Add trusted platform module (TPM) support to TLS package

[pavolloffay]

Description

Add trusted platform module (TPM) support to TLS package.

Link to tracking issue

Resolves open-telemetry/opentelemetry-collector-contrib#38682
Replaces open-telemetry/opentelemetry-collector-contrib#39059

TPM cannot be implemented as extension open-telemetry/opentelemetry-collector-contrib#38682 because it overrides the entire http.transport and therefore invalidates other extensions/authenticators.

Testing

# make otelcorecol 
# sudo ./bin/otelcorecol_linux_amd64 --config ./examples/local/tpm.yaml
#
# CA
#  openssl genrsa -des3 -out ca.key 2048
# openssl req -new -x509 -days 1826 -key ca.key -out ca.crt -subj "/C=US/ST=CA/L=Santa Clara/O=Edge/OU=Edge/CN=localhost" -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"
#
# client
# sudo tpm2tss-genkey -a rsa -s 2048 edge-cert.key
# sudo openssl req -new -provider tpm2  -key edge-cert.key -out edge-cert.csr -subj "/C=US/ST=CA/L=Santa Clara/O=Edge/OU=Edge/CN=localhost" -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"
# openssl x509 -req -in edge-cert.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out edge-cert.crt -days 1826 -copy_extensions copyall
#
# server
# openssl genrsa -out server.key 2048
# openssl req -new -key server.key -out server.csr  -subj "/C=US/ST=CA/L=Santa Clara/O=Edge/OU=Edge/CN=localhost" -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"
# openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 360 -copy_extensions copyall
receivers:
  otlp:
    protocols:
      grpc:
        endpoint: localhost:4317
      http:
        endpoint: localhost:4318
  otlp/server:
    protocols:
      grpc:
        endpoint: localhost:4319
        tls:
          client_ca_file: ca.crt
          cert_file: server.crt
          key_file: server.key
exporters:
  otlp:
    endpoint: https://localhost:4319
    tls:
      key_file: edge-cert.key
      cert_file: edge-cert.crt
      ca_file: ca.crt
      tpm:
        enabled: true
        path: /dev/tpmrm0
  debug:
    verbosity: normal
service:
  telemetry:
    metrics:
      address: localhost:8889
  pipelines:
    metrics/client:
      receivers: [otlp]
      exporters: [otlp]
    metrics/server:
      receivers: [otlp/server]
      exporters: [debug]

Documentation

[codecov]

Codecov Report

Attention: Patch coverage is 93.75000% with 3 lines in your changes missing coverage. Please review.

Project coverage is 91.43%. Comparing base (e7bbf16) to head (3f1b039).

Files with missing lines	Patch %	Lines
config/configtls/tpm.go	88.00%	2 Missing and 1 partial ⚠️

❌ Your patch check has failed because the patch coverage (93.75%) is below the target coverage (95.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #12801   +/-   ##
=======================================
  Coverage   91.43%   91.43%           
=======================================
  Files         487      489    +2     
  Lines       26811    26855   +44     
=======================================
+ Hits        24514    24555   +41     
- Misses       1814     1816    +2     
- Partials      483      484    +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[codeboten]

Does TPM configuration need to be accounted for in the list of cases at the top of this function that returns an error if multiple certs are configured?

[pavolloffay]

no

[jmacd]

I was interested in the statement

TPM cannot be implemented as extension open-telemetry/opentelemetry-collector-contrib#38682 because it overrides the entire http.transport and therefore invalidates other extensions/authenticators.

It looks like the code just needs to modify the certificate used with TLS. In theory, we could define some kind of TLS-extension API, if we wanted the TPM dependency to be an optional one. 🤷 I'm not sure what process this repo uses to manage SBOM.

[pavolloffay]

@codeboten thanks for the review. I have fixed the build but I am not able to get 95% code coverage without making the code a bit odd. Could you please re-review?

[pavolloffay]

There are conflicts in go.mod I have already resolved them once. I will wait for reviews and resolve the conflicts then.