If I got a dollar every time I hear “we had to disable security and authentication in Elasticsearch because otherwise it was unusable”, I’d be a bit richer by now ;-)
Honestly, I don’t quite get where the confusion comes from. It’s 2024, yet some of us are still surprised by “what do you mean: certificate and password???”
Let me explain security in Elasticsearch in a few simple paragraphs.
Some say that keeping passwords in a [web] application is a boring and trivial task: some hashing, maybe some salt, et voilà! However, storing passwords and other sensitive data might not be as simple as it seems. You’ll see a bunch of examples of what to do and what not to do based on a freelance’s experience. Watch and see if you’re not sitting on a bomb.
This talk (in various formats) has been presented at Chamberconf, 4Developers, Devoxx Poland, Wrocław JUG, Coffee JUG Lviv, jLabs Academy and others.