Project: Grafana Tempo (Observability and Analysis / Observability)
File: tls.md

title: Configure TLS communication menuTitle: Configure TLS description: Configure Tempo components to communicate using TLS. aliases: ../../configuration/tls/ # /docs/tempo/<TEMPO_VERSION>/configuration/tls/ Tempo can be configured to communicate between the components using Transport Layer Security, or TLS. {{< admonition type="note" >}} The ciphers and TLS version here are for example purposes only. We are not recommending which ciphers or TLS versions for use in production environments. {{% /admonition %}} This sample TLS server configuration shows supported options. ```yaml server: tlsciphersuites: TLSECDHERSAWITHAES128GCMSHA256,TLSECDHERSAWITHAES256GCMSHA384,TLSECDHEECDSAWITHAES128GCMSHA256,TLSECDHEECDSAWITHAES256GCMSHA384 tlsminversion: VersionTLS12 grpctlsconfig: cert_file: /tls/tls.crt key_file: /tls/tls.key clientauthtype: VerifyClientCertIfGiven clientcafile: /tls/ca.crt httptlsconfig: cert_file: /tls/tls.crt key_file: /tls/tls.key clientauthtype: VerifyClientCertIfGiven clientcafile: /tls/ca.crt ``` Valid values for the `clientauthtype` are documented in the standard `crypt/tls` package under `ClientAuthType` . Several components of Tempo need to configure the gRPC clients they use to communicate with other components. For example, when the `querier` contacts the `query-frontend` to request work, the client in use must enable TLS if the server is serving a TLS endpoint. The Tempo configuration uses a standard configuration stanza for each of these client configurations. Below is an example of the configuration. The optional configuration elements `tlsminversion`, `tlsciphersuites`, and `tlsinsecureskipverify` may be omitted. The option `tlsserver_name` may or may not be required, depending on the environment. ```yaml grpcclientconfig: tls_enabled: true tlscertpath: /tls/tls.crt tlskeypath: /tls/tls.key tlscapath: /tls/ca.crt tlsservername: tempo.trace.svc.cluster.local tlsinsecureskip_verify: false tlsciphersuites: TLSECDHERSAWITHAES128GCMSHA256,TLSECDHERSAWITHAES256GCMSHA384,TLSECDHEECDSAWITHAES128GCMSHA256,TLSECDHEECDSAWITHAES256GCMSHA384 tlsminversion: VersionTLS12 ``` The configuration block needs to be set at the following configuration locations. `ingesterclient.grpcclient_config` `metricsgeneratorclient.grpcclientconfig` `querier.query-frontend.grpcclientconfig` Additionally, `memberlist` must also be configured, but the client configuration is nested directly under `memberlist` as follows. The same configuration options are available as above. ``` memberlist: tls_enabled: true tlscertpath: /tls/tls.crt tlskeypath: /tls/tls.key tlscapath: /tls/ca.crt tlsservername: tempo.trace.svc.cluster.local tlsinsecureskip_verify: false ``` Additional receiver configuration can be added to support TLS communication for traces being sent to Tempo. The receiver configuration is pulled in from the Open Telemetry collector, and is . An example `tls` block might look like the following: ```yaml tls: ca_file: /tls/ca.crt cert_file: /tls/tls.crt key_file: /tls/tls.key min_version: VersionTLS12 ``` The above structure can be set on the following receiver configurations: `distributor.receivers.otlp.protocols.grpc.tls` `distributor.receivers.otlp.protocols.http.tls` `distributor.receivers.zipkin.tls` `distributor.receivers.jaeger.protocols.grpc.tls` `distributor.receivers.jaeger.protocols.thrift_http.tls`