TLS failed to verify certificate when connecting to EventHub from azure eventhub receiver

[fullstackjourney3]

Component(s)

receiver/azureeventhub

What happened?

Description

Azure EventHub Receiver unable to connect to Azure EventHub. TLS failed to verify certificate error when the receiver tries to connect with EventHub

Steps to Reproduce

1. Install OTEL operator using helm chart - OTEL version - v0.107.0
2. Create a OTEL deployment and use below config

Deployment file

kind: Deployment apiVersion: apps/v1 metadata: name: otelcol-deployment labels: app.kubernetes.io/component: opentelemetry-collector spec: replicas: 1 selector: matchLabels: app.kubernetes.io/component: opentelemetry-collector template: metadata: labels: app.kubernetes.io/component: opentelemetry-collector annotations: prometheus.io/path: /metrics prometheus.io/port: '8888' prometheus.io/scrape: 'true' spec: restartPolicy: Always serviceAccountName: otel-collector containers: - resources: limits: cpu: 200m memory: 500Mi requests: cpu: 100m memory: 50Mi name: otc-container env: - name: POD_NAME valueFrom: fieldRef: apiVersion: v1 fieldPath: metadata.name ports: - name: metrics containerPort: 8888 protocol: TCP - name: otlp-grpc containerPort: 4317 protocol: TCP - name: otlp-http containerPort: 4318 protocol: TCP imagePullPolicy: IfNotPresent volumeMounts: - name: otc-internal mountPath: /conf terminationMessagePolicy: File image: 'otel:latest' args: - '--config=/conf/collector.yaml' serviceAccount: otel-collector volumes: - name: otc-internal configMap: name: otelcol-deployment-config items: - key: collector.yaml path: collector.yaml defaultMode: 420

Config Map

receivers: azureeventhub: connection: "CONNECTION-STRING" azureeventhub/all: connection: "CONNECTION-STRING" partition: "" group: "azure-logs" offset: "0-9999999" format: "raw" apply_semantic_conventions: true # optional time_formats: # All supported time format. Default is empty string array, which means using the current iso8601 parser. The format is based on https://pkg.go.dev/time#Layout. If no time-zone info, will use UTC time. logs: ["2006-01-02 15:04:05"] # metrics: ["01/02/2006 15:04:05"] exporters: debug: verbosity: detailed otlphttp/elasticapm: endpoint: https://Elastic-ip tls: insecure_skip_verify: true processors: batch: send_batch_size: 10000 timeout: 5s service: telemetry: logs: level: debug metrics: address: 0.0.0.0:8888 pipelines: logs: exporters: - otlphttp/elasticapm processors: - batch receivers: - azureeventhub - azureeventhub/all

Expected Result

Azure EventHub Receiver should connect to the EventHub and receive records/logs

Actual Result

`2025-01-13T10:23:48.127Z debug [email protected]/eventhubhandler.go:83 Error getting Runtime Information {"kind": "receiver", "name": "azureeventhub", "data_type": "logs", "error": "tls: failed to verify certificate: x509: certificate signed by unknown authority"}2025-01-13T10:23:48.128Z error graph/graph.go:426 Failed to start component {"error": "tls: failed to verify certificate: x509: certificate signed by unknown authority", "type": "Receiver", "id": "azureeventhub"}

2025-01-13T10:23:48.128Z info [email protected]/service.go:295 Starting shutdown...2025-01-13T10:23:48.128Z info extensions/extensions.go:66 Stopping extensions...2025-01-13T10:23:48.128Z info [email protected]/service.go:309 Shutdown complete.Error: cannot start pipelines: tls: failed to verify certificate: x509: certificate signed by unknown authority2025/01/13 10:23:48 collector server run finished with error: cannot start pipelines: tls: failed to verify certificate: x509: certificate signed by unknown authority`

Collector version

v0.107.0

Environment information

Environment

Tested in OpenShift Cluster

OpenTelemetry Collector configuration

receivers:
      azureeventhub:
        connection: "CONNECTION-STRING"
      azureeventhub/all:
        connection: "CONNECTION-STRING"
        partition: ""
        group: "azure-logs"
        offset: "0-9999999"
        format: "raw"
        apply_semantic_conventions: true
        # optional
        time_formats:
          # All supported time format. Default is empty string array, which means using the current iso8601 parser. The format is based on https://pkg.go.dev/time#Layout. If no time-zone info, will use UTC time.
          logs: ["2006-01-02 15:04:05"]
          # metrics: ["01/02/2006 15:04:05"]
    exporters:
      debug:
        verbosity: detailed
      otlphttp/elasticapm:
        endpoint: https://Elastic-ip
        tls:
          insecure_skip_verify: true
    processors:
      batch:
        send_batch_size: 10000
        timeout: 5s
    service:
      telemetry:
        logs:
          level: debug
        metrics:
          address: 0.0.0.0:8888
      pipelines:
        logs:
          exporters:
            - otlphttp/elasticapm
          processors:
            - batch
          receivers:
            - azureeventhub
            - azureeventhub/all

Log output

2025-01-13T10:23:48.127Z        debug   [email protected]/eventhubhandler.go:83    Error getting Runtime Information   {"kind": "receiver", "name": "azureeventhub", "data_type": "logs", "error": "tls: failed to verify certificate: x509: certificate signed by unknown authority"}2025-01-13T10:23:48.128Z        error   graph/graph.go:426      Failed to start component       {"error": "tls: failed to verify certificate: x509: certificate signed by unknown authority", "type": "Receiver", "id": "azureeventhub"}

2025-01-13T10:23:48.128Z        info    [email protected]/service.go:295 Starting shutdown...2025-01-13T10:23:48.128Z        info    extensions/extensions.go:66     Stopping extensions...2025-01-13T10:23:48.128Z        info    [email protected]/service.go:309 Shutdown complete.Error: cannot start pipelines: tls: failed to verify certificate: x509: certificate signed by unknown authority2025/01/13 10:23:48 collector server run finished with error: cannot start pipelines: tls: failed to verify certificate: x509: certificate signed by unknown authority

Additional context

No response

[github-actions]

Pinging code owners:

• receiver/azureeventhub: @atoulme @cparkins

See Adding Labels via Comments if you do not have permissions to add labels yourself.

[fullstackjourney3]

@atoulme @cparkins any update on this would be much helpful