{"record":{"id":"7ebce7aee264b2db","repo":"thanos-io/thanos","slug":"failed-to-create-http-query-client-w","errorCode":null,"errorMessage":"failed to create HTTP query client: %w","messagePattern":"failed to create HTTP query client: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/thanos/rule.go","lineNumber":402,"sourceCode":"\t\tlogger,\n\t\textprom.WrapRegistererWithPrefix(\"thanos_rule_query_apis_\", reg),\n\t\tdns.ResolverType(conf.query.dnsSDResolver),\n\t)\n\tvar (\n\t\tqueryClients    []*clientconfig.HTTPClient\n\t\tpromClients     []*promclient.Client\n\t\tgrpcEndpointSet *query.EndpointSet\n\t\tgrpcEndpoints   []string\n\t)\n\n\tqueryClientMetrics := extpromhttp.NewClientMetrics(extprom.WrapRegistererWith(prometheus.Labels{\"client\": \"query\"}, reg))\n\n\tfor _, cfg := range queryCfg {\n\t\tif cfg.HTTPConfig.NotEmpty() {\n\t\t\tcfg.HTTPConfig.HTTPClientConfig.ClientMetrics = queryClientMetrics\n\t\t\tc, err := clientconfig.NewHTTPClient(cfg.HTTPConfig.HTTPClientConfig, \"query\")\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"failed to create HTTP query client: %w\", err)\n\t\t\t}\n\t\t\tc.Transport = tracing.HTTPTripperware(logger, c.Transport)\n\t\t\tqueryClient, err := clientconfig.NewClient(logger, cfg.HTTPConfig.EndpointsConfig, c, queryProvider.Clone())\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"failed to create query client: %w\", err)\n\t\t\t}\n\t\t\tqueryClients = append(queryClients, queryClient)\n\t\t\tpromClients = append(promClients, promclient.NewClient(queryClient, logger, \"thanos-rule\"))\n\t\t\t// Discover and resolve query addresses.\n\t\t\taddDiscoveryGroups(g, queryClient, conf.query.dnsSDInterval, logger)\n\t\t}\n\n\t\tif cfg.GRPCConfig != nil {\n\t\t\tgrpcEndpoints = append(grpcEndpoints, cfg.GRPCConfig.EndpointAddrs...)\n\t\t}\n\t}\n\n\tif len(grpcEndpoints) > 0 {","sourceCodeStart":384,"sourceCodeEnd":420,"githubUrl":"https://github.com/thanos-io/thanos/blob/35b8b991177def87ed52dcf10f9b6d87f07282c8/cmd/thanos/rule.go#L384-L420","documentation":"This error is produced when clientconfig.NewHTTPClient fails to construct an HTTP client from the http_client config of a query endpoint entry. runRule iterates queryCfg and returns this fmt.Errorf wrapping the underlying error. Typically it reflects invalid TLS/authorization settings that prevent building the http.RoundTripper.","triggerScenarios":"For a queryCfg entry where cfg.HTTPConfig.NotEmpty(), NewHTTPClient(cfg.HTTPConfig.HTTPClientConfig, \"query\") errors — e.g. unreadable TLS cert/key files, bad bearer token file, or invalid HTTP client config fields.","commonSituations":"TLS certificate or key file paths in the query config YAML do not exist inside the container; ca_file missing; bearer_token_file not mounted; malformed TLS config produced by secrets rotation.","solutions":["Verify every tls_cert/tls_key/ca_file path in the query config exists and is readable by the rule process.","Check bearer_token or bearer_token_file values are valid and the file is mounted.","Test the httpConfig with a minimal curl using the same certs to confirm they load.","Ensure Kubernetes Secrets holding TLS material are mounted into the rule pod at the configured paths."],"exampleFix":"// before\nhttp_config:\n  tls_config:\n    cert_file: /etc/thanos/tls/cert.pem  # not mounted\n// after\nhttp_config:\n  tls_config:\n    cert_file: /var/run/secrets/thanos-tls/tls.crt\n    key_file: /var/run/secrets/thanos-tls/tls.key","handlingStrategy":"validation","validationCode":"for _, p := range []string{cfg.TLS.CertFile, cfg.TLS.KeyFile, cfg.TLS.CAFile, cfg.BearerTokenFile} {\n    if p != \"\" {\n        if _, err := os.ReadFile(p); err != nil {\n            return fmt.Errorf(\"query http config file %q unreadable: %w\", p, err)\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Mount TLS secrets explicitly and verify paths inside the container image/pod.","Use relative-cert validation (curl --cert) before rollout.","Keep cert/key pairs generated together so paths and formats match."],"tags":["thanos","http-client","tls","startup"],"backgroundTag":"file-not-found","analyzedSha":"35b8b991177def87ed52dcf10f9b6d87f07282c8","analyzedAt":"2026-09-07T01:49:59.689Z","contentChangedAt":"2026-09-07T01:49:59.689Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}