{"record":{"id":"a548455dbab7dbc8","repo":"thanos-io/thanos","slug":"parsing-downstream-tripper-tls-config-yaml","errorCode":null,"errorMessage":"parsing downstream tripper TLS config YAML","messagePattern":"parsing downstream tripper TLS config YAML","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/thanos/query_frontend.go","lineNumber":212,"sourceCode":"\t\t\tDualStack: true,\n\t\t}).DialContext,\n\t\tForceAttemptHTTP2:     true,\n\t\tMaxIdleConns:          100,\n\t\tIdleConnTimeout:       90 * time.Second,\n\t\tTLSHandshakeTimeout:   10 * time.Second,\n\t\tExpectContinueTimeout: 1 * time.Second,\n\t}\n\n\tif len(downstreamTripperConfContentYaml) > 0 {\n\t\ttripperConfig := &queryfrontend.DownstreamTripperConfig{}\n\t\tif err := yaml.UnmarshalStrict(downstreamTripperConfContentYaml, tripperConfig); err != nil {\n\t\t\treturn nil, errors.Wrap(err, \"parsing downstream tripper config YAML file\")\n\t\t}\n\n\t\tif tripperConfig.TLSConfig != nil {\n\t\t\ttlsConfig, err := exthttp.NewTLSConfig(tripperConfig.TLSConfig)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, errors.Wrap(err, \"parsing downstream tripper TLS config YAML\")\n\t\t\t}\n\t\t\tdownstreamTripper.TLSClientConfig = tlsConfig\n\t\t}\n\t\tif tripperConfig.IdleConnTimeout > 0 {\n\t\t\tdownstreamTripper.IdleConnTimeout = time.Duration(tripperConfig.IdleConnTimeout)\n\t\t}\n\t\tif tripperConfig.ResponseHeaderTimeout > 0 {\n\t\t\tdownstreamTripper.ResponseHeaderTimeout = time.Duration(tripperConfig.ResponseHeaderTimeout)\n\t\t}\n\t\tif tripperConfig.TLSHandshakeTimeout > 0 {\n\t\t\tdownstreamTripper.TLSHandshakeTimeout = time.Duration(tripperConfig.TLSHandshakeTimeout)\n\t\t}\n\t\tif tripperConfig.ExpectContinueTimeout > 0 {\n\t\t\tdownstreamTripper.ExpectContinueTimeout = time.Duration(tripperConfig.ExpectContinueTimeout)\n\t\t}\n\t\tif tripperConfig.MaxIdleConns != nil {\n\t\t\tdownstreamTripper.MaxIdleConns = *tripperConfig.MaxIdleConns\n\t\t}","sourceCodeStart":194,"sourceCodeEnd":230,"githubUrl":"https://github.com/thanos-io/thanos/blob/35b8b991177def87ed52dcf10f9b6d87f07282c8/cmd/thanos/query_frontend.go#L194-L230","documentation":"This error is returned when exthttp.NewTLSConfig fails to build a TLS configuration from the tls_config section of the downstream tripper config. It indicates the TLS fields (CA, cert, key, server name, etc.) are invalid — usually bad file paths or invalid content. Thanos wraps it to point at the downstream tripper TLS block.","triggerScenarios":"tls_config present in the downstream tripper YAML with a ca_file/cert_file/key_file that does not exist or is unreadable, invalid PEM content, or invalid insecure_skip_verify/server_name combinations rejected by exthttp.NewTLSConfig.","commonSituations":"Mount path changes in Kubernetes breaking cert paths, secrets not mounted, certs expired/replaced, or typo in file names inside tls_config.","solutions":["Verify every path in tls_config (ca_file, cert_file, key_file) exists and is readable by the Thanos process.","Ensure cert/key files contain valid PEM data.","Read the wrapped underlying error for the exact failing field.","If TLS is not needed for the downstream connection, remove the tls_config block."],"exampleFix":"// before\ntls_config:\n  ca_file: /etc/secrets/ca.crtp\n// after\ntls_config:\n  ca_file: /etc/secrets/ca.crt","handlingStrategy":"validation","validationCode":"for _, p := range []string{tlsCfg.CAFile, tlsCfg.CertFile, tlsCfg.KeyFile} {\n  if p != \"\" {\n    if _, err := os.Stat(p); err != nil {\n      return fmt.Errorf(\"TLS file %s missing: %w\", p, err)\n    }\n  }\n}","typeGuard":null,"tryCatchPattern":"if _, err := exthttp.NewTLSConfig(tlsConf); err != nil {\n  log.Fatalf(\"downstream TLS config invalid: %v\", err)\n}","preventionTips":["Mount secrets before process start and verify paths","Check PEM validity after cert rotation","Keep cert paths stable across deploys"],"tags":["tls","config","yaml"],"backgroundTag":"invalid-config-value","analyzedSha":"35b8b991177def87ed52dcf10f9b6d87f07282c8","analyzedAt":"2026-09-07T01:49:59.689Z","contentChangedAt":"2026-09-07T01:49:59.689Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}