PMM-15186 Fix for invalid TLS when using change. - #5707
Open
JiriCtvrtka wants to merge 12 commits into
Open
Conversation
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #5707 +/- ##
==========================================
+ Coverage 43.59% 45.57% +1.98%
==========================================
Files 415 419 +4
Lines 43134 43356 +222
==========================================
+ Hits 18804 19761 +957
+ Misses 22454 21647 -807
- Partials 1876 1948 +72
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Contributor
Author
|
@copilot review |
JiriCtvrtka
marked this pull request as ready for review
July 30, 2026 16:12
JiriCtvrtka
requested review from
4nte,
ademidoff and
maxkondr
and removed request for
a team
July 30, 2026 16:12
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughThe PR adds shared TLS and authentication error handling, preserves gRPC error codes for formatting, updates admin client TLS setup, and integrates the behavior into admin CLI operations and agent registration. ChangesServer error handling
Estimated code review effort: 4 (Complex) | ~45 minutes Suggested reviewers: Poem
Sequence Diagram(s)sequenceDiagram
participant AdminCLI
participant AdminClient
participant PMMServer
participant servererror
AdminCLI->>AdminClient: execute agent update
AdminClient->>PMMServer: send HTTPS request
PMMServer-->>AdminClient: certificate or API error
AdminClient->>servererror: wrap or classify error
servererror-->>AdminCLI: diagnostic message and guidance
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@admin/commands/servererror_test.go`:
- Around line 76-105: Update the gRPC code assignments in the “with gRPC code”
and “internal error mapped to 401” subtests to use the existing named constants
grpcUnauthenticated and grpcInternal from TestServerErrorMessage instead of
inline numeric comments; keep the expected assertions unchanged and avoid inline
comments.
In `@agent/commands/setup.go`:
- Around line 159-160: Update the nginxError detection in the surrounding
error-handling flow to use errors.As so wrapped nginxError values are
recognized. Remove the direct type assertion and its inline nolint directive,
while preserving the existing message update for matching errors.
- Around line 146-155: Update the errors.AsType[*mservice.RegisterNodeDefault]
handling to guard all e.Payload accesses with a nil check. Keep message
assignment, conflict text, and servererror.AuthHint processing inside the guard,
while preserving the existing behavior when Payload is present.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 2d31f630-d5f5-4fb3-8f01-82b8ac19f9de
📒 Files selected for processing (11)
admin/cli/cli.goadmin/cli/cli_test.goadmin/commands/base.goadmin/commands/base/setup.goadmin/commands/base/setup_test.goadmin/commands/servererror.goadmin/commands/servererror_test.goagent/commands/setup.goagent/commands/setup_test.goutils/servererror/servererror.goutils/servererror/servererror_test.go
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PMM-15186
Problem
Two separate issues made
pmm-adminandpmm-agentfail against a PMM Server over HTTPS with an unhelpful message:pmm-adminmutatedhttp.DefaultTransportin place when configuring TLS. Because go-openapi hands out the process-wide default transport, the TLS settings (includingServerNameandInsecureSkipVerify) leaked into every other HTTP client in the process, and a--server-insecure-tlsrequest could end up applied to, or overwritten by, an unrelated client.localhostonly), the user saw a rawx509/tlserror with no indication that--server-insecure-tlsexists. Authentication errors were equally misleading: nginxauth_requestaccepts only 401 and 403, so PMM Server maps several gRPC codes — internal errors included — onto HTTP 401, and the CLI unconditionally reported all of them as "Please check username and password".Solution
admin/commands/base/setup.go: clone the transport before reconfiguring it (defaultTransport.Clone()) and assign the clone back to the runtime, so TLS configuration no longer toucheshttp.DefaultTransport.TLSNextProtois still set to keep HTTP/2 disabled, since it takes precedence over theForceAttemptHTTP2thatClonecarries over.--server-insecure-tlsis now opt-in only and no longer dropped: when PMM Server parameters come from the local pmm-agent, an explicitly passed flag is OR-ed with the agent'sServerInsecureTLSinstead of being overwritten by it. A malformed server URL reported by pmm-agent is now reported instead of being silently ignored.utils/servererrorpackage (used by both pmm-admin and pmm-agent, which expose the same flag and talk to PMM Server over the same transport):IsTLSCertificateError/WrapTLSErrordetect certificate verification failures (tls.CertificateVerificationErrorplus the barex509errors) and append a hint naming the host the certificate was checked against, suggesting--server-insecure-tlsor a properly issued certificate. Nothing is added when validation is already disabled.AuthHintdistinguishes rejected credentials (gRPCUnauthenticated) from insufficient permissions (gRPCPermissionDenied/ HTTP 403) and from server-side failures mapped onto HTTP 401, returning the appropriate hint for each. The gRPC code from the response payload is now carried oncommands.ErrorasGRPCCode(excluded from JSON to keep the documentedpmm-admin --jsonerror shape).admin/commands/servererror.goandagent/commands/setup.gorender those hints, each owning its own punctuation and separator; the pmm-agent register path keeps its existing--forcehint for HTTP 409.Testing
Unit tests added for all new behaviour:
utils/servererror/servererror_test.go,admin/commands/servererror_test.go,admin/cli/cli_test.go,admin/commands/base/setup_test.go(transport isolation and flag precedence) andagent/commands/setup_test.go.Summary by CodeRabbit