
opt.ApplyHTTPOption(&cfg)
394405
}
395406
tt.asserts(t, &cfg, false)
396407

397408
// Tests Generic options as gRPC Options
398-
cfg = otlpconfig.NewDefaultConfig()
399-
e.ApplyGRPCEnvConfigs(&cfg)
400-
for _, opt := range tt.opts {
401-
opt.ApplyGRPCOption(&cfg)
402-
}
409+
cfg = otlpconfig.NewGRPCConfig(asGRPCOptions(tt.opts)...)
403410
tt.asserts(t, &cfg, true)
404411
})
405412
}
406413
}
414+
415+
func asGRPCOptions(opts []otlpconfig.GenericOption) []otlpconfig.GRPCOption {
416+
converted := make([]otlpconfig.GRPCOption, len(opts))
417+
for i, o := range opts {
418+
converted[i] = otlpconfig.NewGRPCOption(o.ApplyGRPCOption)
419+
}
420+
return converted
421+
}

‎exporters/otlp/otlpmetric/otlpmetricgrpc/client_test.go

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -280,18 +280,6 @@ func TestNewExporter_WithTimeout(t *testing.T) {
280280
}
281281
}
282282

283-
func TestStartErrorInvalidSecurityConfiguration(t *testing.T) {
284-
mc := runMockCollector(t)
285-
defer func() {
286-
_ = mc.stop()
287-
}()
288-
289-
client := otlpmetricgrpc.NewClient(otlpmetricgrpc.WithEndpoint(mc.endpoint))
290-
err := client.Start(context.Background())
291-
// https://github.com/grpc/grpc-go/blob/a671967dfbaab779d37fd7e597d9248f13806087/clientconn.go#L82
292-
assert.EqualError(t, err, "grpc: no transport security set (use grpc.WithInsecure() explicitly or set credentials)")
293-
}
294-
295283
func TestStartErrorInvalidAddress(t *testing.T) {
296284
client := otlpmetricgrpc.NewClient(
297285
otlpmetricgrpc.WithInsecure(),

‎exporters/otlp/otlptrace/internal/otlpconfig/envconfig.go

Lines changed: 7 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -28,24 +28,21 @@ import (
2828
"go.opentelemetry.io/otel"
2929
)
3030

31-
var httpSchemeRegexp = regexp.MustCompile(`(?i)^(http://|https://)`)
31+
var (
32+
httpSchemeRegexp = regexp.MustCompile(`(?i)^(http://|https://)`)
3233

33-
func ApplyGRPCEnvConfigs(cfg *Config) {
34-
e := EnvOptionsReader{
34+
DefaultEnvOptionsReader = EnvOptionsReader{
3535
GetEnv: os.Getenv,
3636
ReadFile: ioutil.ReadFile,
3737
}
38+
)
3839

39-
e.ApplyGRPCEnvConfigs(cfg)
40+
func ApplyGRPCEnvConfigs(cfg *Config) {
41+
DefaultEnvOptionsReader.ApplyGRPCEnvConfigs(cfg)
4042
}
4143

4244
func ApplyHTTPEnvConfigs(cfg *Config) {
43-
e := EnvOptionsReader{
44-
GetEnv: os.Getenv,
45-
ReadFile: ioutil.ReadFile,
46-
}
47-
48-
e.ApplyHTTPEnvConfigs(cfg)
45+
DefaultEnvOptionsReader.ApplyHTTPEnvConfigs(cfg)
4946
}
5047

5148
type EnvOptionsReader struct {

‎exporters/otlp/otlptrace/internal/otlpconfig/options.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,10 +90,16 @@ func NewGRPCConfig(opts ...GRPCOption) Config {
9090
if cfg.ServiceConfig != "" {
9191
cfg.DialOptions = append(cfg.DialOptions, grpc.WithDefaultServiceConfig(cfg.ServiceConfig))
9292
}
93+
// Priroritize GRPCCredentials over Insecure (passing both is an error).
9394
if cfg.Traces.GRPCCredentials != nil {
9495
cfg.DialOptions = append(cfg.DialOptions, grpc.WithTransportCredentials(cfg.Traces.GRPCCredentials))
9596
} else if cfg.Traces.Insecure {
9697
cfg.DialOptions = append(cfg.DialOptions, grpc.WithInsecure())
98+
} else {
99+
// Default to using the host's root CA.
100+
creds := credentials.NewTLS(nil)
101+
cfg.Traces.GRPCCredentials = creds
102+
cfg.DialOptions = append(cfg.DialOptions, grpc.WithTransportCredentials(creds))
97103
}
98104
if cfg.Traces.Compression == GzipCompression {
99105
cfg.DialOptions = append(cfg.DialOptions, grpc.WithDefaultCallOptions(grpc.UseCompressor(gzip.Name)))

‎exporters/otlp/otlptrace/internal/otlpconfig/options_test.go

Lines changed: 23 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -189,6 +189,16 @@ func TestConfigs(t *testing.T) {
189189
},
190190

191191
// Certificate tests
192+
{
193+
name: "Test Default Certificate",
194+
asserts: func(t *testing.T, c *otlpconfig.Config, grpcOption bool) {
195+
if grpcOption {
196+
assert.NotNil(t, c.Traces.GRPCCredentials)
197+
} else {
198+
assert.Nil(t, c.Traces.TLSCfg)
199+
}
200+
},
201+
},
192202
{
193203
name: "Test With Certificate",
194204
opts: []otlpconfig.GenericOption{
@@ -378,27 +388,32 @@ func TestConfigs(t *testing.T) {
378388

379389
for _, tt := range tests {
380390
t.Run(tt.name, func(t *testing.T) {
381-
382-
e := otlpconfig.EnvOptionsReader{
391+
origEOR := otlpconfig.DefaultEnvOptionsReader
392+
otlpconfig.DefaultEnvOptionsReader = otlpconfig.EnvOptionsReader{
383393
GetEnv: tt.env.getEnv,
384394
ReadFile: tt.fileReader.readFile,
385395
}
396+
t.Cleanup(func() { otlpconfig.DefaultEnvOptionsReader = origEOR })
386397

387398
// Tests Generic options as HTTP Options
388399
cfg := otlpconfig.NewDefaultConfig()
389-
e.ApplyHTTPEnvConfigs(&cfg)
400+
otlpconfig.ApplyHTTPEnvConfigs(&cfg)
390401
for _, opt := range tt.opts {
391402
opt.ApplyHTTPOption(&cfg)
392403
}
393404
tt.asserts(t, &cfg, false)
394405

395406
// Tests Generic options as gRPC Options
396-
cfg = otlpconfig.NewDefaultConfig()
397-
e.ApplyGRPCEnvConfigs(&cfg)
398-
for _, opt := range tt.opts {
399-
opt.ApplyGRPCOption(&cfg)
400-
}
407+
cfg = otlpconfig.NewGRPCConfig(asGRPCOptions(tt.opts)...)
401408
tt.asserts(t, &cfg, true)
402409
})
403410
}
404411
}
412+
413+
func asGRPCOptions(opts []otlpconfig.GenericOption) []otlpconfig.GRPCOption {
414+
converted := make([]otlpconfig.GRPCOption, len(opts))
415+
for i, o := range opts {
416+
converted[i] = otlpconfig.NewGRPCOption(o.ApplyGRPCOption)
417+
}
418+
return converted
419+
}

‎exporters/otlp/otlptrace/otlptracegrpc/client_test.go

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -238,16 +238,6 @@ func TestExportSpansTimeoutHonored(t *testing.T) {
238238
require.Equal(t, codes.DeadlineExceeded, status.Convert(err).Code())
239239
}
240240

241-
func TestStartErrorInvalidSecurityConfiguration(t *testing.T) {
242-
mc := runMockCollector(t)
243-
t.Cleanup(func() { require.NoError(t, mc.stop()) })
244-
245-
client := otlptracegrpc.NewClient(otlptracegrpc.WithEndpoint(mc.endpoint))
246-
err := client.Start(context.Background())
247-
// https://github.com/grpc/grpc-go/blob/a671967dfbaab779d37fd7e597d9248f13806087/clientconn.go#L82
248-
assert.EqualError(t, err, "grpc: no transport security set (use grpc.WithInsecure() explicitly or set credentials)")
249-
}
250-
251241
func TestNew_withMultipleAttributeTypes(t *testing.T) {
252242
mc := runMockCollector(t)
253243

0 commit comments

Comments
 (0)