Expose S3 client TLS configuration

[jdbaldry]

Is your feature request related to a problem? Please describe.

When using an S3 compatible object storage provider, it might be the case that you need to provision the S3 client with the certificates in order to verify the server certificate. The only solution presently is to enable insecure verification as you cannot provide TLS config to the s3 client via our current configuration parameters.

Describe the solution you'd like

The Thanos S3 client used in Mimir supports TLS configuration (

mimir/vendor/github.com/thanos-io/thanos/pkg/objstore/s3/s3.go

Line 121 in b1b9882

TLSConfig objstore.TLSConfig `yaml:"tls_config"`

) which is passed to the MinIO client that itself has TLS configuration support. I would like to see the full set of TLS configuration options exposed in Mimir configuration parameters.

Describe alternatives you've considered

None yet.

Additional context

None yet.

[zalegrala]

The above PR was closed. Tempo has recently added support for the TLS config from dskit. https://github.com/grafana/dskit/blob/main/crypto/tls/tls.go#L87

Mimir may be able to embed this also for consistency of tls options.

[reidlai]

still can't find any information how to set up TLS CA cert file for S3/Minio connection

[benoitschipper]

Same issue here, I would love an option where i could use the Helm Chart's Common Storage Section in order to list a configmap or a secret that allows me to set a TLS cert. Was able to get it working with skip_verify option, see PR for docs here: #7135 perhaps it, at least allows you to continue till a TLS cert injection is possible :)

[zalegrala]

I was able to work around the lack of config by placing my CA cert in /etc/ssl/certs/, which is loaded by Go without config.

[benoitschipper]

I was able to work around the lack of config by placing my CA cert in /etc/ssl/certs/, which is loaded by Go without config.

How did you get it there? Via the helm chart? Or did you adjust the Mimir image? I wonder :)

[zalegrala]

I'm not using helm, but I just mounted a configmap at the location in k8s.

[Itaykal]

I was able to work around the lack of config by placing my CA cert in /etc/ssl/certs/, which is loaded by Go without config.

I think the way to go would be either implementing this workaround in the helm chart, or push forward #2652.
Is there any status on re-opening the PR?