Skip to content

feat(centreon): support TLS verification and mTLS client certificates#6633

Open
aditya-786 wants to merge 1 commit into
keephq:mainfrom
aditya-786:feat/centreon-provider-tls
Open

feat(centreon): support TLS verification and mTLS client certificates#6633
aditya-786 wants to merge 1 commit into
keephq:mainfrom
aditya-786:feat/centreon-provider-tls

Conversation

@aditya-786

Copy link
Copy Markdown
Contributor

Why are these changes needed?

The Centreon provider issued all of its API calls with the requests default of verify=True and no way to configure TLS. Centreon is typically self-hosted, so an instance behind a self-signed or internal-CA certificate could not be connected at all (the calls fail with an SSL verification error), and there was no way to present a client certificate for mutual TLS.

This adds the Grafana-datasource-style TLS controls requested in #3340 to the Centreon provider: skip-verify, a CA certificate to verify the server, and a client certificate plus key for mTLS. It is one incremental, per-provider step toward the umbrella issue (the same pattern as the merged Cilium mTLS and jiraonprem verify changes), so it references rather than closes #3340.

What changed

  • Four optional auth-config fields on CentreonProviderAuthConfig: verify (switch, default true), ca_certificate, client_certificate, and client_key (file). The connection form renders them automatically from the provider metadata, so there is no frontend change.
  • A small context manager threads them into every requests.get call:
    • verify=false skips TLS verification (for self-signed certs without a CA).
    • a CA certificate verifies the server (verify=<ca path>).
    • a client certificate plus key enables mutual TLS (cert=(cert, key)).
  • The CA/client fields hold PEM content, so they are written to temporary files for the duration of each request and removed afterwards (requests needs file paths).
  • Defaults preserve today's behavior exactly: with no fields set, verify stays true and no cert is sent.

Example connection:

authentication:
  host_url: https://centreon.internal
  api_token: "<token>"
  verify: true
  ca_certificate: |
    -----BEGIN CERTIFICATE-----
    ...internal CA...
    -----END CERTIFICATE-----

Checks

  • I've made sure the tests are passing.
  • Testing Strategy
    • Unit tests

tests/providers/centreon_provider/test_centreon_tls.py (7 tests): verify defaults to on, verify=false skips verification, a CA cert is passed as a file path with the right contents, verify=false takes precedence over a CA cert, a client cert + key enables mTLS, a client cert without a key is ignored, and the temporary cert files are cleaned up after the request. All pass locally; ruff clean; the autogenerated provider snippet was regenerated.

The Centreon provider made its API calls with the requests default of
verify=True and no way to configure TLS, so an on-prem Centreon behind a
self-signed or internal-CA certificate could not be connected, and mutual
TLS was not possible.

Add verify, ca_certificate, client_certificate, and client_key auth-config
fields (the connection form renders them from the provider metadata) and
thread them through every request: verify=False skips verification, a CA
certificate verifies the server, and a client certificate plus key enables
mutual TLS. The PEM-content fields are written to temporary files for the
duration of each request and removed afterwards.

refs keephq#3340
@dosubot dosubot Bot added size:L This PR changes 100-499 lines, ignoring generated files. Feature A new feature Provider Providers related issues labels Jul 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Feature A new feature Provider Providers related issues size:L This PR changes 100-499 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Feature] Add TLS settings on providers connection.

1 participant