TLS for gRPC service

[sunng87]

What type of enhancement is this?

Configuration

What does the enhancement do?

Add TLS support for our gRPC services (default port: 4001)

Implementation challenges

No response

[tisonkun]

FWIW, you may add .tls_config at L172:

greptimedb/src/servers/src/grpc.rs

Lines 171 to 174 in 450dfe3

	let builder = tonic::transport::Server::builder()
	.add_routes(routes)
	.add_service(self.create_healthcheck_service())
	.add_service(self.create_reflection_service());

where the ServerTlsConfig is constructed like:

greptimedb/src/common/grpc/src/channel_manager.rs

Lines 74 to 98 in 450dfe3

	pub fn with_tls_config(config: ChannelConfig) -> Result<Self> {
	let mut cm = Self::with_config(config.clone());
	// setup tls
	let path_config = config.client_tls.context(InvalidTlsConfigSnafu {
	msg: "no config input",
	})?;
	let server_root_ca_cert = std::fs::read_to_string(path_config.server_ca_cert_path)
	.context(InvalidConfigFilePathSnafu)?;
	let server_root_ca_cert = Certificate::from_pem(server_root_ca_cert);
	let client_cert = std::fs::read_to_string(path_config.client_cert_path)
	.context(InvalidConfigFilePathSnafu)?;
	let client_key = std::fs::read_to_string(path_config.client_key_path)
	.context(InvalidConfigFilePathSnafu)?;
	let client_identity = Identity::from_pem(client_cert, client_key);
	cm.client_tls_config = Some(
	ClientTlsConfig::new()
	.ca_certificate(server_root_ca_cert)
	.identity(client_identity),
	);
	Ok(cm)
	}

But I'm unfamiliar with TLS and don't know how to test it. So just share my finding that can be a start point.