You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on May 16, 2023. It is now read-only.
The Kibana chart is missing a way to configure the port name of the service (e.g. service.httpPortName like in the Elastic Search chart). This is required when Kibana is running behind Istio's service mesh and TLS is enabled in the chart. The reason is that Istio is doing protocol selection based on the port name, which remains called http in the chart when SSL is enabled. This results in HTTPS traffic being sent to an HTTP port with the following error:
error:1400410B:SSL routines:CONNECT_CR_SRVR_HELLO:wrong version number
Steps to reproduce:
Setup a GKE cluster with Istio (e.g. 1.6)
Install Kibana chart with TLS enabled
Add Istio Gateway with TLS passthrough
Add Istio Virtual Service pointing to kibana-kibana service.
==> HTTPS request failing
Patch the kibana-kibana service by changing to port name to https.
==> HTTPS request successful
Expected behavior: service.httpPortName option is available in the Helm Chart.
Provide logs and/or server output (if relevant):
Be careful to obfuscate every secrets (credentials, token, public IP, ...) that could be visible in the output before copy-pasting
curl -v https://kibana.example.com/
* Trying 34.77.80.28...
* TCP_NODELAY set
* Connected to kibana.example.com (x.x.x.x) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/cert.pem
CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* error:1400410B:SSL routines:CONNECT_CR_SRVR_HELLO:wrong version number
* Closing connection 0
curl: (35) error:1400410B:SSL routines:CONNECT_CR_SRVR_HELLO:wrong version number
Any additional context:
Using GKE's Istio addon (1.6)
The text was updated successfully, but these errors were encountered:
Chart version:
7.9.2
Kubernetes version:
v1.17.9-gke.1504
Kubernetes provider: E.g. GKE (Google Kubernetes Engine)
GKE
Helm Version:
3
helm get release
outputOutput of helm get release
Describe the bug:
The Kibana chart is missing a way to configure the port name of the service (e.g.
service.httpPortName
like in the Elastic Search chart). This is required when Kibana is running behind Istio's service mesh and TLS is enabled in the chart. The reason is that Istio is doing protocol selection based on the port name, which remains calledhttp
in the chart when SSL is enabled. This results in HTTPS traffic being sent to an HTTP port with the following error:Steps to reproduce:
kibana-kibana
service.kibana-kibana
service by changing to port name tohttps
.Expected behavior:
service.httpPortName
option is available in the Helm Chart.Provide logs and/or server output (if relevant):
Be careful to obfuscate every secrets (credentials, token, public IP, ...) that could be visible in the output before copy-pasting
Any additional context:
Using GKE's Istio addon (1.6)
The text was updated successfully, but these errors were encountered: