AuthZService: Add certificates to the client (#101603)

pkg/services/authz/rbac.go

@@ -11,6 +11,7 @@ import (
 	grpcAuth "github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/auth"
 	"github.com/prometheus/client_golang/prometheus"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/credentials/insecure"
 	"k8s.io/client-go/rest"
 
@@ -119,9 +120,17 @@ func newRemoteRBACClient(clientCfg *authzClientSettings, tracer tracing.Tracer)
 		return nil, fmt.Errorf("failed to initialize token exchange client: %w", err)
 	}
 
+	transportCreds := insecure.NewCredentials()
+	if clientCfg.certFile != "" {
+		transportCreds, err = credentials.NewClientTLSFromFile(clientCfg.certFile, "")
+		if err != nil {
+			return nil, fmt.Errorf("failed to load TLS credentials: %w", err)
+		}
+	}
+
 	conn, err := grpc.NewClient(
 		clientCfg.remoteAddress,
-		grpc.WithTransportCredentials(insecure.NewCredentials()),
+		grpc.WithTransportCredentials(transportCreds),
 		grpc.WithPerRPCCredentials(
 			NewGRPCTokenAuth(AuthzServiceAudience, clientCfg.tokenNamespace, tokenClient),
 		),

pkg/services/authz/rbac_settings.go

@@ -23,6 +23,7 @@ const (
 
 type authzClientSettings struct {
 	remoteAddress string
+	certFile      string
 	mode          clientMode
 
 	token            string
@@ -46,6 +47,7 @@ func readAuthzClientSettings(cfg *setting.Cfg) (*authzClientSettings, error) {
 	}
 
 	s.remoteAddress = authzSection.Key("remote_address").MustString("")
+	s.certFile = authzSection.Key("cert_file").MustString("")
 	s.token = grpcClientAuthSection.Key("token").MustString("")
 	s.tokenNamespace = grpcClientAuthSection.Key("token_namespace").MustString("stacks-" + cfg.StackID)
 	s.tokenExchangeURL = grpcClientAuthSection.Key("token_exchange_url").MustString("")