Elasticsearch Creds

[Raksniru]

HI all , i have deployed elastalert on my kubernetes cluster ...and updated all the configurations into configmap .....configured as below , but i dont want to directly use my admin credentials over there...how to fetch the creds from VAULT

Option basic-auth username and password for Elasticsearch

es_username: ****
es_password: ******

[ferozsalam]

I assume you're asking about Hashicorp Vault.

ElastAlert supports loading credentials via environment variable, which is the route you would probably want to follow, loading the secrets as environment variables at runtime. Some instructions can be found here.

In terms of linking Vault to your k8s cluster so that it can load environment variables in pods, that depends. If you're running ElastAlert within your organisation, your SRE/Cloud team might already have a way of doing so, so you should check with them first.

If you're doing so on your own, you might want to look at setting up the Vault provider for the k8s CSI driver (see here for more documentation) or similar. This requires a reasonable amount of familiarity with Kubernetes, however.

[Raksniru]

#es_send_get_body_as: GET
# Option basic-auth username and password for Elasticsearch
#ES_USERNAME:
#ES_PASSWORD:
# Use SSL authentication with client certificates client_cert must be
this is my configmap ,
this is the error , File "/usr/local/lib/python3.9/site-packages/elasticsearch/connection/base.py", line 131, in _raise_error
raise HTTP_EXCEPTIONS.get(status_code, TransportError)(status_code, error_message, additional_info)
elasticsearch.exceptions.AuthenticationException: AuthenticationException(401, 'Unauthorized')

[jertel]

ES_USER should be ES_USERNAME. If you continue to have 401 errors you will need to use kubectl to further diagnose whether the issue is with bad ES credentials or if the environment variables are not being propagated into the pod.

[Raksniru]

with new image the env variables can be loaded , but the config.yaml file is not mapped at opt/config directory and pod is throwing an error verify TLS true or false

[jertel]

The config file should exist in /opt/elastalert/config.yaml, not /opt/config.

[Raksniru]

this issue is sorted out ,thanks