<p>I suggest you create a Deployment of <code>caddy:2</code> Pods which a Caddyfile mounted from a Secret, something like this:</p>
<pre><code>http://elastic-proxy.default.svc.cluster.local:9243 {
    reverse_proxy https://xxx.yyy.eu-west-3.aws.elastic-cloud.com:9243 {
        header_up Authorization &quot;Basic Zm9vOmJhcgo=&quot;
        header_up Host {upstream_hostport}
        header_up X-Forwarded-Host {host}
    }
}
</code></pre>
<p>The create a Service named <code>elastic-proxy</code> in the namespace (<code>default</code> in this example). Point the app Pods to this service instead of the Elastic Cloud.</p>
<p>Explanation:</p>
<p>This will create a Caddy 2 server which reverse proxies everything coming to port 9243 with virtual host <code>elastic-proxy.default.svc.cluster.local</code> to the Elastic Cloud and adds an <code>Authorization</code> header with the Basic Auth credentials (foo:bar here).</p>
<p>You can create the password with <code>base64</code> like this:</p>
<pre><code>$ echo 'elastic:password' | base64
ZWxhc3RpYzpwYXNzd29yZAo=
</code></pre>
<p>Every time you change the password (why do you even change it?), just modify the Caddyfile in the Secret.</p>

CC BY-SA 4.0
2022-01-13T16:09:21.400Z
2022-02-04T08:27:58.563Z
2022-02-04T08:27:58.563Z
vaizki
<p>I have a web server in a Kubernetes <code>Deployment</code> which uses an ElasticSearch instance on ElasticCloud.</p>
<p>I have parameterised (thanks to environment variables) my container, from a <code>Secret</code>, with this kind of url: <code>https://elastic:***@xxx.yyy.eu-west-3.aws.elastic-cloud.com:9243</code></p>
<p>I'm really dissatisfied for these reason:</p>
<ul>
<li>My container have access to the credentials</li>
<li>I have downtimes whenever I change the password</li>
</ul>
<p>Is there a kind of <code>Service</code>, or any good practise, which would be able to proxy ElasticCloud (adding credentials)? If it is possible, I'd like to have a mechanism to update credentials.</p>

<kubernetes><elasticsearch>
Internal proxy for external system
GlinesMome
# Internal proxy for external system

(Asked by: username_0 on 2022-01-09)

I have a web server in a Kubernetes `Deployment` which uses an ElasticSearch instance on ElasticCloud.

I have parameterised (thanks to environment variables) my container, from a `Secret`, with this kind of url: `https://elastic:***@xxx.yyy.eu-west-3.aws.elastic-cloud.com:9243`

I'm really dissatisfied for these reason:

* My container have access to the credentials
* I have downtimes whenever I change the password

Is there a kind of `Service`, or any good practise, which would be able to proxy ElasticCloud (adding credentials)? If it is possible, I'd like to have a mechanism to update credentials.

**Tags:** kubernetes, elasticsearch


---

## 1 answers

### Answer by username_1 on 2022-01-13. Score: 1 | Accepted answer

I suggest you create a Deployment of caddy:2 Pods which a Caddyfile mounted from a Secret, something like this:
http://elastic-proxy.default.svc.cluster.local:9243 {
    reverse_proxy https://xxx.yyy.eu-west-3.aws.elastic-cloud.com:9243 {
        header_up Authorization "Basic Zm9vOmJhcgo="
        header_up Host {upstream_hostport}
        header_up X-Forwarded-Host {host}
    }
}

The create a Service named elastic-proxy in the namespace (default in this example). Point the app Pods to this service instead of the Elastic Cloud.
Explanation:
This will create a Caddy 2 server which reverse proxies everything coming to port 9243 with virtual host elastic-proxy.default.svc.cluster.local to the Elastic Cloud and adds an Authorization header with the Basic Auth credentials (foo:bar here).
You can create the password with base64 like this:
$ echo 'elastic:password' | base64
ZWxhc3RpYzpwYXNzd29yZAo=

Every time you change the password (why do you even change it?), just modify the Caddyfile in the Secret.


---

