Cribl Outpost TLS Block Removed from instance.yml When Converting Worker to Outpost

Symptom

When converting an existing Cribl Stream worker that uses mutual TLS (mTLS) to communicate with the Leader into an Outpost node, the TLS configuration block under distributed.master.tls in instance.yml is replaced with only tls.disabled: false. After the conversion, the Outpost shows up in the Leader UI briefly and then disconnects, and it cannot maintain a stable connection to the Leader even though the same certificates work for a worker.

Environment

• Product: Cribl Stream with Cribl Outpost
• Versions: 4.17.1 (observed)
• Deployment: Distributed — Leader and worker node converted to Outpost
• Control plane: mTLS enabled between the node and the Leader (client certificate required)

Resolution

1. Back up the current configuration files on the node that will run as an Outpost:

   • instance.yml

   • outpost.yml (if present)

2. Open instance.yml on the node and locate the distributed.master.tls section that was working when the node was a worker. It should include fields similar to:

   • disabled: false

   • requestCert: true

   • rejectUnauthorized: true

   • privKeyPath: <path-to-client-key.pem>

   • certPath: <path-to-client-cert.pem>

   • caPath: <path-to-ca-bundle.pem>

3. If the TLS block has been reduced to only tls.disabled: false, restore the full TLS configuration so that it matches the values that worked for the worker.

4. From the Cribl install directory on the node, rerun the Outpost bootstrap command and include the TLS key and certificate options so the CLI does not overwrite the TLS block with incomplete settings. For example:

   ./cribl mode-outpost -H <leader-hostname-or-fqdn> -p 4200 -u '<auth-token>' -g <outpost-group-name> -S true -k <path-to-client-key.pem> -c <path-to-client-cert.pem> && ./cribl restart

5. After the node restarts, reopen instance.yml and confirm that the distributed.master.tls section still contains:

   • disabled: false

   • requestCert: true

   • rejectUnauthorized: true

   • privKeyPath, certPath, and caPath pointing to valid certificate files

   If any of these values are missing, add them back and restart the Outpost service again.

6. In the Leader UI, navigate to the Outposts view and verify that the Outpost shows as Connected and remains connected for more than a few seconds.

7. Confirm that any Edge or Stream nodes configured to use this Outpost as their distributed.master can connect and stay connected.

Cause

This can be caused by:

• Converting a worker that uses mTLS to an Outpost with cribl mode-outpost (or the corresponding UI script) without supplying TLS certificate and key options, which causes the CLI to rewrite the distributed.master.tls block in instance.yml to only tls.disabled: false.
• The resulting TLS configuration no longer includes the client certificate, private key, CA bundle, or strict verification flags, so the Outpost cannot complete the TLS handshake with the Leader; it appears briefly in the Leader UI and then disconnects.

Additional Information

• For background on the Outpost CLI, see the mode-outpost reference in the Cribl Stream documentation: CLI: mode-outpost.
• For general Outpost deployment guidance, see Set up Cribl Outpost.
• For an overview of Outpost behavior and architecture, see Cribl Outpost.