Skip to content

internal: gRPC/HTTP collector TLS and mTLS (fork CI only) - #4

Closed
songzhendong wants to merge 1 commit into
masterfrom
feat/grpc-mtls-java-parity
Closed

internal: gRPC/HTTP collector TLS and mTLS (fork CI only)#4
songzhendong wants to merge 1 commit into
masterfrom
feat/grpc-mtls-java-parity

Conversation

@songzhendong

@songzhendong songzhendong commented Sep 4, 2026

Copy link
Copy Markdown
Owner

Summary

  • Collector TLS/mTLS for gRPC and HTTP: FORCE_TLS, optional CA, optional client cert+key
  • Shared skywalking/utils/tls.py for sync/aio gRPC and HTTP/aiohttp reporters
  • Hardening: follow secret-mount symlinks, 256 KiB PEM cap; missing mTLS material stays one-way TLS (no abort)

Test plan

  • Fork CI
  • Unit: tests/unit/test_tls.py
  • Real-OAP e2e: gRPC-ssl / gRPC-mtls

Internal fork CI only — not for apache upstream visibility.

@songzhendong
songzhendong force-pushed the feat/grpc-mtls-java-parity branch from f18002b to cd06228 Compare September 11, 2026 03:52
Add SW_AGENT_FORCE_TLS and SSL CA/cert/key paths; share tls helpers across
gRPC and HTTP; convert PKCS#1 keys to PKCS#8; set ssl_target_name_override.
Follow symlinks to regular files so Kubernetes secret mounts work. Include
real-OAP ssl/mtls e2e with Java simple-cases-style verify depth.

Co-authored-by: Cursor <cursoragent@cursor.com>
@songzhendong
songzhendong force-pushed the feat/grpc-mtls-java-parity branch from cd06228 to 0c61779 Compare September 11, 2026 08:51
@songzhendong
songzhendong deleted the feat/grpc-mtls-java-parity branch September 11, 2026 08:57
@songzhendong songzhendong changed the title internal: gRPC/HTTP TLS + mTLS Java parity (fork CI only) internal: gRPC/HTTP collector TLS and mTLS (fork CI only) Sep 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant