Add custom certificate CA support for object store

[clyang82]

Is your proposal related to a problem?

Currently, the implementation of connecting with object store is short of tls configuration.

thanos/pkg/objstore/s3/s3.go

Line 150 in 2695ecd

TLSClientConfig: &tls.Config{InsecureSkipVerify: config.HTTPConfig.InsecureSkipVerify},

for my case, I would need the ability to set a custom CA somewhere so that I can connect the external object store. for a workaround, i have to disable tls verification by

type: S3
config:
  bucket: ""
  endpoint: ""
  access_key: ""
  insecure: false
  signature_version2: false
  encrypt_sse: false
  secret_key: ""
  http_config:
    insecure_skip_verify: true

(Write your answer here.)

Describe the solution you'd like

Support configuring certificate CA in http_config

(Describe your proposed solution here.)

Describe alternatives you've considered

(Write your answer here.)

Additional context

(Write your answer here.)

[clyang82]

/assign @clyang82

[clyang82]

List the tasks for this issue:

• Support custom CA for S3
• Support custom CA for Azure
• Support custom CA for GCS GCS is using inline a Service Account
• Update e2e test to enable secure access to MinIO with TLS
• Update kube-thanos to support mount CA certs by secret

[quchangl-github]

@clyang82 I got the update, Azure storage account doesn't support client key access - https://docs.microsoft.com/en-us/answers/questions/807958/where-to-find-the-client-ca-and-key.html.
So I don't think Azure storage can be accessed by customized CA. I saw your update here , GCS is using an inline a Service Account, I think Azure storage has a similar situation, it's using a storage account. Thanks.

[stale]

Hello 👋 Looks like there was no activity on this issue for the last two months.
Do you mind updating us on the status? Is this still reproducible or needed? If yes, just comment on this PR or push a commit. Thanks! 🤗
If there will be no activity in the next two weeks, this issue will be closed (we can always reopen an issue if we need!). Alternatively, use remind command if you wish to be reminded at some point in future.