Our current charm_tracing setup assumes that for sending traces to a TLS-enabled Tempo, a certificate file needs to be present. This is caused by our use of OTLPSpanExporter that allows only a certificate file path, not a whole certificate content. They're using requests.post(... under the hood that also accepts only a certificate path.
There are charms that don't operate on certificate files such as self-signed-certificates-operator and therefore they can't use SSL-enabled tempo without doing modifications to store their CA on the disk. With self-signed-certificates it's even more peculiar as tempo is also using it as the certificate provider so relating it on bothcertificatesandtracing` causes self-signed-certificates to go into error state.
In requests.post(... that OTLPSpanExporter is using there is an option to disable certificate verification by providing verify=False to the method call instead of the certificate path. Setting an environment variable to False could also disable certificate validation. We should consider if we want to expose disabling certificate verification in @charm_tracing API for these special cases.
Enhancement Proposal
Our current
charm_tracing
setup assumes that for sending traces to a TLS-enabled Tempo, a certificate file needs to be present. This is caused by our use ofOTLPSpanExporter
that allows only a certificate file path, not a whole certificate content. They're usingrequests.post(...
under the hood that also accepts only a certificate path.There are charms that don't operate on certificate files such as self-signed-certificates-operator and therefore they can't use SSL-enabled tempo without doing modifications to store their CA on the disk. With
self-signed-certificates it's even more peculiar as tempo is also using it as the certificate provider so relating it on both
certificatesand
tracing` causes self-signed-certificates to go into error state.In
requests.post(...
thatOTLPSpanExporter
is using there is an option to disable certificate verification by providingverify=False
to the method call instead of the certificate path. Setting an environment variable to False could also disable certificate validation. We should consider if we want to expose disabling certificate verification in@charm_tracing
API for these special cases.