{"record":{"id":"b80b6fdb5387adb0","repo":"thanos-io/thanos","slug":"setup-grpc-server-b80b6f","errorCode":null,"errorMessage":"setup gRPC server","messagePattern":"setup gRPC server","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/thanos/rule.go","lineNumber":751,"sourceCode":"\t\t\t\t}\n\t\t\t}\n\t\t}, func(error) {\n\t\t\tcancel()\n\t\t})\n\t}\n\n\tgrpcProbe := prober.NewGRPC()\n\thttpProbe := prober.NewHTTP()\n\tstatusProber := prober.Combine(\n\t\thttpProbe,\n\t\tgrpcProbe,\n\t\tprober.NewInstrumentation(comp, logger, extprom.WrapRegistererWithPrefix(\"thanos_\", reg)),\n\t)\n\n\t// Start gRPC server.\n\ttlsCfg, err := tls.NewServerConfig(log.With(logger, \"protocol\", \"gRPC\"), conf.grpc.tlsSrvCert, conf.grpc.tlsSrvKey, conf.grpc.tlsSrvClientCA, conf.grpc.tlsMinVersion, conf.grpc.tlsCiphers, conf.grpc.tlsCurves)\n\tif err != nil {\n\t\treturn errors.Wrap(err, \"setup gRPC server\")\n\t}\n\n\toptions := []grpcserver.Option{\n\t\tgrpcserver.WithServer(thanosrules.RegisterRulesServer(ruleMgr)),\n\t\tgrpcserver.WithListen(conf.grpc.bindAddress),\n\t\tgrpcserver.WithGracePeriod(conf.grpc.gracePeriod),\n\t\tgrpcserver.WithGracePeriod(conf.grpc.maxConnectionAge),\n\t\tgrpcserver.WithTLSConfig(tlsCfg),\n\t}\n\tinfoOptions := []info.ServerOptionFunc{info.WithRulesInfoFunc()}\n\tif tsdbDB != nil {\n\t\ttsdbStore := store.NewTSDBStore(logger, tsdbDB, component.Rule, conf.lset)\n\t\tinfoOptions = append(\n\t\t\tinfoOptions,\n\t\t\tinfo.WithLabelSetFunc(func() []labelpb.ZLabelSet {\n\t\t\t\treturn tsdbStore.LabelSet()\n\t\t\t}),\n\t\t\tinfo.WithStoreInfoFunc(func() (*infopb.StoreInfo, error) {","sourceCodeStart":733,"sourceCodeEnd":769,"githubUrl":"https://github.com/thanos-io/thanos/blob/35b8b991177def87ed52dcf10f9b6d87f07282c8/cmd/thanos/rule.go#L733-L769","documentation":"Before starting the rule component's gRPC server, runRule builds a TLS server config via tls.NewServerConfig from --grpc-server-tls-cert/key/client-ca and cipher/curve flags. Any failure loading or validating these (missing files, bad PEM, mismatched key, unsupported cipher) is wrapped as \"setup gRPC server\" and stops startup before the listener is created.","triggerScenarios":"tls.NewServerConfig returns an error when: cert or key file paths don't exist or are unreadable; the cert/key pair doesn't match; PEM data is malformed; a configured TLS cipher suite or min version is invalid or unsupported; client CA file can't be parsed when mTLS is requested.","commonSituations":"Typo in --grpc-server-tls-cert path in a Kubernetes manifest; secret mounted with wrong key names; expired or rotated certificate mounted as the wrong file; specifying a TLS 1.0-era cipher with TLS 1.3 min version.","solutions":["Verify --grpc-server-tls-cert and --grpc-server-tls-key point to existing, readable PEM files and that the pair matches (compare modulus/public key).","Validate the CA file and remove --grpc-server-tls-client-ca if mTLS is not intended.","Use only supported cipher names / TLS versions in the tls-ciphers and tls-min-version flags, or drop them for defaults.","Check that mounted Kubernetes secrets contain the expected keys (tls.crt/tls.key) and are correctly mounted."],"exampleFix":"// before\nthanos rule --grpc-server-tls-cert=/etc/ssl/wrong.crt --grpc-server-tls-key=/etc/ssl/server.key\n// after\nthanos rule --grpc-server-tls-cert=/etc/ssl/server.crt --grpc-server-tls-key=/etc/ssl/server.key","handlingStrategy":"validation","validationCode":"// before start: openssl x509 -in cert.pem -noout -checkend 0 && openssl x509 -in cert.pem -pubkey -noout | sha256sum && openssl pkey -in key.pem -pubout | sha256sum  # hashes must match","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate cert/key pair and expiry in CI before deploying","Use only documented cipher names for tls-ciphers","Omit mTLS flags unless client CA is correctly provisioned"],"tags":["grpc","tls","config","startup"],"backgroundTag":"invalid-config-value","analyzedSha":"35b8b991177def87ed52dcf10f9b6d87f07282c8","analyzedAt":"2026-09-07T01:49:59.689Z","contentChangedAt":"2026-09-07T01:49:59.689Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}