Function TestHTTPS

integration/operations/https_test.go:41–85

TestHTTPS tests the use of unsigned certs with Tempo. Due to this we run the special "internal server" on port 3201 which requires us to pass custome readiness probe. Additionally we have to create custom a custom API client that uses https, but doesn't validate the certs. Finally note that we actua

(t *testing.T)

// Finally note that we actually push over an unencrypted connection, using the default harness functions.
// This works b/c the TLS configuration for ingestion is configured through the OTEL receiver config.
func TestHTTPS(t *testing.T) {
	km := setupCertificates(t)

	util.RunIntegrationTests(t, util.TestHarnessConfig{
		ConfigOverlay:  configHTTPS,
		ReadinessProbe: e2e.NewHTTPReadinessProbe(3201, "/ready", 200, 299), // this works b/c the service creation code in ../util/services.go adds a 3201 port to the services. we could also use a custom readiness probe.
		PreStartHook: func(s *e2e.Scenario, _ map[string]any) error {
			require.NoError(t, util.CopyFileToSharedDir(s, km.ServerCertFile, "tls.crt"))
			require.NoError(t, util.CopyFileToSharedDir(s, km.ServerKeyFile, "tls.key"))
			require.NoError(t, util.CopyFileToSharedDir(s, km.CaCertFile, "ca.crt"))

			return nil
		},
	}, func(h *util.TempoHarness) {
		// wait for traces to be writable
		require.True(t, scrapeMetrics(t, h.Services[util.ServiceDistributor], tempoPort, "tempo_partition_ring_partitions{name=\"livestore-partitions\",state=\"Active\"} 1"))

		// write a trace
		info := tempoUtil.NewTraceInfo(time.Now(), "")
		require.NoError(t, h.WriteTraceInfo(info, ""))

		queryFrontend := h.Services[util.ServiceQueryFrontend]
		apiClient := httpclient.New("https://"+queryFrontend.Endpoint(tempoPort), "")

		// trust bad certs
		defaultTransport := http.DefaultTransport.(*http.Transport).Clone()
		defaultTransport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
		apiClient.WithTransport(defaultTransport)

		util.QueryAndAssertTrace(t, apiClient, info)

		// wait for the traces to be queryable
		require.True(t, scrapeMetrics(t, h.Services[util.ServiceLiveStoreZoneA], tempoPort, "tempo_live_store_traces_created_total{tenant=\"single-tenant\"} 1"))
		require.True(t, scrapeMetrics(t, h.Services[util.ServiceLiveStoreZoneB], tempoPort, "tempo_live_store_traces_created_total{tenant=\"single-tenant\"} 1"))

		util.SearchTraceQLAndAssertTrace(t, apiClient, info)

		creds := credentials.NewTLS(&tls.Config{InsecureSkipVerify: true})
		grpcClient, err := util.NewSearchGRPCClient(queryFrontend.Endpoint(tempoPort), creds)
		require.NoError(t, err)

		now := time.Now()
		util.SearchStreamAndAssertTrace(t, context.Background(), grpcClient, info, now.Add(-time.Hour).Unix(), now.Unix())
	})
}

type keyMaterial struct {
	CaCertFile                string