IndustryKit OPC UA

An OPC UA source supports subscribe and poll modes. In subscribe mode, it receives values pushed by the Server after establishing a subscription. In poll mode, it actively reads values at the source interval.

Configuration hierarchy¶

An OPC UA collection instance consists of three configuration levels:

[[sources]]
  [sources.opcua]
    [[sources.opcua.points]]

[[sources]] defines the collection instance, measurement, collection interval, and common tags.
[sources.opcua] defines the Endpoint, authentication, and secure connection used by the instance.
Each [[sources.opcua.points]] maps one Node ID to one output field. Add multiple point entries to collect multiple nodes.

When type = "opcua", only the [sources.opcua] protocol table may be configured, and at least one point is required. Append the complete configuration below to the main IndustryKit configuration file.

Configuration¶

[[sources]]
id = "opcua-line-1"
type = "opcua"
measurement = "opcua_metrics"
interval = "10s"
tags = { device = "opcua-server-01" }

[sources.opcua]
endpoint = "opc.tcp://192.0.2.20:4840"
mode = "subscribe"
auth = "anonymous"
security_policy = "None"
security_mode = "None"
publishing_interval = "1s"

[[sources.opcua.points]]
field = "pressure"
node_id = "ns=2;s=Plant/Pump/Pressure"
sampling_interval = "500ms"
queue_size = 10

[[sources.opcua.points]]
field = "alarm"
category = "logging"
node_id = "ns=2;s=Plant/Pump/Alarm"
sampling_interval = "500ms"
queue_size = 10

For username authentication and an encrypted connection, replace [sources.opcua] above with a configuration similar to the following:

[sources.opcua]
endpoint = "opc.tcp://192.0.2.21:4843"
mode = "poll"
auth = "username"
username = "<OPCUA_USERNAME>"
password = "<OPCUA_PASSWORD>"
security_policy = "Basic256Sha256"
security_mode = "SignAndEncrypt"
certificate_file = "pki/opcua-client.pem"
private_key_file = "pki/opcua-client-key.pem"
server_certificate = "pki/opcua-server.pem"

Options¶

`[[sources]]`¶

Field	Default	Description
`id`	None	Required and unique within the current configuration. Reported as the `source_id` tag.
`type`	None	Must be `opcua`.
`measurement`	`industrial`	Name of the output metric measurement or log source.
`interval`	`10s`	Read interval in `poll` mode. Must be greater than `0`. It does not control the data rate in `subscribe` mode.
`tags`	`{}`	Static tags for this source. They are merged with global tags.

`[sources.opcua]`¶

Field	Default	Description
`endpoint`	None	Required absolute `opc.tcp://host[:port]` address. It must not contain credentials, a query, or a fragment.
`mode`	`subscribe`	Collection mode: `subscribe` or `poll`.
`auth`	`username` when `username` is set; otherwise `anonymous`	Authentication method: `anonymous`, `username`, or `certificate`. The target Endpoint must advertise support for the selected method.
`security_policy`	`None`	Security policy: `None` or `Basic256Sha256`.
`security_mode`	`None`	Message security mode: `None`, `Sign`, or `SignAndEncrypt`. `Basic256Sha256` cannot be used with `None`.
`username`	Empty	Required when `auth = "username"`. It is also required when `password` is set.
`password`	Empty	Password for username authentication.
`certificate_file`	Empty	Client certificate. It must be configured together with `private_key_file`, and is required for certificate authentication or whenever `security_policy` is not `None`.
`private_key_file`	Empty	Client RSA private key. It must be configured together with `certificate_file`.
`server_certificate`	Empty	Required whenever `security_policy` is not `None`. Used to validate the certificate actually presented by the Server.
`publishing_interval`	`1s`	Must be greater than `0`. Publishing interval in `subscribe` mode; unused in `poll` mode.

Relative certificate paths are resolved from the directory containing the main configuration file. The IndustryKit service account must have permission to read these files. When security_policy = "None", security_mode must be None. When using Basic256Sha256, select Sign or SignAndEncrypt and configure the client certificate, private key, and Server certificate.

`[[sources.opcua.points]]`¶

Field	Default	Description
`field`	None	Required output field name. Metrics are written under this name. For logging output, it is included in `message`, with `status` and `value` emitted separately.
`node_id`	None	Required OPC UA Node ID. It must be unique within the source.
`sampling_interval`	`1s`	Must be greater than `0`. Server-side sampling interval in `subscribe` mode; unused in `poll` mode.
`queue_size`	`10`	Must be greater than `0`. Monitored-item queue length in `subscribe` mode. The oldest value is discarded when the queue is full. Unused in `poll` mode.
`category`	`metric`	Output category: `metric` or `logging`.
`tags`	`{}`	Static tags for the point. They are merged with global and source tags.
`scale`	`1`	OPC UA collection does not currently apply this transformation. Keep the default and do not configure it.
`offset`	`0`	OPC UA collection does not currently apply this transformation. Keep the default and do not configure it.
`on_change`	`false`	When set to `true`, a metric is sent only when its value changes. Logging output is change-based by default.
`emit_initial`	`false`	Whether to send the first observed value after change detection is enabled. Otherwise, the first value is used only to establish the baseline.
`status`	`info`	Status emitted when `category = "logging"`.

In poll mode, values are actively read at the source interval. In subscribe mode, publishing_interval, sampling_interval, and queue_size apply. These three settings have no effect in poll mode, but configuration validation still requires positive values; their defaults are used when omitted. See IndustryKit for common installation, operation, and verification instructions.

Data and limitations¶

A valid OPC UA SourceTimestamp is preferred; otherwise, the receive time is used.
Values with Bad quality are not emitted as synthetic values. Uncertain values include quality and opcua_status tags.
Basic256Sha256 requires a client certificate, client private key, and Server certificate, and validates the Server certificate.
IndustryKit currently reads or subscribes to nodes only. Node writes and automatic discovery are not supported.