Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add in ES options for InsecureSkipVerify the host/cert check #1478

Closed
jordo1138 opened this issue Apr 18, 2019 · 1 comment
Closed

add in ES options for InsecureSkipVerify the host/cert check #1478

jordo1138 opened this issue Apr 18, 2019 · 1 comment

Comments

@jordo1138
Copy link

Requirement - what kind of business use case are you trying to solve?

Allow applications configure a remote k8s cluster running with jaeger operator using ES for the storage mode on a remote ES cluster where the cert may not match the host name

Problem - what in Jaeger blocks you from solving the requirement?

The current ES options config struct does not include InsecureSkipVerify bool for tls host verification, some users and env may not have certs matching host names etc so the client from jaeger collector cannot connect to the remote ES cluster when having declared your serverurls like in the jaeger operator
example error if you doing some test to a ES ip like https://10.10.10.1:9200
x509: cannot validate certificate for https://10.10.10.1:9200 because it doesn't contain any IP SANs:

Proposal - what do you suggest to solve the problem or improve the existing situation?

Add in the es config option to include insecureskipverify for host name checking... the cassandra storage option has this already in the options and most popular client implementations like fluentd have this as a es client option also
Seems to me it will need modifications for InsecureSkipVerify bool in these files
https://github.com/jaegertracing/jaeger/blob/master/pkg/es/config/config.go
https://github.com/jaegertracing/jaeger/blob/master/plugin/storage/es/options.go
and then of course your tests.

Any open questions to address

I started this working on committing changes to those files in my fork but wanted to open the issue in the mean time in case the maintaining team had any issue with adding in support for this. If an existing contributor can close this out more efficiently great, otherwise i'll keep working on it as a test...I came across this by trying to deploy jaeger operator on EKS today and found it's all good except I don't have a way to skip the host/cert verification needed to run properly with a tls storage back end of ES that doesn't match the host name on the cert.

@yurishkuro
Copy link
Member

Being done in #1473

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants