Answers: <p>I suggest you create a Deployment of <code>caddy:2</code> Pods which a Caddyfile mounted from a Secret, something like this:</p>
  <pre><code>http://elastic-proxy.default.svc.cluster.local:9243 {
      reverse_proxy https://xxx.yyy.eu-west-3.aws.elastic-cloud.com:9243 {
          header_up Authorization &quot;Basic Zm9vOmJhcgo=&quot;
          header_up Host {upstream_hostport}
          header_up X-Forwarded-Host {host}
      }
  }
  </code></pre>
  <p>The create a Service named <code>elastic-proxy</code> in the namespace (<code>default</code> in this example). Point the app Pods to this service instead of the Elastic Cloud.</p>
  <p>Explanation:</p>
  <p>This will create a Caddy 2 server which reverse proxies everything coming to port 9243 with virtual host <code>elastic-proxy.default.svc.cluster.local</code> to the Elastic Cloud and adds an <code>Authorization</code> header with the Basic Auth credentials (foo:bar here).</p>
  <p>You can create the password with <code>base64</code> like this:</p>
  <pre><code>$ echo 'elastic:password' | base64
  ZWxhc3RpYzpwYXNzd29yZAo=
  </code></pre>
  <p>Every time you change the password (why do you even change it?), just modify the Caddyfile in the Secret.</p>
  
Answers: CC BY-SA 4.0
Answers: 2022-01-13T16:09:21.400Z
Answers: 2022-02-04T08:27:58.563Z
Answers: 2022-02-04T08:27:58.563Z
Answers: vaizki
Body: <p>I have a web server in a Kubernetes <code>Deployment</code> which uses an ElasticSearch instance on ElasticCloud.</p>
  <p>I have parameterised (thanks to environment variables) my container, from a <code>Secret</code>, with this kind of url: <code>https://elastic:***@xxx.yyy.eu-west-3.aws.elastic-cloud.com:9243</code></p>
  <p>I'm really dissatisfied for these reason:</p>
  <ul>
  <li>My container have access to the credentials</li>
  <li>I have downtimes whenever I change the password</li>
  </ul>
  <p>Is there a kind of <code>Service</code>, or any good practise, which would be able to proxy ElasticCloud (adding credentials)? If it is possible, I'd like to have a mechanism to update credentials.</p>
  
Tags: <kubernetes><elasticsearch>
Title: Internal proxy for external system
UserDisplayName: GlinesMome
ThreadText: # Internal proxy for external system
  
  (Asked by: username_0 on 2022-01-09)
  
  I have a web server in a Kubernetes `Deployment` which uses an ElasticSearch instance on ElasticCloud.
  
  I have parameterised (thanks to environment variables) my container, from a `Secret`, with this kind of url: `https://elastic:***@xxx.yyy.eu-west-3.aws.elastic-cloud.com:9243`
  
  I'm really dissatisfied for these reason:
  
  * My container have access to the credentials
  * I have downtimes whenever I change the password
  
  Is there a kind of `Service`, or any good practise, which would be able to proxy ElasticCloud (adding credentials)? If it is possible, I'd like to have a mechanism to update credentials.
  
  **Tags:** kubernetes, elasticsearch
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2022-01-13. Score: 1 | Accepted answer
  
  I suggest you create a Deployment of `caddy:2` Pods which a Caddyfile mounted from a Secret, something like this:
  
  ```
  http://elastic-proxy.default.svc.cluster.local:9243 {
      reverse_proxy https://xxx.yyy.eu-west-3.aws.elastic-cloud.com:9243 {
          header_up Authorization "Basic Zm9vOmJhcgo="
          header_up Host {upstream_hostport}
          header_up X-Forwarded-Host {host}
      }
  }
  
  ```
  
  The create a Service named `elastic-proxy` in the namespace (`default` in this example). Point the app Pods to this service instead of the Elastic Cloud.
  
  Explanation:
  
  This will create a Caddy 2 server which reverse proxies everything coming to port 9243 with virtual host `elastic-proxy.default.svc.cluster.local` to the Elastic Cloud and adds an `Authorization` header with the Basic Auth credentials (foo:bar here).
  
  You can create the password with `base64` like this:
  
  ```
  $ echo 'elastic:password' | base64
  ZWxhc3RpYzpwYXNzd29yZAo=
  
  ```
  
  Every time you change the password (why do you even change it?), just modify the Caddyfile in the Secret.
  
  
  ---
  
  