{"action":"created","issue":{"url":"https://api.github.com/repos/lmenezes/cerebro/issues/293","repository_url":"https://api.github.com/repos/lmenezes/cerebro","labels_url":"https://api.github.com/repos/lmenezes/cerebro/issues/293/labels{/name}","comments_url":"https://api.github.com/repos/lmenezes/cerebro/issues/293/comments","events_url":"https://api.github.com/repos/lmenezes/cerebro/issues/293/events","html_url":"https://github.com/lmenezes/cerebro/issues/293","id":322118336,"node_id":"MDU6SXNzdWUzMjIxMTgzMzY=","number":293,"title":"Chef Cookbook with TLS/SSL for Elasticsearch 6.2, Kibana, and Cerebro Available","user":{"login":"cmcconnell1","id":14812439,"node_id":"MDQ6VXNlcjE0ODEyNDM5","avatar_url":"https://avatars3.githubusercontent.com/u/14812439?v=4","gravatar_id":"","url":"https://api.github.com/users/cmcconnell1","html_url":"https://github.com/cmcconnell1","followers_url":"https://api.github.com/users/cmcconnell1/followers","following_url":"https://api.github.com/users/cmcconnell1/following{/other_user}","gists_url":"https://api.github.com/users/cmcconnell1/gists{/gist_id}","starred_url":"https://api.github.com/users/cmcconnell1/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cmcconnell1/subscriptions","organizations_url":"https://api.github.com/users/cmcconnell1/orgs","repos_url":"https://api.github.com/users/cmcconnell1/repos","events_url":"https://api.github.com/users/cmcconnell1/events{/privacy}","received_events_url":"https://api.github.com/users/cmcconnell1/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-05-10T23:17:53Z","updated_at":"2018-10-12T22:21:49Z","closed_at":null,"author_association":"NONE","body":"Hello,\r\n\r\nThanks for your work on cerebro, we are now using it and wanted to give back.\r\nI was recently working on getting Elasticsearch 6.2, Kibana, and Cerebro automated/deployed with TLS/SSL certs, keys, keystore, etc. for our internal infrastructure.  It's not perfect by any means, but works for us and I'm wondering if it might be helpful for others?:\r\n\r\n[6.x Elasticsearch Chef Cookbook with TLS/SSL, Kibana, and Cerbro for management, etc.](https://github.com/cmcconnell1/cmcc_elasticsearch)\r\n\r\nRegarding the cerebro project, I didn't see a 'contrib' dir, and not sure you'd want one?  \r\nAdditionally, the cookbook that I wrote is large with a lot of stuff you probably don't need (elasticsearch clusters and kibana coordinating nodes, etc.), but might be useful in getting 'something' out there for _automating cerebro_ install/config for the latest Elasticsearch 6.x with x-pack and the new TLS requirements, etc.   It's a bit tricky to get it right.\r\n\r\nQuick Summary:\r\nFor cerebro, I based the automation on what I could find--this one was a gem: \r\n[Access To Elasticsearch With Cerebro Via SSL+LDAP](https://e-mc2.net/access-elasticsearch-cerebro-sslldap)\r\n\r\nOverview of the Kibana and Cerebro components of that cookbook\r\n\r\nKibana (HTTPS/SSL) \"Coordinating Node\"\r\n- Recipe: td_elasticsearch::kibana\r\n- Installed and configured in systemd.\r\n- Post chef-client available at https URL--i.e.: https://kibana1.foo.com:5601\r\n- Redirects to kibana login/service; the kibana service terminates the TLS/SSL at the kibana app.\r\n\r\nCerbro (HTTPS/SSL) on the Kibana node\r\n- Recipe: td_elasticsearch::cerebro\r\n- Installed and configured in systemd.\r\n- Terminates TLS/SSL at the web service on port 443 and redirects to the cerebro play/java app running locally on port 9000\r\n- Post chef-client available at https URL--i.e.: https://kibana1.foo.com\r\n- Cerebro Redirect to Login page and use the following:\r\n- Node Address: 'kibana.foo.com:9200' (9200 is the elasticsearch port)\r\n- Username: use your elasticsearch credentials/account–i.e. 'kibana,' 'cmcc', etc.\r\n- Password: requisite password for the above elasticsearch login\r\n\r\nAnyway, I am hoping that perhaps some of this work could be useful to other users of the cerebro project, and I could do a p/r with a ./contrib/chef dir and maybe some doc about automating it if desired.  I haven't tried to decouple the cerebro recipe from the cookbook as it uses the code and files from them. \r\n\r\nThanks,\r\n-cmcc"},"comment":{"url":"https://api.github.com/repos/lmenezes/cerebro/issues/comments/429478798","html_url":"https://github.com/lmenezes/cerebro/issues/293#issuecomment-429478798","issue_url":"https://api.github.com/repos/lmenezes/cerebro/issues/293","id":429478798,"node_id":"MDEyOklzc3VlQ29tbWVudDQyOTQ3ODc5OA==","user":{"login":"cmcconnell1","id":14812439,"node_id":"MDQ6VXNlcjE0ODEyNDM5","avatar_url":"https://avatars3.githubusercontent.com/u/14812439?v=4","gravatar_id":"","url":"https://api.github.com/users/cmcconnell1","html_url":"https://github.com/cmcconnell1","followers_url":"https://api.github.com/users/cmcconnell1/followers","following_url":"https://api.github.com/users/cmcconnell1/following{/other_user}","gists_url":"https://api.github.com/users/cmcconnell1/gists{/gist_id}","starred_url":"https://api.github.com/users/cmcconnell1/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cmcconnell1/subscriptions","organizations_url":"https://api.github.com/users/cmcconnell1/orgs","repos_url":"https://api.github.com/users/cmcconnell1/repos","events_url":"https://api.github.com/users/cmcconnell1/events{/privacy}","received_events_url":"https://api.github.com/users/cmcconnell1/received_events","type":"User","site_admin":false},"created_at":"2018-10-12T22:21:49Z","updated_at":"2018-10-12T22:21:49Z","author_association":"NONE","body":"Hey @abessifi (regarding my above comment five months ago)\r\nSince ES 6.x introduced required TLS encryption with keys etc., it was a pretty big change from the previous major versions that we were running which didn't use TLS and didn't have to have CA's to run ES queries, etc.   And you can't license a 6.x cluster unless you have the certs installed/configured etc.  AIR at that time, the ES docs were lacking many requisite details, etc.  And regarding cerebro, at that time, I didn't find any updated automated install CM (chef, etc.) cookbooks/playbooks available online that showed how to handle the requisite certs, etc. TLS is also a requirement for 6.x and onward for kibana, etc.  \r\nSo, at that time of my above comment (five months ago) I don't think anyone had any working examples showing the certs requirements for a lot of these ES-stack related components.  I chose to stick our certs in locked-down S3 buckets (which for us are created for each ES cluster before deploying and are available to chef nodes via IAM policy and roles).  Chef and databags is not a good idea and encrypted data bags are even worse.  Regarding ES stack and certs, I wasted a lot of time trying to hack our automation for 6.x ES stack to use (CSR) certs that were signed by Digi, only to find out that those would never work with ES--if I recall correctly we couldn't use our wildcard certs since they were missing the hostname, etc.  That was also not in the docs.  Also, at that time you could only use PEM formatted certs (i.e. PKCS12 wouldn't work && found out the hard way there too).  Of course, this may have changed.  YMMV.  ;-)"}}
{"actor":{"display_login":"cmcconnell1"}}