How to curl elasticsearch kubernetes operator without passing -k over tls? - elasticsearch

Question

Hello ElasticSearch Champs,
I deployed EK from https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-quickstart.html on Kubernetes.
I Am unable to curl ElasticSearch without -k option!
curl --cacert ca-bundle.crt -u "elastic:9sg8q9h4tncvdl2srqiptn9z" "https://10.4.1.14:9200"
curl: (60) Peer's certificate issuer has been marked as not trusted by the user.
More details here: http://curl.haxx.se/docs/sslcerts.html
curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.
[root#quickstart-es-default-0 certs]#

Answer 1

If you are unable to connect elasatic search using curl without -k option.
i.e. curl --cacert public-http.crt -u "elastic:9sg8q9h4tncvdl2srq9ptn9z" "https://35.193.165.24:9200"
Note: in above public-http.crt is the ca.crt(CA) in <clustername>--es-http-certs-public like quickstart-es-http-certs-public secret(kubectl get secrets -all-namespaces)
This can be resolved by passing the kubernetes cluster-IP/loadbalancer/server-hostname(DNS) from which you are running curl command in the kind:Elasticsearch manifest under subjectAltNames as shown below:
cat <<EOF | kubectl apply -f
apiVersion: elasticsearch.k8s.elastic.co/v1
kind: Elasticsearch
metadata:
name: quickstart
spec:
version: 7.6.2
nodeSets:
- name: default
count: 1
config:
node.master: true
node.data: true
node.ingest: true
node.store.allow_mmap: false
http:
tls:
selfSignedCertificate:
subjectAltNames:
- ip: 10.4.0.16
- dns: logstash
- ip: 10.4.0.14
- ip: 10.8.0.117
- ip: 35.193.165.24
- dns: localhost
EOF
==========================================================================
root#logstash:/certificates/espod# curl --cacert public-http.crt -u "elastic:9sg8q9h4tncvdl2srq9ptn9z" "https://35.193.165.24:9200"
{
"name" : "quickstart-es-default-0",
"cluster_name" : "quickstart",
"cluster_uuid" : "H-ftq8B7Q6e4Swuq6mfDew",
"version" : {
"number" : "7.6.2",
"build_flavor" : "default",
"build_type" : "docker",
"build_hash" : "ef48eb35cf30adf4db14086e8aabd07ef6fb113f",
"build_date" : "2020-03-26T06:34:37.794943Z",
"build_snapshot" : false,
"lucene_version" : "8.4.0",
"minimum_wire_compatibility_version" : "6.8.0",
"minimum_index_compatibility_version" : "6.0.0-beta1"
},
"tagline" : "You Know, for Search"
}
More references:
https://www.elastic.co/guide/en/logstash/7.7/ls-security.html#ls-http-ssl
https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-tls-certificates.html