round trip

Author: musa-asad

receiver/prometheusreceiver/targetallocator/manager.go

@@ -6,6 +6,9 @@ package targetallocator // import "github.com/open-telemetry/opentelemetry-colle
 import (
 	"bytes"
 	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
 	"fmt"
 	"hash/fnv"
 	"io"
@@ -66,6 +69,16 @@ func (m *Manager) Start(ctx context.Context, host component.Host, sm *scrape.Man
 		m.settings.Logger.Error("Failed to create http client", zap.Error(err))
 		return err
 	}
+
+	if base, ok := httpClient.Transport.(*http.Transport); ok {
+		httpClient.Transport = &dynamicTLSRoundTripper{
+			base: base,
+			cfg:  m.cfg,
+		}
+	} else {
+		return errors.New("unexpected transport type")
+	}
+
 	m.settings.Logger.Info("Starting target allocator discovery")
 	// immediately sync jobs, not waiting for the first tick
 	savedHash, err := m.sync(uint64(0), httpClient)
@@ -97,8 +110,65 @@ func (m *Manager) Shutdown() {
 	close(m.shutdown)
 }
 
-// sync request jobs from targetAllocator and update underlying receiver, if the response does not match the provided compareHash.
-// baseDiscoveryCfg can be used to provide additional ScrapeConfigs which will be added to the retrieved jobs.
+type dynamicTLSRoundTripper struct {
+	base *http.Transport
+	cfg  *Config
+}
+
+func (d *dynamicTLSRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	tlsCfg, err := createDynamicTLSConfig(d.cfg)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create dynamic TLS config: %w", err)
+	}
+	clone := d.base.Clone()
+	clone.TLSClientConfig = tlsCfg
+	return clone.RoundTrip(req)
+}
+
+func createDynamicTLSConfig(cfg *Config) (*tls.Config, error) {
+	tlsCfg := &tls.Config{
+		InsecureSkipVerify: cfg.TLSSetting.InsecureSkipVerify,
+		ServerName:         cfg.TLSSetting.ServerName,
+	}
+
+	tlsCfg.GetCertificate = func(clientHello *tls.ClientHelloInfo) (*tls.Certificate, error) {
+		cert, err := tls.LoadX509KeyPair(cfg.TLSSetting.CertFile, cfg.TLSSetting.KeyFile)
+		if err != nil {
+			return nil, fmt.Errorf("failed to load client certificate and key: %w", err)
+		}
+		return &cert, nil
+	}
+
+	if cfg.TLSSetting.CAFile != "" {
+		caBytes, err := os.ReadFile(cfg.TLSSetting.CAFile)
+		if err != nil {
+			return nil, fmt.Errorf("failed to read CA file: %w", err)
+		}
+		caPool := x509.NewCertPool()
+		if ok := caPool.AppendCertsFromPEM(caBytes); !ok {
+			return nil, fmt.Errorf("failed to append CA certs from %s", cfg.TLSSetting.CAFile)
+		}
+		tlsCfg.RootCAs = caPool
+	}
+
+	if cfg.TLSSetting.MinVersion != "" {
+		minVersion, err := convertTLSVersion(cfg.TLSSetting.MinVersion)
+		if err != nil {
+			return nil, err
+		}
+		tlsCfg.MinVersion = uint16(minVersion)
+	}
+	if cfg.TLSSetting.MaxVersion != "" {
+		maxVersion, err := convertTLSVersion(cfg.TLSSetting.MaxVersion)
+		if err != nil {
+			return nil, err
+		}
+		tlsCfg.MaxVersion = uint16(maxVersion)
+	}
+
+	return tlsCfg, nil
+}
+
 func (m *Manager) sync(compareHash uint64, httpClient *http.Client) (uint64, error) {
 	m.settings.Logger.Debug("Syncing target allocator jobs")
 	m.settings.Logger.Debug("endpoint", zap.String("endpoint", m.cfg.Endpoint))