How to connect to an ES cluster that runs with custom SSL cert

[titansmc]

How can I add my own JVM Trust Store so I can put the self-signed certificate that my ES cluster has?

[KongZ]

First, you need to put the truststore file here graylog.serverFiles
All file here will be mounted to /etc/graylog/server

Second, add the -Djavax.net.ssl.keyStore=/etc/graylog/server/keystore.jks here
graylog.javaOpts

[oddkl]

2 questions:

1. How do you upload binary jks files with graylog.serverFiles ?
2. Shouldn't it be -Djavax.net.ssl.trustStore= ?

[titansmc]

Did you find out how to pass a binary file ? What I did (and cannot make it work) is to manually create a configmap, then get it with kubectl get cm file -oyaml and this output I would paste it to the graylog chart. But then the new configmap looks like:

apiVersion: v1
data:
  truststore.jks: |
    /u3+7QAAAAIAAAABAAAAAgAKb3BlbnNlYXJjaAAAAY8V6M+VAAVYLjUwOQAABgQwggYAMIID6KADAgECAhEAy4iPmxi0O/CC6YQ9NQTSqjANBgkqhkiG9w0BAQsFADAdMRswGQYDVQQDExJvcGVuc2VhcmNoLWNsdXN0ZXIwHhcNMjQwNDE4MTA1NDM0WhcNMjUwNDE4MTA1NDM0WjA6MRswGQYDVQQLExJvcGVuc2VhcmNoLWNsdXN0ZXIxGzAZBgNVBAMTEm9wZW5zZWFyY2gtY2x1c3RlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALi

with the pipe | after the name, which I didn't have initially....

Any ideas about what could be wrong ?

Cheers.

[titansmc]

I think the configmap created by the helm chart based and what it is existing in values, is generating a CM type data while it should be binaryData and that is the reason why it doesn't work.

[titansmc]

I made it work this way:

kubectl create configmap -n graylog --from-file=./truststore.jks  truststore

then the chart:

  ## Additional volume mounts
  ##
  extraVolumeMounts:
    - name: config-volume
      mountPath: /etc/graylog/server/

  ## Additional volumes
  ##
  extraVolumes:
    - name: config-volume
      configMap:
        name: truststore
        items:
        - key: truststore.jks
          path: truststore.jks

and the java options in the chart:

## Graylog default Java option
  javaOpts: "-Djavax.net.ssl.trustStorePassword=passwordhere -Djavax.net.ssl.trustStore=/etc/graylog/server/truststore.jks -Dlog4j2.formatMsgNoLookups=true -Djdk.tls.acknowledgeCloseNotify=true -XX:+UnlockExperimentalVMOptions -XX:NewRatio=1 -XX:MaxRAMPercentage=50.0 -XX:MaxMetaspaceSize=256m -server -XX:+ResizeTLAB -XX:-OmitStackTraceInFastThrow"