Graphite output plugin: Enable secure connection

[dheerajdwivedi]

Feature Request

Proposal:

We are looking to use hosted solution for graphite.
Since the communication is over internet it needs to be secure.
Hence the support for tls over tcp is required.

Current behavior:

Insecure communication between telegraf client and server

Desired behavior:

Secure the communication between client and server

Use case:

Graphite hosted solutions where data flows over internet.
To avoid middleman attack, hence secure the auth credentials and metrics data between client and server

[danielnelson]

#2600

[dheerajdwivedi]

False failure can someone rebuild it please.

[nhaugo]

@dheerajdwivedi can you write some tests so we can support this long term.

[danielnelson]

Current test situation is fine for this one.

[danielnelson]

I think we don't need this option, enabling a secure connection can be based on the tlsConfig being nil or not.

[danielnelson]

Indent this section to 2 spaces

[danielnelson]

Need to use timeout with tls connections. Should be able to do this using tls.DialWithDialer.

I think its possible to just use a nil tls.Config to do a insecure connection, but not sure. This way you don't need the branch.

[danielnelson]

remove

[danielnelson]

Thanks! Will be included in 1.4.0.

[michael-lohier]

Hello,

@danielnelson @dheerajdwivedi

The current configuration to establish an TLS/SSL connection between Telegraf and Graphite is made via the output plugin, setting these options in Telegraf:

  ## Optional TLS Config
  # tls_ca = "/etc/telegraf/ca.pem"
  # tls_cert = "/etc/telegraf/cert.pem"
  # tls_key = "/etc/telegraf/key.pem"
  ## Use TLS but skip chain & host verification
  # insecure_skip_verify = false

However, on Graphite side, it doesn't seem so clear how to set it up. I assume it is possible (or at least it was at the time you added this option). Could you please tell me how was the setup with Graphite you used to test the TLS/SSL connection between Telegraf and Graphite, at the time you added these options?

Thanks a lot