Skip to content

feat: add TLSConfigManager#27216

Merged
gwossum merged 6 commits into1.12from
gw/tlsconfigmanager-1.12.3-omnibus
Feb 12, 2026
Merged

feat: add TLSConfigManager#27216
gwossum merged 6 commits into1.12from
gw/tlsconfigmanager-1.12.3-omnibus

Conversation

@gwossum
Copy link
Copy Markdown
Member

@gwossum gwossum commented Feb 12, 2026

Add tlsconfig.TLSConfigManager for managing TLS configurations, handling certificate reloads, logging certificate expiration warnings, etc.

This is backport of the following master-1.x PRs to the 1.12 branch:

Add TLSConfigManager.DialWithDialer method.

(cherry picked from commit a116576)
…27106)

Add convenience constructors NewClientTLSConfigManager and NewDisabledTLSConfigManager, along with associated tests and refactoring.

(cherry picked from commit 17e7050)
Small quality of life improvement by adding TLSConfigManager.UseTLS.
Also contains some minor internal refactoring.

(cherry picked from commit 3e6fcc0)
* fix: Clone *tls.Config returned by TLSConfigManager.TLSConfig

TLSConfigManager.TLSConfig() will now always returned a cloned
*tls.Config. This eliminates the need to manually cloning the returned
*tls.Config before using it to Dial or Listen. It will also eliminate
any bugs in current code which used the returned config without cloning
it.

* chore: fix issue in test code

(cherry picked from commit f8351ea)
* feat: multiple TLS configuration improvements

Externally visible changes:
- New `[http] https-insecure-certificate` configuration allows skipping permission
checking for HTTP TLS certificate.
- New `[opentsdb] insecure-certificate` configuration allows skipping
permission checking for OpenTSDB endpoint certificates.

Internal changes:
- TLSConfigManager
  - Allow skipping certificate permission checks with WithIgnoreFilePermissions
  - Direct passthrough of TLSCertLoader options suported.
  - Add support for client authentication using WithClientAuth
  - Custom root CAs supported through WithRootCAIncludeSystem and
    WithRootCAFiles
  - Custom client CAs supported through WithClientCAIncludeSystem and
    WithClientCAFiles
  - Refactoring of construction code
  - NewClientTLSManager now returns an error
- TLSCertLoader
  - GetClientCertificate: Improve client and server side error messages
    when the server will not accept the client certificate
  - GetClientCertificate: error message improvement
  - NewTLSCertLoader no longer waits for certificate monitoring goroutine
    to start before returning. Test code that needs to wait for this should
    use TLSCertLoader.WaitForMonitorStart.
  - TLSCertLoaderOpt constructors include TLSCertLoader in their name

(cherry picked from commit 85353b3)
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Backports the tlsconfig.TLSConfigManager feature set to the 1.12 branch to centralize TLS config creation, certificate loading/reloading, and related logging/CA configuration, and updates services to use the new manager.

Changes:

  • Add pkg/tlsconfig.TLSConfigManager with helpers for Listen, Dial, and certificate reload orchestration.
  • Extend TLS handling with CA pool options, client auth support, and file-permission checking controls; refactor TLSCertLoader option naming and monitor startup behavior.
  • Wire httpd and opentsdb services (and sample config) to use the new manager and add “insecure-certificate” config flags.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.

Show a summary per file
File Description
services/opentsdb/service.go Switch OpenTSDB listener/cert reload logic to use TLSConfigManager; add insecure cert-permissions flag plumbing.
services/opentsdb/config.go Add insecure-certificate configuration field.
services/httpd/service.go Replace direct TLSCertLoader usage with TLSConfigManager; add insecure cert-permissions flag plumbing.
services/httpd/config.go Add https-insecure-certificate config (but currently has a duplicate field).
pkg/tlsconfig/configmanager.go New TLSConfigManager implementation with options for CA pools, client auth, cert loader passthrough, dialing/listening, and reload support.
pkg/tlsconfig/configmanager_test.go New comprehensive tests for TLSConfigManager behaviors.
pkg/tlsconfig/certconfig.go Extend LoadCertificate with options (ignore perms), refactor TLSCertLoader opts naming, add monitor start coordination, improve errors.
pkg/tlsconfig/certconfig_test.go Update tests for renamed TLSCertLoader opts and monitor-start semantics; adjust GetClientCertificate expectations.
etc/config.sample.toml Document new insecure-certificate knobs and TLS wording updates.
Comments suppressed due to low confidence (1)

pkg/tlsconfig/certconfig_test.go:299

  • These logging tests can become flaky now that the monitor goroutine may emit the same warning before this first assertion runs (depending on scheduling and testCheckTime). Instead of require.Len(..., 1), consider asserting at least one matching warning (and then clearing the observer) or using require.Eventually around the expected log emission.
	checkWarning := func(t *testing.T) {
		warning := logs.FilterMessage("Certificate is not valid yet").TakeAll()
		require.Len(t, warning, 1)
		require.Equal(t, zap.WarnLevel, warning[0].Level)
		require.Equal(t, ss.CertPath, warning[0].ContextMap()["cert"])

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@gwossum gwossum marked this pull request as ready for review February 12, 2026 23:00
Copy link
Copy Markdown

@devanbenz devanbenz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@gwossum gwossum merged commit 049b1f7 into 1.12 Feb 12, 2026
9 checks passed
@gwossum gwossum deleted the gw/tlsconfigmanager-1.12.3-omnibus branch February 12, 2026 23:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants