Skip to content

Elastic api - #556

Merged
afeefghannam89 merged 4 commits into
mainfrom
elastic_api
Sep 25, 2026
Merged

afeefghannam89 merged 4 commits into
mainfrom
elastic_api

Conversation

@afeefghannam89

Copy link
Copy Markdown
Member

Two defects in the same 15-line function, Api.new_client_basic_auth().

The client was built with an SSLContext that switched both certificate checks off and handed verify_certs alongside it. elastic_transport configures the urllib3 pool from verify_certs regardless of the context, so the context never took effect, ca_certs never reached the connection, and an http host was rejected with a ValueError before the first request.

The modules also refused nothing on version 7 of the elasticsearch library. That version accepts basic_auth without sending the credentials, so every request arrived unauthenticated and came back as HTTP 401. That is the error in #335. The library ends up at version 7 because packages.yml fell back to the distribution package on every host: its condition not elasticstack_pip_installation | bool can never be true, a registered result is a dict and the bool filter coerces any dict to false. On EL 9 and Ubuntu 22.04, two of the three platforms this collection declares, that package is still version 7.

Measured on three real client installations and against a local TLS server:

7.17.6 8.19.3 9.5.1
basic_auth sets the authorization header no yes yes
new old
https, matching name, verify on connects connects
https, wrong name, verify on rejected rejected
https, wrong name, verify off connects connects
http connects ValueError: TLS options require scheme to be 'https'

Closes #549
Closes #335

@afeefghannam89
afeefghannam89 merged commit 54ad7a4 into main Sep 25, 2026
28 of 29 checks passed
@afeefghannam89
afeefghannam89 deleted the elastic_api branch September 25, 2026 13:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: The SSLContext in api.py has no effect, and the logstash user is created unverified [Bug]: Creation of Logstash Roles fails in some situations

1 participant