Project: Grafana Mimir (Observability and Analysis / Observability)
File: securing-communications-with-tls.md

aliases: ../../operators-guide/securing/securing-communications-with-tls/ ../../operators-guide/secure/securing-communications-with-tls/ description: Learn how to configure TLS between Grafana Mimir components. menuTitle: Securing communications with TLS title: Securing Grafana Mimir communications with TLS weight: 50 Grafana Mimir is a distributed system with significant traffic between its components. To allow for secure communication, Grafana Mimir supports TLS between its components. This topic describes the process used to set up TLS. To establish secure inter-component communication in Grafana Mimir with TLS, you must generate certificates using a certificate authority (CA). The CA should be private to the organization because certificates signed by the CA will have permissions to communicate with the cluster. {{< admonition type="note" >}} The generated certificates are valid for 100,000 days. You can change the duration by adjusting the `-days` option in the command. You should replace certificates more regularly. {{< /admonition >}} The following script generates self-signed certificates for the cluster. The script generates private keys `client.key`, `server.key` and certificates `client.crt`, `server.crt` for both the client and server. The script generates the CA cert as `root.crt`. ``` openssl genrsa -out root.key openssl genrsa -out client.key openssl genrsa -out server.key openssl req -x509 -new -nodes -key root.key -subj "/C=US/ST=KY/O=Org/CN=root" -sha256 -days 100000 -out root.crt openssl req -new -sha256 -key client.key -subj "/C=US/ST=KY/O=Org/CN=client" -out client.csr openssl req -new -sha256 -key server.key -subj "/C=US/ST=KY/O=Org/CN=localhost" -out server.csr openssl x509 -req -in client.csr -CA root.crt -CAkey root.key -CAcreateserial -out client.crt -days 100000 -sha256 openssl x509 -req -in server.csr -CA root.crt -CAkey root.key -CAcreateserial -out server.crt -days 100000 -sha256 ``` Every gRPC connection between Grafana Mimir components supports TLS configuration as specified in server flags and client flags. You can set the cipher suites and minimum TLS version that the server will accept: `-server.tls-cipher-suites`: Comma-separated list of cipher suites to use. If blank, the default Go cipher suites is used. Possible values, from https://pkg.go.dev/crypto/tls#pkg-constants: TLSRSAWITHRC4128_SHA TLSRSAWITH3DESEDECBCSHA TLSRSAWITHAES128CBCSHA TLSRSAWITHAES256CBCSHA TLSRSAWITHAES128CBCSHA256 TLSRSAWITHAES128GCMSHA256 TLSRSAWITHAES256GCMSHA384 TLSECDHEECDSAWITHRC4128SHA TLSECDHEECDSAWITHAES128CBC_SHA TLSECDHEECDSAWITHAES256CBC_SHA TLSECDHERSAWITHRC4128SHA TLSECDHERSAWITH3DESEDECBC_SHA TLSECDHERSAWITHAES128CBC_SHA TLSECDHERSAWITHAES256CBC_SHA TLSECDHEECDSAWITHAES128CBC_SHA256 TLSECDHERSAWITHAES128CBC_SHA256 TLSECDHERSAWITHAES128GCM_SHA256 TLSECDHEECDSAWITHAES128GCM_SHA256 TLSECDHERSAWITHAES256GCM_SHA384 TLSECDHEECDSAWITHAES256GCM_SHA384 TLSECDHERSAWITHCHACHA20POLY1305SHA256 TLSECDHEECDSAWITHCHACHA20POLY1305SHA256 `-server.tls-min-version`: Minimum TLS version to use. Allowed values: "VersionTLS10", "VersionTLS11", "VersionTLS12", "VersionTLS13". If blank, the Go TLS minimum version is used. The following server flag settings determine if a server requires a client to provide a valid certificate back to the server. The flags support all the values defined in the standard library. For all values except `NoClientCert`, the policy defines that the server requests a client certificate during the handshake. The values determine whether the client must send certificates and if the server must verify

Use the following options to define the server certificate policy: `NoClientCert`: The server does not request a client certificate. `RequestClientCert`: The server requests a client certificate, but the client is not required to send it. `RequireClientCert`: The server requests a client to send at least one certificate, but a valid certificate is not required. `VerifyClientCertIfGiven`: The server does not require the client to send a certificate, but if it does, the certificate must be valid. `RequireAndVerifyClientCert`: The server requires the client to send at least one valid certificate. In the following example, both of the server authorization flags, `-server.http-tls-client-auth` and `-server.grpc-tls-client-auth`, are shown with the most restrictive option, which is `RequiredAndVerifyClientCert`. ``` -server.http-tls-cert-path=/path/to/server.crt -server.http-tls-key-path=/path/to/server.key -server.http-tls-client-auth="RequireAndVerifyClientCert" -server.http-tls-ca-path="/path/to/root.crt" -server.grpc-tls-cert-path=/path/to/server.crt -server.grpc-tls-key-path=/path/to/server.key -server.grpc-tls-client-auth="RequireAndVerifyClientCert" -server.grpc-tls-ca-path=/path/to/root.crt ``` You can configure TLS private keys, certificates, and certificate authorities in a similar fashion for gRPC clients in Grafana Mimir. To enable TLS for a component, use the client configuration flag that contains the suffix `*.tls-enabled=true`, for example, `-querier.frontend-client.tls-enabled=true`. The following Grafana Mimir components support TLS for inter-communication, which are shown with their corresponding configuration flag prefixes: Query-scheduler gRPC client used to connect to query-frontends: `-query-scheduler.grpc-client-config.*` Querier gRPC client used to connect to store-gateways: `-querier.store-gateway-client.*` Querier gRPC client used to connect to query-frontends and query-schedulers: `-querier.frontend-client.*` Query-frontend gRPC client used to connect to query-schedulers: `-query-frontend.grpc-client-config.*` Ruler gRPC client used to connect to other ruler instances: `-ruler.client.*` Ruler gRPC client used to connect to query-frontend: `-ruler.query-frontend.grpc-client-config.*` Distributor gRPC client used to forward series matching a configured set to a dedicated remote endpoint: `-distributor.forwarding.grpc-client.*` Alertmanager gRPC client used to connect to other Alertmanager instances: `-alertmanager.alertmanager-client.*` gRPC client used by distributors, queriers, and rulers to connect to ingesters: `-ingester.client.*` etcd client used by all Mimir components to connect to etcd, which is required only if you're running the hash ring or HA tracker on the etcd backend: `-<prefix>.etcd.*` Memberlist client used by all Mimir components to gossip the hash ring, which is required only if you're running the hash ring on memberlist: `-memberlist.` Each of the components listed above support the following TLS configuration options, which are shown with their corresponding flag suffixes: `*.tls-enabled=<boolean>`: Enable TLS in the client. `*.tls-server-name=<string>`: Override the expected name on the server certificate. `*.tls-insecure-skip-verify=<boolean>`: Skip validating the server certificate. `*.tls-cipher-suites=<string>`: Comma-separated list of accepted cipher suites. For the list of supported cipher suites, refer to . `*.tls-min-version=<string>`: Minimum TLS version required. For the list of supported versions, refer to . The following example shows how to configure the gRPC client flags in the querier used to connect to the query-frontend: ``` -querier.frontend-client.tls-cert-path=/path/to/client.crt -querier.frontend-client.tls-key-path=/path/to/client.key -querier.frontend-client.tls-ca-path=/path/to/root.crt ```