Using Client Certificate for Elastic Search Authentication

[reynaldiwijaya]

Is there any plan to accommodate using client certificate for authenticating jaeger to ES? Our elastic search deployment is using search guard which only enable client certificate now, and we would like to keep it that way. ES is deployed in Kubernetes v1.9, and we would like to deploy Jaeger there as well.

If there are none, do you have any suggestion of workaround for this problem?

[yurishkuro]

if the Go driver supports it, we can add the options similar to how they were added for Cassandra:

      --cassandra.tls                                        Enable TLS
      --cassandra.tls.ca string                              Path to TLS CA file
      --cassandra.tls.cert string                            Path to TLS certificate file
      --cassandra.tls.key string                             Path to TLS key file
      --cassandra.tls.server-name string                     Override the TLS server name
      --cassandra.tls.verify-host                            Enable (or disable) host key verification (default true)

[reynaldiwijaya]

oh yeah thanks for update. Should we let this issue opened (in case the client updates it)? Please feel free to close it as well

[sneko]

Hi @reynaldiwijaya! How did you manage that in a proper way please 😃 ?

[sneko]

@yurishkuro I just saw that you are using the olivere/elastic client in Go.

I just checked their docs and found it's possible:
olivere/elastic#636
olivere/elastic#738

It would be really helpful using ES cluster through https 😀

Do you think it could be on the roadmap? I'm not used to Golang but if I could help by testing... it would be a pleasure 😃

[sneko]

Hi @yurishkuro any news about having this on your roadmap?

Thanks :)

[isaachier]

Honestly, seeing as we don't use ES internally, don't get too excited about seeing this on a roadmap any time soon.

[sneko]

@isaachier oh ok that's too bad 😢

Anyway, thanks for this tool 😀 !

[yurishkuro]

If the driver supports it, the change is fairy trivial, doesn't have to be done by official maintainers.

[reynaldiwijaya]

@sneko hi im using cassandra at the end, works like a charm 👍