From fa8dafec77a45e5050858d57b40dccc64a61842f Mon Sep 17 00:00:00 2001 From: Alex Hunsaker Date: Tue, 1 Apr 2025 06:41:22 -0600 Subject: [PATCH] Tempo: fix streaming with TLS without BasicAuth (#100546) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes #100545 Streaming queries/metrics do not work if TLS is enabled and basic auth is not. "Save & test" while adding/editing a tempo datasource throw `e.data is undefined` in the ui. Gafana server logs report: > logger=grafana-apiserver t=2025-02-12T17:55:29.131036665Z level=info msg="[core] [Channel #42 SubChannel #43]grpc: > addrConn.createTransport failed to connect to {Addr: \"tempo:3200\", ServerName: \"tempo:3200\", }. Err: connection > error: desc = \"error reading server preface: read tcp 127.0.0.1:55432->127.0.0.1:3200: read: connection reset by > peer\"" > logger=grafana-apiserver t=2025-02-12T17:55:36.835523455Z level=info msg="[core] [Channel #31 SubChannel #32]grpc: > addrConn.createTransport failed to connect to {Addr: \"tempo:3200\", ServerName: > \"tempo:3200\", }. Err: connection > error: desc = \"error reading server preface: EOF\"" Fix by using TLS when enabled regardless of basic auth settings. Co-authored-by: André Pereira --- pkg/tsdb/tempo/grpc.go | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/pkg/tsdb/tempo/grpc.go b/pkg/tsdb/tempo/grpc.go index 81a41020b6c..b4d0d3e3882 100644 --- a/pkg/tsdb/tempo/grpc.go +++ b/pkg/tsdb/tempo/grpc.go @@ -86,23 +86,26 @@ func getDialOpts(ctx context.Context, settings backend.DataSourceInstanceSetting // Also User agent but that is set before each rpc call as for decoupled DS we have to get it from request context // and cannot add it to client here. - var dialOps []grpc.DialOption - - dialOps = append(dialOps, grpc.WithChainStreamInterceptor(CustomHeadersStreamInterceptor(opts))) - if settings.BasicAuthEnabled { - // If basic authentication is enabled, it uses TLS transport credentials and sets the basic authentication header for each RPC call. + var creds credentials.TransportCredentials + if opts.TLS != nil { tls, err := httpclient.GetTLSConfig(opts) if err != nil { return nil, fmt.Errorf("failure in configuring tls for grpc: %w", err) } + creds = credentials.NewTLS(tls) + } else { + creds = insecure.NewCredentials() + } - dialOps = append(dialOps, grpc.WithTransportCredentials(credentials.NewTLS(tls))) + var dialOps []grpc.DialOption + dialOps = append(dialOps, grpc.WithChainStreamInterceptor(CustomHeadersStreamInterceptor(opts))) + if settings.BasicAuthEnabled { + dialOps = append(dialOps, grpc.WithTransportCredentials(creds)) dialOps = append(dialOps, grpc.WithPerRPCCredentials(&basicAuth{ Header: basicHeaderForAuth(opts.BasicAuth.User, opts.BasicAuth.Password), })) } else { - // Otherwise, it uses insecure credentials. - dialOps = append(dialOps, grpc.WithTransportCredentials(insecure.NewCredentials())) + dialOps = append(dialOps, grpc.WithTransportCredentials(creds)) } // The following code is required to make gRPC work with Grafana Cloud PDC