{"record":{"id":"5a4e106689e8ed01","repo":"thanos-io/thanos","slug":"setup-grpc-server-5a4e10","errorCode":null,"errorMessage":"setup gRPC server","messagePattern":"setup gRPC server","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/thanos/sidecar.go","lineNumber":326,"sourceCode":"\t\t\treturn reloader.Watch(ctx)\n\t\t}, func(error) {\n\t\t\tcancel()\n\t\t})\n\t}\n\n\t// Setup the gRPC server.\n\t{\n\t\tc := promclient.NewWithTracingClient(logger, httpClient, clientconfig.ThanosUserAgent)\n\n\t\tpromStore, err := store.NewPrometheusStore(logger, reg, c, conf.prometheus.url, component.Sidecar, m.Labels, m.Timestamps, m.Version)\n\t\tif err != nil {\n\t\t\treturn errors.Wrap(err, \"create Prometheus store\")\n\t\t}\n\n\t\ttlsCfg, err := tls.NewServerConfig(log.With(logger, \"protocol\", \"gRPC\"),\n\t\t\tconf.grpc.tlsSrvCert, conf.grpc.tlsSrvKey, conf.grpc.tlsSrvClientCA, conf.grpc.tlsMinVersion, conf.grpc.tlsCiphers, conf.grpc.tlsCurves)\n\t\tif err != nil {\n\t\t\treturn errors.Wrap(err, \"setup gRPC server\")\n\t\t}\n\n\t\texemplarSrv := exemplars.NewPrometheus(conf.prometheus.url, c, m.Labels)\n\n\t\tinfoSrv := info.NewInfoServer(\n\t\t\tcomponent.Sidecar.String(),\n\t\t\tinfo.WithLabelSetFunc(func() []labelpb.ZLabelSet {\n\t\t\t\treturn promStore.LabelSet()\n\t\t\t}),\n\t\t\tinfo.WithStoreInfoFunc(func() (*infopb.StoreInfo, error) {\n\t\t\t\tif httpProbe.IsReady() {\n\t\t\t\t\tmint, maxt := m.Timestamps()\n\t\t\t\t\treturn &infopb.StoreInfo{\n\t\t\t\t\t\tMinTime:                      mint,\n\t\t\t\t\t\tMaxTime:                      maxt,\n\t\t\t\t\t\tSupportsSharding:             true,\n\t\t\t\t\t\tSupportsWithoutReplicaLabels: true,\n\t\t\t\t\t\tTsdbInfos:                    promStore.TSDBInfos(),","sourceCodeStart":308,"sourceCodeEnd":344,"githubUrl":"https://github.com/thanos-io/thanos/blob/35b8b991177def87ed52dcf10f9b6d87f07282c8/cmd/thanos/sidecar.go#L308-L344","documentation":"tls.NewServerConfig failed while building the gRPC server TLS configuration. This validates that the supplied TLS cert/key files exist, parse as X.509, and that a client CA (if given) loads. On any of these failures the sidecar aborts with 'setup gRPC server'.","triggerScenarios":"errors.Wrap in runSidecar: --grpc-cert and --grpc-key provided but a file is missing/unreadable, key/cert mismatch, invalid PEM, or --grpc-client-ca-file points to a non-existent/invalid CA bundle.","commonSituations":"Secret mounted at the wrong path after a Helm change; cert renewed but key not updated (mismatch); CA bundle typo; permissions preventing the thanos user from reading the key.","solutions":["Check the paths in --grpc-cert/--grpc-key/--grpc-client-ca-file exist and are readable (ls, openssl x509 -in cert)","Verify cert and key match: compare modulus/fingerprint of both files","Refresh the mounted Kubernetes Secret and restart the sidecar","Remove the TLS flags temporarily to confirm TLS config is the failing part, then re-add corrected files"],"exampleFix":"// before\n- --grpc-cert=/etc/thanos/tls/server.crt\n- --grpc-key=/etc/thanos/tls/server.key   # stale key\n// after\n- --grpc-cert=/etc/tls/server.crt\n- --grpc-key=/etc/tls/server.key\n# with both files refreshed from the same cert issuance","handlingStrategy":"validation","validationCode":"for _, p := range []string{tlsCert, tlsKey, tlsCA} {\n    if p != \"\" {\n        if _, err := os.Stat(p); err != nil {\n            return fmt.Errorf(\"TLS file missing: %s\", p)\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":"tlsCfg, err := tls.NewServerConfig(logger, cert, key, ca, ...)\nif err != nil {\n    return errors.Wrap(err, \"setup gRPC server\")\n}","preventionTips":["Mount TLS Secrets at fixed paths with readOnly","Verify cert/key pairing after every renewal (openssl compare)","Include the client CA bundle in the same Secret rollout","Test TLS config with openssl s_client after deployment"],"tags":["tls","grpc","certificates","startup"],"backgroundTag":"file-not-found","analyzedSha":"35b8b991177def87ed52dcf10f9b6d87f07282c8","analyzedAt":"2026-09-07T01:49:59.689Z","contentChangedAt":"2026-09-07T01:49:59.689Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}