{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/cloud-on-k8s/issues/1614","repository_url":"https://api.github.com/repos/elastic/cloud-on-k8s","labels_url":"https://api.github.com/repos/elastic/cloud-on-k8s/issues/1614/labels{/name}","comments_url":"https://api.github.com/repos/elastic/cloud-on-k8s/issues/1614/comments","events_url":"https://api.github.com/repos/elastic/cloud-on-k8s/issues/1614/events","html_url":"https://github.com/elastic/cloud-on-k8s/issues/1614","id":484006422,"node_id":"MDU6SXNzdWU0ODQwMDY0MjI=","number":1614,"title":"Improve handling public CA for ES certificate in Kibana","user":{"login":"david-kow","id":50632861,"node_id":"MDQ6VXNlcjUwNjMyODYx","avatar_url":"https://avatars1.githubusercontent.com/u/50632861?v=4","gravatar_id":"","url":"https://api.github.com/users/david-kow","html_url":"https://github.com/david-kow","followers_url":"https://api.github.com/users/david-kow/followers","following_url":"https://api.github.com/users/david-kow/following{/other_user}","gists_url":"https://api.github.com/users/david-kow/gists{/gist_id}","starred_url":"https://api.github.com/users/david-kow/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/david-kow/subscriptions","organizations_url":"https://api.github.com/users/david-kow/orgs","repos_url":"https://api.github.com/users/david-kow/repos","events_url":"https://api.github.com/users/david-kow/events{/privacy}","received_events_url":"https://api.github.com/users/david-kow/received_events","type":"User","site_admin":false},"labels":[{"id":1109838375,"node_id":"MDU6TGFiZWwxMTA5ODM4Mzc1","url":"https://api.github.com/repos/elastic/cloud-on-k8s/labels/%3Ebug","name":">bug","color":"d73a4a","default":false},{"id":1116677339,"node_id":"MDU6TGFiZWwxMTE2Njc3MzM5","url":"https://api.github.com/repos/elastic/cloud-on-k8s/labels/discuss","name":"discuss","color":"b22520","default":false}],"state":"open","locked":false,"assignee":{"login":"charith-elastic","id":52399125,"node_id":"MDQ6VXNlcjUyMzk5MTI1","avatar_url":"https://avatars1.githubusercontent.com/u/52399125?v=4","gravatar_id":"","url":"https://api.github.com/users/charith-elastic","html_url":"https://github.com/charith-elastic","followers_url":"https://api.github.com/users/charith-elastic/followers","following_url":"https://api.github.com/users/charith-elastic/following{/other_user}","gists_url":"https://api.github.com/users/charith-elastic/gists{/gist_id}","starred_url":"https://api.github.com/users/charith-elastic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/charith-elastic/subscriptions","organizations_url":"https://api.github.com/users/charith-elastic/orgs","repos_url":"https://api.github.com/users/charith-elastic/repos","events_url":"https://api.github.com/users/charith-elastic/events{/privacy}","received_events_url":"https://api.github.com/users/charith-elastic/received_events","type":"User","site_admin":false},"assignees":[{"login":"charith-elastic","id":52399125,"node_id":"MDQ6VXNlcjUyMzk5MTI1","avatar_url":"https://avatars1.githubusercontent.com/u/52399125?v=4","gravatar_id":"","url":"https://api.github.com/users/charith-elastic","html_url":"https://github.com/charith-elastic","followers_url":"https://api.github.com/users/charith-elastic/followers","following_url":"https://api.github.com/users/charith-elastic/following{/other_user}","gists_url":"https://api.github.com/users/charith-elastic/gists{/gist_id}","starred_url":"https://api.github.com/users/charith-elastic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/charith-elastic/subscriptions","organizations_url":"https://api.github.com/users/charith-elastic/orgs","repos_url":"https://api.github.com/users/charith-elastic/repos","events_url":"https://api.github.com/users/charith-elastic/events{/privacy}","received_events_url":"https://api.github.com/users/charith-elastic/received_events","type":"User","site_admin":false}],"milestone":null,"comments":4,"created_at":"2019-08-22T13:48:48Z","updated_at":"2019-09-16T13:26:15Z","closed_at":null,"author_association":"COLLABORATOR","body":"There are three cases to consider when it comes to ES TLS CA:\r\n1. internal (operators own) CA,\r\n1. external, non-public CA,\r\n1. external, public CA.\r\n\r\nRight now we don't handle 3. well (#1583) - since we always overwrite Kibanas CA it loses all public CAs. Right now we would require to provide ca.crt in ES TLS secret with public CA chain, which is not a good user experience.\r\n\r\nWe should stop overriding CAs when there is no ca.crt specified. This will handle case 3.\r\nCase 2. will work as is, because users are expected to provide ca.crt for their internal CA (#1494).\r\nTo not regress in case 1. we would need to add ca.crt with operators CA to ES TLS cert secret."},"comment":{"url":"https://api.github.com/repos/elastic/cloud-on-k8s/issues/comments/531775533","html_url":"https://github.com/elastic/cloud-on-k8s/issues/1614#issuecomment-531775533","issue_url":"https://api.github.com/repos/elastic/cloud-on-k8s/issues/1614","id":531775533,"node_id":"MDEyOklzc3VlQ29tbWVudDUzMTc3NTUzMw==","user":{"login":"charith-elastic","id":52399125,"node_id":"MDQ6VXNlcjUyMzk5MTI1","avatar_url":"https://avatars1.githubusercontent.com/u/52399125?v=4","gravatar_id":"","url":"https://api.github.com/users/charith-elastic","html_url":"https://github.com/charith-elastic","followers_url":"https://api.github.com/users/charith-elastic/followers","following_url":"https://api.github.com/users/charith-elastic/following{/other_user}","gists_url":"https://api.github.com/users/charith-elastic/gists{/gist_id}","starred_url":"https://api.github.com/users/charith-elastic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/charith-elastic/subscriptions","organizations_url":"https://api.github.com/users/charith-elastic/orgs","repos_url":"https://api.github.com/users/charith-elastic/repos","events_url":"https://api.github.com/users/charith-elastic/events{/privacy}","received_events_url":"https://api.github.com/users/charith-elastic/received_events","type":"User","site_admin":false},"created_at":"2019-09-16T13:26:15Z","updated_at":"2019-09-16T13:26:15Z","author_association":"COLLABORATOR","body":"Cert-manager does the correct thing by populating `ca.crt` with the appropriate trust chain.\r\n\r\nQuick-and-dirty self-signed certificates (using methods similar to the one we have [documented](https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-custom-http-certificate.html)), will not contain the appropriate `ca.crt` key but all that the users need to do is to duplicate the value of `tls.crt` key into the `ca.crt` key as well. I don't think it's possible to detect this case reliably and perform that step automatically because the layout of the secret would be identical to the case when users provide us with a certificate issued by a well-known CA (`ca.crt` should be left blank in that case)\r\n"}}
{"actor":{"display_login":"charith-elastic"}}