David Dyball

@bwplotka Apologies, I meant I can look at writing some similar code to what is in place for FileSD to implement `FileStoreConfig` or something :-P Definitely don't want to mix...

@mleklund Try getambassador.io for a nice GRPC proxy. It's what we ended up using to get around the problem of not being able to mix TLS and non-TLS stores. @povilasv...

@benjaminhuo I don't think it does solve the problem here. The issue is that I'd like `query` to talk to different stores in different ways (e.g. TLS vs non-TLS) and...

@benjaminhuo I had `thanos-query` talking directly to `ambassador` directly, so didn't use Ambassador for outbound. You'd probably want to use Envoy directly for that part, no?

We're not validating TLS at the moment @benjaminhuo , so there's no TLS config on `query`, just a list of `store` endpoints :+1:

Per-store TLS config. The ability to specify TLS for some stores and disable it for others. We've since worked around the issue, so if it doesn't fit with the intended...

We ended up switching off TLS for the time being and using Ambassador as a proxy. The eventual goal is to use cross-cluster services via Istio, so we can just...

Apologies, it is a very long log and I wasn't sure if it'd be useful in its entirety: ``` ERROR [reactor-http-epoll-4] r.c.p.Operators: Operator called default onErrorDropped reactor.core.Exceptions$ErrorCallbackNotImplemented: java.lang.ClassCastException: Cannot cast...

When I enabled `TRACE` on `Jackson2JsonEncoder` I can see the permissions it's assigning me after checking authorization: ``` 2023-09-13 12:39:12,716 TRACE [reactor-http-epoll-2] o.s.h.c.j.Jackson2JsonEncoder: [7579b09d-11] Encoding [class AuthenticationInfoDTO { rbacEnabled: true...

@mmasipgu Are you using Okta? I tried switching out `type: group` for `type: role`, but I still get the `Cannot cast DefaultOidcUser to UserDetails` error 🤔