From 192d3783d5bede8362c1eed0c27422f431478b5a Mon Sep 17 00:00:00 2001
From: mohammad-hamid <mohammad.hamid@grafana.com>
Date: Wed, 2 Apr 2025 09:12:58 -0400
Subject: [PATCH] Zanzana/enable TLS for client side gRPC (#103000)

* zanzana - add tls to the client

* remove todo

* gofmt

* adjust comment
---
 pkg/services/authz/zanzana.go   | 14 +++++++++++---
 pkg/setting/settings_zanzana.go |  3 +++
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/pkg/services/authz/zanzana.go b/pkg/services/authz/zanzana.go
index 6067a232082..6ef6c6ebc30 100644
--- a/pkg/services/authz/zanzana.go
+++ b/pkg/services/authz/zanzana.go
@@ -5,12 +5,14 @@ import (
 	"errors"
 	"fmt"
 
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/credentials/insecure"
+
 	"github.com/fullstorydev/grpchan/inprocgrpc"
 	grpcAuth "github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/auth"
 	openfgav1 "github.com/openfga/api/proto/openfga/v1"
 	"github.com/prometheus/client_golang/prometheus"
 	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
 	healthv1pb "google.golang.org/grpc/health/grpc_health_v1"
 
 	authnlib "github.com/grafana/authlib/authn"
@@ -53,9 +55,15 @@ func ProvideZanzana(cfg *setting.Cfg, db db.DB, tracer tracing.Tracer, features
 			return nil, fmt.Errorf("missing stack ID")
 		}
 
+		transportCredentials := insecure.NewCredentials()
+		if cfg.ZanzanaClient.ServerCertFile != "" {
+			transportCredentials, err = credentials.NewClientTLSFromFile(cfg.ZanzanaClient.ServerCertFile, "")
+			if err != nil {
+				return nil, fmt.Errorf("failed to initialize TLS certificate: %w", err)
+			}
+		}
 		dialOptions := []grpc.DialOption{
-			// TODO: add TLS support
-			grpc.WithTransportCredentials(insecure.NewCredentials()),
+			grpc.WithTransportCredentials(transportCredentials),
 			grpc.WithPerRPCCredentials(
 				NewGRPCTokenAuth(AuthzServiceAudience, fmt.Sprintf("stacks-%s", cfg.StackID), tokenClient),
 			),
diff --git a/pkg/setting/settings_zanzana.go b/pkg/setting/settings_zanzana.go
index 8a63e9011dc..9b0c2d1c411 100644
--- a/pkg/setting/settings_zanzana.go
+++ b/pkg/setting/settings_zanzana.go
@@ -18,6 +18,9 @@ type ZanzanaClientSettings struct {
 	// Addr is the address of the Zanzana server.
 	// Only used when mode is set to client.
 	Addr string
+	// Certificate used to authenticate the Server
+	// Only used when mode is set to client
+	ServerCertFile string
 	// Token used to perform the exchange request.
 	// Only used when mode is set to client.
 	Token string