Skip to content

feat(inputs.opcua): Support persistent self-signed client certificates - #17991

Merged
mstrandboge merged 6 commits into
influxdata:masterfrom
skartikey:inputs_opcua_client_certificate
Nov 25, 2025
Merged

feat(inputs.opcua): Support persistent self-signed client certificates#17991
mstrandboge merged 6 commits into
influxdata:masterfrom
skartikey:inputs_opcua_client_certificate

Conversation

@skartikey

@skartikey skartikey commented Nov 11, 2025

Copy link
Copy Markdown
Contributor

Summary

Add support for persistent auto-generated client certificates to maintain stable client identity across Telegraf restarts. Previously, self-signed certificates were always generated in temporary directories and recreated on each restart, requiring OPC UA servers to re-authorize the client.

This PR implements a three-tier certificate management strategy:

Case 1: Temporary Certificates (Backward Compatible)

# certificate = "/etc/telegraf/cert.pem"  # commented out
# private_key = "/etc/telegraf/key.pem"   # commented out
  • Generates certificates in temporary directory
  • Recreated on each restart
  • Current behavior, fully backward compatible

Case 2: Persistent Auto-Generated Certificates (NEW)

certificate = "/etc/telegraf/opcua_cert.pem"
private_key = "/etc/telegraf/opcua_key.pem"
  • If files don't exist: Telegraf generates them at specified paths
  • On subsequent restarts: Telegraf reuses existing certificates
  • Solves the re-authorization problem

Case 3: Manual Certificates

certificate = "/etc/telegraf/opcua_cert.pem"
private_key = "/etc/telegraf/opcua_key.pem"
  • If files exist: Telegraf uses them
  • Current behavior, unchanged

Checklist

Related issues

resolves #11454
@skartikey
feat(inputs.opcua): Support persistent self-signed client certificates
1fe1fb6 
  Add support for persistent auto-generated client certificates to maintain
  stable client identity across Telegraf restarts. Previously, self-signed
  certificates were always generated in temporary directories and recreated
  on each restart, requiring OPC UA servers to re-authorize the client.
@telegraf-tiger telegraf-tiger Bot added area/opcua feat Improvement on an existing feature such as adding a new setting/mode to an existing plugin plugin/input 1. Request for new input plugins 2. Issues/PRs that are related to input plugins labels Nov 11, 2025
srebhan
srebhan reviewed Nov 13, 2025
View reviewed changes

@srebhan srebhan left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @skartikey! Some comments...
Comment thread plugins/common/opcua/opcua_util.go Outdated
Comment thread plugins/common/opcua/opcua_util.go Outdated
Comment thread plugins/common/opcua/client.go
@skartikey
refactor(inputs.opcua): Simplify certificate path handling
e1f4fe1 
  - Use os.MkdirAll instead of custom validateCertificatePaths function
  - Move fileExists helper to test file
  - Extract certificate setup into determineOrCreateCertificates method
srebhan
srebhan reviewed Nov 14, 2025
View reviewed changes

@srebhan srebhan left a comment •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@skartikey some more minor comments and a suggestion to untangle the creation reasoning process a bit.
Comment thread plugins/common/opcua/client.go Outdated
Comment thread plugins/common/opcua/client.go Outdated
Comment thread plugins/common/opcua/opcua_util.go Outdated
Comment thread plugins/common/opcua/opcua_util.go Outdated
Comment thread plugins/inputs/opcua/README.md Outdated
Comment thread plugins/inputs/opcua/README.md Outdated
Comment thread plugins/inputs/opcua/README.md Outdated
Comment thread plugins/inputs/opcua/README.md Outdated
Comment thread plugins/inputs/opcua/README.md Outdated
Comment thread plugins/inputs/opcua/sample.conf
@skartikey
fix(inputs.opcua): Address review feedback for persistent certificates
4d988a2 
  - Restructure determineOrCreateCertificates with generate/permanent flags
  - Add check for specifying only one of certificate/private_key
  - Use errors.Is for proper error checking on os.Stat
  - Simplify os.MkdirAll calls without extra directory checks
  - Update README headings and use Markdown alerts
  - Merge and simplify certificate documentation in sample.conf
srebhan
srebhan reviewed Nov 24, 2025
View reviewed changes

@srebhan srebhan left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice @skartikey! Just two more comments regarding the tests...
Comment thread plugins/common/opcua/opcua_util_test.go Outdated
Comment thread plugins/common/opcua/opcua_util_test.go Outdated
skartikey and others added 2 commits November 24, 2025 10:49
@skartikey @srebhan
Update plugins/common/opcua/opcua_util_test.go
8d5d7ed 
Co-authored-by: Sven Rebhan <36194019+srebhan@users.noreply.github.com>
@skartikey @srebhan
Update plugins/common/opcua/opcua_util_test.go
04a0aff 
Co-authored-by: Sven Rebhan <36194019+srebhan@users.noreply.github.com>
srebhan
srebhan reviewed Nov 24, 2025
View reviewed changes

@srebhan srebhan left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry @skartikey somehow Github ate my comment regarding the file existence check...
Comment thread plugins/common/opcua/opcua_util_test.go Outdated
@skartikey
chore(inputs.opcua): Use testify FileExists helpers in tests
f1cea9b 
  Replace custom fileExists() helper with require.FileExists() and
  require.NoFileExists() from testify/require package.
@telegraf-tiger

telegraf-tiger Bot commented Nov 24, 2025

Copy link
Copy Markdown
Contributor

Download PR build artifacts for linux_amd64.tar.gz, darwin_arm64.tar.gz, and windows_amd64.zip.
Downloads for additional architectures and packages are available below.

⚠️ This pull request increases the Telegraf binary size by 1.23 % for linux amd64 (new size: 299.7 MB, nightly size 296.1 MB)

📦 Click here to get additional PR build artifacts

Artifact URLs

. DEB . RPM . TAR . GZ . ZIP
amd64.deb aarch64.rpm darwin_amd64.tar.gz windows_amd64.zip
arm64.deb armel.rpm darwin_arm64.tar.gz windows_arm64.zip
armel.deb armv6hl.rpm freebsd_amd64.tar.gz windows_i386.zip
armhf.deb i386.rpm freebsd_armv7.tar.gz
i386.deb ppc64le.rpm freebsd_i386.tar.gz
mips.deb riscv64.rpm linux_amd64.tar.gz
mipsel.deb s390x.rpm linux_arm64.tar.gz
ppc64el.deb x86_64.rpm linux_armel.tar.gz
riscv64.deb linux_armhf.tar.gz
s390x.deb linux_i386.tar.gz
linux_mips.tar.gz
linux_mipsel.tar.gz
linux_ppc64le.tar.gz
linux_riscv64.tar.gz
linux_s390x.tar.gz
srebhan
srebhan approved these changes Nov 24, 2025
View reviewed changes

@srebhan srebhan left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice. Thanks @skartikey!
@srebhan srebhan added the ready for final review This pull request has been reviewed and/or tested by multiple users and is ready for a final review. label Nov 24, 2025
@srebhan srebhan assigned mstrandboge and unassigned srebhan Nov 24, 2025
@mstrandboge
mstrandboge merged commit f5fe33a into influxdata:master Nov 25, 2025
26 of 27 checks passed
@github-actions github-actions Bot added this to the v1.37.0 milestone Nov 25, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/opcua feat Improvement on an existing feature such as adding a new setting/mode to an existing plugin plugin/input 1. Request for new input plugins 2. Issues/PRs that are related to input plugins ready for final review This pull request has been reviewed and/or tested by multiple users and is ready for a final review.

3 participants

@skartikey @srebhan @mstrandboge