Add s3 config option insecure_skip_verify (#1470)

* Add s3 config option insecure_skip_verify * Update changelog * Improve docs from feedback * Update changelog
grafana · Jun 10, 2022 · 6c35e24 · 6c35e24
1 parent ff2914f
commit 6c35e24
Show file tree

Hide file tree

Showing 4 changed files with 25 additions and 15 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -20,6 +20,7 @@ Additionally, default label `span_status` is renamed to `status_code`.
 * [ENHANCEMENT] metrics-generator: expose max_active_series as a metric [#1471](https://github.com/grafana/tempo/pull/1471) (@kvrhdn)
 * [ENHANCEMENT] Azure Backend: Add support for authentication with Managed Identities. [#1457](https://github.com/grafana/tempo/pull/1457) (@joe-elliott)
 * [ENHANCEMENT] Add metric to track feature enablement [#1459](https://github.com/grafana/tempo/pull/1459) (@zalegrala)
+* [ENHANCEMENT] Added s3 config option `insecure_skip_verify` [#1470](https://github.com/grafana/tempo/pull/1470) (@zalegrala)
 * [BUGFIX] Fix nil pointer panic when the trace by id path errors. [#1441](https://github.com/grafana/tempo/pull/1441) (@joe-elliott)
 * [BUGFIX] Update tempo microservices Helm values example which missed the 'enabled' key for thriftHttp. [#1472](https://github.com/grafana/tempo/pull/1472) (@hajowieland)
 * [BUGFIX] Fix race condition in forwarder overrides loop. [1468](https://github.com/grafana/tempo/pull/1468) (@mapno)

diff --git a/docs/tempo/website/configuration/_index.md b/docs/tempo/website/configuration/_index.md
@@ -532,7 +532,11 @@ storage:
 
             # optional.
             # enable if endpoint is http
-            [insecure: <bool>]          
+            [insecure: <bool>]
+
+            # optional.
+            # Set to true to disable verification of an TLS endpoint.  The default value is false.
+            [insecure_skip_verify: <bool>]
 
             # optional.
             # enable to use path-style requests.

diff --git a/tempodb/backend/s3/config.go b/tempodb/backend/s3/config.go
@@ -7,15 +7,16 @@ import (
 )
 
 type Config struct {
-	Bucket            string         `yaml:"bucket"`
-	Endpoint          string         `yaml:"endpoint"`
-	Region            string         `yaml:"region"`
-	AccessKey         string         `yaml:"access_key"`
-	SecretKey         flagext.Secret `yaml:"secret_key"`
-	Insecure          bool           `yaml:"insecure"`
-	PartSize          uint64         `yaml:"part_size"`
-	HedgeRequestsAt   time.Duration  `yaml:"hedge_requests_at"`
-	HedgeRequestsUpTo int            `yaml:"hedge_requests_up_to"`
+	Bucket             string         `yaml:"bucket"`
+	Endpoint           string         `yaml:"endpoint"`
+	Region             string         `yaml:"region"`
+	AccessKey          string         `yaml:"access_key"`
+	SecretKey          flagext.Secret `yaml:"secret_key"`
+	Insecure           bool           `yaml:"insecure"`
+	InsecureSkipVerify bool           `yaml:"insecure_skip_verify"`
+	PartSize           uint64         `yaml:"part_size"`
+	HedgeRequestsAt    time.Duration  `yaml:"hedge_requests_at"`
+	HedgeRequestsUpTo  int            `yaml:"hedge_requests_up_to"`
 	// SignatureV2 configures the object storage to use V2 signing instead of V4
 	SignatureV2    bool `yaml:"signature_v2"`
 	ForcePathStyle bool `yaml:"forcepathstyle"`

diff --git a/tempodb/backend/s3/s3.go b/tempodb/backend/s3/s3.go
@@ -16,9 +16,9 @@ import (
 	gkLog "github.com/go-kit/log"
 	"github.com/go-kit/log/level"
 	"github.com/grafana/tempo/tempodb/backend"
-	"github.com/minio/minio-go/v7"
+	minio "github.com/minio/minio-go/v7"
 	"github.com/minio/minio-go/v7/pkg/credentials"
-	"github.com/opentracing/opentracing-go"
+	opentracing "github.com/opentracing/opentracing-go"
 	"github.com/pkg/errors"
 
 	tempo_io "github.com/grafana/tempo/pkg/io"
@@ -36,14 +36,14 @@ type readerWriter struct {
 // appendTracker is a struct used to track multipart uploads
 type appendTracker struct {
 	uploadID   string
-	partNum    int
-	parts      []minio.ObjectPart
 	objectName string
+	parts      []minio.ObjectPart
+	partNum    int
 }
 
 type overrideSignatureVersion struct {
-	useV2    bool
 	upstream credentials.Provider
+	useV2    bool
 }
 
 func (s *overrideSignatureVersion) Retrieve() (credentials.Value, error) {
@@ -343,6 +343,10 @@ func createCore(cfg *Config, hedge bool) (*minio.Core, error) {
 		return nil, errors.Wrap(err, "create minio.DefaultTransport")
 	}
 
+	if cfg.InsecureSkipVerify {
+		customTransport.TLSClientConfig.InsecureSkipVerify = true
+	}
+
 	// add instrumentation
 	transport := instrumentation.NewS3Transport(customTransport)
 	var stats *hedgedhttp.Stats