{"record":{"id":"448111fe67e919e5","repo":"thanos-io/thanos","slug":"improper-http-client-config","errorCode":null,"errorMessage":"Improper http client config","messagePattern":"Improper http client config","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/thanos/sidecar.go","lineNumber":84,"sourceCode":"\n\t\tgrpcLogOpts, logFilterMethods, err := logging.ParsegRPCOptions(conf.reqLogConfig)\n\n\t\tif err != nil {\n\t\t\treturn errors.Wrap(err, \"error while parsing config for request logging\")\n\t\t}\n\n\t\thttpConfContentYaml, err := conf.prometheus.httpClient.Content()\n\t\tif err != nil {\n\t\t\treturn errors.Wrap(err, \"getting http client config\")\n\t\t}\n\t\thttpClientConfig, err := clientconfig.NewHTTPClientConfigFromYAML(httpConfContentYaml)\n\t\tif err != nil {\n\t\t\treturn errors.Wrap(err, \"parsing http config YAML\")\n\t\t}\n\n\t\thttpClient, err := clientconfig.NewHTTPClient(*httpClientConfig, \"thanos-sidecar\")\n\t\tif err != nil {\n\t\t\treturn errors.Wrap(err, \"Improper http client config\")\n\t\t}\n\n\t\topts := reloader.Options{\n\t\t\tHTTPClient:    *httpClient,\n\t\t\tCfgFile:       conf.reloader.confFile,\n\t\t\tCfgOutputFile: conf.reloader.envVarConfFile,\n\t\t\tWatchedDirs:   conf.reloader.ruleDirectories,\n\t\t\tWatchInterval: conf.reloader.watchInterval,\n\t\t\tRetryInterval: conf.reloader.retryInterval,\n\t\t}\n\n\t\tswitch conf.reloader.method {\n\t\tcase HTTPReloadMethod:\n\t\t\topts.ReloadURL = reloader.ReloadURLFromBase(conf.prometheus.url)\n\t\tcase SignalReloadMethod:\n\t\t\topts.ProcessName = conf.reloader.processName\n\t\t\topts.RuntimeInfoURL = reloader.RuntimeInfoURLFromBase(conf.prometheus.url)\n\t\tdefault:","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/thanos-io/thanos/blob/35b8b991177def87ed52dcf10f9b6d87f07282c8/cmd/thanos/sidecar.go#L66-L102","documentation":"Once the YAML parses into an HTTPClientConfig, the sidecar constructs a usable client with clientconfig.NewHTTPClient(*httpClientConfig, \"thanos-sidecar\"). This step validates semantic combinations (e.g. both bearer_token and bearer_token_file set, missing cert/key pairing) that YAML parsing alone accepts. Failures abort startup with \"Improper http client config\".","triggerScenarios":"Calling NewHTTPClient with a config that is structurally valid YAML but semantically invalid — e.g. specifying both bearer_token and bearer_token_file, cert_file without key_file, or an unreadable CA file path — at cmd/thanos/sidecar.go:83.","commonSituations":"Setting both inline credentials and credential files; TLS cert provided without its key; secret files mounted at the wrong path so the client can't load them; authorization/basic_auth configured alongside mutually exclusive fields.","solutions":["Read the wrapped error from NewHTTPClient — it names the exact invalid combination (e.g. 'authorization config: at most one of basic_auth, oauth2, bearer_token & bearer_token_file must be configured').","Keep exactly one credential mechanism: either bearer_token OR bearer_token_file, not both.","Ensure TLS pairs are complete: cert_file always together with key_file, and CA/key files exist and are readable by the sidecar process.","Remove mutually exclusive fields until the config passes, then reintroduce one at a time."],"exampleFix":"// before\n{\"bearer_token\": \"abc\", \"bearer_token_file\": \"/var/run/token\"}\n// after\n{\"bearer_token_file\": \"/var/run/token\"}","handlingStrategy":"validation","validationCode":"func semanticallyValid(cfg clientconfig.HTTPClientConfig) error {\n    if cfg.BearerToken != \"\" && cfg.BearerTokenFile != \"\" {\n        return errors.New(\"at most one of bearer_token / bearer_token_file\")\n    }\n    if (cfg.TLSConfig.CertFile != \"\") != (cfg.TLSConfig.KeyFile != \"\") {\n        return errors.New(\"cert_file and key_file must be set together\")\n    }\n    return nil\n}","typeGuard":"null","tryCatchPattern":"httpClient, err := clientconfig.NewHTTPClient(*httpClientConfig, \"thanos-sidecar\")\nif err != nil {\n    return fmt.Errorf(\"Improper http client config: %w\", err)\n}","preventionTips":["Never set both inline credentials and credential files — pick one mechanism","Always pair cert_file with key_file and verify the files are readable by the process","Construct the client in a startup smoke test so semantic config errors surface before production"],"tags":["go","config","tls","http-client","thanos"],"backgroundTag":"invalid-config-value","analyzedSha":"35b8b991177def87ed52dcf10f9b6d87f07282c8","analyzedAt":"2026-09-07T01:49:59.689Z","contentChangedAt":"2026-09-07T01:49:59.689Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}