Use tls.Dial when proxy is configured with TLS

Author: tscolari

server/server.go

@@ -2,6 +2,7 @@ package server
 
 import (
 	"context"
+	"crypto/tls"
 	"fmt"
 	"net"
 	"strings"
@@ -118,14 +119,27 @@ func NewServer(conf *config.Config, logger log.Logger) (*Server, error) {
 
 	// Cluster.
 
+	proxyTLSConfig, err := conf.Proxy.TLS.Load()
+	if err != nil {
+		return nil, fmt.Errorf("proxy tls: %w", err)
+	}
+
 	s.clusterState = cluster.NewState(&cluster.Node{
 		ID:        conf.Cluster.NodeID,
 		ProxyAddr: conf.Proxy.AdvertiseAddr,
 		AdminAddr: conf.Admin.AdvertiseAddr,
 	}, logger)
 	s.clusterState.Metrics().Register(registry)
 
-	upstreams := upstream.NewLoadBalancedManager(s.clusterState)
+	var clientTLSConfig *tls.Config
+	if proxyTLSConfig != nil {
+		clientTLSConfig, err = conf.Proxy.ClientTLS.Load()
+		if err != nil {
+			return nil, fmt.Errorf("proxy client tls: %w", err)
+		}
+	}
+
+	upstreams := upstream.NewLoadBalancedManager(s.clusterState, clientTLSConfig)
 	upstreams.Metrics().Register(registry)
 
 	// Proxy server.
@@ -140,10 +154,6 @@ func NewServer(conf *config.Config, logger log.Logger) (*Server, error) {
 			auth.NewJWTVerifier(verifierConf), nil,
 		)
 	}
-	proxyTLSConfig, err := conf.Proxy.TLS.Load()
-	if err != nil {
-		return nil, fmt.Errorf("proxy tls: %w", err)
-	}
 	s.proxyServer = proxy.NewServer(
 		upstreams,
 		conf.Proxy,

server/upstream/manager.go

@@ -1,6 +1,7 @@
 package upstream
 
 import (
+	"crypto/tls"
 	"sync"
 
 	"github.com/prometheus/client_golang/prometheus"
@@ -83,12 +84,15 @@ type LoadBalancedManager struct {
 	cluster *cluster.State
 
 	metrics *Metrics
+
+	clientTLSConfig *tls.Config
 }
 
-func NewLoadBalancedManager(cluster *cluster.State) *LoadBalancedManager {
+func NewLoadBalancedManager(cluster *cluster.State, proxyClientTLSConfig *tls.Config) *LoadBalancedManager {
 	return &LoadBalancedManager{
-		localUpstreams: make(map[string]*loadBalancer),
-		cluster:        cluster,
+		localUpstreams:  make(map[string]*loadBalancer),
+		cluster:         cluster,
+		clientTLSConfig: proxyClientTLSConfig,
 		usage: &Usage{
 			Requests:  atomic.NewUint64(0),
 			Upstreams: atomic.NewUint64(0),
@@ -118,7 +122,7 @@ func (m *LoadBalancedManager) Select(endpointID string, allowRemote bool) (Upstr
 		"node_id": node.ID,
 	}).Inc()
 	m.usage.Requests.Inc()
-	return NewNodeUpstream(endpointID, node), true
+	return NewNodeUpstream(endpointID, node, m.clientTLSConfig), true
 }
 
 func (m *LoadBalancedManager) AddConn(u Upstream) {