# Problem loading root cert filebeat on openshift
**URL:** https://discuss.elastic.co/t/problem-loading-root-cert-filebeat-on-openshift/243364
**Category:** Beats
**Tags:** filebeat
**Created:** [July 31, 2020, 2:43pm UTC](https://discuss.elastic.co/t/problem-loading-root-cert-filebeat-on-openshift/243364 "2020-07-31T14:43:18Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@mladen](https://discuss.elastic.co/u/mladen)
#### Post date: [July 31, 2020, 2:43pm UTC](https://discuss.elastic.co/t/problem-loading-root-cert-filebeat-on-openshift/243364/1 "2020-07-31T14:43:18Z")
Hello,
I am trying to install filebeat on my three openshift worker nodes. Following docs I manged to install filebeat agents.
In log I see the following error:
2020-07-31T14:05:31.350Z ERROR tlscommon/tls.go:145 Failed reading CA certificate: read /etc/certificate/elasticsearch-ca.pem: is a directory
> 2020-07-31T14:05:31.350Z ERROR instance/beat.go:933 Exiting: error initializing publisher: 1 error: read /etc/certificate/elasticsearch-ca.pem: is a directory reading /etc/certificate/elasticsearch-ca.pem
> Exiting: error initializing publisher: 1 error: read /etc/certificate/elasticsearch-ca.pem: is a directory reading /etc/certificate/elasticsearch-ca.pem
My yaml file is:
> apiVersion: v1
> kind: ConfigMap
> metadata:
> name: filebeat-config
> namespace: kube-system
> labels:
> k8s-app: filebeat
> data:
> filebeat.yml: |-
> filebeat.inputs:
> - type: container
> paths:
> - /var/log/containers/\*.log
> processors:
> - add\_kubernetes\_metadata:
> host: ${NODE\_NAME}
> matchers:
> - logs\_path:
> logs\_path: "/var/log/containers/"
>
> ```
> # To enable hints based autodiscover, remove `filebeat.inputs` configuration and uncomment this:
> #filebeat.autodiscover:
> # providers:
> # - type: kubernetes
> # node: ${NODE_NAME}
> # hints.enabled: true
> # hints.default_config:
> # type: container
> # paths:
> # - /var/log/containers/*${data.kubernetes.container.id}.log
>
> processors:
> - add_cloud_metadata:
> - add_host_metadata:
>
> cloud.id: ${ELASTIC_CLOUD_ID}
> cloud.auth: ${ELASTIC_CLOUD_AUTH}
>
> output.elasticsearch:
> hosts: ['${ELASTICSEARCH_HOST:elasticsearch}:${ELASTICSEARCH_PORT:9200}']
> username: ${ELASTICSEARCH_USERNAME}
> password: ${ELASTICSEARCH_PASSWORD}
> ssl.certificate_authorities:
> - /etc/certificate/elasticsearch-ca.pem
>
> ```
> apiVersion: apps/v1
> kind: DaemonSet
> metadata:
> name: filebeat
> namespace: kube-system
> labels:
> k8s-app: filebeat
> spec:
> selector:
> matchLabels:
> k8s-app: filebeat
> template:
> metadata:
> labels:
> k8s-app: filebeat
> spec:
> serviceAccountName: filebeat
> terminationGracePeriodSeconds: 30
> hostNetwork: true
> dnsPolicy: ClusterFirstWithHostNet
> containers:
> - name: filebeat
> image: [docker.elastic.co/beats/filebeat:7.6.2](http://docker.elastic.co/beats/filebeat:7.6.2)
> args: [
> "-c", "/etc/filebeat.yml",
> "-e",
> ]
> env:
> - name: ELASTICSEARCH\_HOST
> value: name\_of\_the\_host
> - name: ELASTICSEARCH\_PORT
> value: "9200"
> - name: ELASTICSEARCH\_USERNAME
> value: elastic
> - name: ELASTICSEARCH\_PASSWORD
> value: \*\*\*\*\*\*\*\*
> - name: ELASTIC\_CLOUD\_ID
> value:
> - name: ELASTIC\_CLOUD\_AUTH
> value:
> - name: NODE\_NAME
> valueFrom:
> fieldRef:
> fieldPath: spec.nodeName
> securityContext:
> runAsUser: 0
> # If using Red Hat OpenShift uncomment this:
> privileged: true
> resources:
> limits:
> memory: 200Mi
> requests:
> cpu: 100m
> memory: 100Mi
> volumeMounts:
> - name: config
> mountPath: /etc/filebeat.yml
> readOnly: true
> subPath: filebeat.yml
> - name: certs
> mountPath: /etc/certificate/elasticsearch-ca.pem
> readOnly: true
> subPath: elasticsearch-ca.pem
> - name: data
> mountPath: /usr/share/filebeat/data
> - name: varlibdockercontainers
> mountPath: /var/lib/docker/containers
> readOnly: true
> - name: varlog
> mountPath: /var/log
> readOnly: true
> volumes:
> - name: config
> configMap:
> defaultMode: 0640
> name: filebeat-config
> - name: certs
> secret:
> secretName: elasticsearch-ca
> - name: varlibdockercontainers
> hostPath:
> path: /var/lib/docker/containers
> - name: varlog
> hostPath:
> path: /var/log
> # data folder stores a registry of read status for all files, so we don't send everything again on a Filebeat pod restart
> - name: data
> hostPath:
> # When filebeat runs as non-root user, this directory needs to be writable by group (g+w).
> path: /var/lib/filebeat-data
> type: DirectoryOrCreate
> apiVersion: [rbac.authorization.k8s.io/v1](http://rbac.authorization.k8s.io/v1)
> kind: ClusterRoleBinding
> metadata:
> name: filebeat
> subjects:
>
> - kind: ServiceAccount
> name: filebeat
> namespace: kube-system
> roleRef:
> kind: ClusterRole
> name: filebeat
> apiGroup: [rbac.authorization.k8s.io](http://rbac.authorization.k8s.io)
> apiVersion: [rbac.authorization.k8s.io/v1](http://rbac.authorization.k8s.io/v1)
> kind: ClusterRole
> metadata:
> name: filebeat
> labels:
> k8s-app: filebeat
> rules:
>
> - apiGroups: [""] # "" indicates the core API group
> resources:
> - namespaces
> - pods
> verbs:
> - get
> - watch
> - list
> apiVersion: v1
> kind: ServiceAccount
> metadata:
> name: filebeat
> namespace: kube-system
> labels:
> k8s-app: filebeat
Does anyone have any idea what I am doing wrong?
BR,
Mladen
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 28, 2020, 4:43pm UTC](https://discuss.elastic.co/t/problem-loading-root-cert-filebeat-on-openshift/243364/2 "2020-08-28T16:43:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.