Review any security implications with OpenTelemetry Collector Jaeger receivers/exporters

[objectiser]

Re: #1718

1. Client To Agent
   1. UDP Channels - still no TLS/authentication 👍
   2. HTTP Config Channel - still no TLS/authentication 👍
2. Client To Collector
   1. HTTP - still no TLS/authentication 👍
3. Agent To Collector
   1. gRPC - TLS with client cert authentication: Exporter 👍 Receiver 👎 (see TLS config for Jaeger gRPC receiver jaeger-opentelemetry-collector#22)
4. Collector To Storage (relevant if storage implemented as exporters)
   1. Cassandra - TLS with client cert authentication supported (TO BE CONFIRMED)
   2. Elasticsearch - TLS with client cert authentication supported; bearer token propagation (TO BE CONFIRMED)
   3. Kafka - Kerberos authentication supported (TO BE CONFIRMED)

[yurishkuro]

what is the goal of this ticket vs. #1718?

[objectiser]

This was moved from the jaeger-opentelemetry-collector repo, so was referring to security implications related to OpenTelemetry Collector receivers/exporters.

[pavolloffay]

4. Storage exporters support all auth mechanisms.

The missing part is the TLS configuration in Jaeger gRPC exporter. I will submit a PR to OTEL.

[pavolloffay]

Replicated @jpkrohling deployment from jaegertracing/jaeger-opentelemetry-collector#22 with Jaeger OTEL components. It uses TLS between agent and collector. But we need also mTLS.

Jager OTEL collector: SPAN_STORAGE_TYPE=elasticsearch go run ./cmd/collector/main.go --config=conf.yaml --new-metrics=true

receivers:
  jaeger:
    protocols:
      grpc:
        endpoint: "localhost:14250"
        tls_credentials:
          cert_file: /home/ploffay/projects/opentelemetry/opentelemetry-collector/receiver/jaegerreceiver/testdata/certificate.pem
          key_file: /home/ploffay/projects/opentelemetry/opentelemetry-collector/receiver/jaegerreceiver/testdata/key.pem

service:
  pipelines:
    traces:
      receivers: [jaeger]

Jaeger OTEL agent: go run ./cmd/agent/main.go --config=conf-agent.yaml --metrics-addr=:8889 --new-metrics=true

exporters:
  jaeger:
    endpoint: "localhost:14250"
    cert_pem_file: /home/ploffay/projects/opentelemetry/opentelemetry-collector/receiver/jaegerreceiver/testdata/certificate.pem
    server_name_override: opentelemetry.io

extensions:
  health_check:
    port: 13134

[pavolloffay]

PR to add mTLS to gRPC exporters
open-telemetry/opentelemetry-collector#927

We need also TLS for remote sampling strategies open-telemetry/opentelemetry-collector#461

[pavolloffay]

I am closing this as done. The last part is to expose configure TLS config via flags but that is a separate issue.