9a719e2a18
This change enables TLS between Elasticsearch and Kibana data path. Note that TLS terminates at apache-proxy container of the Elasticsearch-client pod, not directly to port 9200 of elasticsearch-client container. Since all data traffic goes through apache-proxy container, fluentd output to Elasticsearch are configured to have TLS enabled as well. In additon, other Elasticsearch pods that communicate with Elasticsearch-client endpoint are modified to provide the cacert option with curl. Change-Id: I3373c0c350b30c175be4a34d25a403b9caf74294
42 lines
1.1 KiB
YAML
42 lines
1.1 KiB
YAML
---
|
|
conf:
|
|
fluentd:
|
|
conf:
|
|
output: |
|
|
<label @output>
|
|
<match **>
|
|
<buffer>
|
|
chunk_limit_size 512K
|
|
flush_interval 5s
|
|
flush_thread_count 8
|
|
queue_limit_length 32
|
|
retry_forever false
|
|
retry_max_interval 30
|
|
</buffer>
|
|
host "#{ENV['ELASTICSEARCH_HOST']}"
|
|
reload_connections false
|
|
reconnect_on_error true
|
|
reload_on_failure true
|
|
include_tag_key true
|
|
logstash_format true
|
|
password "#{ENV['ELASTICSEARCH_PASSWORD']}"
|
|
port "#{ENV['ELASTICSEARCH_PORT']}"
|
|
scheme "#{ENV['ELASTICSEARCH_SCHEME']}"
|
|
@type elasticsearch
|
|
user "#{ENV['ELASTICSEARCH_USERNAME']}"
|
|
ssl_verify true
|
|
ssl_version TLSv1_2
|
|
ca_file /etc/elasticsearch/certs/ca.crt
|
|
</match>
|
|
</label>
|
|
endpoints:
|
|
elasticsearch:
|
|
scheme:
|
|
default: "https"
|
|
port:
|
|
http:
|
|
default: 443
|
|
manifests:
|
|
certificates: true
|
|
...
|