-
Notifications
You must be signed in to change notification settings - Fork 1.2k
Document how to use OTLP exporters with self-signed certificates #6882
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #6882 +/- ##
=======================================
- Coverage 82.3% 82.3% -0.1%
=======================================
Files 263 263
Lines 24418 24418
=======================================
- Hits 20098 20097 -1
- Misses 3938 3939 +1
Partials 382 382 🚀 New features to boost your workflow:
|
…s, use custom environment variable.
Hi @pellared , |
// ExampleWithTLSCredentials demonstrates how to configure the exporter with certificates, including self-signed certificates. | ||
func ExampleWithTLSCredentials() { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can we simplify the example so that it only demonstrate how to use self-signed certificates?
// ExampleWithTLSCredentials demonstrates how to configure the exporter with certificates, including self-signed certificates. | |
func ExampleWithTLSCredentials() { | |
// Demonstrates how to configure the exporter using self-signed certificates. | |
func Example_selfSignedCertificates() { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
May comment was not only about the name and description of the example but related to the content as well. It should be simplified.
if caFile != "" && clientCert != "" && clientKey != "" { | ||
// mTLS connection | ||
tlsCfg := tls.Config{ | ||
InsecureSkipVerify: false, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is it needed if we add CA certificate to root CA pool?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Use new cert pool instead
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Sill, do we need to set InsecureSkipVerify
to false?
Is this not the only thing that is needed?
pool := x509.NewCertPool()
if !pool.AppendCertsFromPEM(data) {
panic("failed to add CA certificate to root CA pool")
}
tlsCfg := &tls.Config{
RootCAs: certs,
}
creds := credentials.NewTLS(tlsCfg)
Co-authored-by: Robert Pająk <[email protected]>
Co-authored-by: Robert Pająk <[email protected]>
Fixes #6661