Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

HTTP: configuration option for a Custom CA #359

Open
pvogler opened this issue Sep 27, 2024 · 18 comments
Open

HTTP: configuration option for a Custom CA #359

pvogler opened this issue Sep 27, 2024 · 18 comments
Labels
enhancement New feature or request

Comments

@pvogler
Copy link

pvogler commented Sep 27, 2024

Feature Description

With issue report #337 HTTP tls verification for v1 was implemented.
In fact this feature is missing in version 2 and the master branch.

Easy way would be to upstream the verification skipping, but I would prefer to allow an option to configure a custom ca or disable verification manually.

Version of logstash-exporter this feature request applies to

v2

Motivation and Goals

Motivation is, to get the exporter working out of the box also with the ECK operator deployment.

Alternatives Considered

Disabling TLS on Logstash side would work as well, but from security perspective this is not a good way.

Additional Context

No response

@pvogler pvogler added the enhancement New feature or request label Sep 27, 2024
@satk0
Copy link
Collaborator

satk0 commented Sep 30, 2024

Good catch, I could rewrite it for v2

@pvogler
Copy link
Author

pvogler commented Oct 2, 2024

If you provide a nightly image, I would be happy to test it for you.

@satk0
Copy link
Collaborator

satk0 commented Oct 2, 2024

Thanks in advance, it would sure be a huge help! Right now, I am still waiting for @kuskoman to finally merge my hot-reload PR 😮‍💨

I honestly can't wait to start working on it, I have the right mood and motivation to do it 😄

satk0 added a commit to satk0/logstash-exporter that referenced this issue Oct 30, 2024
satk0 added a commit to satk0/logstash-exporter that referenced this issue Oct 30, 2024
@satk0
Copy link
Collaborator

satk0 commented Oct 30, 2024

Done in #382

@pvogler
Copy link
Author

pvogler commented Nov 2, 2024 via email

@satk0
Copy link
Collaborator

satk0 commented Nov 2, 2024

Chill, relax on your holidays ;)

We first have to provide a nightly image for that and merge the PR.
@kuskoman do you have time for that?

kuskoman pushed a commit that referenced this issue Nov 4, 2024
@satk0
Copy link
Collaborator

satk0 commented Nov 21, 2024

@pvogler Did you managed to check it? If it works, I could just close this issue heh 😅

@pvogler
Copy link
Author

pvogler commented Nov 22, 2024

@satk0 Looks like the direct port from version. As a workaround the possibility to disable the TLS verification is a good starting point and does work as expected. But to transform this exporter in a really secure one, it should be possible to specify a custom ca file provide to the exporter.
e.g. as config parameter
Logstash:
customer: "path to custom ca file"

If you think this would be a good option as well, we could also close this issue and open a new one, concentrating on the custom ca.

And sorry for the late reply. Got some different business to finish first.

@satk0
Copy link
Collaborator

satk0 commented Nov 29, 2024

Yeah, it is indeed a workaround. I see what you mean, for me it looks like a proper improvement. @kuskoman wdyt?

@pvogler
Copy link
Author

pvogler commented Nov 29, 2024 via email

@satk0
Copy link
Collaborator

satk0 commented Dec 19, 2024

@pvogler me and kuskoman agreed on this idea, and I'd be working on it. Could you just let me know, is it about setting specifically root certificate authority (RootCA)?
I am not an expert in this field and your response would be really helpful, idk where to start with it hah

@kuskoman
Copy link
Owner

i feel like this got duplicated by #393
@satk0 please take a look on the other issue, some user already implemented it, but did not create a PR

@satk0
Copy link
Collaborator

satk0 commented Dec 19, 2024

@kuskoman You mean this? chanyongkit@3f7679a

This implements HTTP TLS but I think there is the need to specify custom root ca to tls.config for each logstash instance instead of merely using HttpInsecure var, wdyt?

@kuskoman
Copy link
Owner

kuskoman commented Dec 19, 2024

yep, but i believe this needs some testing, you can copy the branch to your repo, so that the commit will have its original author

@satk0
Copy link
Collaborator

satk0 commented Dec 19, 2024

I will just rewrite it, I am not that git-savy 😛

@satk0
Copy link
Collaborator

satk0 commented Dec 19, 2024

Do we need this commit for v1, or should I implement it only for v2?

@pvogler
Copy link
Author

pvogler commented Dec 20, 2024

@satk0 @kuskoman
Just for clarification: #393 adds support for encrypting the exporter, so that Prometheus talks https with this exporter.

I want to talk TLS with the Logstash API. So 393 is not a duplicate
And for these calls I want to specify a RootCA-file. One file should be enough. Either all CAs can be put inside this file like the ca-bundle.crt e.g. on Redhat, or we simply start multiple exporters if different CAs are required.

And for me v2 would be sufficient.

Does this help in clarification?

@satk0
Copy link
Collaborator

satk0 commented Dec 21, 2024

Yeah, sure it helps, thanks for being so active ;)

I've already started working here #401 on encrypting the exporter, when I finish writing tests for it, I will start resolving this one so stay tuned 😸

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

3 participants