Hello you all,
Im trying to configure kibana with elasticsearch using the xpack security module from the elastic helm official repository (https://github.com/elastic/helm-charts)
I followed the guides for the security implementation using these values files:
elasticsearch_values.yaml
(...)
esConfig:
elasticsearch.yml: |
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-certificate.p12
xpack.security.transport.ssl.truststore.path: /usr/share/elasticsearch/config/certs/elastic-certificate.p12
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.truststore.path: /usr/share/elasticsearch/config/certs/elastic-certificate.p12
xpack.security.http.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-certificate.p12
extraEnvs:
- name: ELASTIC_PASSWORD
valueFrom:
secretKeyRef:
name: elastic-credentials
key: password - name: ELASTIC_USERNAME
valueFrom:
secretKeyRef:
name: elastic-credentials
key: username
secretMounts:
- name: elastic-certificates
secretName: elastic-certificates
path: /usr/share/elasticsearch/config/certs
image: "docker.elastic.co/elasticsearch/elasticsearch"
imageTag: "7.1.1"
imagePullPolicy: "IfNotPresent"
(...)
and
kibana_values.yaml
elasticsearchURL: "" # "http://elasticsearch-master:9200"
elasticsearchHosts: "https://elasticsearch-master:9200"
replicas: 1
extraEnvs:
- name: 'ELASTICSEARCH_USERNAME'
valueFrom:
secretKeyRef:
name: elastic-credentials
key: username - name: 'ELASTICSEARCH_PASSWORD'
valueFrom:
secretKeyRef:
name: elastic-credentials
key: password
secretMounts:
- name: elastic-certificate-pem
secretName: elastic-certificate-pem
path: /usr/share/kibana/config/certs - name: kibana-certificates
secretName: kibana-certificates
path: /usr/share/kibana/config/certs/kibana
image: "docker.elastic.co/kibana/kibana"
imageTag: "7.1.1"
imagePullPolicy: "IfNotPresent"
resources:
requests:
cpu: "100m"
memory: "500m"
limits:
cpu: "1000m"
memory: "1Gi"
protocol: https
serverHost: "0.0.0.0"
healthCheckPath: "/app/kibana"
kibanaConfig:
kibana.yml: |
xpack.security.enabled: true
server.ssl:
enabled: true
key: /usr/share/kibana/config/certs/kibana/tls.key
certificate: /usr/share/kibana/config/certs/kibana/tls.crt
xpack.security.encryptionKey: ajskfiejknckskspwu5r930128fgjvklnkdpajfe
logging.verbose: true
elasticsearch.ssl:
certificateAuthorities: /usr/share/kibana/config/certs/elastic-certificate.pem
verificationMode: certificate
podSecurityContext:
fsGroup: 1000
securityContext:
capabilities:
drop:
- ALL
runAsNonRoot: true
runAsUser: 1000
serviceAccount: ""
priorityClassName: ""
antiAffinityTopologyKey: "kubernetes.io/hostname"
antiAffinity: "hard"
httpPort: 5601
maxUnavailable: 1
updateStrategy:
type: "Recreate"
service:
type: ClusterIP
port: 5601
nodePort:
annotations: {}
readinessProbe:
failureThreshold: 3
initialDelaySeconds: 10
periodSeconds: 10
successThreshold: 3
timeoutSeconds: 5
imagePullSecrets:
nodeSelector: {}
tolerations:
affinity: {}
nameOverride: ""
fullnameOverride: ""
and created all the p12 and pem files inside kubernetes.
However kibana cannot login successfully:
{"type":"error","@timestamp":"2019-07-12T14:12:03Z","tags":["debug","security","auth","session"],"pid":1,"level":"error","error":{"message":"Unauthorized","name":"Error","stack":"Error: Unauthorized\n at validate (/usr/share/kibana/node_modules/hapi-auth-cookie/lib/index.js:153:49)\n at Object.authenticate (/usr/share/kibana/node_modules/hapi-auth-cookie/lib/index.js:226:26)\n at module.exports.internals.Manager.execute (/usr/share/kibana/node_modules/hapi/lib/toolkit.js:35:106)\n at module.exports.internals.Auth.test (/usr/share/kibana/node_modules/hapi/lib/auth.js:92:54)\n at Session.get (/usr/share/kibana/node_modules/x-pack/plugins/security/server/lib/authentication/session.js:56:47)\n at Authenticator.authenticate (/usr/share/kibana/node_modules/x-pack/plugins/security/server/lib/authentication/authenticator.js:132:49)\n at Object.server.expose.request [as authenticate] (/usr/share/kibana/node_modules/x-pack/plugins/security/server/lib/authentication/authenticator.js:288:60)\n at Object.authenticate (/usr/share/kibana/node_modules/x-pack/plugins/security/server/lib/auth_redirect.js:28:60)\n at module.exports.internals.Manager.execute (/usr/share/kibana/node_modules/hapi/lib/toolkit.js:35:106)\n at module.exports.internals.Auth._authenticate (/usr/share/kibana/node_modules/hapi/lib/auth.js:238:58)\n at authenticate (/usr/share/kibana/node_modules/hapi/lib/auth.js:214:21)\n at Request._lifecycle (/usr/share/kibana/node_modules/hapi/lib/request.js:263:62)\n at process._tickCallback (internal/process/next_tick.js:68:7)"},"message":"Unauthorized"}
{"type":"log","@timestamp":"2019-07-12T14:12:03Z","tags":["debug","security","basic"],"pid":1,"message":"Trying to authenticate user request to /app/kibana."}
{"type":"log","@timestamp":"2019-07-12T14:12:03Z","tags":["debug","security","basic"],"pid":1,"message":"Trying to authenticate via login attempt."}
{"type":"log","@timestamp":"2019-07-12T14:12:03Z","tags":["debug","security","basic"],"pid":1,"message":"Username and password not found in payload."}
{"type":"log","@timestamp":"2019-07-12T14:12:03Z","tags":["debug","security","basic"],"pid":1,"message":"Trying to authenticate via header."}
{"type":"log","@timestamp":"2019-07-12T14:12:03Z","tags":["debug","security","basic"],"pid":1,"message":"Authorization header is not presented."}
I can successfully curl elasticsearch:
[root@elasticsearch-master-0 elasticsearch]# curl -k -u elastic:(pass) https://elasticsearch-master:9200
{
"name" : "elasticsearch-master-0",
"cluster_name" : "elasticsearch",
"cluster_uuid" : "Oh9jTS4qTni__GG6KHCo3w",
"version" : {
"number" : "7.1.1",
"build_flavor" : "default",
"build_type" : "docker",
"build_hash" : "7a013de",
"build_date" : "2019-05-23T14:04:00.380842Z",
"build_snapshot" : false,
"lucene_version" : "8.0.0",
"minimum_wire_compatibility_version" : "6.8.0",
"minimum_index_compatibility_version" : "6.0.0-beta1"
},
"tagline" : "You Know, for Search"
}
I dont really know what I can do