Skip to content

Commit c414808

Browse files
pavolloffaypavolloffay
committed
Add TLS support to auto-instrumentation
Signed-off-by: Pavol Loffay <[email protected]>
1 parent 65b40cb commit c414808

15 files changed

+752
-10
lines changed

‎.chloggen/inst-tls.yaml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
2+
change_type: enhancement
3+
4+
# The name of the component, or a single word describing the area of concern, (e.g. collector, target allocator, auto-instrumentation, opamp, github action)
5+
component: auto-instrumentation
6+
7+
# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`).
8+
note: Add support for specifying exporter TLS certificates in auto-instrumentation.
9+
10+
# One or more tracking issues related to the change
11+
issues: [3338]
12+
13+
# (Optional) One or more lines of additional information to render under the primary note.
14+
# These lines will be padded with 2 spaces and then inserted directly into the document.
15+
# Use pipe (|) for multiline entries.
16+
subtext: |
17+
Now Instrumentation CR supports specifying TLS certificates for exporter:
18+
```yaml
19+
spec:
20+
exporter:
21+
endpoint: https://otel-collector:4317
22+
tls:
23+
secretName: otel-tls-certs
24+
ca: ca.crt
25+
cert: tls.crt
26+
key: tls.key
27+
```
28+
29+
* Propagating secrets across namespaces can be done with https://github.com/EmberStack/kubernetes-reflector or https://github.com/zakkg3/ClusterSecret
30+
* Restarting workloads on certificate renewal can be done with https://github.com/stakater/Reloader or https://github.com/wave-k8s/wave

‎apis/v1alpha1/instrumentation_types.go

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,8 +97,36 @@ type Resource struct {
9797
// Exporter defines OTLP exporter configuration.
9898
type Exporter struct {
9999
// Endpoint is address of the collector with OTLP endpoint.
100+
// The TLS is enabled
100101
// +optional
101102
Endpoint string `json:"endpoint,omitempty"`
103+
104+
// TLS defines certificates for TLS.
105+
// TLS needs to be enabled by specifying https:// scheme in the Endpoint.
106+
TLS *TLS `json:"tls,omitempty"`
107+
}
108+
109+
// TLS defines TLS configuration for exporter.
110+
type TLS struct {
111+
// SecretName defines secret name that will be used to configure TLS on the exporter.
112+
// It is user responsibility to create the secret in the namespace of the workload.
113+
// The secret should contain keys ca.crt, tls.key, tls.crt
114+
SecretName string `json:"secretName,omitempty"`
115+
116+
// ConfigMapName defines configmap name with CA certificate. If it is not defined CA certificate will be
117+
// used from the secret defined in SecretName.
118+
ConfigMapName string `json:"configMapName,omitempty"`
119+
120+
// CA defines the key of certificate in the configmap map, secret or absolute path to a certificate.
121+
// The absolute path can be used when certificate is already present on the workload filesystem e.g.
122+
// /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt
123+
CA string `json:"ca,omitempty"`
124+
// Cert defines the key of the client certificate in the secret or absolute path to a certificate.
125+
// The absolute path can be used when certificate is already present on the workload filesystem.
126+
Cert string `json:"cert,omitempty"`
127+
// Key defines a key of the private key in the secret or absolute path to a certificate.
128+
// The absolute path can be used when certificate is already present on the workload filesystem.
129+
Key string `json:"key,omitempty"`
102130
}
103131

104132
// Sampler defines sampling configuration.

‎apis/v1alpha1/zz_generated.deepcopy.go

Lines changed: 21 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎bundle/community/manifests/opentelemetry-operator.clusterserviceversion.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ metadata:
9999
categories: Logging & Tracing,Monitoring
100100
certified: "false"
101101
containerImage: ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator
102-
createdAt: "2024-10-08T09:52:53Z"
102+
createdAt: "2024-10-09T17:08:59Z"
103103
description: Provides the OpenTelemetry components, including the Collector
104104
operators.operatorframework.io/builder: operator-sdk-v1.29.0
105105
operators.operatorframework.io/project_layout: go.kubebuilder.io/v3

‎bundle/community/manifests/opentelemetry.io_instrumentations.yaml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -409,6 +409,19 @@ spec:
409409
properties:
410410
endpoint:
411411
type: string
412+
tls:
413+
properties:
414+
ca:
415+
type: string
416+
cert:
417+
type: string
418+
configMapName:
419+
type: string
420+
key:
421+
type: string
422+
secretName:
423+
type: string
424+
type: object
412425
type: object
413426
go:
414427
properties:

‎bundle/openshift/manifests/opentelemetry-operator.clusterserviceversion.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ metadata:
9999
categories: Logging & Tracing,Monitoring
100100
certified: "false"
101101
containerImage: ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator
102-
createdAt: "2024-10-08T09:52:57Z"
102+
createdAt: "2024-10-09T17:08:59Z"
103103
description: Provides the OpenTelemetry components, including the Collector
104104
operators.operatorframework.io/builder: operator-sdk-v1.29.0
105105
operators.operatorframework.io/project_layout: go.kubebuilder.io/v3

‎bundle/openshift/manifests/opentelemetry.io_instrumentations.yaml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -409,6 +409,19 @@ spec:
409409
properties:
410410
endpoint:
411411
type: string
412+
tls:
413+
properties:
414+
ca:
415+
type: string
416+
cert:
417+
type: string
418+
configMapName:
419+
type: string
420+
key:
421+
type: string
422+
secretName:
423+
type: string
424+
type: object
412425
type: object
413426
go:
414427
properties:

‎config/crd/bases/opentelemetry.io_instrumentations.yaml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -407,6 +407,19 @@ spec:
407407
properties:
408408
endpoint:
409409
type: string
410+
tls:
411+
properties:
412+
ca:
413+
type: string
414+
cert:
415+
type: string
416+
configMapName:
417+
type: string
418+
key:
419+
type: string
420+
secretName:
421+
type: string
422+
type: object
410423
type: object
411424
go:
412425
properties:

‎docs/api.md

Lines changed: 65 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1625,7 +1625,71 @@ Exporter defines exporter configuration.
16251625
<td><b>endpoint</b></td>
16261626
<td>string</td>
16271627
<td>
1628-
Endpoint is address of the collector with OTLP endpoint.<br/>
1628+
Endpoint is address of the collector with OTLP endpoint.
1629+
The TLS is enabled<br/>
1630+
</td>
1631+
<td>false</td>
1632+
</tr><tr>
1633+
<td><b><a href="#instrumentationspecexportertls">tls</a></b></td>
1634+
<td>object</td>
1635+
<td>
1636+
TLS defines certificates for TLS.
1637+
TLS needs to be enabled by specifying https:// scheme in the Endpoint.<br/>
1638+
</td>
1639+
<td>false</td>
1640+
</tr></tbody>
1641+
</table>
1642+
1643+
1644+
### Instrumentation.spec.exporter.tls
1645+
<sup><sup>[↩ Parent](#instrumentationspecexporter)</sup></sup>
1646+
1647+
1648+
1649+
TLS defines certificates for TLS.
1650+
TLS needs to be enabled by specifying https:// scheme in the Endpoint.
1651+
1652+
<table>
1653+
<thead>
1654+
<tr>
1655+
<th>Name</th>
1656+
<th>Type</th>
1657+
<th>Description</th>
1658+
<th>Required</th>
1659+
</tr>
1660+
</thead>
1661+
<tbody><tr>
1662+
<td><b>ca</b></td>
1663+
<td>string</td>
1664+
<td>
1665+
CA defines the key of certificate in the secret or absolute path to a certificate.
1666+
The absolute path can be used when certificate is already present on the workload filesystem e.g.
1667+
/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt<br/>
1668+
</td>
1669+
<td>false</td>
1670+
</tr><tr>
1671+
<td><b>cert</b></td>
1672+
<td>string</td>
1673+
<td>
1674+
Cert defines the key of the client certificate in the secret or absolute path to a certificate.
1675+
The absolute path can be used when certificate is already present on the workload filesystem.<br/>
1676+
</td>
1677+
<td>false</td>
1678+
</tr><tr>
1679+
<td><b>key</b></td>
1680+
<td>string</td>
1681+
<td>
1682+
Key defines a key of the private key in the secret or absolute path to a certificate.
1683+
The absolute path can be used when certificate is already present on the workload filesystem.<br/>
1684+
</td>
1685+
<td>false</td>
1686+
</tr><tr>
1687+
<td><b>secretName</b></td>
1688+
<td>string</td>
1689+
<td>
1690+
SecretName defines a secret name that will be used to configure TLS on the exporter.
1691+
It is user responsibility to create the secret in the namespace of the workload.
1692+
The secret should contain keys ca.crt, tls.key, tls.crt<br/>
16291693
</td>
16301694
<td>false</td>
16311695
</tr></tbody>

‎pkg/constants/env.go

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -15,12 +15,16 @@
1515
package constants
1616

1717
const (
18-
EnvOTELServiceName = "OTEL_SERVICE_NAME"
19-
EnvOTELExporterOTLPEndpoint = "OTEL_EXPORTER_OTLP_ENDPOINT"
20-
EnvOTELResourceAttrs = "OTEL_RESOURCE_ATTRIBUTES"
21-
EnvOTELPropagators = "OTEL_PROPAGATORS"
22-
EnvOTELTracesSampler = "OTEL_TRACES_SAMPLER"
23-
EnvOTELTracesSamplerArg = "OTEL_TRACES_SAMPLER_ARG"
18+
EnvOTELServiceName = "OTEL_SERVICE_NAME"
19+
EnvOTELResourceAttrs = "OTEL_RESOURCE_ATTRIBUTES"
20+
EnvOTELPropagators = "OTEL_PROPAGATORS"
21+
EnvOTELTracesSampler = "OTEL_TRACES_SAMPLER"
22+
EnvOTELTracesSamplerArg = "OTEL_TRACES_SAMPLER_ARG"
23+
24+
EnvOTELExporterOTLPEndpoint = "OTEL_EXPORTER_OTLP_ENDPOINT"
25+
EnvOTELExporterCertificate = "OTEL_EXPORTER_OTLP_CERTIFICATE"
26+
EnvOTELExporterClientCertificate = "OTEL_EXPORTER_OTLP_CLIENT_CERTIFICATE"
27+
EnvOTELExporterClientKey = "OTEL_EXPORTER_OTLP_CLIENT_KEY"
2428

2529
InstrumentationPrefix = "instrumentation.opentelemetry.io/"
2630
AnnotationDefaultAutoInstrumentationJava = InstrumentationPrefix + "default-auto-instrumentation-java-image"

0 commit comments

Comments
 (0)