telemetry: generate DPU ephemeral TLS certificates - #772
Conversation
Signed-off-by: Dawei Huang <daweihuang@microsoft.com>
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
There was a problem hiding this comment.
Pull request overview
This PR adds a new telemetry TLS mode intended for SmartSwitch DPU deployments: it generates a process-local, self-signed server certificate whose SANs include the DPU’s current non-loopback IP addresses (plus hostname) so clients (including Python gRPC) can verify by IP address without requiring a pre-provisioned keypair.
Changes:
- Add
--dpu_ephemeral_tlsflag and reject invalid flag combinations (--insecure,--noTLS, or explicit--server_crt/--server_key). - Generate and serve a fresh self-signed certificate/key at startup when
--dpu_ephemeral_tlsis enabled. - Introduce
pkg/dpuephemeraltlswith unit tests including a TLS handshake that verifies the server cert by IP SAN.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| telemetry/telemetry.go | Adds the new DPU ephemeral TLS mode flag, validates conflicts, and wires certificate generation into server startup. |
| telemetry/telemetry_test.go | Extends flag parsing tests to cover the new mode and its conflict rules. |
| pkg/dpuephemeraltls/certificate.go | Implements self-signed cert generation using current host IPs/hostname as SANs. |
| pkg/dpuephemeraltls/certificate_test.go | Tests SAN contents, lifetime, error cases, and a verified TLS handshake by IP. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| for _, addr := range addrs { | ||
| ip, _, err := net.ParseCIDR(addr.String()) | ||
| if err != nil || ip.IsLoopback() || ip.IsUnspecified() { | ||
| continue | ||
| } | ||
| key := ip.String() | ||
| if !seen[key] { | ||
| seen[key] = true | ||
| ipAddresses = append(ipAddresses, ip) | ||
| } | ||
| } |
There was a problem hiding this comment.
Handled in e3373cc. Address discovery now supports both *net.IPNet and *net.IPAddr, with test coverage for the direct IP form.
Signed-off-by: Dawei Huang <daweihuang@microsoft.com>
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
Why
The SmartSwitch DPU launcher selects
telemetry --insecurewhen no server certificate is configured. The generic--insecurepath callstestdata/tls.NewCert().The generated certificate contains only the
example.comSAN and expires after one hour. A Python gRPC client cannot verify a DPU IP address against the certificate.References
gnoi-shutdowndaemon is orphaned byconfig reload, causing DPU graceful shutdown to hang for the fulldpu_halt_services_timeout(~3 min) sonic-buildimage#29188What
telemetryadds--dpu_ephemeral_tlsand leaves generic--insecurebehavior unchanged.net.InterfaceAddrs().NotBeforeto five minutes before generation and uses a ten-year certificate lifetime.telemetrygenerates a new key and certificate on each restart.telemetryrejects--dpu_ephemeral_tls.Validation
go test -race ./pkg/dpuephemeraltlsgo test -count=10 ./pkg/dpuephemeraltlsgo vet ./pkg/dpuephemeraltlsSecurity scope
The mode encrypts transport and provides a leaf certificate that clients can pin. The certificate does not provide CA-backed DPU identity.
Restart
telemetryafter a DPU IP address changes to regenerate the certificate.