Add secure connection support to tempo-cli

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 * [CHANGE] **BREAKING CHANGE** Deprecating vParquet2 block format [#5688](https://github.com/grafana/tempo/pull/5688) (@ie-pham)
 * [ENHANCEMENT] On startup, first record for live store to consume is not older than two complete block timeouts [#5693](https://github.com/grafana/tempo/pull/5693) (@ruslan-mikhailov)
+* [ENHANCEMENT] Add secure connection support to tempo-cli [#5692](https://github.com/grafana/tempo/pull/5692) (@TheoBrigitte)
 
 # v2.9.0-rc.0
 

cmd/tempo-cli/cmd-query-metrics-query-range.go

@@ -10,10 +10,10 @@ import (
 	"time"
 
 	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
 
 	"github.com/gogo/protobuf/jsonpb"
 	"github.com/grafana/dskit/user"
+
 	"github.com/grafana/tempo/pkg/api"
 	"github.com/grafana/tempo/pkg/tempopb"
 )
@@ -28,6 +28,7 @@ type metricsQueryCmd struct {
 	UseGRPC    bool   `help:"stream search results over GRPC"`
 	Instant    bool   `help:"perform an instant query instead of a range query"`
 	PathPrefix string `help:"string to prefix all http paths with"`
+	Secure     bool   `help:"use https or grpc with TLS"`
 }
 
 func (cmd *metricsQueryCmd) Run(_ *globalOptions) error {
@@ -77,7 +78,12 @@ func (cmd *metricsQueryCmd) queryRangeGRPC(req *tempopb.QueryRangeRequest) error
 		return err
 	}
 
-	clientConn, err := grpc.NewClient(cmd.HostPort, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	creds, err := grpcTransportCredentials(cmd.Secure)
+	if err != nil {
+		return err
+	}
+
+	clientConn, err := grpc.NewClient(cmd.HostPort, creds)
 	if err != nil {
 		return err
 	}
@@ -108,7 +114,7 @@ func (cmd *metricsQueryCmd) queryRangeGRPC(req *tempopb.QueryRangeRequest) error
 
 // nolint: goconst // goconst wants us to make http:// a const
 func (cmd *metricsQueryCmd) queryRangeHTTP(req *tempopb.QueryRangeRequest) error {
-	httpReq, err := http.NewRequest("GET", "http://"+path.Join(cmd.HostPort, cmd.PathPrefix, api.PathMetricsQueryRange), nil)
+	httpReq, err := http.NewRequest("GET", httpScheme(cmd.Secure)+"://"+path.Join(cmd.HostPort, cmd.PathPrefix, api.PathMetricsQueryRange), nil)
 	if err != nil {
 		return err
 	}
@@ -155,7 +161,12 @@ func (cmd *metricsQueryCmd) queryInstantGRPC(req *tempopb.QueryInstantRequest) e
 		return err
 	}
 
-	clientConn, err := grpc.NewClient(cmd.HostPort, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	creds, err := grpcTransportCredentials(cmd.Secure)
+	if err != nil {
+		return err
+	}
+
+	clientConn, err := grpc.NewClient(cmd.HostPort, creds)
 	if err != nil {
 		return err
 	}
@@ -186,7 +197,7 @@ func (cmd *metricsQueryCmd) queryInstantGRPC(req *tempopb.QueryInstantRequest) e
 
 // nolint: goconst // goconst wants us to make http:// a const
 func (cmd *metricsQueryCmd) queryInstantHTTP(req *tempopb.QueryInstantRequest) error {
-	httpReq, err := http.NewRequest("GET", "http://"+path.Join(cmd.HostPort, cmd.PathPrefix, api.PathMetricsQueryInstant), nil)
+	httpReq, err := http.NewRequest("GET", httpScheme(cmd.Secure)+"://"+path.Join(cmd.HostPort, cmd.PathPrefix, api.PathMetricsQueryInstant), nil)
 	if err != nil {
 		return err
 	}

cmd/tempo-cli/cmd-query-search-tag-values.go

@@ -8,10 +8,10 @@ import (
 	"time"
 
 	"github.com/grafana/dskit/user"
+	"google.golang.org/grpc"
+
 	"github.com/grafana/tempo/pkg/httpclient"
 	"github.com/grafana/tempo/pkg/tempopb"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
 )
 
 type querySearchTagValuesCmd struct {
@@ -24,6 +24,7 @@ type querySearchTagValuesCmd struct {
 	OrgID      string `help:"optional orgID"`
 	UseGRPC    bool   `help:"stream search results over GRPC"`
 	PathPrefix string `help:"string to prefix all http paths with"`
+	Secure     bool   `help:"use https or grpc with TLS"`
 }
 
 func (cmd *querySearchTagValuesCmd) Run(_ *globalOptions) error {
@@ -56,7 +57,7 @@ func (cmd *querySearchTagValuesCmd) searchHTTP(start, end int64) error {
 	if cmd.PathPrefix != "" {
 		cmd.HostPort = path.Join(cmd.HostPort, cmd.PathPrefix)
 	}
-	client := httpclient.New("http://"+cmd.HostPort, cmd.OrgID)
+	client := httpclient.New(httpScheme(cmd.Secure)+"://"+cmd.HostPort, cmd.OrgID)
 
 	var tags *tempopb.SearchTagValuesV2Response
 	var err error
@@ -80,7 +81,12 @@ func (cmd *querySearchTagValuesCmd) searchGRPC(start, end int64) error {
 		return err
 	}
 
-	clientConn, err := grpc.DialContext(ctx, cmd.HostPort, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	creds, err := grpcTransportCredentials(cmd.Secure)
+	if err != nil {
+		return err
+	}
+
+	clientConn, err := grpc.NewClient(cmd.HostPort, creds)
 	if err != nil {
 		return err
 	}

cmd/tempo-cli/cmd-query-search-tags.go

@@ -8,10 +8,10 @@ import (
 	"time"
 
 	"github.com/grafana/dskit/user"
+	"google.golang.org/grpc"
+
 	"github.com/grafana/tempo/pkg/httpclient"
 	"github.com/grafana/tempo/pkg/tempopb"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
 )
 
 type querySearchTagsCmd struct {
@@ -22,6 +22,7 @@ type querySearchTagsCmd struct {
 	OrgID      string `help:"optional orgID"`
 	UseGRPC    bool   `help:"stream search results over GRPC"`
 	PathPrefix string `help:"string to prefix all http paths with"`
+	Secure     bool   `help:"use https or grpc with TLS"`
 }
 
 func (cmd *querySearchTagsCmd) Run(_ *globalOptions) error {
@@ -54,7 +55,7 @@ func (cmd *querySearchTagsCmd) searchHTTP(start, end int64) error {
 	if cmd.PathPrefix != "" {
 		cmd.HostPort = path.Join(cmd.HostPort, cmd.PathPrefix)
 	}
-	client := httpclient.New("http://"+cmd.HostPort, cmd.OrgID)
+	client := httpclient.New(httpScheme(cmd.Secure)+"://"+cmd.HostPort, cmd.OrgID)
 
 	var tags *tempopb.SearchTagsV2Response
 	var err error
@@ -78,7 +79,12 @@ func (cmd *querySearchTagsCmd) searchGRPC(start, end int64) error {
 		return err
 	}
 
-	clientConn, err := grpc.DialContext(ctx, cmd.HostPort, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	creds, err := grpcTransportCredentials(cmd.Secure)
+	if err != nil {
+		return err
+	}
+
+	clientConn, err := grpc.NewClient(cmd.HostPort, creds)
 	if err != nil {
 		return err
 	}

cmd/tempo-cli/cmd-query-search.go

@@ -10,10 +10,10 @@ import (
 	"time"
 
 	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
 
 	"github.com/gogo/protobuf/jsonpb"
 	"github.com/grafana/dskit/user"
+
 	"github.com/grafana/tempo/pkg/api"
 	"github.com/grafana/tempo/pkg/tempopb"
 )
@@ -29,6 +29,7 @@ type querySearchCmd struct {
 	SPSS       int    `help:"spans per spanset" default:"0"`
 	Limit      int    `help:"limit number of results" default:"0"`
 	PathPrefix string `help:"string to prefix all http paths with"`
+	Secure     bool   `help:"use https or grpc with TLS"`
 }
 
 func (cmd *querySearchCmd) Run(_ *globalOptions) error {
@@ -66,7 +67,12 @@ func (cmd *querySearchCmd) searchGRPC(req *tempopb.SearchRequest) error {
 		return err
 	}
 
-	clientConn, err := grpc.DialContext(ctx, cmd.HostPort, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	creds, err := grpcTransportCredentials(cmd.Secure)
+	if err != nil {
+		return err
+	}
+
+	clientConn, err := grpc.NewClient(cmd.HostPort, creds)
 	if err != nil {
 		return err
 	}
@@ -97,7 +103,7 @@ func (cmd *querySearchCmd) searchGRPC(req *tempopb.SearchRequest) error {
 
 // nolint: goconst // goconst wants us to make http:// a const
 func (cmd *querySearchCmd) searchHTTP(req *tempopb.SearchRequest) error {
-	httpReq, err := http.NewRequest("GET", "http://"+path.Join(cmd.HostPort, cmd.PathPrefix, api.PathSearch), nil)
+	httpReq, err := http.NewRequest("GET", httpScheme(cmd.Secure)+"://"+path.Join(cmd.HostPort, cmd.PathPrefix, api.PathSearch), nil)
 	if err != nil {
 		return err
 	}

cmd/tempo-cli/shared.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"crypto/x509"
 	"errors"
 	"fmt"
 	"sort"
@@ -11,6 +12,10 @@ import (
 	"github.com/gogo/protobuf/jsonpb"
 	"github.com/gogo/protobuf/proto"
 	"github.com/google/uuid"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/credentials/insecure"
+
 	"github.com/grafana/tempo/pkg/boundedwaitgroup"
 	"github.com/grafana/tempo/tempodb/backend"
 )
@@ -135,3 +140,25 @@ func printAsJSON(pb proto.Message) error {
 	fmt.Println(string(traceJSON))
 	return nil
 }
+
+func httpScheme(secure bool) string {
+	if secure {
+		return "https"
+	}
+	return "http"
+}
+
+func grpcTransportCredentials(secure bool) (opt grpc.DialOption, err error) {
+	var creds credentials.TransportCredentials
+	if secure {
+		certPool, err := x509.SystemCertPool()
+		if err != nil {
+			return nil, err
+		}
+		creds = credentials.NewClientTLSFromCert(certPool, "")
+	} else {
+		creds = insecure.NewCredentials()
+	}
+
+	return grpc.WithTransportCredentials(creds), nil
+}

docs/sources/tempo/operations/tempo_cli.md

@@ -96,6 +96,7 @@ Options:
 - `--spss <value>`        Number of spans to return for each spanset
 - `--limit <value>`       Number of results to return
 - `--path-prefix <value>` String to prefix search paths with
+- `--secure`              Use https or grpc with TLS
 
 {{< admonition type="note" >}}
 Streaming over HTTP requires the `stream_over_http_enabled` flag to be set. For more information, refer to [Tempo GRPC API documentation](../../api_docs/).
@@ -116,6 +117,7 @@ Options:
 - `--org-id <value>`      Organization ID (for use in multi-tenant setup).
 - `--use-grpc`            Use GRPC streaming
 - `--path-prefix <value>` String to prefix search paths with
+- `--secure`              Use https or grpc with TLS
 
 {{< admonition type="note" >}}
 Streaming over HTTP requires the `stream_over_http_enabled` flag to be set. For more information, refer to [Tempo GRPC API documentation](../../api_docs/).
@@ -137,6 +139,7 @@ Options:
 - `--org-id <value>`      Organization ID (for use in multi-tenant setup).
 - `--use-grpc`            Use GRPC streaming
 - `--path-prefix <value>` String to prefix search paths with
+- `--secure`              Use https or grpc with TLS
 
 {{< admonition type="note" >}}
 Streaming over HTTP requires the `stream_over_http_enabled` flag to be set. For more information, refer to [Tempo GRPC API documentation](../../api_docs/).
@@ -158,6 +161,7 @@ Options:
 - `--org-id <value>`      Organization ID (for use in multi-tenant setup).
 - `--use-grpc`            Use GRPC streaming
 - `--path-prefix <value>` String to prefix search paths with
+- `--secure`              Use https or grpc with TLS
 
 {{< admonition type="note" >}}
 Streaming over HTTP requires the `stream_over_http_enabled` flag to be set. For more information, refer to [Tempo GRPC API documentation](../../api_docs/).