NETOBSERV-1101: support [Mutual] TLS for grpc server

[jotak]

Related PRs:

• eBPF Agent: NETOBSERV-1101: secure GRPC connection netobserv-ebpf-agent#166
• Operator: WIP

Breaking change:
The Client TLS configuration API changes (previously used only for Kafka):

• In Go, struct is renamed from ClientTLS to TLSConfig
• Metrics server TLS now uses this same TLSConfig API
• New field type can be none, simple or mutual. If you were previously using TLS, set it to simple for 1-1 migration. Empty defaults to none.
• JSON (and Go) fields are renamed:
  • userCertPath => certPath
  • userKeyPath => keyPath

[openshift-ci-robot]

@jotak: This pull request references NETOBSERV-1101 which is a valid jira issue.

In response to this:

Related PRs:

• eBPF Agent: NETOBSERV-1101: secure GRPC connection netobserv-ebpf-agent#166
• Operator: WIP

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[jotak]

not tested yet end to end

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from jotak. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jotak]

Since mtls is quite symetric, I wonder if it still makes sense to have dedicated structs for ClientTLS and ServerTLS, or if we should merge them ...

[codecov]

Codecov Report

Patch coverage: 54.16% and project coverage change: -0.10% ⚠️

Comparison is base (89f2c60) 66.15% compared to head (7b93175) 66.06%.
Report is 19 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #469      +/-   ##
==========================================
- Coverage   66.15%   66.06%   -0.10%     
==========================================
  Files          94       95       +1     
  Lines        6867     6960      +93     
==========================================
+ Hits         4543     4598      +55     
- Misses       2065     2088      +23     
- Partials      259      274      +15     

Flag	Coverage Δ
unittests	66.06% <54.16%> (-0.10%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files Changed	Coverage Δ
cmd/flowlogs-pipeline/main.go	53.07% <0.00%> (+3.43%)	⬆️
pkg/api/encode_kafka.go	100.00% <ø> (ø)
pkg/api/encode_prom.go	100.00% <ø> (ø)
pkg/api/enum.go	75.75% <ø> (ø)
pkg/config/config.go	78.78% <ø> (ø)
pkg/pipeline/utils/prom_server.go	0.00% <0.00%> (ø)
pkg/api/tls.go	45.12% <42.66%> (-3.27%)	⬇️
pkg/pipeline/ingest/test_utils.go	75.00% <75.00%> (ø)
pkg/pipeline/ingest/ingest_grpc.go	73.80% <77.77%> (-0.17%)	⬇️
pkg/pipeline/encode/encode_kafka.go	61.64% <100.00%> (ø)
... and 2 more

... and 1 file with indirect coverage changes

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[openshift-ci-robot]

@jotak: This pull request references NETOBSERV-1101 which is a valid jira issue.

In response to this:

Related PRs:

• eBPF Agent: NETOBSERV-1101: secure GRPC connection netobserv-ebpf-agent#166
• Operator: WIP

Breaking change:
The Client TLS configuration API changes (previously used only for Kafka):

• In Go, struct is renamed from ClientTLS to TLSConfig
• Metrics server TLS now uses this same TLSConfig API
• New field type can be none, simple or mutual. If you were previously using TLS, set it to simple for 1-1 migration. Empty defaults to none.
• JSON (and Go) fields are renamed:
• userCertPath => certPath
• userKeyPath => keyPath

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-merge-robot]

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.