Skip to content

Commit a9c59da

Browse files
svetlanabrennanlegendecasdyladan
authored
feat(trace-otlp-grpc): configure security with env vars (#2827)
* feat(trace-otlp-grpc): add insecure configs Signed-off-by: Svetlana Brennan <[email protected]> * feat(trace-otlp-grpc): add unit tests Signed-off-by: Svetlana Brennan <[email protected]> * feat(trace-otlp-grpc): wip add certificate and tests Signed-off-by: Svetlana Brennan <[email protected]> * feat(trace-otlp-grpc): fix security config and unit tests Signed-off-by: Svetlana Brennan <[email protected]> * feat(trace-otlp-grpc): add env and certificate tests Signed-off-by: Svetlana Brennan <[email protected]> * feat(trace-otlp-grpc): wip certificate tests Signed-off-by: Svetlana Brennan <[email protected]> * feat(trace-otlp-grpc): fix lint error Signed-off-by: Svetlana Brennan <[email protected]> * feat(trace-otlp-grpc): wip add additional security setting checks Signed-off-by: Svetlana Brennan <[email protected]> * feat(trace-otlp-grpc): update default url to http scheme Signed-off-by: Svetlana Brennan <[email protected]> * feat(trace-otlp-grpc): wip add tests Signed-off-by: Svetlana Brennan <[email protected]> * feat(trace-otlp-grpc): wip refactor function around insecure setting Signed-off-by: Svetlana Brennan <[email protected]> * feat(trace-otlp-grpc): wip update returned security setting for some use cases Signed-off-by: Svetlana Brennan <[email protected]> * feat(trace-otlp-grpc): update certificate and add tests Signed-off-by: Svetlana Brennan <[email protected]> * feat(trace-otlp-grpc): wip certificate tests Signed-off-by: Svetlana Brennan <[email protected]> * feat(trace-otlp-grpc): fix tests Signed-off-by: Svetlana Brennan <[email protected]> * feat(trace-otlp-grpc): add diag tests Signed-off-by: Svetlana Brennan <[email protected]> * feat(trace-otlp-grpc): update default url Signed-off-by: Svetlana Brennan <[email protected]> * feat(trace-otlp-grpc): fix tests Signed-off-by: Svetlana Brennan <[email protected]> * feat(trace-otlp-grpc): fix tests Signed-off-by: Svetlana Brennan <[email protected]> * feat(trace-otlp-grpc): add changelog item Signed-off-by: Svetlana Brennan <[email protected]> * feat(trace-otlp-grpc): add grpc scheme check and update test Signed-off-by: Svetlana Brennan <[email protected]> * feat(trace-otlp-grpc): add grpc scheme test Signed-off-by: Svetlana Brennan <[email protected]> * feat(trace-otlp-grpc): fix metrics default url Signed-off-by: Svetlana Brennan <[email protected]> * feat(trace-otlp-grpc): update readme Signed-off-by: Svetlana Brennan <[email protected]> * feat(trace-otlp-grpc): fix lint Signed-off-by: Svetlana Brennan <[email protected]> * feat(trace-otlp-grpc): fix changelog and get security from env func Signed-off-by: Svetlana Brennan <[email protected]> * feat(trace-otlp-grpc): wip troubleshoot Signed-off-by: Svetlana Brennan <[email protected]> * feat(trace-otlp-grpc): fix readme Signed-off-by: Svetlana Brennan <[email protected]> * feat(trace-otlp-grpc): refactor code and fix lint Signed-off-by: Svetlana Brennan <[email protected]> * feat(trace-otlp-grpc): remove grpc scheme and grpc scheme tests Signed-off-by: Svetlana Brennan <[email protected]> * feat(trace-otlp-grpc): fix credentials for failing test afer main merge Signed-off-by: Svetlana Brennan <[email protected]> * feat(trace-otlp-grpc): move changelog to unreleased section Signed-off-by: Svetlana Brennan <[email protected]> * Use exact match for protocol check to avoid leaking cases like httpx Co-authored-by: Chengzhong Wu <[email protected]> Co-authored-by: Daniel Dyla <[email protected]>
1 parent 22085fc commit a9c59da

File tree

11 files changed

+277
-43
lines changed

11 files changed

+277
-43
lines changed

‎experimental/CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ All notable changes to experimental packages in this project will be documented
1313

1414
* feat(exporters): update proto version and use otlp-transformer #2929 @pichlermarc
1515
* fix(sdk-metrics-base): misbehaving aggregation temporality selector tolerance #2958 @legendecas
16+
* feat(trace-otlp-grpc): configure security with env vars #2827 @svetlanabrennan
1617
* feat(sdk-metrics-base): async instruments callback timeout #2742 @legendecas
1718

1819
### :bug: (Bug Fix)

‎experimental/packages/exporter-trace-otlp-grpc/README.md‎

Lines changed: 20 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,8 @@ const { BasicTracerProvider, SimpleSpanProcessor } = require('@opentelemetry/sdk
2727
const { OTLPTraceExporter } = require('@opentelemetry/exporter-trace-otlp-grpc');
2828

2929
const collectorOptions = {
30-
// url is optional and can be omitted - default is localhost:4317
31-
url: '<collector-hostname>:<port>',
30+
// url is optional and can be omitted - default is http://localhost:4317
31+
url: 'http://<collector-hostname>:<port>',
3232
};
3333

3434
const provider = new BasicTracerProvider();
@@ -51,8 +51,8 @@ const { BasicTracerProvider, SimpleSpanProcessor } = require('@opentelemetry/sdk
5151
const { OTLPTraceExporter } = require('@opentelemetry/exporter-trace-otlp-grpc');
5252

5353
const collectorOptions = {
54-
// url is optional and can be omitted - default is localhost:4317
55-
url: '<collector-hostname>:<port>',
54+
// url is optional and can be omitted - default is http://localhost:4317
55+
url: 'http://<collector-hostname>:<port>',
5656
credentials: grpc.credentials.createSsl(),
5757
};
5858

@@ -91,8 +91,8 @@ const metadata = new grpc.Metadata();
9191
metadata.set('k', 'v');
9292

9393
const collectorOptions = {
94-
// url is optional and can be omitted - default is localhost:4317
95-
url: '<collector-hostname>:<port>',
94+
// url is optional and can be omitted - default is http://localhost:4317
95+
url: 'http://<collector-hostname>:<port>',
9696
metadata, // // an optional grpc.Metadata object to be sent with each request
9797
};
9898

@@ -135,8 +135,8 @@ By default no compression will be used. To use compression, set it programmatica
135135
const { CompressionAlgorithm } = require('@opentelemetry/exporter-trace-otlp-grpc');
136136

137137
const collectorOptions = {
138-
// url is optional and can be omitted - default is localhost:4317
139-
url: '<collector-hostname>:<port>',
138+
// url is optional and can be omitted - default is http://localhost:4317
139+
url: 'http://<collector-hostname>:<port>',
140140
metadata, // // an optional grpc.Metadata object to be sent with each request
141141
compression: CompressionAlgorithm.GZIP,
142142
};
@@ -149,11 +149,20 @@ const exporter = new OTLPTraceExporter(collectorOptions);
149149

150150
| Environment variable | Description |
151151
|----------------------|-------------|
152-
| OTEL_EXPORTER_OTLP_TRACES_TIMEOUT | The maximum waiting time, in milliseconds, allowed to send each OTLP trace batch. Default is 10000. |
153-
| OTEL_EXPORTER_OTLP_TIMEOUT | The maximum waiting time, in milliseconds, allowed to send each OTLP trace and metric batch. Default is 10000. |
154152
| OTEL_EXPORTER_OTLP_TRACES_COMPRESSION | The compression type to use on OTLP trace requests. Options include gzip. By default no compression will be used. |
155153
| OTEL_EXPORTER_OTLP_COMPRESSION | The compression type to use on OTLP trace, metric, and log requests. Options include gzip. By default no compression will be used. |
156-
> The per-signal environment variables (`OTEL_EXPORTER_OTLP_TRACES_TIMEOUT`) takes precedence and non-per-signal environment variable (`OTEL_EXPORTER_OTLP_TIMEOUT`).
154+
| OTEL_EXPORTER_OTLP_TRACES_INSECURE | Whether to enable client transport security for the exporter's gRPC connection for trace requests. This option only applies to OTLP/gRPC when an endpoint is provided without the http or https scheme. Options include true or false. By default insecure is false which creates a secure connection. |
155+
| OTEL_EXPORTER_OTLP_INSECURE | Whether to enable client transport security for the exporter's gRPC connection for trace, metric and log requests. This option only applies to OTLP/gRPC when an endpoint is provided without the http or https scheme. Options include true or false. By default insecure is false which creates a secure connection. |
156+
| OTEL_EXPORTER_OTLP_TRACES_CERTIFICATE | The path to the file containing trusted root certificate to use when verifying an OTLP trace server's TLS credentials. By default the host platform's trusted root certificate is used.|
157+
| OTEL_EXPORTER_OTLP_CERTIFICATE | The path to the file containing trusted root certificate to use when verifying an OTLP trace, metric, or log server's TLS credentials. By default the host platform's trusted root certificate is used. |
158+
| OTEL_EXPORTER_OTLP_TRACES_CLIENT_KEY | The path to the file containing private client key to use when verifying an OTLP trace client's TLS credentials. Must provide a client certificate/chain when providing a private client key. By default no client key file is used. |
159+
| OTEL_EXPORTER_OTLP_CLIENT_KEY | The path to the file containing private client key to use when verifying an OTLP trace, metric or log client's TLS credentials. Must provide a client certificate/chain when providing a private client key. By default no client key file is used. |
160+
| OTEL_EXPORTER_OTLP_TRACES_CLIENT_CERTIFICATE | The path to the file containing trusted client certificate/chain for clients private key to use when verifying an OTLP trace server's TLS credentials. Must provide a private client key when providing a certificate/chain. By default no chain file is used. |
161+
| OTEL_EXPORTER_OTLP_CLIENT_CERTIFICATE | The path to the file containing trusted client certificate/chain for clients private key to use when verifying an OTLP trace, metric and log server's TLS credentials. Must provide a private client key when providing a certificate/chain. By default no chain file is used. |
162+
| OTEL_EXPORTER_OTLP_TRACES_TIMEOUT | The maximum waiting time, in milliseconds, allowed to send each OTLP trace batch. Default is 10000. |
163+
| OTEL_EXPORTER_OTLP_TIMEOUT | The maximum waiting time, in milliseconds, allowed to send each OTLP trace and metric batch. Default is 10000. |
164+
165+
> Settings configured programmatically take precedence over environment variables. Per-signal environment variables take precedence over non-per-signal environment variables.
157166
158167
## Running opentelemetry-collector locally to see the traces
159168

‎experimental/packages/exporter-trace-otlp-grpc/src/OTLPTraceExporter.ts‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,12 +21,11 @@ import {
2121
OTLPGRPCExporterConfigNode,
2222
OTLPGRPCExporterNodeBase,
2323
ServiceClientType,
24-
validateAndNormalizeUrl
24+
validateAndNormalizeUrl,
25+
DEFAULT_COLLECTOR_URL
2526
} from '@opentelemetry/otlp-grpc-exporter-base';
2627
import { createExportTraceServiceRequest, IExportTraceServiceRequest } from '@opentelemetry/otlp-transformer';
2728

28-
const DEFAULT_COLLECTOR_URL = 'localhost:4317';
29-
3029
/**
3130
* OTLP Trace Exporter for Node
3231
*/
@@ -55,7 +54,7 @@ export class OTLPTraceExporter
5554
? validateAndNormalizeUrl(getEnv().OTEL_EXPORTER_OTLP_TRACES_ENDPOINT)
5655
: getEnv().OTEL_EXPORTER_OTLP_ENDPOINT.length > 0
5756
? validateAndNormalizeUrl(getEnv().OTEL_EXPORTER_OTLP_ENDPOINT)
58-
: DEFAULT_COLLECTOR_URL;
57+
: validateAndNormalizeUrl(DEFAULT_COLLECTOR_URL);
5958
}
6059

6160
getServiceClientType() {

‎experimental/packages/exporter-trace-otlp-grpc/test/OTLPTraceExporter.test.ts‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -123,9 +123,9 @@ const testCollectorExporter = (params: TestParams) =>
123123
fs.readFileSync('./test/certs/client.key'),
124124
fs.readFileSync('./test/certs/client.crt')
125125
)
126-
: undefined;
126+
: grpc.credentials.createInsecure();
127127
collectorExporter = new OTLPTraceExporter({
128-
url: 'grpcs://' + address,
128+
url: 'https://' + address,
129129
credentials,
130130
metadata: params.metadata,
131131
});
@@ -207,7 +207,7 @@ const testCollectorExporter = (params: TestParams) =>
207207
fs.readFileSync('./test/certs/client.key'),
208208
fs.readFileSync('./test/certs/client.crt')
209209
)
210-
: undefined;
210+
: grpc.credentials.createInsecure();
211211

212212
const collectorExporterWithTimeout = new OTLPTraceExporter({
213213
url: 'grpcs://' + address,
@@ -236,9 +236,9 @@ const testCollectorExporter = (params: TestParams) =>
236236
fs.readFileSync('./test/certs/client.key'),
237237
fs.readFileSync('./test/certs/client.crt')
238238
)
239-
: undefined;
239+
: grpc.credentials.createInsecure();
240240
collectorExporter = new OTLPTraceExporter({
241-
url: 'grpcs://' + address,
241+
url: 'https://' + address,
242242
credentials,
243243
metadata: params.metadata,
244244
compression: CompressionAlgorithm.GZIP,
@@ -286,11 +286,11 @@ const testCollectorExporter = (params: TestParams) =>
286286
fs.readFileSync('./test/certs/client.key'),
287287
fs.readFileSync('./test/certs/client.crt')
288288
)
289-
: undefined;
289+
: grpc.credentials.createInsecure();
290290

291291
envSource.OTEL_EXPORTER_OTLP_COMPRESSION = 'gzip';
292292
collectorExporter = new OTLPTraceExporter({
293-
url: 'grpcs://' + address,
293+
url: 'https://' + address,
294294
credentials,
295295
metadata: params.metadata,
296296
});

‎experimental/packages/opentelemetry-exporter-metrics-otlp-grpc/README.md‎

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,8 @@ The OTLPMetricsExporter in Node expects the URL to only be the hostname. It will
2626
const { MeterProvider, PeriodicExportingMetricReader } = require('@opentelemetry/sdk-metrics-base');
2727
const { OTLPMetricExporter } = require('@opentelemetry/exporter-metrics-otlp-grpc');
2828
const collectorOptions = {
29-
// url is optional and can be omitted - default is grpc://localhost:4317
30-
url: 'grpc://<collector-hostname>:<port>',
29+
// url is optional and can be omitted - default is http://localhost:4317
30+
url: 'http://<collector-hostname>:<port>',
3131
};
3232

3333
const exporter = new OTLPMetricExporter(collectorOptions);
@@ -48,6 +48,23 @@ const counter = meter.createCounter('metric_name');
4848
counter.add(10, { 'key': 'value' });
4949
```
5050

51+
## Environment Variable Configuration
52+
53+
| Environment variable | Description |
54+
|----------------------|-------------|
55+
| OTEL_EXPORTER_OTLP_METRICS_COMPRESSION | The compression type to use on OTLP metric requests. Options include gzip. By default no compression will be used. |
56+
| OTEL_EXPORTER_OTLP_COMPRESSION | The compression type to use on OTLP trace, metric, and log requests. Options include gzip. By default no compression will be used. |
57+
| OTEL_EXPORTER_OTLP_METRICS_INSECURE | Whether to enable client transport security for the exporter's gRPC connection for metric requests. This option only applies to OTLP/gRPC when an endpoint is provided without the http or https scheme. Options include true or false. By default insecure is false which creates a secure connection. |
58+
| OTEL_EXPORTER_OTLP_INSECURE | Whether to enable client transport security for the exporter's gRPC connection for trace, metric and log requests. This option only applies to OTLP/gRPC when an endpoint is provided without the http or https scheme. Options include true or false. By default insecure is false which creates a secure connection. |
59+
| OTEL_EXPORTER_OTLP_METRICS_CERTIFICATE | The path to the file containing trusted root certificate to use when verifying an OTLP metric server's TLS credentials. By default the host platform's trusted root certificate is used.|
60+
| OTEL_EXPORTER_OTLP_CERTIFICATE | The path to the file containing trusted root certificate to use when verifying an OTLP trace, metric, or log server's TLS credentials. By default the host platform's trusted root certificate is used. |
61+
| OTEL_EXPORTER_OTLP_METRICS_CLIENT_KEY | The path to the file containing private client key to use when verifying an OTLP metric client's TLS credentials. Must provide a client certificate/chain when providing a private client key. By default no client key file is used. |
62+
| OTEL_EXPORTER_OTLP_CLIENT_KEY | The path to the file containing private client key to use when verifying an OTLP trace, metric or log client's TLS credentials. Must provide a client certificate/chain when providing a private client key. By default no client key file is used. |
63+
| OTEL_EXPORTER_OTLP_METRICS_CLIENT_CERTIFICATE | The path to the file containing trusted client certificate/chain for clients private key to use when verifying an OTLP metric server's TLS credentials. Must provide a private client key when providing a certificate/chain. By default no chain file is used. |
64+
| OTEL_EXPORTER_OTLP_CLIENT_CERTIFICATE | The path to the file containing trusted client certificate/chain for clients private key to use when verifying an OTLP trace, metric and log server's TLS credentials. Must provide a private client key when providing a certificate/chain. By default no chain file is used. |
65+
66+
> Settings configured programmatically take precedence over environment variables. Per-signal environment variables take precedence over non-per-signal environment variables.
67+
5168
## Running opentelemetry-collector locally to see the metrics
5269

5370
1. Go to `examples/otlp-exporter-node`

‎experimental/packages/opentelemetry-exporter-metrics-otlp-grpc/src/OTLPMetricExporter.ts‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -24,15 +24,13 @@ import {
2424
OTLPGRPCExporterConfigNode,
2525
OTLPGRPCExporterNodeBase,
2626
ServiceClientType,
27-
validateAndNormalizeUrl
27+
validateAndNormalizeUrl,
28+
DEFAULT_COLLECTOR_URL
2829
} from '@opentelemetry/otlp-grpc-exporter-base';
2930
import { baggageUtils, getEnv } from '@opentelemetry/core';
3031
import { Metadata } from '@grpc/grpc-js';
3132
import { createExportMetricsServiceRequest, IExportMetricsServiceRequest } from '@opentelemetry/otlp-transformer';
3233

33-
const DEFAULT_COLLECTOR_URL = 'localhost:4317';
34-
35-
3634
class OTLPMetricExporterProxy extends OTLPGRPCExporterNodeBase<ResourceMetrics, IExportMetricsServiceRequest> {
3735

3836
constructor(config: OTLPGRPCExporterConfigNode & OTLPMetricExporterOptions= defaultOptions) {
@@ -59,7 +57,7 @@ class OTLPMetricExporterProxy extends OTLPGRPCExporterNodeBase<ResourceMetrics,
5957
? validateAndNormalizeUrl(getEnv().OTEL_EXPORTER_OTLP_METRICS_ENDPOINT)
6058
: getEnv().OTEL_EXPORTER_OTLP_ENDPOINT.length > 0
6159
? validateAndNormalizeUrl(getEnv().OTEL_EXPORTER_OTLP_ENDPOINT)
62-
: DEFAULT_COLLECTOR_URL;
60+
: validateAndNormalizeUrl(DEFAULT_COLLECTOR_URL);
6361
}
6462

6563
convert(metrics: ResourceMetrics[]): IExportMetricsServiceRequest {

‎experimental/packages/opentelemetry-exporter-metrics-otlp-grpc/test/OTLPMetricExporter.test.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -123,9 +123,9 @@ const testOTLPMetricExporter = (params: TestParams) =>
123123
fs.readFileSync('./test/certs/client.key'),
124124
fs.readFileSync('./test/certs/client.crt')
125125
)
126-
: undefined;
126+
: grpc.credentials.createInsecure();
127127
collectorExporter = new OTLPMetricExporter({
128-
url: 'grpcs://' + address,
128+
url: 'https://' + address,
129129
credentials,
130130
metadata: params.metadata,
131131
temporalityPreference: AggregationTemporality.CUMULATIVE

‎experimental/packages/otlp-grpc-exporter-base/src/index.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,4 +16,4 @@
1616

1717
export * from './OTLPGRPCExporterNodeBase';
1818
export { ServiceClientType, OTLPGRPCExporterConfigNode } from './types';
19-
export { validateAndNormalizeUrl, GrpcCompressionAlgorithm } from './util';
19+
export { DEFAULT_COLLECTOR_URL, validateAndNormalizeUrl, GrpcCompressionAlgorithm } from './util';

‎experimental/packages/otlp-grpc-exporter-base/src/util.ts‎

Lines changed: 100 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,16 +21,19 @@ import { getEnv, globalErrorHandler } from '@opentelemetry/core';
2121
import * as path from 'path';
2222
import { OTLPGRPCExporterNodeBase } from './OTLPGRPCExporterNodeBase';
2323
import { URL } from 'url';
24+
import * as fs from 'fs';
2425
import { GRPCQueueItem, OTLPGRPCExporterConfigNode, ServiceClientType, } from './types';
2526
import { CompressionAlgorithm, ExportServiceError, OTLPExporterError } from '@opentelemetry/otlp-exporter-base';
2627

28+
export const DEFAULT_COLLECTOR_URL = 'http://localhost:4317';
29+
2730
export function onInit<ExportItem, ServiceRequest>(
2831
collector: OTLPGRPCExporterNodeBase<ExportItem, ServiceRequest>,
2932
config: OTLPGRPCExporterConfigNode
3033
): void {
3134
collector.grpcQueue = [];
32-
const credentials: grpc.ChannelCredentials =
33-
config.credentials || grpc.credentials.createInsecure();
35+
36+
const credentials: grpc.ChannelCredentials = configureSecurity(config.credentials, collector.url);
3437

3538
const includeDirs = [path.resolve(__dirname, '..', 'protos')];
3639

@@ -120,14 +123,107 @@ export function validateAndNormalizeUrl(url: string): string {
120123
'URL path should not be set when using grpc, the path part of the URL will be ignored.'
121124
);
122125
}
123-
if (target.protocol !== '' && !target.protocol?.match(/(http|grpc)s?/)) {
126+
if (target.protocol !== '' && !target.protocol?.match(/^(http)s?:$/)) {
124127
diag.warn(
125-
'URL protocol should be http(s):// or grpc(s)://. Using grpc://.'
128+
'URL protocol should be http(s)://. Using http://.'
126129
);
127130
}
128131
return target.host;
129132
}
130133

134+
export function configureSecurity(credentials: grpc.ChannelCredentials | undefined, endpoint: string):
135+
grpc.ChannelCredentials {
136+
137+
let insecure: boolean;
138+
139+
if (credentials) {
140+
return credentials;
141+
} else if (endpoint.startsWith('https://')) {
142+
insecure = false;
143+
} else if (endpoint.startsWith('http://') || endpoint === DEFAULT_COLLECTOR_URL) {
144+
insecure = true;
145+
} else {
146+
insecure = getSecurityFromEnv();
147+
}
148+
149+
if (insecure) {
150+
return grpc.credentials.createInsecure();
151+
} else {
152+
return useSecureConnection();
153+
}
154+
}
155+
156+
function getSecurityFromEnv(): boolean {
157+
const definedInsecure =
158+
getEnv().OTEL_EXPORTER_OTLP_TRACES_INSECURE ||
159+
getEnv().OTEL_EXPORTER_OTLP_INSECURE;
160+
161+
if (definedInsecure) {
162+
return definedInsecure.toLowerCase() === 'true';
163+
} else {
164+
return false;
165+
}
166+
}
167+
168+
export function useSecureConnection(): grpc.ChannelCredentials {
169+
const rootCertPath = retrieveRootCert();
170+
const privateKeyPath = retrievePrivateKey();
171+
const certChainPath = retrieveCertChain();
172+
173+
return grpc.credentials.createSsl(rootCertPath, privateKeyPath, certChainPath);
174+
}
175+
176+
function retrieveRootCert(): Buffer | undefined {
177+
const rootCertificate =
178+
getEnv().OTEL_EXPORTER_OTLP_TRACES_CERTIFICATE ||
179+
getEnv().OTEL_EXPORTER_OTLP_CERTIFICATE;
180+
181+
if (rootCertificate) {
182+
try {
183+
return fs.readFileSync(path.resolve(process.cwd(), rootCertificate));
184+
} catch {
185+
diag.warn('Failed to read root certificate file');
186+
return undefined;
187+
}
188+
} else {
189+
return undefined;
190+
}
191+
}
192+
193+
function retrievePrivateKey(): Buffer | undefined {
194+
const clientKey =
195+
getEnv().OTEL_EXPORTER_OTLP_TRACES_CLIENT_KEY ||
196+
getEnv().OTEL_EXPORTER_OTLP_CLIENT_KEY;
197+
198+
if (clientKey) {
199+
try {
200+
return fs.readFileSync(path.resolve(process.cwd(), clientKey));
201+
} catch {
202+
diag.warn('Failed to read client certificate private key file');
203+
return undefined;
204+
}
205+
} else {
206+
return undefined;
207+
}
208+
}
209+
210+
function retrieveCertChain(): Buffer | undefined {
211+
const clientChain =
212+
getEnv().OTEL_EXPORTER_OTLP_TRACES_CLIENT_CERTIFICATE ||
213+
getEnv().OTEL_EXPORTER_OTLP_CLIENT_CERTIFICATE;
214+
215+
if (clientChain) {
216+
try {
217+
return fs.readFileSync(path.resolve(process.cwd(), clientChain));
218+
} catch {
219+
diag.warn('Failed to read client certificate chain file');
220+
return undefined;
221+
}
222+
} else {
223+
return undefined;
224+
}
225+
}
226+
131227
function toGrpcCompression(compression: CompressionAlgorithm): GrpcCompressionAlgorithm {
132228
if(compression === CompressionAlgorithm.NONE)
133229
return GrpcCompressionAlgorithm.NONE;

0 commit comments

Comments
 (0)