Secured Elasticsearch connection

[gquintana]

My Elasticsearch cluster is secured with HTTPS and Basic Auth. I'd like to connect jaeger-ingester and jaeger-query on it.

I tried setting:

es.server-urls=https://elasticsearch:9200
es.tls.enabled=true
es.username=jaeger
es.password=XXXX

But I get:

{"level":"fatal","ts":1626344336.0828998,"caller":"command-line-arguments/main.go:65","msg":"Failed to init storage factory","error":"failed to create primary Elasticsearch client: health check timeout: no Elasticsearch node available","stacktrace":"main.main.func1\n\tcommand-line-arguments/main.go:65\ngithub.com/spf13/cobra.(*Command).execute\n\tgithub.com/spf13/cobra@v0.0.7/command.go:838\ngithub.com/spf13/cobra.(*Command).ExecuteC\n\tgithub.com/spf13/cobra@v0.0.7/command.go:943\ngithub.com/spf13/cobra.(*Command).Execute\n\tgithub.com/spf13/cobra@v0.0.7/command.go:883\nmain.main\n\tcommand-line-arguments/main.go:114\nruntime.main\n\truntime/proc.go:225"}

This error message is not helpful. How can I debug storage connection initialisation?

[albertteoh]

@gquintana are you starting jaeger-ingester/query from a docker container? Can the ingest/query process reach elasticsearch:9200?

[gquintana]

I am not running jaeger with Docker (sad me). I have to use systemd:

[Unit]
Description=Jaeger Query and UI
After=network.target

[Service]
Type=simple
SyslogIdentifier=jaeger
User=jaeger
Group=jaeger
WorkingDirectory=/opt/jaeger
Environment=SPAN_STORAGE_TYPE=elasticsearch
ExecStart=/opt/jaeger/jaeger-query --config-file /etc/jaeger/jaeger-query.properties >>/var/log/jaeger/jaeger-query.log

[Install]
WantedBy=multi-user.target

I can curl the elasticsearch host from the jaeger host. The jaeger host can reach the elasticsearch host on port 9200.

[jpkrohling]

If you remove TLS from the setup, does it work? I wonder if TLS has anything to do with your problem...