fluent-operator icon indicating copy to clipboard operation
fluent-operator copied to clipboard

help request: opensearch cant find tlsverify: false

Open allanian opened this issue 2 years ago • 1 comments

Describe the issue

Hello, i'm trying to connect fluentbit=>fluentd on my k8s to opensearch with ssl, but getting this error, how i can fix it?

"SSL_connect returned=1 errno=0 peeraddr=10.3.1.55:9200 state=error: certificate verify failed (unable to get local issuer certificate) (OpenSSL::SSL::SSLError) Unable to verify certificate. This may be an issue with the remote host or with Excon. Excon has certificates bundled, but these can be customized:\n\n            `Excon.defaults[:ssl_ca_path] = path_to_certs`\n            `ENV['SSL_CERT_DIR'] = path_to_certs`\n            `Excon.defaults[:ssl_ca_file] = path_to_file`\n            `ENV['SSL_CERT_FILE'] = path_to_file`\n            `Excon.defaults[:ssl_verify_callback] = callback`\n                (see OpenSSL::SSL::SSLContext#verify_callback)\nor:\n            `Excon.defaults[:ssl_verify_peer] = false` (less secure).\n"

its a my ClusterOutput

apiVersion: fluentd.fluent.io/v1alpha1
kind: ClusterOutput
metadata:
  name: fluentd-output-os
  labels:
    output.fluentd.fluent.io/enabled: "true"
spec:
  outputs:
    - opensearch:
        host: os-dbn.rendez-vous.ru
        logstashFormat: true
        logstashPrefix: k8s-dbnp-logs
        port: 9200
        scheme: https
        transport:
          insecure: true
          verify: false
        password:
          valueFrom:
            secretKeyRef:
              key: password
              name: os-secret
        port: 9200
        user:
          valueFrom:
            secretKeyRef:
              key: username
              name: os-secret

How did you install fluent operator?

with helm and disabled fluentd

Additional context

No response

allanian avatar Feb 13 '23 17:02 allanian

You can refer to this https://github.com/fluent/fluent-plugin-opensearch/blob/main/README.Troubleshooting.md#cannot-connect-tls-enabled-reverse-proxy

wenchajun avatar Apr 03 '23 10:04 wenchajun