Zanzana/enable TLS for client side gRPC (#103000)

* zanzana - add tls to the client

* remove todo

* gofmt

* adjust comment

pkg/services/authz/zanzana.go

@@ -5,12 +5,14 @@ import (
 	"errors"
 	"fmt"
 
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/credentials/insecure"
+
 	"github.com/fullstorydev/grpchan/inprocgrpc"
 	grpcAuth "github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/auth"
 	openfgav1 "github.com/openfga/api/proto/openfga/v1"
 	"github.com/prometheus/client_golang/prometheus"
 	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
 	healthv1pb "google.golang.org/grpc/health/grpc_health_v1"
 
 	authnlib "github.com/grafana/authlib/authn"
@@ -53,9 +55,15 @@ func ProvideZanzana(cfg *setting.Cfg, db db.DB, tracer tracing.Tracer, features
 			return nil, fmt.Errorf("missing stack ID")
 		}
 
+		transportCredentials := insecure.NewCredentials()
+		if cfg.ZanzanaClient.ServerCertFile != "" {
+			transportCredentials, err = credentials.NewClientTLSFromFile(cfg.ZanzanaClient.ServerCertFile, "")
+			if err != nil {
+				return nil, fmt.Errorf("failed to initialize TLS certificate: %w", err)
+			}
+		}
 		dialOptions := []grpc.DialOption{
-			// TODO: add TLS support
-			grpc.WithTransportCredentials(insecure.NewCredentials()),
+			grpc.WithTransportCredentials(transportCredentials),
 			grpc.WithPerRPCCredentials(
 				NewGRPCTokenAuth(AuthzServiceAudience, fmt.Sprintf("stacks-%s", cfg.StackID), tokenClient),
 			),

pkg/setting/settings_zanzana.go

@@ -18,6 +18,9 @@ type ZanzanaClientSettings struct {
 	// Addr is the address of the Zanzana server.
 	// Only used when mode is set to client.
 	Addr string
+	// Certificate used to authenticate the Server
+	// Only used when mode is set to client
+	ServerCertFile string
 	// Token used to perform the exchange request.
 	// Only used when mode is set to client.
 	Token string