Missing CLI flags(--query.http.tls.reload-interval, --query.grpc.tls.reload-interval) in Jaeger v1.62.0 documentation

[Sidhartha-Biswal]

Hi @yurishkuro ,

The below PR was merged in Jaeger v1.62.0
[query] Change HTTP and TLS server configurations to use OTEL configurations #6023

But there is no update regarding the CLI flags(--query.http.tls.reload-interval, --query.grpc.tls.reload-interval) in https://www.jaegertracing.io/docs/1.62/cli/

So could you please update those?

Was there certificate reload support for Query using certWatcher before Jaeger v1.62.0?

Thanks,
Sidhartha

[yurishkuro]

The CLI docs are auto-generated, if you don't see the flags in them then they are not supported in that version.

Yes, the certs in the past were reloaded via file watcher, but that's no longer supported and they are reloaded periodically.

[Sidhartha-Biswal]

Hi @yurishkuro, #6023 was included in Jaeger v1.62.0. The certificate reload was not working for Query. After adding the --query.http.tls.reload-interval flag, the reload worked. But this flag is not mentioned in https://www.jaegertracing.io/docs/1.62/cli/ or https://www.jaegertracing.io/docs/1.65/cli/.

[yurishkuro]

$ SPAN_STORAGE_TYPE=memory go run ./cmd/query --query.http.tls.reload-interval=1s
...
unknown flag: --query.http.tls.reload-interval

I see this code

jaeger/pkg/config/tlscfg/flags.go

Lines 61 to 63 in 980dc31

	if c.EnableCertReloadInterval {
	flags.Duration(c.Prefix+tlsReloadInterval, 0, "The duration after which the certificate will be reloaded (0s means will not be reloaded)")
	}

@mahadzaryab1 any idea why we need this gate instead of always enabling the flag?

[mahadzaryab1]

@yurishkuro Looked through blame and found this comment. Is this no longer relevant? If so, I can open a quick PR to remove that gate.

[yurishkuro]

Yeah, I wonder if that comment is still accurate. It would make more sense if it was on ClientFlagsConfig because there are different kinds of clients and we don't always know if they support swapped the certs. But for servers we only have HTTP and gRPC and those definitely support swapping of the certs, in fact OTEL's tls Config doesn't even return plain certs, it only returns them in the form of a load function

	return &tls.Config{
		RootCAs:              certPool,
		GetCertificate:       getCertificate, // <-- here
		GetClientCertificate: getClientCertificate,
		MinVersion:           minTLS,
		MaxVersion:           maxTLS,
		CipherSuites:         cipherSuites,
	}, nil

So I think we should ditch that option and always define the reload option. I opened #6521

[Sidhartha-Biswal]

Hi @yurishkuro,

We are using Jaeger 1.62 and after adding the --query.http.tls.reload-interval flag, we observed that the certificate reload was working.

But you did some changes and closed #6521.

So is the certificate reload working fine for Query with Jaeger 1.62 or will it be fixed in Jaeger 1.66 with #6521?