Clarification in docs

[nadilas]

Hi everyone,

This line cost me 1 day 😄 ...

jaeger/pkg/es/config/config.go

Line 294 in 4b58b94

if c.TLS.Enabled {

Maybe you could update to docs to be more specific in saying --es.tls ignores --es.tls.ca? Or is it just me who got this wrong? 😊

[yurishkuro]

It should not ignore CA, what makes you think it does?

Meanwhile, this code will change with #1838

[nadilas]

@yurishkuro well, when setting —es.tls I don’t see this line in that if path of the code:

jaeger/pkg/es/config/config.go

Line 308 in 4b58b94

if c.TLS.CaPath != "" {

But that’s only after I always had a “no such file or directory” - yes without a file path - error on startup. Removing the —es.tls flag, leaving behind the —es.tls.ca flag fixed the issue. So I checked the code and then came to the conclusion above. Although I didn’t check c.TLS.createTLSConfig() itself.

[jpkrohling]

The code does look strange and I think it could have a few comments, but when the CA path is set, both code branches will attempt to read the file.

jaeger/pkg/es/config/config.go

Lines 308 to 315 in 4b58b94

	if c.TLS.CaPath != "" {
	ctls := &TLSConfig{CaPath: c.TLS.CaPath}
	ca, err := ctls.loadCertificate()
	if err != nil {
	return nil, err
	}
	httpTransport.TLSClientConfig.RootCAs = ca
	}

and

jaeger/pkg/es/config/config.go

Lines 344 to 360 in 4b58b94

	func (tlsConfig *TLSConfig) createTLSConfig() (*tls.Config, error) {
	rootCerts, err := tlsConfig.loadCertificate()
	if err != nil {
	return nil, err
	}
	clientPrivateKey, err := tlsConfig.loadPrivateKey()
	if err != nil {
	return nil, err
	}
	// #nosec
	return &tls.Config{
	RootCAs: rootCerts,
	Certificates: []tls.Certificate{*clientPrivateKey},
	InsecureSkipVerify: tlsConfig.SkipHostVerify,
	}, nil
	}

[nadilas]

@jpkrohling got it. It does make sense, although the createTLSConfig is actually a createTLSConfigWithClientCertificate implementation.

jaeger/pkg/es/config/config.go

Lines 308 to 315 in 4b58b94

	if c.TLS.CaPath != "" {
	ctls := &TLSConfig{CaPath: c.TLS.CaPath}
	ca, err := ctls.loadCertificate()
	if err != nil {
	return nil, err
	}
	httpTransport.TLSClientConfig.RootCAs = ca
	}

Then my issue was definitely not having CertPath and KeyPath set as I was using password authentication. Sorry for the misinterpretation.