In PR #6, changes were made to the handling of mutual TLS authentication. With this change, Stacker could be configured to authenticate with an X.509 client certificate, using the PKI authentication realm. However, this is tricky to get working correctly with the Kibana API. The documentation on the PKI authentication realm for the Kibana API is somewhat sparse, and seems to depend on the Elasticsearch PKI realm being configured correctly as well.
This is also true of username/password auth -- not all Kibana instances necessarily allow basic auth (some only allow OAuth, for example), so it is impossible to dump e.g. saved objects using this authentication method.
The most foolproof way to make this work is to use the user-specified authentication method just once to communicate with Elasticsearch, in order to get a short-lived API key. API key authentication works easily out of the box on both Elasticsearch and Kibana, and can be set up using only calls to the Elasticsearch API. Doing things this way will make the handling of Kibana API endpoints much smoother.
In PR #6, changes were made to the handling of mutual TLS authentication. With this change, Stacker could be configured to authenticate with an X.509 client certificate, using the PKI authentication realm. However, this is tricky to get working correctly with the Kibana API. The documentation on the PKI authentication realm for the Kibana API is somewhat sparse, and seems to depend on the Elasticsearch PKI realm being configured correctly as well.
This is also true of username/password auth -- not all Kibana instances necessarily allow basic auth (some only allow OAuth, for example), so it is impossible to dump e.g. saved objects using this authentication method.
The most foolproof way to make this work is to use the user-specified authentication method just once to communicate with Elasticsearch, in order to get a short-lived API key. API key authentication works easily out of the box on both Elasticsearch and Kibana, and can be set up using only calls to the Elasticsearch API. Doing things this way will make the handling of Kibana API endpoints much smoother.