search

open-telemetry / opentelemetry-collector

OpenTelemetry Collector
https://opentelemetry.io
Apache License 2.0
4.47k stars 1.47k forks source link

Dynamic reloading of server certificates is not working for OTEL GRPC and HTTP interfaces #8503

Open sidharthabiswal opened 1 year ago

sidharthabiswal commented 1 year ago

Describe the bug We use Jaeger 1.42 and observed that the dynamic reloading of server certificates is not working for OTEL GRPC and HTTP interfaces. Here is the ticket raised on Jaeger. https://github.com/jaegertracing/jaeger/issues/4554 We think that the OTLP GRPC and HTTP servers are implemented in opentelemetry collector where the certificate reload mechanism is missing. Could you please check this issue?

Steps to reproduce

  1. Reduce the renewal time of the server certificates to a lower value say 3 minutes.
  2. After 3 minutes try to connect to OTLP HTTP 4318 and GRPC 4317 port and then below error will occur. remote error: tls: expired certificate
  3. The validity of the server certificate is not changing that can be checked using openssl s_client --connect HOST:PORT | openssl x509 -noout -dates

What did you expect to see? OTEL collector should support the dynamic reloading of server certificates for the mentioned interfaces

What did you see instead? The certificates were not reloaded due to which we are getting certificate expired error

What version did you use? v0.70.0

What config did you use? Config: (e.g. the yaml config file)

Environment OS: (e.g., "Ubuntu 20.04") Compiler(if manually compiled): (e.g., "go 14.2")

Additional context Add any other context about the problem here.

wdullaer commented 1 year ago

Could you paste the yaml configuration you used?

The collector does support reloading certificates, but you must specify a reload interval: https://github.com/open-telemetry/opentelemetry-collector/blob/df8aaaec98af5f9933e691d3dd9be4638ed8fc12/config/configtls/README.md?plain=1#L53

If you do not specify it, it will not reload.