search

rode / grafeas-elasticsearch

An implementation of the Grafeas storage backend based on Elasticsearch
Apache License 2.0
12 stars 5 forks source link

Add support for self-signed TLS certs #53

Closed cyberbliss closed 3 years ago

cyberbliss commented 3 years ago

I've just been testing against an Elastic instance, hosted by Kubernetes, that was created using the community elastic-operator. By default the instance only allows TLS access and it generates self-signed certs to support this. The code in the current createESClient function fails when trying to create a new ES client due to an x509 error caused by these self-signed certs, however, it was fairly straight-forward to handle this by changing the code in the function to alter the ES config and set InsecureSkipVerify to true. What are your thoughts about a more permanent fix with a flag to enable/disable support for self-signed certs (default false)?

aalsabag commented 3 years ago

@cyberbliss thanks for bringing this to our attention. I didn't realize the elastic operator was secure by default.

I think a flag like this would be useful. Can you let me know if the linked branch above addresses your issue. I can raise a PR and have the team review it and see what they think.

cyberbliss commented 3 years ago

@aalsabag Just tested the linked branch and it works as expected. Many thanks

aalsabag commented 3 years ago

@cyberbliss I'm closing this issue as this was resolved by #54