[EXPORTER] OTLP GRPC mTLS support

[konicasaini]

Is your feature request related to a problem?
Wanted to setup mtls connection between opentelemetry collector and opentelemetry-cpp client.

But was receiving error like

E1116 16:33:08.044460991 1642002 ssl_transport_security.cc:555] Corruption detected.
E1116 16:33:08.044507949 1642002 ssl_transport_security.cc:531] error:10000412:SSL routines:OPENSSL_internal:SSLV3_ALERT_BAD_CERTIFICATE
E1116 16:33:08.044518471 1642002 secure_endpoint.cc:306]     Decryption error: TSI_DATA_CORRUPTED
E1116 16:33:08.048551622 1642002 ssl_transport_security.cc:555] Corruption detected.
E1116 16:33:08.048570967 1642002 ssl_transport_security.cc:531] error:10000412:SSL routines:OPENSSL_internal:SSLV3_ALERT_BAD_CERTIFICATE
E1116 16:33:08.048579525 1642002 secure_endpoint.cc:306]     Decryption error: TSI_DATA_CORRUPTED

Upon research found out there is no mtls support from opentelemetry-cpp client side to enable connection with otel collector.

Steps to reproduce Issue
otel config should be:

receivers:
  otlp:
    protocols:
      grpc:
        tls:
          client_ca_file: "path to client.pem"
          cert_file: "path to server.crt"
          key_file: "path to server.key"
processors:
  batch:

exporters:
  logging:
    logLevel: debug

service:
  pipelines:
    logs:
      receivers: [otlp]
      processors: [batch]
      exporters: [logging]

    traces:
      receivers: [otlp]
      processors: [batch]
      exporters: [logging]

    metrics:
      receivers: [otlp]
      processors: [batch]
      exporters: [logging]

Run Client as following:

<path_to_dir>/opentelemetry-cpp/build/examples/otlp$ ./example_otlp_grpc localhost:4317 <path_to_ca_cert>

Please enable mTLS support on opentelemetry-cpp client side.

[sirzooro]

Related: #1756

[konicasaini]

@sirzooro this is in regards with grpc mtls support.
However, tls is supported in grpc on client opentelemetry-cpp.

[marcalff]

Analysis

The OTLP GRPC client options are:

struct OtlpGrpcExporterOptions
{
  // The endpoint to export to. By default the OpenTelemetry Collector's default endpoint.
  std::string endpoint = GetOtlpDefaultGrpcEndpoint();
  // By default when false, uses grpc::InsecureChannelCredentials(); If true,
  // uses ssl_credentials_cacert_path if non-empty, else uses ssl_credentials_cacert_as_string
  bool use_ssl_credentials = GetOtlpDefaultIsSslEnable();
  // ssl_credentials_cacert_path specifies path to .pem file to be used for SSL encryption.
  std::string ssl_credentials_cacert_path = GetOtlpDefaultSslCertificatePath();
  // ssl_credentials_cacert_as_string in-memory string representation of .pem file to be used for
  // SSL encryption.
  std::string ssl_credentials_cacert_as_string = GetOtlpDefaultSslCertificateString();
  // Timeout for grpc deadline
  std::chrono::system_clock::duration timeout = GetOtlpDefaultTimeout();
  // Additional HTTP headers
  OtlpHeaders metadata = GetOtlpDefaultHeaders();
  // User agent
  std::string user_agent = GetOtlpDefaultUserAgent();
};

There are options for the CA_CERT, as a path or a string.

Options for the client key (path or string), and client cert (path or string) are missing.

[konicasaini]

@lalitb Any update on this

[marcalff]

For OTLP HTTP, there is work in progress to implement mTLS, see PR #1793

For OTLP GRPC, this is not started yet.

[github-actions]

This issue was marked as stale due to lack of activity.

[kylepl]

And just a note for folks trying it out, as you'll see in the code, it is disabled by-default currently, need to define the macro ENABLE_OTLP_GRPC_SSL_MTLS_PREVIEW (or Cmake option of DWITH_OTLP_GRPC_SSL_MTLS_PREVIEW=ON) to enable it.