Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add TLS dialer to Kerberos transport as well #18607

Merged
merged 2 commits into from
May 18, 2020
Merged

Add TLS dialer to Kerberos transport as well #18607

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
599ddd8
add tls options to kerberos transport as well
kvch May 18, 2020
418f34b
add changelog entry
kvch May 18, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.next.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -244,6 +244,7 @@ field. You can revert this change by configuring tags for the module and omittin
- Add config example of how to skip the `add_host_metadata` processor when forwarding logs. {issue}13920[13920] {pull}18153[18153]
- When using the `decode_json_fields` processor, decoded fields are now deep-merged into existing event. {pull}17958[17958]
- Add backoff configuration options for the Kafka output. {issue}16777[16777] {pull}17808[17808]
- Add TLS support to Kerberos authentication in Elasticsearch. {pull}18607[18607]

*Auditbeat*

Expand Down
28 changes: 13 additions & 15 deletions libbeat/esleg/eslegclient/connection.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,28 +129,26 @@ func NewConnection(s ConnectionSettings) (*Connection, error) {
}
}

var httpClient esHTTPClient
// when dropping the legacy client in favour of the official Go client, it should be instrumented
// eg, like in https://github.com/elastic/apm-server/blob/7.7/elasticsearch/client.go
transp := apmelasticsearch.WrapRoundTripper(&http.Transport{
Dial: dialer.Dial,
DialTLS: tlsDialer.Dial,
TLSClientConfig: s.TLS.ToConfig(),
Proxy: proxy,
IdleConnTimeout: s.IdleConnTimeout,
})

var httpClient esHTTPClient
httpClient = &http.Client{
Transport: apmelasticsearch.WrapRoundTripper(&http.Transport{
Dial: dialer.Dial,
DialTLS: tlsDialer.Dial,
TLSClientConfig: s.TLS.ToConfig(),
Proxy: proxy,
IdleConnTimeout: s.IdleConnTimeout,
}),
Timeout: s.Timeout,
Transport: transp,
Timeout: s.Timeout,
}

if s.Kerberos.IsEnabled() {
c := &http.Client{
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we can now remove this statement and use httpClient instead of c as the 2nd argument to kerberos.NewClient below now?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, we cannot. kerberos.NewClient expects an http.Client, but the client above is an esHTTPClient.

Transport: &http.Transport{
Dial: dialer.Dial,
Proxy: proxy,
IdleConnTimeout: s.IdleConnTimeout,
},
Timeout: s.Timeout,
Transport: transp,
Timeout: s.Timeout,
}
httpClient, err = kerberos.NewClient(s.Kerberos, c, s.URL)
if err != nil {
Expand Down