Enable ssl between logstash and agent #1669
Conversation
|
There are two approaches to add the client certificates when fleet output is added through config
|
bhapas
force-pushed
the
enable_ssl
branch
2 times, most recently
from
6ed276d
to
3cd61cd
Compare
A workaround to fix the indentation in the yaml config - https://github.com/elastic/elastic-package/pull/1669/files#diff-9fd733fc9d8f10a5c2dd55a062523d3dcb0655bc1db097648b3adabbd3460173R206 |
|
/test |
| # logstash expects the key in pkcs8 format. Hence converting the key.pem to pkcs8 format using openssl. | ||
| # Also logstash-filter-elastic_integration plugin is installed by default to run ingest pipelines in logstash. | ||
| # elastic-package#1637 made improvements to enable logstash stats through port 9600. | ||
| command: bash -c 'openssl pkcs8 -inform PEM -in /usr/share/logstash/config/certs/key.pem -topk8 -nocrypt -outform PEM -out /tmp/logstash.pkcs8.key && chmod +x /tmp/logstash.pkcs8.key && if [[ ! $(bin/logstash-plugin list) == *"logstash-filter-elastic_integration"* ]]; then echo "Missing plugin logstash-filter-elastic_integration, installing now" && bin/logstash-plugin install logstash-filter-elastic_integration; fi && bin/logstash -f /usr/share/logstash/pipeline/logstash.conf' |
There was a problem hiding this comment.
This shall be extracted to a script in #1668
| @@ -171,6 +184,45 @@ func applyResources(profile *profile.Profile, stackVersion string) error { | |||
| return nil | |||
| } | |||
|
|
|||
| func addClientCertsToResources(resourceManager *resource.Manager, certResources []resource.Resource) error { | |||
There was a problem hiding this comment.
Could we use an approach like this one for serverless? So we provide the certificates when creating the output and we don't need to update it later?
There was a problem hiding this comment.
But for serverless the certificates are created at a later stage than adding the agent policy. And to add agent policy the output needs to be created
There was a problem hiding this comment.
I think we could move applyServerlessResources to an early stage if needed. It is only now in startLocalServices because so far it was only needed for local services. But we could run this earlier if needed to create the project.
There was a problem hiding this comment.
Will try this in another PR
💚 Build Succeeded
History
|
Currently ssl is disabled between logstash and agent when running on local stack. This PR enables ssl communication between logstash and agent.
Closes #1658