# After enabling xpack security readinessprobe fails

**URL:** <https://discuss.elastic.co/t/after-enabling-xpack-security-readinessprobe-fails/361625>\
**Category:** Elasticsearch\
**Tags:** docker\
**Created:** [June 18, 2024, 7:48am UTC](https://discuss.elastic.co/t/after-enabling-xpack-security-readinessprobe-fails/361625 "2024-06-18T07:48:01Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![laurijssen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/laurijssen/32/117021_2.png) [@laurijssen](https://discuss.elastic.co/u/laurijssen)\
**Post date:** [June 18, 2024, 7:48am UTC](https://discuss.elastic.co/t/after-enabling-xpack-security-readinessprobe-fails/361625/1 "2024-06-18T07:48:01Z")

</div>

I've got elk stack running through helm without security but now I was aked to turn it on.

So I generated certificates with elastic-certutil and put them in a secret and changed the config into

```auto
esConfig:
  elasticsearch.yml: |
    cluster.name: "docker-cluster"
    network.host: 0.0.0.0
    xpack.security.enabled: true
    xpack.security.transport.ssl.enabled: true
    xpack.security.transport.ssl.verification_mode: certificate
    xpack.security.transport.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
    xpack.security.transport.ssl.truststore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
    xpack.license.self_generated.type: basic

secretMounts:
  - name: elastic-certificates
    secretName: elastic-certificates
    path: /usr/share/elasticsearch/config/certs
    defaultMode: 0755

```

Also changed protocol to https: `protocol: https`

Then helm upgrade and the elastics pod restarts without error. Yet it never becomes ready!

This is 100% because of readinessprobe not triggering, because this the readinessprobe in elasticsearch and that is NOT logged in the kubelet logs

```auto
                http () {
                  local path="${1}"
                  local args="${2}"
                  set -- -XGET -s

                  if ["$args" != ""]; then
                    set -- "$@" $args
                  fi

                  if [-n "${ELASTIC_PASSWORD}"]; then
                    set -- "$@" -u "elastic:${ELASTIC_PASSWORD}"
                  fi

                  curl --connect-timeout 20 --output /dev/null -k "$@" "{{ .Values.protocol }}://127.0.0.1:{{ .Values.httpPort }}${path}"
}

```

What IS logged is the readinessprobe bash command from KIBANA and that fails all the time with a connect timeout.

I feel like Im in a chicken and egg situation here. How do I get xpack securitu going with kibana as frontend?

Here's the kubelet log showing the curl request from kibana with timeouts, this is with protocol http but https fails as well.

```auto
[bash -c #!/usr/bin/env bash -e
# Disable nss cache to avoid filling dentry cache when calling curl
# This is required with Kibana Docker using nss < 3.52
export NSS_SDB_USE_CACHE=no

http () {
local path="${1}"
            set -- -XGET -s --fail -L
  if [-n "${ELASTICSEARCH_USERNAME}"] && [-n "${ELASTICSEARCH_PASSWORD}"]; then
 set -- "$@" -u "${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD}"

STATUS=$(curl --output /dev/null --write-out "%{http_code}" -k "$@" "http://localhost:5601${path}")

```

---

<div class="post-metadata">

**Author:** ![Artem\_Shelkovnikov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/artem_shelkovnikov/32/134322_2.png) [@Artem\_Shelkovnikov](https://discuss.elastic.co/u/Artem_Shelkovnikov)\
**Post date:** [June 18, 2024, 8:29am UTC](https://discuss.elastic.co/t/after-enabling-xpack-security-readinessprobe-fails/361625/2 "2024-06-18T08:29:25Z")

</div>

From #Elastic Search to #Elasticsearch

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [June 19, 2024, 4:09am UTC](https://discuss.elastic.co/t/after-enabling-xpack-security-readinessprobe-fails/361625/3 "2024-06-19T04:09:18Z")

</div>

This helm chart requires that, if security is enabled, you provide the password for the `elastic` user to the container in the `ELASTIC_PASSWORD` environment variable.

```auto
                  if [-n "${ELASTIC_PASSWORD}"]; then
                    set -- "$@" -u "elastic:${ELASTIC_PASSWORD}"
                  fi

```

Otherwise the `curl` health check will fail because it does not have valid credentials.

---

<div class="post-metadata">

**Author:** ![laurijssen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/laurijssen/32/117021_2.png) [@laurijssen](https://discuss.elastic.co/u/laurijssen)\
**Post date:** [June 19, 2024, 6:26am UTC](https://discuss.elastic.co/t/after-enabling-xpack-security-readinessprobe-fails/361625/4 "2024-06-19T06:26:55Z")

</div>

Ok thanks. I tried that by just hardcoding default credentials in the ready proby.  
With xpack security disabled, protocol http the kubelet logs do get the script triggered.....and the pod becomes ready.

```auto
Jun 19 08:17:56 LOGSTASH.nl kubelet[757]: if ["$args" != ""]; then
Jun 19 08:17:56 LOGSTASH.nl kubelet[757]: set -- "$@" $args
Jun 19 08:17:56 LOGSTASH.nl kubelet[757]: fi
Jun 19 08:17:56 LOGSTASH.nl kubelet[757]:
Jun 19 08:17:56 LOGSTASH.nl kubelet[757]: set -- "$@" -u "elastic:changeme"
Jun 19 08:17:56 LOGSTASH.nl kubelet[757]:
Jun 19 08:17:56 LOGSTASH.nl kubelet[757]: curl --output /dev/null -k "$@" .......

```

But with xpack.security enabled and protocol https the script is never logged in the kubelet logs, so it seems its not triggered at all.

---

<div class="post-metadata">

**Author:** ![laurijssen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/laurijssen/32/117021_2.png) [@laurijssen](https://discuss.elastic.co/u/laurijssen)\
**Post date:** [June 20, 2024, 6:14am UTC](https://discuss.elastic.co/t/after-enabling-xpack-security-readinessprobe-fails/361625/6 "2024-06-20T06:14:30Z")

</div>

found the solution

I enabled only transport level

```auto
xpack.security.transport.ssl.enabled: true

```

but http must also be enabled!

```auto
    xpack.security.http.ssl.enabled: true
    xpack.security.http.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
    xpack.security.http.ssl.truststore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12

```

then (of course) elastic runs on https and also the credentials must be provided

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 18, 2024, 6:15am UTC](https://discuss.elastic.co/t/after-enabling-xpack-security-readinessprobe-fails/361625/7 "2024-07-18T06:15:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.