From 44a52da165fa05edf7e8bc029e08876b871f4e5e Mon Sep 17 00:00:00 2001
From: Martin Heck <mheck136@gmail.com>
Date: Thu, 26 Mar 2020 12:23:54 +0100
Subject: [PATCH] Add support for TLS configuration of elasticsearch sink

---
 pkg/sinks/elasticsearch.go | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/pkg/sinks/elasticsearch.go b/pkg/sinks/elasticsearch.go
index 78b3a4a..660d37a 100644
--- a/pkg/sinks/elasticsearch.go
+++ b/pkg/sinks/elasticsearch.go
@@ -3,10 +3,13 @@ package sinks
 import (
 	"bytes"
 	"context"
+	"crypto/tls"
 	"encoding/json"
 	"github.com/elastic/go-elasticsearch/v7"
 	"github.com/elastic/go-elasticsearch/v7/esapi"
 	"github.com/opsgenie/kubernetes-event-exporter/pkg/kube"
+	"io/ioutil"
+	"net/http"
 )
 
 type ElasticsearchConfig struct {
@@ -19,15 +22,39 @@ type ElasticsearchConfig struct {
 	// Indexing preferences
 	UseEventID bool   `yaml:"useEventID"`
 	Index      string `yaml:"index"`
+	TLS        struct {
+		InsecureSkipVerify bool   `yaml:"insecureSkipVerify"`
+		ServerName         string `yaml:"serverName"`
+		CaFile             string `yaml:"caFile"`
+	} `yaml:"tls"`
 }
 
 func NewElasticsearch(cfg *ElasticsearchConfig) (*Elasticsearch, error) {
+	var caCert []byte
+
+	if len(cfg.TLS.CaFile) > 0 {
+		readFile, err := ioutil.ReadFile(cfg.TLS.CaFile)
+		if err != nil {
+			return nil, err
+		}
+		caCert = readFile
+	}
+
+	tlsClientConfig := &tls.Config{
+		InsecureSkipVerify: cfg.TLS.InsecureSkipVerify,
+		ServerName:         cfg.TLS.ServerName,
+	}
+	tlsClientConfig.RootCAs.AppendCertsFromPEM(caCert)
+
 	client, err := elasticsearch.NewClient(elasticsearch.Config{
 		Addresses: cfg.Hosts,
 		Username:  cfg.Username,
 		Password:  cfg.Password,
 		CloudID:   cfg.CloudID,
 		APIKey:    cfg.APIKey,
+		Transport: &http.Transport{
+			TLSClientConfig: tlsClientConfig,
+		},
 	})
 	if err != nil {
 		return nil, err