Support TLS

[jtlisi]

Cortex as a project does not have many mechanisms in place to secure its messages. As things stand, no security mechanisms exist with cortex and that responsibility is off-loaded to the system that proxies requests to Cortex. As a distributed system with significant traffic between services, I think we should consider adding support for TLS within Cortex. Initially this support could be focuses on GRPC services within Cortex and then expanded to cover its HTTP services.

[annanay25]

I'd like to pick this up!

To do this, we can add support for bidirectional (client and server) auth. The supported TLS version could be synced with the prometheus node_exporter https package.

Tracking steps

• Add HTTPS support to weaveworks/common/server by adding TLSConfig options. The relevant changes are here.
• Add TLS support to all HTTP/GRPC clients in cortex components that interact with weaveworks/common/server. (Will probably split this off into multiple PRs depending on number of files touched).

[bboreham]

Ping me if you make a PR in weaveworks/common - I don't always catch the notification.

[halcyondude]

Has the approach of relying on a service mesh (e.g. linkerd, or something else) to enable mTLS between services been explored? This might be simpler than baking it into the project itself, and might integrate more cohesively with existing k8s fleets.

[annanay25]

@halcyondude - I have answered on the PR.