<p>I have a NodeJs application running inside a Kubernetes cluster (I am using <a href="https://microk8s.io/" rel="noreferrer">microk8s</a>). I've also followed the <a href="https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-quickstart.html" rel="noreferrer">official steps</a> to setup Elasticsearch on Kubernetes.</p>
<h1>Issue</h1>
<p>But I am unable to connect to the Elasticsearch cluster. I get this error:</p>
<pre><code>ConnectionError: self signed certificate in certificate chain
</code></pre>
<p>This is a <a href="https://github.com/flolu/elasticsearch-k8s-connection/blob/e5c321d7727dc026ec1af14a7dcea44a1874d14b/search/index.ts#L4" rel="noreferrer">code snippet</a> of my connection:</p>
<pre class="lang-js prettyprint-override"><code>const client = new elasticsearch.Client({
  node: process.env.elasticsearch_node,
  // https://elasticsearch-es-http.default.svc.cluster.local:9200
});
</code></pre>
<h1>Minimal reproduction</h1>
<p>I've created a minimal reproduction of this issue here: <a href="https://github.com/flolu/elasticsearch-k8s-connection" rel="noreferrer">https://github.com/flolu/elasticsearch-k8s-connection</a>. (Setup instructions are in the README)</p>
<p>Basically, everything works fine when running Elasticsearch inside Docker compose, but I can't connect when running inside Kubernetes.</p>
<p>The reason for this is probably because I didn't setup TLS certificates correctly, but I haven't found any information about it. <em>Do I configure it inside my NodeJs application when creating the ES client or at a cluster level?</em></p>

Florian Ludewig
<p>The solution is to configure SSL and the Elastic user when creating the <code>Client</code></p>
<pre><code>const client = new elasticsearch.Client({
  node: process.env.elasticsearch_node,
  auth: {
    username: &quot;elastic&quot;,
    password: process.env.elasticsearch_password || &quot;changeme&quot;,
  },
  ssl: {
    ca: process.env.elasticsearch_certificate,
    rejectUnauthorized: false,
  },
});
</code></pre>
<p>The password and the certificate are provided by Elastic. They are stored inside Kubernetes secrets.
So I've just passed the password and the certificate into my NodeJs service via environment variables like this:</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: search-deployment
spec:
  selector:
    matchLabels:
      app: search
  replicas: 1
  template:
    metadata:
      labels:
        app: search
    spec:
      containers:
        - name: search
          image: search:placeholder_name
          imagePullPolicy: Always
          env:
            - name: elasticsearch_node
              value: https://elasticsearch-es-http.default.svc.cluster.local:9200
            - name: elasticsearch_certificate
              valueFrom:
                secretKeyRef:
                  name: elasticsearch-es-http-ca-internal
                  key: tls.crt
            - name: elasticsearch_password
              valueFrom:
                secretKeyRef:
                  name: elasticsearch-es-elastic-user
                  key: elastic
</code></pre>
