fluent-plugin-opentelemetry-radiant 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5b3f35dd254aa50aee69218bd2a13ecdf80222d9c80f216694a3728821cead78
-  data.tar.gz: 124931e149bc6def82b37f5ce24c2e68995ec6040819ccfd9bc6a85eaa81d92a
+  metadata.gz: '08cf17bafeddfd37c8ea288aeea8bdc9f3c9c6f12383d37b2b78d43a5e16087a'
+  data.tar.gz: ec2cdb92e14a3323c84451256523b8df2084cbb5865fa93f47620a4ac56f4990
 SHA512:
-  metadata.gz: 1edb669c95e239d288c03819d14a1559dbf023fa8942b2be39435c4f60f7bb819175ac07798786d85566c7e95010dcb0c296ab3d680cbe5cee4ec08a87ad0a0f
-  data.tar.gz: f7ac40e9c4b7fe92e2956c28ceb2e89e1d2a4482720f276e1d6a6d3452017c46a632e423456bc66d9f6e8f2a50dbfe0cbcb63e7587af0f3fb64b30da8fec59f8
+  metadata.gz: 57c372462c52f818e06427d2867e3534c267ccd4a4a43182ce1fe365255ce59143054959d26629f283487faef0a03a66f368dc10909d59aad2a161100b6794ee
+  data.tar.gz: ca0f93fc4f847113465ba7c54625491ec7491a1303da6bc1e85f99e7606c5230ccfc650fcb7ee1f0dce0344eee168d3fcf3ea968f37ed3049ae927454219f163

data/CHANGELOG.md

@@ -1,9 +1,11 @@
-## [Unreleased]
+## [0.1.1] - 2026-10-28
 
-- Normalize log strings to valid UTF-8 without mutating records, preventing binary or invalid bytes from dropping whole chunks.
+- Check gRPC TLS files before each export and reconnect when certificates or
+  keys change, without a Fluentd reload or restart. Keep the current channel if the new files cannot be loaded.
 
-## [0.1.0] - 2026-09-02
+## [0.1.0] - 2026-10-27
 
+- Normalize log strings to valid UTF-8 without mutating records, preventing binary or invalid bytes from dropping whole chunks.
 - Add secret-masked authentication headers for HTTP and lowercase gRPC metadata.
 - Add HTTP CA and mutual TLS settings without changing global Excon defaults;
   warn once at start when HTTP certificate verification is disabled.

data/README.md

@@ -200,6 +200,14 @@ a `Fluent::ConfigError` identifying the path. An encrypted client key can use
 The HTTP `min_version` / `max_version` settings are not applied to gRPC, whose
 TLS negotiation is managed by gRPC core.
 
+**Certificate rotation.** HTTP opens new connections with the TLS files as they
+are on disk. gRPC checks the configured TLS files before each send and reconnects
+when their contents change. If the files cannot be read or the new credentials
+are invalid, gRPC warns and keeps its current channel, then checks again on the
+next send. Headers (including tokens) are read when the configuration loads, so
+a token change needs a config reload. Mount Kubernetes Secrets as a directory,
+not with `subPath`, because kubelet does not update `subPath` mounts.
+
 | gRPC option | Default | Meaning |
 |---|---|---|
 | `compress` | `text` | `text` sends uncompressed messages; `gzip` enables gRPC gzip compression. |

data/lib/fluent/plugin/opentelemetry/grpc_output_handler.rb

@@ -19,6 +19,8 @@ require "opentelemetry/proto/collector/trace/v1/trace_service_services_pb"
 require "fluent/plugin/opentelemetry/constant"
 require "fluent/plugin/opentelemetry/output_response"
 require "google/protobuf"
+require "digest"
+require "set"
 
 class Fluent::Plugin::Opentelemetry::GrpcOutputHandler
   include Fluent::Plugin::Opentelemetry::OutputResponse
@@ -30,6 +32,8 @@ class Fluent::Plugin::Opentelemetry::GrpcOutputHandler
     [GRPC::Core::StatusCodes.const_get(name), name.to_s]
   end.freeze
 
+  class TlsFileError < StandardError; end
+
   class ServiceStub
     class Logs
       def initialize(host, creds, **kw)
@@ -82,26 +86,38 @@ class Fluent::Plugin::Opentelemetry::GrpcOutputHandler
       raise Fluent::ConfigError, "certificate verification cannot be turned off for gRPC; set ca_path to the server's CA instead"
     end
 
-    credential = channel_credentials(transport_config)
-    channel_args = {}
+    @transport_config = transport_config
+    @tls_mutex = Mutex.new
+    @active_exports = Hash.new(0)
+    @tls_failures = Set.new
+    if transport_config&.protocol == :tls
+      @tls_paths = {
+        ca_path: transport_config.ca_path, cert_path: transport_config.cert_path,
+        private_key_path: transport_config.private_key_path
+      }.compact
+    end
+    pems = read_tls_files if @tls_paths
+    credential = channel_credentials(pems)
+    @tls_fingerprints = fingerprints(pems) if @tls_paths
+    @channel_args = {}
     if grpc_config.compress == :gzip
-      channel_args = GRPC::Core::CompressionOptions.new(default_algorithm: :gzip).to_channel_arg_hash
+      @channel_args = GRPC::Core::CompressionOptions.new(default_algorithm: :gzip).to_channel_arg_hash
     end
-    channel_args["grpc.keepalive_time_ms"] = grpc_config.keepalive_time * 1000
-    channel_args["grpc.keepalive_timeout_ms"] = grpc_config.keepalive_timeout * 1000
-    channel_args["grpc.keepalive_permit_without_calls"] = 1
-    @services = {
-      Fluent::Plugin::Opentelemetry::RECORD_TYPE_LOGS => ServiceStub::Logs.new(grpc_config.endpoint, credential, channel_args: channel_args),
-      Fluent::Plugin::Opentelemetry::RECORD_TYPE_METRICS => ServiceStub::Metrics.new(grpc_config.endpoint, credential, channel_args: channel_args),
-      Fluent::Plugin::Opentelemetry::RECORD_TYPE_TRACES => ServiceStub::Traces.new(grpc_config.endpoint, credential, channel_args: channel_args)
-    }
+    @channel_args["grpc.keepalive_time_ms"] = grpc_config.keepalive_time * 1000
+    @channel_args["grpc.keepalive_timeout_ms"] = grpc_config.keepalive_timeout * 1000
+    @channel_args["grpc.keepalive_permit_without_calls"] = 1
+    @channel_args["grpc.primary_user_agent"] = "grpc-ruby/#{GRPC::VERSION}"
+    @channel, @services = build_services(credential)
+  rescue TlsFileError => e
+    raise Fluent::ConfigError, e.message, cause: nil
   end
 
   def export(record)
-    service = @services[record["type"]]
-    raise Fluent::UnrecoverableError, "got unknown record type '#{record['type']}'" unless service
+    response = with_service(record["type"]) do |service|
+      raise Fluent::UnrecoverableError, "got unknown record type '#{record['type']}'" unless service
 
-    response = service.export(record["message"], **call_options)
+      service.export(record["message"], **call_options)
+    end
     warn_partial_success(response) if record["type"] == Fluent::Plugin::Opentelemetry::RECORD_TYPE_LOGS
   rescue Google::Protobuf::ParseError => e
     raise Fluent::UnrecoverableError, e.message
@@ -111,7 +127,9 @@ class Fluent::Plugin::Opentelemetry::GrpcOutputHandler
   end
 
   def export_logs(request)
-    response = logs_service.export_request(request, **call_options)
+    response = with_service(Fluent::Plugin::Opentelemetry::RECORD_TYPE_LOGS) do |service|
+      service.export_request(request, **call_options)
+    end
     warn_partial_success(response)
   rescue GRPC::BadStatus => e
     code_name = CODE_NAMES.fetch(e.code, e.code.to_s)
@@ -128,34 +146,121 @@ class Fluent::Plugin::Opentelemetry::GrpcOutputHandler
     @services.fetch(Fluent::Plugin::Opentelemetry::RECORD_TYPE_LOGS)
   end
 
+  def service_for(type)
+    type == Fluent::Plugin::Opentelemetry::RECORD_TYPE_LOGS ? logs_service : @services[type]
+  end
+
+  def with_service(type)
+    return yield service_for(type) unless @tls_paths
+
+    channel = nil
+    service = @tls_mutex.synchronize do
+      refresh_tls_files
+      channel = @channel
+      @active_exports[channel] += 1
+      service_for(type)
+    end
+    yield service
+  ensure
+    if channel
+      @tls_mutex.synchronize do
+        @active_exports[channel] -= 1
+        if @active_exports[channel].zero?
+          @active_exports.delete(channel)
+          channel.close unless channel.equal?(@channel)
+        end
+      end
+    end
+  end
+
+  def build_services(credential)
+    channel = GRPC::Core::Channel.new(@grpc_config.endpoint, @channel_args, credential)
+    options = { channel_override: channel }
+    services = {
+      Fluent::Plugin::Opentelemetry::RECORD_TYPE_LOGS => ServiceStub::Logs.new(@grpc_config.endpoint, credential, **options),
+      Fluent::Plugin::Opentelemetry::RECORD_TYPE_METRICS => ServiceStub::Metrics.new(@grpc_config.endpoint, credential, **options),
+      Fluent::Plugin::Opentelemetry::RECORD_TYPE_TRACES => ServiceStub::Traces.new(@grpc_config.endpoint, credential, **options)
+    }
+    [channel, services]
+  rescue StandardError
+    channel&.close
+    raise
+  end
+
+  def refresh_tls_files
+    begin
+      pems = read_tls_files
+      current = fingerprints(pems)
+      if current != @tls_fingerprints
+        channel, services = build_services(channel_credentials(pems, rotation: true))
+        old_channel = @channel
+        @channel, @services, @tls_fingerprints = channel, services, current
+      end
+    rescue StandardError => e
+      message = e.is_a?(TlsFileError) ? e.message : "could not rebuild gRPC TLS channel for #{@tls_paths.values.join(', ')} (#{e.class})"
+      failure = [message, current]
+      if @tls_failures.add?(failure)
+        @logger.warn "#{message}; keeping the current gRPC channel and retrying the TLS files on the next export"
+      end
+      return
+    end
+    @tls_failures.clear
+    return unless old_channel
+
+    @logger.info "gRPC TLS files changed; reconnecting with the updated certificate files"
+    # Let calls that already selected the old stubs finish before closing them.
+    old_channel.close unless @active_exports.key?(old_channel)
+  end
+
   def call_options
     { deadline: Time.now + @grpc_config.timeout, metadata: @metadata }
   end
 
-  def channel_credentials(transport)
-    return :this_channel_is_insecure unless transport&.protocol == :tls
+  def channel_credentials(pems, rotation: false)
+    return :this_channel_is_insecure unless @tls_paths
 
-    ca_pem = read_pem(transport.ca_path)
-    key_pem = read_pem(transport.private_key_path)
-    cert_pem = read_pem(transport.cert_path)
+    transport = @transport_config
+    ca_pem, key_pem, cert_pem = pems.values_at(:ca_path, :private_key_path, :cert_path)
     if key_pem.nil? != cert_pem.nil?
-      raise Fluent::ConfigError, "gRPC TLS requires both cert_path and private_key_path for a client certificate"
+      raise TlsFileError, "gRPC TLS requires both cert_path and private_key_path for a client certificate"
     end
-    if key_pem && transport.private_key_passphrase
+    # Configure-time checks stay as in 0.1.0. A rotation replaces a working
+    # channel, so it also requires a parseable key that matches the certificate.
+    if key_pem && (transport.private_key_passphrase || rotation)
       begin
-        key_pem = OpenSSL::PKey.read(key_pem, transport.private_key_passphrase).to_pem
+        key = OpenSSL::PKey.read(key_pem, transport.private_key_passphrase || "")
       rescue OpenSSL::OpenSSLError, ArgumentError
-        raise Fluent::ConfigError, "could not decrypt gRPC TLS private_key_path '#{transport.private_key_path}'", cause: nil
+        action = transport.private_key_passphrase ? "decrypt" : "read"
+        raise TlsFileError, "could not #{action} gRPC TLS private_key_path '#{transport.private_key_path}'", cause: nil
       end
     end
+    if key_pem && rotation
+      begin
+        valid_pair = OpenSSL::X509::Certificate.new(cert_pem).check_private_key(key)
+      rescue OpenSSL::OpenSSLError, ArgumentError
+        valid_pair = false
+      end
+      unless valid_pair
+        raise TlsFileError, "invalid gRPC TLS client certificate/key pair '#{transport.cert_path}' and '#{transport.private_key_path}'", cause: nil
+      end
+    end
+    key_pem = key.to_pem if key_pem && transport.private_key_passphrase
     GRPC::Core::ChannelCredentials.new(ca_pem, key_pem, cert_pem)
   end
 
+  def read_tls_files
+    @tls_paths.transform_values { |path| read_pem(path) }
+  end
+
+  def fingerprints(pems)
+    pems.transform_values { |pem| Digest::SHA256.hexdigest(pem) }
+  end
+
   def read_pem(path)
     return nil unless path
 
-    File.read(path)
+    File.binread(path)
   rescue SystemCallError, IOError
-    raise Fluent::ConfigError, "could not read gRPC TLS file '#{path}'", cause: nil
+    raise TlsFileError, "could not read gRPC TLS file '#{path}'", cause: nil
   end
 end

data/lib/fluent/plugin/opentelemetry_radiant/version.rb

@@ -8,7 +8,7 @@
 module Fluent
   module Plugin
     module OpentelemetryRadiant
-      VERSION = "0.1.0"
+      VERSION = "0.1.1"
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: fluent-plugin-opentelemetry-radiant
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Radiant Logic, Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-27 00:00:00.000000000 Z
+date: 2026-10-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: async-http