Helm-charts: Baic authentication ES clutser in production

[harsh4870]

i want to set basic authentication only username:password to ES clutser. i have created kubernetes secret and added in values.yaml file also added xpack.security.enabled: true.

my web app would be sending request over simple HTTP only.

Please let me know if it is possible just set basic authentication username: credentials without setting up SSL transport layer security.

UPDATE

i am done with basic setup, mean basic auth and certificate creation working well also cluster is up.

but when i am sending curl request getting

curl localhost:9200

curl: (52) Empty reply from server

but when sending curl with --insecure or with -k getting response

{
  "name" : "elasticsearch-master-0",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "sUVANxDTQI2L8iSYBXIijg",
  "version" : {
    "number" : "7.3.2",
    "build_flavor" : "default",
    "build_type" : "docker",
    "build_hash" : "1c1faf1",
    "build_date" : "2019-09-06T14:40:30.409026Z",
    "build_snapshot" : false,
    "lucene_version" : "8.1.0",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}

any solution of this --insecure i think error occurring due to self-sign certificates.

elasticsearach.yaml file

esConfig:
  elasticsearch.yml: |
    xpack.security.enabled: true
    xpack.security.transport.ssl.enabled: true
    xpack.security.transport.ssl.verification_mode: certificate
    xpack.security.transport.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
    xpack.security.transport.ssl.truststore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
    xpack.security.http.ssl.enabled: true
    xpack.security.http.ssl.truststore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
    xpack.security.http.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
    xpack.security.authc.realms.native.local.order: 0

i just want to run on HTTPS and simple basic password, if anyone can please help.

is it okay if i remove from yaml file

xpack.security.http.ssl.enabled: true
    xpack.security.http.ssl.truststore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
    xpack.security.http.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12

by removing above three line it's working with curl without insecure mode.

Thanks. Please help

[sanvir10]

With this steps we enable xpack security without SSL on Google Kubernetes Engine.

1.- Edit config.yml add

extraEnvs:
  - name: ELASTIC_PASSWORD
    valueFrom:
      secretKeyRef:
        name: elastic-credentials
        key: password
  - name: ELASTIC_USERNAME
    valueFrom:
      secretKeyRef:
        name: elastic-credentials
        key: username

esConfig:
  elasticsearch.yml: |
    xpack.security.enabled: true

2.- Create credentials on GKE

kubectl -n default create secret generic elastic-credentials  --from-literal=password=$password --from-literal=username=elastic

• Change $password *

3.- Install on GKE

helm upgrade --wait --timeout=1500 --install \
  --values ./config.yaml elasticsearch elastic/elasticsearch

I hope this help, i haven't SSL on my cluster.

[sanvir10]

Or maybe you are using

bin/elasticsearch-certutil cert ...

And not

bin/elasticsearch-certutil http

Check SSL/TLS

[harsh4870]

@sanvir10 thanks working well. how about

esConfig:
  elasticsearch.yml: |
    xpack.security.enabled: true
    xpack.security.transport.ssl.enabled: true
    xpack.security.transport.ssl.verification_mode: certificate
    xpack.security.transport.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
    xpack.security.transport.ssl.truststore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
    #xpack.security.http.ssl.enabled: true
    #xpack.security.http.ssl.truststore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
    #xpack.security.http.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
    xpack.security.authc.realms.native.local.order: 0

you must be commenting http.ssl

[sanvir10]

@harsh4870 Can you share how are you creating elastic-certificates.p12?

I did this steps but i get error * "Caused by: java.security.cert.CertificateException: No name matching elasticsearch-master-headless found" *

1.- bin/elasticsearch-certutil ca I used bin/elasticsearch from local folder maybe here is the error
2.- bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12
3.- I Uploaded the elastic-certificates.p12 to secrets on GKE
4.- Edit the yml

secretMounts:
  - name: elastic-certificates
    secretName: elastic-certificates-68g78f96fb        ---> my secret p12 file
    path: /usr/share/elasticsearch/config/certs

esConfig:
  elasticsearch.yml: |
    xpack.security.enabled: true
    xpack.security.transport.ssl.enabled: true
    xpack.security.transport.ssl.verification_mode: certificate
    xpack.security.transport.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
    xpack.security.transport.ssl.truststore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12

[harsh4870]

created certificate with using make command only

https://github.com/elastic/helm-charts/blob/master/elasticsearch/examples/security/Makefile

secrets:
    docker rm -f elastic-helm-charts-certs || true
    rm -f elastic-certificates.p12 elastic-certificate.pem elastic-certificate.crt elastic-stack-ca.p12 || true
    password=$$([ ! -z "$$ELASTIC_PASSWORD" ] && echo $$ELASTIC_PASSWORD || echo $$(docker run --rm busybox:1.31.1 /bin/sh -c "< /dev/urandom tr -cd '[:alnum:]' | head -c20")) && \
    docker run --name elastic-helm-charts-certs -i -w /tmp \
        $(ELASTICSEARCH_IMAGE) \
        /bin/sh -c " \
            elasticsearch-certutil ca --out /tmp/elastic-stack-ca.p12 --pass '' && \
            elasticsearch-certutil cert --name security-master --dns security-master --ca /tmp/elastic-stack-ca.p12 --pass '' --ca-pass '' --out /tmp/elastic-certificates.p12" && \
    docker cp elastic-helm-charts-certs:/tmp/elastic-certificates.p12 ./ && \
    docker rm -f elastic-helm-charts-certs && \
    openssl pkcs12 -nodes -passin pass:'' -in elastic-certificates.p12 -out elastic-certificate.pem && \
    openssl x509 -outform der -in elastic-certificate.pem -out elastic-certificate.crt && \
    kubectl create secret generic elastic-certificates --from-file=elastic-certificates.p12 && \
    kubectl create secret generic elastic-certificate-pem --from-file=elastic-certificate.pem && \
    kubectl create secret generic elastic-certificate-crt --from-file=elastic-certificate.crt && \
    kubectl create secret generic elastic-credentials  --from-literal=password=$$password --from-literal=username=elastic && \
    rm -f elastic-certificates.p12 elastic-certificate.pem elastic-certificate.crt elastic-stack-ca.p12

[sanvir10]

Thanx so much, i see whats is my problem.

I have 7 nodes on my cluster(3 master, 2 data and 2 clients) but each group have diferent pod name:
1- elasticsearch-master
2.-elasticsearch-data
3.-elasticsearch-client

I did some change to the script

from

...elasticsearch-certutil cert --name security-master --dns security-master --ca /tmp/elastic-stack-ca.p12 --pass '' --ca-pass '' --out /tmp/elastic-certificates.p12" && \

to

...elasticsearch-certutil cert --name security-master --dns elastisearch-master, elasticsearch-data,elasticsearch-client --ca /tmp/elastic-stack-ca.p12 --pass '' --ca-pass '' --out /tmp/elastic-certificates.p12" && \

But this don't work yet :(.

[harsh4870]

@sanvir10 i am not 100% sure about issue but i followed this article only in comment someone suggested to use kubernets svc as DNS name.

https://pimwiddershoven.nl/entry/deploy-a-secure-instance-of-elasticsearch-on-kubernetes

please you can look it once

[sanvir10]

@harsh4870 thanks so much i will che it.

Regards