Hey wave I m currently setting up DataHub using the `0 3 27` DataHub #all-things-deployment

Hey :wave: I'm currently setting up DataHub using ...

lemon-receptionist-90470

02/26/2024, 4:32 PM

Hey 👋 I'm currently setting up DataHub using the

0.3.27

chart version and using Elasticsearch

8.5.1

chart version to be compatible with EKS

1.28.0

Datahub Setup - authentication • Set up a user and password for Elasticsearch. • In the

datahub

values, I've configured the

elasticsearch

settings to use SSL, skip SSL checks (for now), and provided the auth credentials:

Copy code

global:
  strict_mode: true
  graph_service_impl: elasticsearch
  datahub_analytics_enabled: true
  datahub_standalone_consumers_enabled: false

  elasticsearch:
    useSSL: "true"
    skipcheck: "true"
    insecure: "true" # This should be false in values-production.yaml
    auth:
      username: "elastic"
      password:
        secretRef: elasticsearch-master-credentials
        secretKey: password

Issue • The elasticsearchSetupJob
runs as expected, but the gms
service is encountering errors during startup. • The error logs indicate an issue with SSL certification path and a connection refused error:

Copy code

Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target                                                │
│ See <https://opensearch.org/docs/latest/clients/java-rest-high-level/> for troubleshooting.                                                                                                                                                         │
│     at org.opensearch.client.RestClient.extractAndWrapCause(RestClient.java:947)                                                                                                                                                                  │
│     at org.opensearch.client.RestClient.performRequest(RestClient.java:332)                                                                                                                                                                       │
│     at org.opensearch.client.RestClient.performRequest(RestClient.java:320)                                                                                                                                                                       │
│     at org.opensearch.client.RestHighLevelClient.internalPerformRequest(RestHighLevelClient.java:1918)                                                                                                                                            │
│     at org.opensearch.client.RestHighLevelClient.performRequest(RestHighLevelClient.java:1884)                                                                                                                                                    │
│     at org.opensearch.client.RestHighLevelClient.performRequestAndParseEntity(RestHighLevelClient.java:1852)                                                                                                                                      │
│     at org.opensearch.client.RestHighLevelClient.search(RestHighLevelClient.java:1095)                                                                                                                                                            │
│     at com.linkedin.metadata.search.elasticsearch.query.ESSearchDAO.executeAndExtract(ESSearchDAO.java:186)                                                                                                                                       │
│     ... 16 common frames omitted

Does anyone have insights on resolving this? I also checked other similar threads here, but they did not help. Thanks!

rich-barista-93413

02/29/2024, 7:11 PM

If you have a self-signed or custom certificate that does not use the standard root CAs, it's possible to configure the truststore/keystore used by the high level client using these environment variables: https://github.com/datahub-project/datahub/blob/master/metadata-service/configuration/src/main/resources/application.yml#L176-L185 As a side note, we do not actively support ElasticSearch 8.x, our supported versions are ElasticSearch 7.x, OpenSearch 1.x and 2.x. Your issue may or may not be related to an issue with 8.x support, but we have not done any testing with 8.x.

lemon-receptionist-90470

03/01/2024, 10:26 AM

Thanks! I'll take a look 🙂.

lemon-receptionist-90470

03/06/2024, 3:21 PM

I followed the solution presented by Gerrit-K in https://github.com/datahub-project/datahub/issues/8433#issuecomment-1843072352 and worked.

4 Views

Open in Slack

Previous Next