Add trusted platform module (TPM) support to TLS package

[pavolloffay]

Description

Add trusted platform module (TPM) support to TLS package.

Link to tracking issue

Resolves open-telemetry/opentelemetry-collector-contrib#38682
Replaces open-telemetry/opentelemetry-collector-contrib#39059

TPM cannot be implemented as extension open-telemetry/opentelemetry-collector-contrib#38682 because it overrides the entire http.transport and therefore invalidates other extensions/authenticators.

Testing

# make otelcorecol 
# sudo ./bin/otelcorecol_linux_amd64 --config ./examples/local/tpm.yaml
#
# CA
#  openssl genrsa -des3 -out ca.key 2048
# openssl req -new -x509 -days 1826 -key ca.key -out ca.crt -subj "/C=US/ST=CA/L=Santa Clara/O=Edge/OU=Edge/CN=localhost" -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"
#
# client
# sudo tpm2tss-genkey -a rsa -s 2048 edge-cert.key
# sudo openssl req -new -provider tpm2  -key edge-cert.key -out edge-cert.csr -subj "/C=US/ST=CA/L=Santa Clara/O=Edge/OU=Edge/CN=localhost" -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"
# openssl x509 -req -in edge-cert.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out edge-cert.crt -days 1826 -copy_extensions copyall
#
# server
# openssl genrsa -out server.key 2048
# openssl req -new -key server.key -out server.csr  -subj "/C=US/ST=CA/L=Santa Clara/O=Edge/OU=Edge/CN=localhost" -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"
# openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 360 -copy_extensions copyall
receivers:
  otlp:
    protocols:
      grpc:
        endpoint: localhost:4317
      http:
        endpoint: localhost:4318
  otlp/server:
    protocols:
      grpc:
        endpoint: localhost:4319
        tls:
          client_ca_file: ca.crt
          cert_file: server.crt
          key_file: server.key
exporters:
  otlp:
    endpoint: https://localhost:4319
    tls:
      key_file: edge-cert.key
      cert_file: edge-cert.crt
      ca_file: ca.crt
      tpm:
        enabled: true
        path: /dev/tpmrm0
  debug:
    verbosity: normal
service:
  telemetry:
    metrics:
      address: localhost:8889
  pipelines:
    metrics/client:
      receivers: [otlp]
      exporters: [otlp]
    metrics/server:
      receivers: [otlp/server]
      exporters: [debug]

Documentation

[codecov]

Codecov Report

Attention: Patch coverage is 93.75000% with 3 lines in your changes missing coverage. Please review.

Project coverage is 91.69%. Comparing base (9dc5682) to head (ff33b51).
Report is 4 commits behind head on main.

Files with missing lines	Patch %	Lines
config/configtls/tpm.go	88.00%	2 Missing and 1 partial ⚠️

❌ Your patch status has failed because the patch coverage (93.75%) is below the target coverage (95.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #12801   +/-   ##
=======================================
  Coverage   91.69%   91.69%           
=======================================
  Files         501      503    +2     
  Lines       27506    27550   +44     
=======================================
+ Hits        25221    25262   +41     
- Misses       1806     1808    +2     
- Partials      479      480    +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[jmacd]

I was interested in the statement

TPM cannot be implemented as extension open-telemetry/opentelemetry-collector-contrib#38682 because it overrides the entire http.transport and therefore invalidates other extensions/authenticators.

It looks like the code just needs to modify the certificate used with TLS. In theory, we could define some kind of TLS-extension API, if we wanted the TPM dependency to be an optional one. 🤷 I'm not sure what process this repo uses to manage SBOM.

[pavolloffay]

@codeboten thanks for the review. I have fixed the build but I am not able to get 95% code coverage without making the code a bit odd. Could you please re-review?

[pavolloffay]

There are conflicts in go.mod I have already resolved them once. I will wait for reviews and resolve the conflicts then.

[codeboten]

Thanks @pavolloffay, approving, please resolve the conflicts and we can get this merged

[pavolloffay]

PR is rebased

[sincejune]

@pavolloffay Changed in this PR are currently failing unit tests on the ARM platform in the main branch. Do you have a plan to address and fix this issue? https://github.com/open-telemetry/opentelemetry-collector/actions/runs/14757290557/job/41428733892

[jackgopack4]

It seems like this PR introduced a CGO dependency from go-tpm-tools

john.peterson@COMP-HHVKJYJXCY configtls % go test -v ./...
# github.com/google/go-tpm-tools/simulator/internal
In file included from ../../../../go/pkg/mod/github.com/google/[email protected]/simulator/internal/internal_cgo.go:45:
In file included from ../../../../go/pkg/mod/github.com/google/[email protected]/simulator/ms-tpm-20-ref/TPMCmd/tpm/include/Tpm.h:47:
In file included from ../../../../go/pkg/mod/github.com/google/[email protected]/simulator/ms-tpm-20-ref/TPMCmd/tpm/include/LibSupport.h:65:
../../../../go/pkg/mod/github.com/google/[email protected]/simulator/ms-tpm-20-ref/TPMCmd/tpm/include/Ossl/TpmToOsslSym.h:47:10: fatal error: 'openssl/aes.h' file not found
   47 | #include <openssl/aes.h>
      |          ^~~~~~~~~~~~~~~
1 error generated.
FAIL    go.opentelemetry.io/collector/config/configtls [build failed]
FAIL

Is this intended? I thought we weren't using CGO in collector-core

[codeboten]

Adding the CGO requirement was definitely not an intention on my part (having reviewed the PR), @pavolloffay, is cgo a requirement for this?

[pavolloffay]

It should not be. I have tested this PR with

make otelcorecol                                                                                                                                                                                                                                                 ploffay@fedora
pushd cmd/otelcorecol && CGO_ENABLED=0 go build -trimpath -o ../../bin/otelcorecol_linux_amd64 \
	-tags  ./cmd/otelcorecol && popd
~/projects/open-telemetry/opentelemetry-collector/cmd/otelcorecol ~/projects/open-telemetry/opentelemetry-collector
~/projects/open-telemetry/opentelemetry-collector

and it worked well