[query-frontend] TLS configarion for downstream query backend

[twiden]

Is your proposal related to a problem?

I'm setting up Thanos in an environment where Istio enforces strict mTLS. Each pod, including thanos frontend, runs a sidecar that exposes the application through a TLS enabled port with self signed certificates generated by Istio.

Most Thanos and Prometheus components lets me configure the application to use ca, cert and key from a file on disk. This is very conventient because the Istio sidecar can provide a volume with these files.

But I can't find a way to pass this configuration to query-frontend. It seems like the binary simply does not take any argument for this. We have --query-frontend.downstream-tripper-config and --query-frontend.downstream-tripper-config-file but these only provide a subset of the config that the transport go library can handle.

Describe the solution you'd like

I would like to pass a TLSConfig to Thanos query-frontend pointing out the caFile, certFile and keyFile on disk as well as the ability to skip hostname check. These could be provided through --query-frontend.downstream-tripper-config and --query-frontend.downstream-tripper-config-file

For Ruler I can accomplish this with a query_config:

  - http_config:
      tls_config:
        ca_file: "/etc/certs/root-cert.pem"
        cert_file: "/etc/certs/cert-chain.pem"
        key_file: "/etc/certs/key.pem"
        insecure_skip_verify: true

Describe alternatives you've considered

The only way around this that I have found is to add pod annotations so that istio ignores traffic on the incoming http port of thanos query backend and on the outgoing port on query frontend. But this affects other services such as Grafana who also communcates with query backend. Grafana can handle these tls settings but I have to make the same hacky workaround on the Grafana pod anyway since I've had to bypass it on the datasource.

[GiedriusS]

Makes sense, I think we can add this to the same downstream tripper config.

[WYGIN]

hi , i am willing to contribute to this pr, & it would be helpful if you point me to some resources which explains to test changes made locally