# Accessing ECK through NodeJS SDK

**URL:** <https://discuss.elastic.co/t/accessing-eck-through-nodejs-sdk/235454>\
**Category:** Elastic Cloud on Kubernetes (ECK)\
**Created:** [June 3, 2020, 4:07am UTC](https://discuss.elastic.co/t/accessing-eck-through-nodejs-sdk/235454 "2020-06-03T04:07:54Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![O\_897](https://avatars.discourse-cdn.com/v4/letter/o/e274bd/32.png) [@O\_897](https://discuss.elastic.co/u/O_897)\
**Post date:** [June 3, 2020, 4:07am UTC](https://discuss.elastic.co/t/accessing-eck-through-nodejs-sdk/235454/1 "2020-06-03T04:07:54Z")

</div>

Hi there!

I've been trying out and experimenting with the ECK Quickstart project and the Node.js SDK for a while and it's been really nice this far. However, I've only done so with certificate verification turned off, and it seems I'm running into some issues when turning it on.

The relevant code in my Node service looks something like this (I’ve changed the name “quickstart” to “elastic”):

```auto
  const client = new Client({
    node: 'https://elastic-es-http.default.svc.cluster.local:9200',
    maxRetries: 5,
    requestTimeout: 60000,
    sniffOnStart: true,
    auth: {
      username: 'elastic',
      password: process.env.ELASTIC_PASSWORD,
    },
    ssl: {
      ca: fs.readFileSync('/etc/ssl/elastic/ca.crt'),
      rejectUnauthorized: true,
    },
  })

```

My service deployment is configured with the relevant parts as follows,:

```auto
spec:
  template:
    spec:
      containers:
      - name: servicename
        env:
          - name: ELASTIC_PASSWORD
            valueFrom:
              secretKeyRef:
                name: elastic-es-elastic-user
                key: elastic
        volumeMounts:
          - name: elastic-certs
            mountPath: /etc/ssl/elastic/ca.crt
            readOnly: true
            subPath: ca.crt
      volumes:
        - name: elastic-certs
          secret:
            secretName: elastic-es-http-certs-public

```

I’ve also configured the Elastic cluster to add the address I’m trying to use as a SAN:

```auto
spec:
  version: 7.7.0
  http:
    tls:
      selfSignedCertificate:
        subjectAltNames:
        - dns: elastic-es-http.default.svc.cluster.local

```

I’m executing the service with `NODE_EXTRA_CA_CERTS=/etc/ssl/elastic/ca.crt node ./run.js`

For the life of me I can’t get this working though, since the IP of the Elastic cluster is not in the certificate’s alt names:

```auto
ConnectionError: Hostname/IP does not match certificate's altnames: IP: 10.12.1.2 is not in the cert's list:

```

Of course, it does work if I add the IP to the SANs of the certificate, but this feels error-prone since this IP is bound to change if I’d be using another environment.

It feels like I’m probably just missing something simple here, but I'd greatly appreciate getting any pointers on what it is I'm missing. 🙂

---

<div class="post-metadata">

**Author:** ![michael.morello](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michael.morello/32/47448_2.png) [@michael.morello](https://discuss.elastic.co/u/michael.morello)\
**Post date:** [June 3, 2020, 7:32am UTC](https://discuss.elastic.co/t/accessing-eck-through-nodejs-sdk/235454/2 "2020-06-03T07:32:43Z")

</div>

I guess this is because you enable `sniffOnStart`. By default ECK set `network.publish_host` to the Pod IP, which is not in the HTTP certs.

I'll open a Github issue to discuss this problem. In the meantime could you try to disable `sniffOnStart` ?

Thanks

---

<div class="post-metadata">

**Author:** ![O\_897](https://avatars.discourse-cdn.com/v4/letter/o/e274bd/32.png) [@O\_897](https://discuss.elastic.co/u/O_897)\
**Post date:** [June 3, 2020, 8:44am UTC](https://discuss.elastic.co/t/accessing-eck-through-nodejs-sdk/235454/3 "2020-06-03T08:44:31Z")

</div>

@michael.morello wow, thanks a lot, that did the trick!

I'll keep an eye on the discussions in the Github issue and see where you land.

All the best

---

<div class="post-metadata">

**Author:** ![michael.morello](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michael.morello/32/47448_2.png) [@michael.morello](https://discuss.elastic.co/u/michael.morello)\
**Post date:** [June 4, 2020, 6:33am UTC](https://discuss.elastic.co/t/accessing-eck-through-nodejs-sdk/235454/4 "2020-06-04T06:33:59Z")

</div>

Issue has been opened here: [https://github.com/elastic/cloud-on-k8s/issues/3182](https://github.com/elastic/cloud-on-k8s/issues/3182)

[I managed to make sniffing work](https://github.com/elastic/cloud-on-k8s/compare/master...barkbay:sniff) but it requires a potential user-facing change in the Kubernetes Services managed by ECK.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2022, 8:00am UTC](https://discuss.elastic.co/t/accessing-eck-through-nodejs-sdk/235454/5 "2022-11-04T08:00:48Z")

</div>