# Elasticsearch enable security issues

**URL:** <https://discuss.elastic.co/t/elasticsearch-enable-security-issues/225413>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [March 27, 2020, 1:13pm UTC](https://discuss.elastic.co/t/elasticsearch-enable-security-issues/225413 "2020-03-27T13:13:34Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![willelastz](https://avatars.discourse-cdn.com/v4/letter/w/e495f1/32.png) [@willelastz](https://discuss.elastic.co/u/willelastz)\
**Post date:** [March 27, 2020, 1:13pm UTC](https://discuss.elastic.co/t/elasticsearch-enable-security-issues/225413/1 "2020-03-27T13:13:34Z")

</div>

Hi,

I have a Elasticsearch 7.6 cluster installed base on

[https://github.com/openstack/openstack-helm-infra/tree/master/elasticsearch](https://github.com/openstack/openstack-helm-infra/tree/master/elasticsearch)

Following is what I did to enable security:  
a. Generate certificate

```auto
    ./bin/elasticsearch-certutil ca
    File location: /usr/share/elasticsearch/elastic-stack-ca.p12

    ./bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12
    File location: /usr/share/elasticsearch/elastic-certificates.p12

    kubectl create secret generic elastic-certificates --from-file=elastic-certificates.p12

```

b. Enable Security on statefulset for master pod  
`kubectl edit statefulset elasticsearch-master`

```auto
     ----
        - name: xpack.security.enabled
          value: "true"
        - name: xpack.security.transport.ssl.enabled
          value: "true"
        - name: xpack.security.transport.ssl.verification_mode
          value: certificate
        - name: xpack.security.transport.ssl.keystore.path
          value: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
        - name: xpack.security.transport.ssl.truststore.path
          value: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
    ----
        - mountPath: /usr/share/elasticsearch/config/certs
          name: elastic-certificates
          readOnly: true
    ----
      - name: elastic-certificates
        secret:
          defaultMode: 444
          secretName: elastic-certificates

```

c. Enable security on statefulset for data pod  
`kubectl edit statefulset elasticsearch-data`

```auto
    ----
        - name: xpack.security.enabled
          value: "true"
        - name: xpack.security.transport.ssl.enabled
          value: "true"
        - name: xpack.security.transport.ssl.verification_mode
          value: certificate
    ----
        - mountPath: /usr/share/elasticsearch/config/certs
          name: elastic-certificates
    ----
      - name: elastic-certificates
        secret:
          defaultMode: 444
          secretName: elastic-certificates

```

d. Enable security on deployment for client  
`kubectl edit deployment elasticsearch-client`

```auto
    ----
        - name: xpack.security.enabled
          value: "true"
        - name: xpack.security.transport.ssl.enabled
          value: "true"
        - name: xpack.security.transport.ssl.verification_mode
          value: certificate
        - name: xpack.security.transport.ssl.keystore.path
          value: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
        - name: xpack.security.transport.ssl.truststore.path
          value: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
    ----
        - mountPath: /usr/share/elasticsearch/config/certs
          name: elastic-certificates
    ----
      - name: elastic-certificates
        secret:
          defaultMode: 444
          secretName: elastic-certificates

```

After pods restart, I got the following issue:  
a. data pots are stuck in init stage

```auto
        kubectl get pod |grep data
        elasticsearch-data-0 1/1 Running 0 42m
        elasticsearch-data-1 0/1 Init:0/3 0 10m
        kubectl logs elasticsearch-data-1 -c init |tail -1
Entrypoint WARNING: <date/time> entrypoint.go:72: Resolving dependency Service elasticsearch-logging in namespace osh-infra failed: Service elasticsearch-logging has no endpoints .

```

b. Client pod errors regarding connection refused

```auto
    Warning Unhealthy 18m (x4 over 19m) kubelet, s1-worker-2 Readiness probe failed: Get http://192.180.71.82:9200/_cluster/health: dial tcp 192.180.71.82:9200: connect: connection refused
    Warning Unhealthy 4m17s (x86 over 18m) kubelet, s1-worker-2 Readiness probe failed: HTTP probe failed with statuscode: 401

```

c. Service "elasticsearch-logging" endpoints is empty

Any suggestions how to fix or what is wrong?  
Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 24, 2020, 1:13pm UTC](https://discuss.elastic.co/t/elasticsearch-enable-security-issues/225413/2 "2020-04-24T13:13:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.