Use case

I want to test TLS connections but I don't have valid certificates.

Development and testing environments often do not have valid certificates signed by a well-known internet CA. Typically development certs

• are self-signed or have a self-signed CA in their trust chain.
• do not have a CN that matches the hostname they are installed on.

Solution

Add a TLS section to the OutputSpec output configuration for the cluster-logging-operator containing an option to disable verification (InsecureSkipVerify):

// If InsecureSkipVerify is true, then the TLS client will be configured to ignore errors with certificates.
//
// This option is *not* recommended for production configurations.
InsecureSkipVerify bool `json:"insecureSkipVerify,omitempty"`

The setting should be documented as only for testing/debugging purpose, not to be used in production environments.

Example usage:

spec:
  outputs:
  - name: example-output
    type: elasticsearch
    url: https://es-with-custom-certificate:9200/
    tls:
      insecureSkipVerify: true