Skip to content

New component: tpmextesion - trusted platform module #38682

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
pavolloffay opened this issue Mar 17, 2025 · 1 comment · Fixed by open-telemetry/opentelemetry-collector#12801
Closed

New component: tpmextesion - trusted platform module #38682

pavolloffay opened this issue Mar 17, 2025 · 1 comment · Fixed by open-telemetry/opentelemetry-collector#12801
Labels
Accepted Component New component has been sponsored

Comments

@pavolloffay
Copy link
Member

pavolloffay commented Mar 17, 2025 •
edited
Loading

The purpose and use-cases of the new component

I would like to introduce a new extension which would enable reading TLS certificates from trusted platform module (TPM)

We see a common requirement to read TLS certificates from TPM when the collector runs on an edge device.

See:

Example configuration for the component

  cert_index: 0x01C00002
  key_index: 0x01C00003
  ca_index: 0x01C00004
  client_ca_index: 0x01C00005

Telemetry data types supported

all

Code Owner(s)

pavolloffay

Sponsor (optional)

No response

Additional context

It seems the extension could be implemented via:
@pavolloffay pavolloffay added needs triage New item requiring triage Sponsor Needed New component seeking sponsor labels Mar 17, 2025
@atoulme
Copy link
Contributor

atoulme commented Mar 17, 2025

I can sponsor this component.

@atoulme atoulme added Accepted Component New component has been sponsored and removed Sponsor Needed New component seeking sponsor needs triage New item requiring triage labels Mar 17, 2025
@github-actions github-actions bot mentioned this issue Mar 18, 2025
Closed
@pavolloffay pavolloffay mentioned this issue Mar 21, 2025
Merged
atoulme pushed a commit that referenced this issue Mar 21, 2025
@pavolloffay
New component: scaffolding for trusted platform module extension (#38855
ee23cbb 
)

<!--Ex. Fixing a bug - Describe the bug and how this fixes the issue.
Ex. Adding a feature - Explain what this achieves.-->
#### Description

<!-- Issue number (e.g. #1234) or full URL to issue, if applicable. -->
#### Link to tracking issue

Updates
#38682

<!--Describe what testing was performed and which tests were added.-->
#### Testing

Nothing, this is just scaffolding

<!--Describe the documentation added.-->
#### Documentation

<!--Please delete paragraphs that you did not use before submitting.-->

---------

Signed-off-by: Pavol Loffay <[email protected]>
This was referenced Mar 23, 2025
Closed
Closed
This was referenced Mar 31, 2025
Closed
Merged
Fiery-Fenix pushed a commit to Fiery-Fenix/opentelemetry-collector-contrib that referenced this issue Apr 24, 2025
@pavolloffay @Fiery-Fenix
New component: scaffolding for trusted platform module extension (ope…
5f2c055 
…n-telemetry#38855)

<!--Ex. Fixing a bug - Describe the bug and how this fixes the issue.
Ex. Adding a feature - Explain what this achieves.-->
#### Description

<!-- Issue number (e.g. open-telemetry#1234) or full URL to issue, if applicable. -->
#### Link to tracking issue

Updates
open-telemetry#38682

<!--Describe what testing was performed and which tests were added.-->
#### Testing

Nothing, this is just scaffolding

<!--Describe the documentation added.-->
#### Documentation

<!--Please delete paragraphs that you did not use before submitting.-->

---------

Signed-off-by: Pavol Loffay <[email protected]>
github-merge-queue bot pushed a commit to open-telemetry/opentelemetry-collector that referenced this issue Apr 30, 2025
@pavolloffay
Add trusted platform module (TPM) support to TLS package (#12801)
045488f 
<!--Ex. Fixing a bug - Describe the bug and how this fixes the issue.
Ex. Adding a feature - Explain what this achieves.-->
#### Description

Add trusted platform module (TPM) support to TLS package.

<!-- Issue number if applicable -->
#### Link to tracking issue
Resolves
open-telemetry/opentelemetry-collector-contrib#38682
Replaces
open-telemetry/opentelemetry-collector-contrib#39059

TPM cannot be implemented as extension
open-telemetry/opentelemetry-collector-contrib#38682
because it overrides the entire `http.transport` and therefore
invalidates other extensions/authenticators.

<!--Describe what testing was performed and which tests were added.-->
#### Testing

```yaml
# make otelcorecol 
# sudo ./bin/otelcorecol_linux_amd64 --config ./examples/local/tpm.yaml
#
# CA
#  openssl genrsa -des3 -out ca.key 2048
# openssl req -new -x509 -days 1826 -key ca.key -out ca.crt -subj "/C=US/ST=CA/L=Santa Clara/O=Edge/OU=Edge/CN=localhost" -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"
#
# client
# sudo tpm2tss-genkey -a rsa -s 2048 edge-cert.key
# sudo openssl req -new -provider tpm2  -key edge-cert.key -out edge-cert.csr -subj "/C=US/ST=CA/L=Santa Clara/O=Edge/OU=Edge/CN=localhost" -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"
# openssl x509 -req -in edge-cert.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out edge-cert.crt -days 1826 -copy_extensions copyall
#
# server
# openssl genrsa -out server.key 2048
# openssl req -new -key server.key -out server.csr  -subj "/C=US/ST=CA/L=Santa Clara/O=Edge/OU=Edge/CN=localhost" -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"
# openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 360 -copy_extensions copyall
receivers:
  otlp:
    protocols:
      grpc:
        endpoint: localhost:4317
      http:
        endpoint: localhost:4318
  otlp/server:
    protocols:
      grpc:
        endpoint: localhost:4319
        tls:
          client_ca_file: ca.crt
          cert_file: server.crt
          key_file: server.key
exporters:
  otlp:
    endpoint: https://localhost:4319
    tls:
      key_file: edge-cert.key
      cert_file: edge-cert.crt
      ca_file: ca.crt
      tpm:
        enabled: true
        path: /dev/tpmrm0
  debug:
    verbosity: normal
service:
  telemetry:
    metrics:
      address: localhost:8889
  pipelines:
    metrics/client:
      receivers: [otlp]
      exporters: [otlp]
    metrics/server:
      receivers: [otlp/server]
      exporters: [debug]
```

<!--Describe the documentation added.-->
#### Documentation



<!--Please delete paragraphs that you did not use before submitting.-->

Signed-off-by: Pavol Loffay <[email protected]>
@pavolloffay pavolloffay mentioned this issue May 19, 2025
Merged
songy23 pushed a commit that referenced this issue May 21, 2025
@pavolloffay
Remove unused TPM extension scaffolding (#40125)
a9db3be 
<!--Ex. Fixing a bug - Describe the bug and how this fixes the issue.
Ex. Adding a feature - Explain what this achieves.-->
#### Description

<!-- Issue number (e.g. #1234) or full URL to issue, if applicable. -->
#### Link to tracking issue
Updates
#38682

<!--Describe what testing was performed and which tests were added.-->
#### Testing

<!--Describe the documentation added.-->
#### Documentation

<!--Please delete paragraphs that you did not use before submitting.-->

---------

Signed-off-by: Pavol Loffay <[email protected]>
dragonlord93 pushed a commit to dragonlord93/opentelemetry-collector-contrib that referenced this issue May 23, 2025
@pavolloffay @dragonlord93
Remove unused TPM extension scaffolding (open-telemetry#40125)
db889c3 
<!--Ex. Fixing a bug - Describe the bug and how this fixes the issue.
Ex. Adding a feature - Explain what this achieves.-->
#### Description

<!-- Issue number (e.g. open-telemetry#1234) or full URL to issue, if applicable. -->
#### Link to tracking issue
Updates
open-telemetry#38682

<!--Describe what testing was performed and which tests were added.-->
#### Testing

<!--Describe the documentation added.-->
#### Documentation

<!--Please delete paragraphs that you did not use before submitting.-->

---------

Signed-off-by: Pavol Loffay <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Accepted Component New component has been sponsored
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Add trusted platform module (TPM) support to TLS package pavolloffay/opentelemetry-collector
2 participants
@atoulme @pavolloffay