Query: Support per endpoint TLS configuration by Naman-B-Parlecha · Pull Request #8594 · thanos-io/thanos

Naman-B-Parlecha · 2025-12-09T21:11:25Z

I m still working on this have some edge case and tests to add. Will update description soon.

I added CHANGELOG entry for this change.
Change is not relevant to the end user.

Related to: Add support for mixed TLS and non-TLS endpoints in Query #8586

Changes

Add per-endpoint and default TLS configuration for the Query component via endpoint.sd-config.

Each endpoint can now specify its own client_config with TLS settings, server name, and compression
A default_client_config can be set in the YAML config to apply TLS settings to all endpoints that don't specify their own
The existing --grpc-client-tls-* CLI flags are deprecated (hidden from --help) and will be removed after v0.43.0
A deprecation warning is logged when deprecated CLI flags are used

Precedence order

Per-endpoint client_config (highest)
default_client_config from YAML
--grpc-client-tls-* CLI flags (deprecated, lowest)

Example config

default_client_config:
  tls_config:
    enabled: true
    insecure_skip_verify: true
    cert_file: "/path/to/client.crt" 
    key_file: "/path/to/client.key"    
    ca_file: "/path/to/ca.crt"    
    min_version: "1.3"
  compression: "snappy"         
                                           
endpoints:                              
  - address: "store1:10901"
    client_config:                                                                                                                      
      tls_config:
        enabled: true                                                                                                                   
        cert_file: "/path/to/client.crt"                                                                                              
        key_file: "/path/to/client.key"                                                                                               
        ca_file: "/path/to/ca.crt"                                                                                                      
      server_name: "store"
      compression: "snappy"

Verification

Added debug logs to check if switching between global and per endpoint configuration works as intended

./thanos query --log.level=debug --endpoint.sd-config-file=test_per_endpoint.yml

ts=2025-12-20T17:21:32.579477401Z caller=endpointset.go:429 level=debug msg="configured endpoint" addr=localhost:10901 tls=global compression=none
ts=2025-12-20T17:21:32.579526715Z caller=endpointset.go:429 level=debug msg="configured endpoint" addr=localhost:10902 tls="global (fallback)" compression=none
ts=2025-12-20T17:21:32.57954552Z caller=endpointset.go:429 level=debug msg="configured endpoint" addr=localhost:10903 tls="global (fallback)" compression=none
ts=2025-12-20T17:21:32.579550379Z caller=endpointset.go:429 level=debug msg="configured endpoint" addr=localhost:10904 tls=global compression=none
ts=2025-12-20T17:21:32.579554076Z caller=endpointset.go:429 level=debug msg="configured endpoint" addr=localhost:10905 tls=global compression=none
ts=2025-12-20T17:21:32.590883522Z caller=endpointset.go:429 level=debug msg="configured endpoint" addr=localhost:10906 tls=per-endpoint compression=none

Signed-off-by: Naman-B-Parlecha <naman.parlecha@finalroundai.com>

Signed-off-by: Naman-B-Parlecha <namanparlecha@gmail.com>

Signed-off-by: Naman-B-Parlecha <naman.parlecha@finalroundai.com>

Signed-off-by: Naman-B-Parlecha <namanparlecha@gmail.com>

Naman-B-Parlecha · 2025-12-20T19:08:05Z

@MichaHoffmann i have refactored to client_config PTAL!!

ringerc

Thanks for this. While I'm not a proper project member, I hope this initial review is helpful. I'll see if I can also test out the change as this is functionality I happen to need.

I note that there is a test failure from CI below, but it appears to be unrelated to this change.

Naman-B-Parlecha · 2026-02-04T13:51:54Z

Hey @ringerc! Thanks for the review, comment completely make sense i will try and refactor based on your suggestions

…port Signed-off-by: Naman-B-Parlecha <namanparlecha@gmail.com>

Signed-off-by: Craig Ringer <craig.ringer@enterprisedb.com>

Signed-off-by: Naman-B-Parlecha <namanparlecha@gmail.com>

GiedriusS · 2026-03-12T16:22:20Z

Updated to 1.26 here #8717 so we can remove lots of boilerplate.

Signed-off-by: Naman-B-Parlecha <namanparlecha@gmail.com>

Naman-B-Parlecha · 2026-03-12T19:30:15Z

@GiedriusS refactored all changed requested PLAT!! thanks:))

GiedriusS

Could we mark --endpoint and other parameters as deprecated in cmd/thanos/query.go in this same PR? In other words, let's only support using files for setting endpoints. In next_version+1 we can remove them entirely.

Naman-B-Parlecha · 2026-03-25T06:12:16Z

Could we mark --endpoint and other parameters as deprecated in cmd/thanos/query.go in this same PR? In other words, let's only support using files for setting endpoints. In next_version+1 we can remove them entirely.

yes read the slack thread regarding this
will refactor!!

thanks

Signed-off-by: Naman-B-Parlecha <namanparlecha@gmail.com>

ringerc · 2026-04-20T02:17:49Z

This is still waiting. What can we do to progress this to merge?

ringerc · 2026-04-29T01:21:16Z

@Naman-B-Parlecha This now needs rebase. Sorry it's taking so long, I'm trying to encourage this to get through final review.

Co-authored-by: Copilot <copilot@github.com>

Naman-B-Parlecha · 2026-04-29T07:44:27Z

The docs and unit test failures are not related to pr

ringerc · 2026-05-05T01:43:55Z

Thanks very much @GiedriusS

This commit changes the log verbosity from info to debug for TLS client configuration setup. Running a Thanos Query on the main branch with `--endpoint.sd-config-file` instead of the legacy `--grpc-client*` arguments, log messages are emitted every 5 seconds (the interval at which the list of endpoints is refreshed): ``` ts=2026-06-15T14:47:46.913935863Z caller=client.go:147 level=info msg="enabling client to server TLS" ts=2026-06-15T14:47:46.9141221Z caller=options.go:145 level=info msg="TLS client using provided certificate pool" ts=2026-06-15T14:47:46.914143614Z caller=options.go:165 level=info msg="setting minimum TLS version to 1.3" ts=2026-06-15T14:47:46.91415433Z caller=options.go:191 level=info msg="TLS client authentication enabled" ts=2026-06-15T14:47:51.914025066Z caller=client.go:147 level=info msg="enabling client to server TLS" ts=2026-06-15T14:47:51.914294263Z caller=options.go:145 level=info msg="TLS client using provided certificate pool" ts=2026-06-15T14:47:51.91431529Z caller=options.go:165 level=info msg="setting minimum TLS version to 1.3" ts=2026-06-15T14:47:51.914326314Z caller=options.go:191 level=info msg="TLS client authentication enabled" ts=2026-06-15T14:47:56.913622829Z caller=client.go:147 level=info msg="enabling client to server TLS" ts=2026-06-15T14:47:56.913977311Z caller=options.go:145 level=info msg="TLS client using provided certificate pool" ts=2026-06-15T14:47:56.913995512Z caller=options.go:165 level=info msg="setting minimum TLS version to 1.3" ts=2026-06-15T14:47:56.914006135Z caller=options.go:191 level=info msg="TLS client authentication enabled" ``` I think that it was introduced in #8594. Signed-off-by: Simon Pasquier <spasquie@redhat.com>

feat: per endpoint grpc client TLS config

6187b3c

Signed-off-by: Naman-B-Parlecha <naman.parlecha@finalroundai.com>

pull-request-size Bot added the size/M label Dec 9, 2025

Naman-B-Parlecha marked this pull request as draft December 9, 2025 21:11

Naman-B-Parlecha and others added 3 commits December 10, 2025 02:47

Merge branch 'main' into NamanParlecha/PerEndpointTLS

dda6592

addding some context

d057893

Signed-off-by: Naman-B-Parlecha <namanparlecha@gmail.com>

adding edge cases

8925177

Signed-off-by: Naman-B-Parlecha <naman.parlecha@finalroundai.com>

pull-request-size Bot added size/L and removed size/M labels Dec 10, 2025

Naman-B-Parlecha added 5 commits December 18, 2025 20:00

adding per-endpoint compression

051e4d9

Signed-off-by: Naman-B-Parlecha <naman.parlecha@finalroundai.com>

Merge branch 'main' into NamanParlecha/PerEndpointTLS

1471a0f

renaming

a6c7a54

Signed-off-by: Naman-B-Parlecha <naman.parlecha@finalroundai.com>

compression edge case fix

58dc7d3

Signed-off-by: Naman-B-Parlecha <naman.parlecha@finalroundai.com>

documentation

fddb1b4

Signed-off-by: Naman-B-Parlecha <naman.parlecha@finalroundai.com>

Naman-B-Parlecha force-pushed the NamanParlecha/PerEndpointTLS branch from 205dc0a to fddb1b4 Compare December 20, 2025 17:08

Naman-B-Parlecha added 2 commits December 20, 2025 22:38

Merge branch 'main' into NamanParlecha/PerEndpointTLS

78adcb4

per-endpoint compression fix

a7f370a

Signed-off-by: Naman-B-Parlecha <naman.parlecha@finalroundai.com>

Naman-B-Parlecha marked this pull request as ready for review December 20, 2025 17:34

MichaHoffmann reviewed Dec 20, 2025

View reviewed changes

Comment thread cmd/thanos/endpointset.go Outdated

refactor: use client_config

8a0b44a

Signed-off-by: Naman-B-Parlecha <namanparlecha@gmail.com>

Naman-B-Parlecha changed the title ~~WIP: Query: Support per endpoint TLS configuration~~ Query: Support per endpoint TLS configuration Dec 20, 2025

Naman-B-Parlecha added 3 commits December 30, 2025 20:45

Merge branch 'main' into NamanParlecha/PerEndpointTLS

ec532ec

Merge branch 'main' into NamanParlecha/PerEndpointTLS

239b35f

Merge branch 'main' into NamanParlecha/PerEndpointTLS

30f953e

Naman-B-Parlecha requested a review from MichaHoffmann January 13, 2026 20:23

ringerc reviewed Feb 4, 2026

View reviewed changes

Comment thread cmd/thanos/endpointset.go

Comment thread cmd/thanos/endpointset.go Outdated

Comment thread cmd/thanos/endpointset.go Outdated

Comment thread docs/components/query.md

Comment thread docs/components/query.md Outdated

Merge branch 'thanos-io:main' into NamanParlecha/PerEndpointTLS

7bf1a8f

feat: add per-endpoint TLS configuration with minimum TLS version sup…

bf8c193

…port Signed-off-by: Naman-B-Parlecha <namanparlecha@gmail.com>

Naman-B-Parlecha force-pushed the NamanParlecha/PerEndpointTLS branch from 54fd19b to bf8c193 Compare February 4, 2026 19:45

docs: Update TLS config docs for min_version changes

8b790a6

Signed-off-by: Craig Ringer <craig.ringer@enterprisedb.com>

Naman-B-Parlecha force-pushed the NamanParlecha/PerEndpointTLS branch 2 times, most recently from 66a0cd0 to 8b790a6 Compare March 9, 2026 19:00

chore: make use of variables for config tests

1ae3ef1

Signed-off-by: Naman-B-Parlecha <namanparlecha@gmail.com>

GiedriusS reviewed Mar 12, 2026

View reviewed changes

Comment thread cmd/thanos/config.go

Comment thread cmd/thanos/endpointset.go Outdated

Comment thread cmd/thanos/endpointset_test.go Outdated

Comment thread cmd/thanos/endpointset.go

Naman-B-Parlecha added 3 commits March 12, 2026 22:11

Merge branch 'main' into NamanParlecha/PerEndpointTLS

81d7cd3

refactor: use new(T) syntax and centralize TLS version validation

c69a0b5

Signed-off-by: Naman-B-Parlecha <namanparlecha@gmail.com>

docs: Lint fix

23ebdf2

Signed-off-by: Naman-B-Parlecha <namanparlecha@gmail.com>

GiedriusS reviewed Mar 25, 2026

View reviewed changes

Comment thread pkg/tls/options.go Outdated

Naman-B-Parlecha added 3 commits March 29, 2026 23:06

Merge branch 'thanos-io:main' into NamanParlecha/PerEndpointTLS

b10bfaa

feat(query): add default_client_config to deprecate ---grpc-client-*

9313353

Signed-off-by: Naman-B-Parlecha <namanparlecha@gmail.com>

feat(tls): deprecate grpc-client flags and update TLS version handling

003eb7a

Signed-off-by: Naman-B-Parlecha <namanparlecha@gmail.com>

Naman-B-Parlecha requested review from GiedriusS, MichaHoffmann and ringerc April 8, 2026 05:12

Merge branch 'main' into NamanParlecha/PerEndpointTLS

dcdaa71

Co-authored-by: Copilot <copilot@github.com>

GiedriusS approved these changes May 4, 2026

View reviewed changes

GiedriusS enabled auto-merge May 4, 2026 11:03

GiedriusS merged commit 200c475 into thanos-io:main May 4, 2026
36 of 38 checks passed

GiedriusS mentioned this pull request May 8, 2026

[Feature] Per-Store TLS configuration in Thanos Query #977

Closed

simonpasquier mentioned this pull request Jun 15, 2026

chore: move TLS config logs from info to debug #8855

Merged

1 of 2 tasks

Conversation

Naman-B-Parlecha commented Dec 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Precedence order

Example config

Verification

Uh oh!

Uh oh!

Naman-B-Parlecha commented Dec 20, 2025

Uh oh!

ringerc left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Naman-B-Parlecha commented Feb 4, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

GiedriusS commented Mar 12, 2026

Uh oh!

Naman-B-Parlecha commented Mar 12, 2026

Uh oh!

GiedriusS left a comment

Choose a reason for hiding this comment

Uh oh!

Naman-B-Parlecha commented Mar 25, 2026

Uh oh!

Uh oh!

ringerc commented Apr 20, 2026

Uh oh!

ringerc commented Apr 29, 2026

Uh oh!

Naman-B-Parlecha commented Apr 29, 2026

Uh oh!

Uh oh!

ringerc commented May 5, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Naman-B-Parlecha commented Dec 9, 2025 •

edited

Loading

ringerc left a comment •

edited

Loading