# Setup security on elasticsearch based on redhat image in openshift

**URL:** <https://discuss.elastic.co/t/setup-security-on-elasticsearch-based-on-redhat-image-in-openshift/356308>\
**Category:** Elastic Cloud on Kubernetes (ECK)\
**Tags:** elastic-stack-security, docker\
**Created:** [March 27, 2024, 3:59pm UTC](https://discuss.elastic.co/t/setup-security-on-elasticsearch-based-on-redhat-image-in-openshift/356308 "2024-03-27T15:59:51Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sohaib\_El\_Mediouni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sohaib_el_mediouni/32/123391_2.png) [@Sohaib\_El\_Mediouni](https://discuss.elastic.co/u/Sohaib_El_Mediouni)\
**Post date:** [March 27, 2024, 3:59pm UTC](https://discuss.elastic.co/t/setup-security-on-elasticsearch-based-on-redhat-image-in-openshift/356308/1 "2024-03-27T15:59:51Z")

</div>

**Closed.** This question is [not about programming or software development](https://stackoverflow.com/help/closed-questions). It is not currently accepting answers.

* * *

This question does not appear to be about [a specific programming problem, a software algorithm, or software tools primarily used by programmers](https://stackoverflow.com/help/on-topic). You can edit the question so it's [on-topic](https://stackoverflow.com/help/on-topic) or see if it can be answered on [another Stack Exchange site](https://stackexchange.com/sites), but be sure to read the on-topic page for a site before posting there.

Closed 44 secs ago.

[Edit question](https://stackoverflow.com/posts/78226029/edit)Delete question

Currently, I am trying to install Elasticsearch and Kibana in OpenShift. So far, I have been successful without any security, but with the latest version, it is now required to set up security. I have begun this process, but I am encountering an error. I have Elasticsearch based on a Red Hat image with 3 nodes in a StatefulSet, and Kibana in a deployment. Each Elasticsearch node has a PVC mounted in /usr/share/elasticsearch/data. I have generated the **elastic-stack-ca.p12 and the elastic-stack-ca.p12** , and I have copied them into **/usr/share/elasticsearch/data** where my volume is mounted.

In the environment variable, I have set it up them like this:

```auto
   env:
            - name: ingest.geoip.downloader.enabled
              value: 'false'
            - name: xpack.security.enabled
              value: 'true'
            - name: elasticsearch-xpack
              value: disabled
            - name: cluster.name
              value: Trafic-Cluster-Uat-Openshift
            - name: discovery.seed_hosts
              value: >-
                elasticsearch-0.elasticsearch-discovery,elasticsearch-1.elasticsearch-discovery
            - name: cluster.initial_master_nodes
              value: 'elasticsearch-0,elasticsearch-1'
            - name: xpack.monitoring.collection.enabled
              value: 'true'
            - name: xpack.security.transport.ssl.enabled
              value: 'false'
            - name: xpack.security.enrollment.enabled
              value: 'true'
            - name: xpack.security.transport.ssl.verification_mode
              value: certificate
            - name: xpack.security.transport.ssl.client_authentication
              value: required
            - name: xpack.security.transport.ssl.keystore.path
              value: /usr/share/elasticsearch/data/elastic-certificates.p12
            - name: xpack.security.transport.ssl.truststore.path
              value: /usr/share/elasticsearch/data/elastic-certificates.p12

```

**now the problem that i'm facing is that i added the password in the keystore but when the pods are reloading all is gone because of the Ephemeral and i m getting a crashloopback and an error saying :**

```auto
"error.message":"failed to load SSL configuration [xpack.security.transport.ssl] - cannot read configured [PKCS12] keystore (as a truststore) [/usr/share/elasticsearch/data/elastic-certificates.p12] - this is usually caused by an incorrect password; (no password was provided)","error.stack_trace":"org.elasticsearch.ElasticsearchSecurityException: failed to load SSL configuration [xpack.security.transport.ssl] - cannot read configured [PKCS12] keystore (as a truststore) [/usr/share/elasticsearch/data/elastic-certificates.p12] - this is usually caused by an incorrect password; (no password was provided)\n\tat org.elasticsearch.xcore@8.4.3/org.elasticsearch.xpack.core.ssl.SSLService.lambda$loadSslConfigurations$11(SSLService.java:605)\n\tat java.base/java.util.HashMap.forEach(HashMap.java:1421)\n\tat java.base/java.util.Collections$UnmodifiableMap.forEach(Collections.java:1553)\n\tat org.elasticsearch.xcore@8.4.3/org.elasticsearch.xpack.core.ssl.SSLService.loadSslConfigurations(SSLService.java:601)\n\tat org.elasticsearch.xcore@8.4.3/org.elasticsearch.xpack.core.ssl.SSLService.<init>(SSLService.java:156)\n\tat org.elasticsearch.xcore@8.4.3/org.elasticsearch.xpack.core.XPackPlugin.createSSLService(XPackPlugin.java:463)\n\tat `

```

I also tried to set the password in the secret of openshift but i got another error saying :

```auto
"Setting [xpack.security.transport.ssl.keystore.secure_password] is a secure setting 

```

What's the solution

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 24, 2024, 4:00pm UTC](https://discuss.elastic.co/t/setup-security-on-elasticsearch-based-on-redhat-image-in-openshift/356308/2 "2024-04-24T16:00:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.