Use TLS config from dskit

[zalegrala]

Here we implement the initial TLS configuration options from dskit on the s3 configuration. The change here is pretty minimal, but will set us up to make use of the other TLS common components, such as CA cert file loading and server name. Currently only the s3 config is modified, but I can see this impacting the others as well later.

What this PR does:

• add tls.ClientConfig inline config
• add documentation for new supported TLS client configurations
• replace the minio TLS configuration with the one based on tls.ClientConfig
• breaking change rename storage.trace.s3.insecure_skip_verify config option

Which issue(s) this PR fixes:
Fixes #2262
Fixes #1914
Fixes #2373

Checklist

• Tests updated
• Documentation added
• CHANGELOG.md updated - the order of entries should be [CHANGE], [FEATURE], [ENHANCEMENT], [BUGFIX]

[knylander-grafana]

Thank you for adding doc.

[joe-elliott]

how does this work? i'm reading the code here:

https://github.com/grafana/dskit/blob/main/crypto/tls/tls.go#L87

and it looks like you have to set a reader somewhere?

Also, it looks like GetTLSConfig() always returns a value and so it will always be set on line 385 below. Is this ok? Should there be a way to not set this and just use defaults?

[zalegrala]

Good find. That commit isn't in the branch currently, but it looks like was introduced here: grafana/dskit#274

I assume the reader interface was just to provide a little more flexibility on where to read the config data.

The nil check is just a habit when I see a pointer that could be nil, just in case the implementation changes we're still being defensive. I can remove.

I'll double check, but it looked to me like if we don't set the config items, then we get a mostly default tls config, which looks okay to me. Also note, that what we got back from the minio tls code is non-default, and so we set the min version in our config RegisterFlagsAndApplyDefaults to account for this.

[joe-elliott]

ok, rereading this makes way more sense. I missed that GetTLSConfig() is being called on the composed struct above. What is returned here will be the product of the settings. Wuf.

[joe-elliott]

Nice one, Zach.

[joe-elliott]

ok, rereading this makes way more sense. I missed that GetTLSConfig() is being called on the composed struct above. What is returned here will be the product of the settings. Wuf.