[Canvas] Timelion data source does not work on Cloud

[rayafratkina]

Update by @LeeDr : We just verified the same issue on a new 6.5.0 Cloud instance of Kibana (not only upgrade).

Kibana version:
6.5

Original install method (e.g. download page, yum, from source, etc.):
Cloud install

Describe the bug:
On cloud instances that were upgraded to 6.5, timelion functions on Canvas don't work

Steps to reproduce:

1. Set up a Cloud instance using old version
2. Upgrade instance to 6.5
3. Go to Canvas and create a new workpad
4. Create an element using Timelion data source
   -> error appears

Expected behavior:
Data is displayed

Screenshots (if relevant):

Errors in browser console (if relevant):

Provide logs and/or server output (if relevant):

Any additional context:

[rashmivkulkarni]

cc @elastic/kibana-qa

[LeeDr]

I hit this same issue locally on Windows 2012 Server. We thought it was an issue with getting the self-signed certs to be trusted properly. I worked on it a couple of hours but never got it to work.

Lee Drengenberg [9:37 AM]
@cqliu1 I see this issue was fixed/closed #24461 but I still get this error in the latest 6.5.0 BC6 for Timelion data source when security is enabled, TLS is enabled, and using self-signed certificates
Pasted image at 2018-11-09, 9:36 AM

rashidkpc [9:39 AM]
@LeeDr the problem isn't that it's self signed, it's that it's untrusted
you'd need to add the cert to your trust store
or rather, the cert authority

Lee Drengenberg [9:47 AM]
@rashidkpc I thought you were almost certainly correct, but when I use the Chrome browser on this Windows VM where the self-signed certs have been installed to the local trust store I still get the same error. I'm pretty sure the certs are installed locally because neither Chrome nor IE gave any errors or warnings when opening Kibana. Maybe I still don't quite have everything set right... It would appear that the browser is happy opening Kibana over https, but Canvas isn't happy connecting to Elasticsearch over https?

rashidkpc [9:48 AM]
that's because you added the cert to the browser trust store
but this is a system level thing

Lee Drengenberg [9:49 AM]
I'm doing certutil -addstore root $QADIR/../certs/ca/ca.crt

rashidkpc [9:50 AM]
sorry, not totally sure how ssl trust works on your particular system

Lee Drengenberg [9:50 AM]
I have some ideas to try

rashidkpc [9:50 AM]
but that's the root cause, it's not that it's self signed, it's that it's untrusted

Lee Drengenberg [9:51 AM]
yep
Timelion by itself works fine in Kibana. Just not a Timelion data source from Canvas.

rashidkpc [9:52 AM]
yep, connection works from the backend in Canvas

My error was slightly different but still about the certificate;

[rayafratkina]

CC @alexbrasetvik

[rayafratkina]

@elastic/kibana-canvas , @alexbrasetvik has there been any movement on this issue? I think we need to look into this for the next patch...

[alexfrancoeur]

+1 here, I believe we need to backport a fix to 6.5.2. A new user to Cloud with no data in their cluster will be prompted to install sample data. If they choose eCommerce, and look at the Canvas workpad that is loaded, they'll see errors.

We don't want this to be a new users experience with Canvas.

I believe this is related to #26308 and #23092 as well. Can we get an update here?

[alexfrancoeur]

@elastic/kibana-canvas Is there any update on this? were we able to make a 6.5.3 backport?

[monfera]

@alexfrancoeur I don't immediately see a work item associated with it, is this task assigned to someone yet @rashidkpc @w33ble @rayafratkina @clintandrewhall ?

[w33ble]

@legrego have you heard if #26809 fixed this or not?

[legrego]

@w33ble I just tested using 6.6.0-SNAPSHOT on cloud -- it doesn't appear that #26809 fixed this cloud issue.

I'm wondering: is is possible to have the timelion canvas function run as a browser-only function, rather than a server-only function? If we can run this on the browser, then that should eliminate the certificate problems, right? The client already has to trust the connection to Kibana, so it would behave like any other API call that the browser makes.

[alexfrancoeur]

How does the Timelion application work today? For the short term, it might be good to mimic what we're doing there. If we can't get a fix for this and backport to 6.6, I propose we either create a new workpad for the eCommerce sample data set or remove the workpad. I'd prefer not to go down that route but want to make sure new users to our stack no longer see this problem as part of their first experience.

[w33ble]

I'm wondering: is is possible to have the timelion canvas function run as a browser-only function, rather than a server-only function?

@legrego it looks like that would be a pretty easy change, it's just calling off to the timelion API. I don't know the implications of the session and whatnot on that API though, so it may require some new fetch helper or something too, or maybe not, I'm just not very familiar with that part.

If we can run this on the browser, then that should eliminate the certificate problems, right?

As far as I understand all this, yes, that would solve the problem.

[legrego]

I don't know the implications of the session and whatnot on that API though, so it may require some new fetch helper or something too, or maybe not, I'm just not very familiar with that part.

If you're talking about the existing Kibana user session here, then I don't think there's anything special we need to do for this to work - rather than using the axios fetch method that it calls today, it could be updated to use Kibana's kfetch, which should work without any [major] changes.

[alexfrancoeur]

yes @w33ble !!