Splunk Connect for k8S - HTTPS problem

npe — Tue, 25 Jan 2022 08:59:47 GMT

Hello,

I am trying to configure Splunk Connect for Kubernetes to capture a k8s cluster application logs.

I have problems when configuring https connection to HEC.

On the Heavy Forwarder, I have configured a ServerCert, which has been signed by our Company Authority.

Then, on Splunk Connect for Kubernetes Helm, if I configure https :

splunk: hec: # host is required and should be provided by user host: hostname.domain.com # token is required and should be provided by user token: MY-HEC-TOKEN # protocol has two options: "http" and "https", default is "https" # For self signed certificate leave this field blank protocol: https

When deploying, I see the following logs on Heavy Forwarder :

01-25-2022 09:37:16.729 +0100 WARN SSLCommon [1235867 HttpInputServerDataThread] - Received fatal SSL3 alert. ssl_state='SSLv3 read client key exchange A', alert_description='unknown CA'. 01-25-2022 09:37:16.729 +0100 WARN HttpListener [1235867 HttpInputServerDataThread] - Socket error from 10.8.199.195:55608 while idling: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca - please check the output of the `openssl verify` command for the certificates involved; note that if certificate verification is enabled (requireClientCert or sslVerifyServerCert set to "true"), the CA certificate and the server certificate should not have the same Common Name.

I have to configure insecureSSL: true to get the connection working and see logs on Indexer.

But, If I activate HTTPS connection, I do not want it to be insecure ^^.

I am a bit confused about Splunk Connect 4 Kubernetes configuration.

Can I use :

splunk: # Configurations for HEC (HTTP Event Collector) hec: # The PEM-format CA certificate file. # NOTE: The content of the file itself should be used here, not the file path. # The file will be stored as a secret in kubernetes. caFile:

To configure ma Company CA ?

Or are keys clientCert, clientKey and CaFile only used for mTLS configuration ?

Thank you in advance for your answers.

Regards.

Nicolas.

topic Splunk Connect for k8S - HTTPS problem in Security

Splunk Connect for k8S - HTTPS problem