Add support for client certificates to the readiness probe

Describe the feature:

I would like to enable xpack.security.http.ssl.client_authentication: required on my cluster, but this breaks the readiness probe since there is no parameter to let it include a client certificate in the cURL request. It would be nice if there was a way to specify additional cURL arguments so that I could add it myself, or if there were parameters to specify certificate paths and such.

I could work around it for now by setting xpack.security.http.ssl.client_authentication: optional but then I might as well not use client certificates at all.

Describe a specific use case for the feature:

Additional cluster security.

[abossard]

I’m interested in that feature too, it’s one of the few ways traffic e.g. from nginx ingress can be securely authenticated towards the elasticsearch cluster.

The readinessProbe, how I see it, would become much more complex, e.g. it would need to evaluate the current config and based on the parameters there either use a client certificate or not. Also it needs another secret that has a client certificate mounted.

Maybe there’s a simpler way of implementing it, but e.g. having Helm Parameters like:

addtionalCertificateVolumeMounts:
- secretName:
  mountPath:
# and
additionalCurlParameters:
- --cert <some path from above client.cert>
- --key <some path from above client.key>
- --cacert <some path from above ca.crt>

Is that something that could be considered good enough to be ever accepted as PR?

[OvervCW]

Still a problem we’re facing.