sslpartialchain¶

Enables OpenSSL X509_V_FLAG_PARTIAL_CHAIN verification.

This parameter applies to Kubernetes Metadata Module (mmkubernetes).

Name:: sslpartialchain
Scope:: action
Type:: boolean
Default:: off
Required?:: no
Introduced:: at least 8.x, possibly earlier

Description¶

This option is only available if rsyslog was built with support for OpenSSL and only if the X509_V_FLAG_PARTIAL_CHAIN flag is available. If you attempt to set this parameter on other platforms, you will get an INFO level log message. This was done so that you could use the same configuration on different platforms. If “on”, this will set the OpenSSL certificate store flag X509_V_FLAG_PARTIAL_CHAIN. This will allow you to verify the Kubernetes API server cert with only an intermediate CA cert in your local trust store, rather than having to have the entire intermediate CA + root CA chain in your local trust store. See also man s_client - the -partial_chain flag. If you get errors like this, you probably need to set sslpartialchain=”on”:

rsyslogd: mmkubernetes: failed to connect to [https://...url...] -
60:Peer certificate cannot be authenticated with given CA certificates

Action usage¶

action(type="mmkubernetes" sslPartialChain="on")

sslpartialchain¶

Description¶

Action usage¶

See also¶