TLS kibana 502 bad gateway about viya4-monitoring-kubernetes

[gsmith-sas]

Hello,

Ingress configuration can be tricky and I'm no expert, so I'm not sure I'll be able to solve this. However, let me make a few suggestions/comments:

• I noticed a typo in the yaml file you shared. On the last line, you identify the "host" as "hotsname"; I suspect that should have been "hostname" (you swapped the "s" and "t" in the middle). But I'm not sure if that was the actual value in your yaml file or just a dummy value you used to avoid revealing your actual host name. If it is an actual value, correct the typo and see if that fixes the problem.

• I notice the server/host is identified as "hosthame" in the nginx ingress log messages you shared. Again, I don't know if that was just a typo somewhere in the actual configuration or a mistake in a global change you made to hide the actual host before posting the log messages. If it is the former, check your configuration for the typo (I don't see that typo in your yaml).

• You did not include the URL you are using to access Kibana. Are you specifying HTTP or HTTPS as the protocol? In either case, have you tried specifying the other value?

  I'm sorry I can't be more helpful. Please let us know how things go.

[ricgatti]

Hello,

The value hotsname, yeah is wrong typo but it's only a dummy value.
When I try to access I specift https://hostname/kibana

[gsmith-sas]

I think we've identified the problem. If you need/want TLS enabled for the communication with Kibana, you currently need to set an additional environment variable, LOG_KB_TLS_ENABLE, to "true" before deploying Elasticsearch and Kibana. The need for this environment variable is being eliminated.

Since you have not set that environment variable, Kibana is NOT configured for TLS regardless of the ingress settings. You should be able to verify this is the case without redeploying things by doing one of the following:

• Use Kubernetes port-forwarding to access Kibana. This would bypass the ingress configuration entirely. I would expect that you would need to use HTTP (and not HTTPS) to access Kibana in this case.
• Or, you could change the Kubernetes annotation nginx.ingress.kubernetes.io/backend-protocol on the ingress object from HTTPS to HTTP. This could be done via kubectl commands and is probably the easier option.

But, if you want to require TLS/HTTPS for accessing Kibana, you will need to redploy after setting the environment variable.

[gsmith-sas]

Hello again,
Another user recently ran into a similar problem and we realized they had failed to create all of the necessary TLS certificates. We generate some of the certificates for you but not all. Have you obtained a set of TLS certificates and saved them as the Kubernetes secret kibana-ingress-tls-secret (within the logging namespace)? If you have NOT populated that secret with a valid set of TLS certs, things won't work. There are instructions within the repo that describe how to create the secret once you have obtained a TLS cert.

[ricgatti]

Hello,

With LOG_KB_TLS_ENABLE set to true it deploy correctly and I can access the web page with HTTPS.
The TLS certificate as been created correctly using my cluster issuer.

I thinks we can close the issue now thanks.

[gsmith-sas]

Great! I'm glad to hear you were able to get things working. I am closing this issue.