I'm trying to get datahub v0.8.10 talking to Elast...
# troubleshootb
blue-megabyte-68048
08/20/2021, 1:58 PMI'm trying to get datahub v0.8.10 talking to Elastic via SSL, but it doesn't want to pick up the certs I've configured. I've got
ELASTICSEARCH_USE_SSL=trueELASTICSEARCH_SSL_*blue-megabyte-68048
08/20/2021, 2:04 PMGMS starts up fine, but when I attempt a search, the certs don't get sent in the request to elastic.
blue-megabyte-68048
08/20/2021, 2:07 PMPossibly of note: I am also setting a username and password.
m
mammoth-bear-12532
08/20/2021, 2:12 PM
@wonderful-quill-11255 might be able to help here
👍 1
e
early-lamp-41924
08/20/2021, 4:12 PM@blue-megabyte-68048 are you using kubernetes or docker? Also, is it not picking up in the gms pod?
b
big-carpet-38439
08/20/2021, 4:30 PMHm. And also - you are not deploying the MAE consumer pod separately, right?
b
blue-megabyte-68048
08/20/2021, 4:30 PMI'm on k8s and I can verify that the files are all on the pod, readable by gms and I just double-checked that all the paths are correct. I don't see any error logs on startup and I only get them in the stacktrace returned from a failed call. The stacktrace is just the response from the elastic's nginx saying that the required certs are missing. I can use these same certs in a curl call, so I know that they are valid.
blue-megabyte-68048
08/20/2021, 4:30 PMI was going to deploy mae separately, is that a bad idea?
b
big-carpet-38439
08/20/2021, 4:32 PMIt's not necessarily a bad idea, just more places to configure for speaking with elastic
👍 1
big-carpet-38439
08/20/2021, 4:32 PMI'd recommend minimizing the surface area by deploying them all together
👍 1
b
blue-megabyte-68048
08/20/2021, 5:04 PMIf I disable all the SSL env vars, I still get the same result
e
early-lamp-41924
08/20/2021, 6:02 PMearly-lamp-41924
08/20/2021, 6:02 PMThey look correct to me
early-lamp-41924
08/20/2021, 6:02 PMhmnn
b
blue-megabyte-68048
08/20/2021, 6:03 PMYep, that's exactly what I've been looking at
blue-megabyte-68048
08/20/2021, 6:06 PMIf I enable the mae consumer, I get an error from 'metadataAuditEventsProcessor' that it received a cert error from the nginx (elastic) server
blue-megabyte-68048
08/20/2021, 6:14 PMIf I give it the wrong path, I get a different error, so it is reading it.
e
early-lamp-41924
08/20/2021, 6:21 PMthey both use the same factory, so it should lead to the same error
early-lamp-41924
08/20/2021, 6:21 PMhmn
b
blue-megabyte-68048
08/20/2021, 6:23 PMYeah, I think the root es error I get from the gms api is the same as from the mae consumer
blue-megabyte-68048
08/20/2021, 6:24 PMI'm going to try rebuilding the keystore
blue-megabyte-68048
08/20/2021, 6:42 PMsame result
blue-megabyte-68048
08/23/2021, 12:37 PMI'm still having issues with this, if anyone has any advice
blue-megabyte-68048
08/23/2021, 1:37 PMAlright, I think that Factory linked above doesn't load keys from the keystore
m
mammoth-bear-12532
08/23/2021, 2:59 PM
thanks @blue-megabyte-68048!
👍 2
mammoth-bear-12532
08/23/2021, 2:59 PM
great catch. /cc @early-lamp-41924
b
blue-megabyte-68048
08/23/2021, 3:01 PMoops, converted it to a draft while I check something out
blue-megabyte-68048
08/23/2021, 3:40 PMAlright, good to go
b
big-carpet-38439
08/23/2021, 7:31 PMu are awesome greyson. thank you for debugging this!
➕ 1
b
blue-megabyte-68048
08/23/2021, 8:03 PMNo problem!