Configure Filebeat on Kubenetes

Hi,

I'm trying to follow this guide for setting up Filebeats on our K8s cluster (v1.5.4) and the daemonset starts successfully but we never see logs shipped to Logstash. I checked the logs on one of the filebeats daemonset pods and saw these messages. Is there a way we can reference our kubeconfig file (includes our CA cert) to address this problem? Or reference our CA cert at a minimum?

https://www.elastic.co/guide/en/beats/filebeat/6.0/running-on-kubernetes.html

2018-04-10T16:53:16.572Z INFO kubernetes/watcher.go:140 kubernetes: Watching API for pod events
2018-04-10T16:53:16.581Z ERROR kubernetes/watcher.go:145 kubernetes: Watching API error Get https://10.157.0.1:443/api/v1/pods?fieldSelector=spec.nodeName%3Dlocalhost&resourceVersion=0&watch=true: x509: cannot validate certificate for 10.157.0.1 because it doesn't contain any IP SANs
2018-04-10T16:53:16.582Z INFO kubernetes/watcher.go:140 kubernetes: Watching API for pod events
2018-04-10T16:53:16.608Z ERROR kubernetes/watcher.go:145 kubernetes: Watching API error Get https://10.157.0.1:443/api/v1/pods?fieldSelector=spec.nodeName%3Dlocalhost&resourceVersion=0&watch=true: x509: cannot validate certificate for 10.157.0.1 because it doesn't contain any IP SANs
2018-04-10T16:53:16.609Z INFO kubernetes/watcher.go:140 kubernetes: Watching API for pod events
2018-04-10T16:53:16.617Z ERROR kubernetes/watcher.go:145 kubernetes: Watching API error Get https://10.157.0.1:443/api/v1/pods?fieldSelector=spec.nodeName%3Dlocalhost&resourceVersion=0&watch=true: x509: cannot validate certificate for 10.157.0.1 because it doesn't contain any IP SANs
2018-04-10T16:53:16.618Z INFO kubernetes/watcher.go:140 kubernetes: Watching API for pod events
2018-04-10T16:53:16.629Z ERROR kubernetes/watcher.go:145 kubernetes: Watching API error Get https://10.157.0.1:443/api/v1/pods?fieldSelector=spec.nodeName%3Dlocalhost&resourceVersion=0&watch=true: x509: cannot validate certificate for 10.157.0.1 because it doesn't contain any IP SANs
2018-04-10T16:53:16.629Z INFO kubernetes/watcher.go:140 kubernetes: Watching API for pod events
2018-04-10T16:53:16.639Z ERROR kubernetes/watcher.go:145 kubernetes: Watching API error Get https://10.157.0.1:443/api/v1/pods?fieldSelector=spec.nodeName%3Dlocalhost&resourceVersion=0&watch=true: x509: cannot validate certificate for 10.157.0.1 because it doesn't contain any IP SANs
2018-04-10T16:53:16.639Z INFO kubernetes/watcher.go:140 kubernetes: Watching API for pod events
2018-04-10T16:53:16.670Z ERROR kubernetes/watcher.go:145 kubernetes: Watching API error Get https://10.157.0.1:443/api/v1/pods?fieldSelector=spec.nodeName%3Dlocalhost&resourceVersion=0&watch=true: x509: cannot validate certificate for 10.157.0.1 because it doesn't contain any IP SANs
2018-04-10T16:53:16.671Z INFO kubernetes/watcher.go:140 kubernetes: Watching API for pod events
2018-04-10T16:53:16.682Z ERROR kubernetes/watcher.go:145 kubernetes: Watching API error Get https://10.157.0.1:443/api/v1/pods?fieldSelector=spec.nodeName%3Dlocalhost&resourceVersion=0&watch=true: x509: cannot validate certificate for 10.157.0.1 because it doesn't contain any IP SANs
2018-04-10T16:53:16.682Z INFO kubernetes/watcher.go:140 kubernetes: Watching API for pod events
2018-04-10T16:53:16.697Z ERROR kubernetes/watcher.go:145 kubernetes: Watching API error Get https://10.157.0.1:443/api/v1/pods?fieldSelector=spec.nodeName%3Dlocalhost&resourceVersion=0&watch=true: x509: cannot validate certificate for 10.157.0.1 because it doesn't contain any IP SANs
2018-04-10T16:53:16.697Z INFO kubernetes/watcher.go:140 kubernetes: Watching API for pod events
2018-04-10T16:53:16.715Z ERROR kubernetes/watcher.go:145 kubernetes: Watching API error Get https://10.157.0.1:443/api/v1/pods?fieldSelector=spec.nodeName%3Dlocalhost&resourceVersion=0&watch=true: x509: cannot validate certificate for 10.157.0.1 because it doesn't contain any IP SANs

are the default serviceaccont certs mounted? i don't know 1.5.x but with 1.8 its mounted per default, if not you always can do a hostPath mount

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.