{"record":{"id":"56b2f2d806cac4cb","repo":"thanos-io/thanos","slug":"building-grpc-client","errorCode":null,"errorMessage":"building gRPC client","messagePattern":"building gRPC client","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/thanos/config.go","lineNumber":104,"sourceCode":"func (gc *grpcClientConfig) registerFlag(cmd extkingpin.FlagClause) *grpcClientConfig {\n\tcmd.Flag(\"grpc-client-tls-secure\", \"Deprecated after v0.43.0: Use TLS when talking to the gRPC server\").Default(\"false\").BoolVar(&gc.secure)\n\tcmd.Flag(\"grpc-client-tls-skip-verify\", \"Deprecated after v0.43.0: Disable TLS certificate verification i.e self signed, signed by fake CA\").Default(\"false\").BoolVar(&gc.skipVerify)\n\tcmd.Flag(\"grpc-client-tls-cert\", \"Deprecated after v0.43.0: TLS Certificates to use to identify this client to the server\").Default(\"\").StringVar(&gc.cert)\n\tcmd.Flag(\"grpc-client-tls-key\", \"Deprecated after v0.43.0: TLS Key for the client's certificate\").Default(\"\").StringVar(&gc.key)\n\tcmd.Flag(\"grpc-client-tls-ca\", \"Deprecated after v0.43.0: TLS CA Certificates to use to verify gRPC servers\").Default(\"\").StringVar(&gc.caCert)\n\tcmd.Flag(\"grpc-client-server-name\", \"Deprecated after v0.43.0: Server name to verify the hostname on the returned gRPC certificates. See https://tools.ietf.org/html/rfc4366#section-3.1\").Default(\"\").StringVar(&gc.serverName)\n\tcompressionOptions := strings.Join([]string{snappy.Name, compressionNone}, \", \")\n\tcmd.Flag(\"grpc-compression\", \"Deprecated after v0.43.0: Compression algorithm to use for gRPC requests to other clients. Must be one of: \"+compressionOptions).Default(compressionNone).EnumVar(&gc.compression, snappy.Name, compressionNone)\n\tcmd.Flag(\"grpc-client-tls-min-version\",\n\t\t\"Deprecated after v0.43.0: TLS supported minimum version for gRPC client. If no version is specified, it'll default to 1.3. Allowed values: [\\\"1.0\\\", \\\"1.1\\\", \\\"1.2\\\", \\\"1.3\\\"]\").\n\t\tDefault(\"1.3\").EnumVar(&gc.minTLSVersion, tls.AllowedTLSVersions...)\n\treturn gc\n}\n\nfunc (gc *grpcClientConfig) dialOptions(logger log.Logger, reg prometheus.Registerer, tracer opentracing.Tracer) ([]grpc.DialOption, error) {\n\tdialOpts, err := extgrpc.StoreClientGRPCOpts(logger, reg, tracer)\n\tif err != nil {\n\t\treturn nil, errors.Wrapf(err, \"building gRPC client\")\n\t}\n\treturn dialOpts, nil\n}\n\ntype httpConfig struct {\n\tbindAddress string\n\ttlsConfig   string\n\tgracePeriod model.Duration\n}\n\nfunc (hc *httpConfig) registerFlag(cmd extkingpin.FlagClause) *httpConfig {\n\tcmd.Flag(\"http-address\",\n\t\t\"Listen host:port for HTTP endpoints.\").\n\t\tDefault(\"0.0.0.0:10902\").StringVar(&hc.bindAddress)\n\tcmd.Flag(\"http-grace-period\",\n\t\t\"Time to wait after an interrupt received for HTTP Server.\").\n\t\tDefault(\"2m\").SetValue(&hc.gracePeriod)\n\tcmd.Flag(","sourceCodeStart":86,"sourceCodeEnd":122,"githubUrl":"https://github.com/thanos-io/thanos/blob/35b8b991177def87ed52dcf10f9b6d87f07282c8/cmd/thanos/config.go#L86-L122","documentation":"grpcClientConfig.dialOptions builds client-side gRPC dial options via extgrpc.StoreClientGRPCOpts, which assembles TLS credentials from the configured cert/key/CA files. When credential loading fails (unreadable files, bad PEM, invalid key pair), the error is wrapped as 'building gRPC client' and Thanos client setup aborts at startup.","triggerScenarios":"StoreClientGRPCOpts returns an error — cert, key, or CA file passed via --grpc-client-tls-cert/--grpc-client-tls-key/--grpc-client-tls-ca does not exist, is unreadable, or contains invalid PEM; or cert+key do not form a valid tls.X509KeyPair.","commonSituations":"Typo in TLS file paths, files mounted but with wrong permissions in Kubernetes secrets, expired/mismatched cert/key pairs, or using deprecated TLS flags after the v0.43.0 switch to YAML-based grpc client config without migrating.","solutions":["Verify each TLS file path exists and is readable by the Thanos process; check k8s secret mounts and permissions.","Validate that cert and key match: 'openssl x509 -noout -modulus -in cert.pem' vs 'openssl rsa -noout -modulus -in key.pem'.","Confirm PEM contents are valid: 'openssl x509 -in cert.pem -text' and 'openssl verify -CAfile ca.pem cert.pem'.","Migrate deprecated --grpc-client-tls-* flags to the YAML grpc client configuration (deprecated after v0.43.0), then restart."],"exampleFix":"// before\n--grpc-client-tls-cert=/etc/thanos/client.crt --grpc-client-tls-key=/etc/thanos/client.key --grpc-client-tls-ca=/etc/thanos/ca.crt\n// (fails: /etc/thanos/ca.crt missing)\n// after\n--grpc-client-tls-cert=/etc/thanos/tls/client.crt --grpc-client-tls-key=/etc/thanos/tls/client.key --grpc-client-tls-ca=/etc/thanos/tls/ca.crt","handlingStrategy":"validation","validationCode":"// Validate TLS material before dialing\nfunc validateTLS(cert, key, ca string) error {\n    for _, p := range []string{cert, key, ca} {\n        if p == \"\" { continue }\n        f, err := os.Open(p)\n        if err != nil { return fmt.Errorf(\"cannot open %s: %w\", p, err) }\n        f.Close()\n    }\n    if cert != \"\" && key != \"\" {\n        if _, err := tls.LoadX509KeyPair(cert, key); err != nil {\n            return fmt.Errorf(\"invalid key pair: %w\", err)\n        }\n    }\n    return nil\n}","typeGuard":"func tlsFilesReadable(cert, key, ca string) bool {\n    for _, p := range []string{cert, key, ca} {\n        if p != \"\" {\n            if _, err := os.Stat(p); err != nil { return false }\n        }\n    }\n    return true\n}","tryCatchPattern":"dialOpts, err := gc.dialOptions(logger, reg, tracer)\nif err != nil {\n    return nil, errors.Wrap(err, \"building gRPC client\") // log full inner cause: file path + reason\n}","preventionTips":["Mount TLS files via secrets and verify paths/permissions in the deployment manifest.","Check cert/key pair match and expiry in CI before rollout.","Migrate off deprecated --grpc-client-tls-* flags to YAML grpc config (post v0.43.0).","Smoke-test client connections with the same TLS material in a pre-prod check."],"tags":["grpc","tls","thanos","configuration"],"backgroundTag":"file-read-failed","analyzedSha":"35b8b991177def87ed52dcf10f9b6d87f07282c8","analyzedAt":"2026-09-07T01:49:59.689Z","contentChangedAt":"2026-09-07T01:49:59.689Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}