search

cloud-gov / cg-atlas

Repository hosting issues and artifacts related to operations of the cloud.gov platform
Creative Commons Zero v1.0 Universal
3 stars 1 forks source link

Update Kibana to stop exposing directory listings #129

Open dlapiduz opened 8 years ago

dlapiduz commented 8 years ago

In order to stop exposing directory listings we should update kibana to 4.3.5.

Acceptance Criteria:

Implementation Idea:

jmcarp commented 8 years ago

@dlapiduz: looks like kibana 4.3.5 isn't a thing. Should we use the latest version under the current minor version (4.3.3)? The version used by upstream logsearch-for-cloudfoundry (4.4.2)? Or the latest under the current major version (4.5.3)?

dlapiduz commented 8 years ago

@jmcarp sorry, yeah I meant 4.5.3

mogul commented 8 years ago

Merged but not yet built and deployed.

jmcarp commented 8 years ago

Turns out that the upgraded kibana also requires a newer version of elastic. We could try updating to a newer version of logsearch-boshrelease, but we're pretty far behind now, so that could be scary (although it needs to happen eventually). Also, upgrading didn't appear to stop kibana from serving node_modules. Which version of kibana fixed that issue @dlapiduz?

jmcarp commented 8 years ago

Hilarious: the fix on kibana that I'm guessing @dlapiduz was looking for didn't actually make it into 4.x--looks like it's slated for 5.x, and not included in any stable releases: https://github.com/elastic/kibana/pull/6764.

In the meantime, we need to either roll back the kibana upgrade or start on https://github.com/18F/cg-atlas/issues/131.

mogul commented 8 years ago

@jmcarp will ask for a 4.x that includes the two-line fix upstream.

jmcarp commented 7 years ago

Sorry this hasn't made progress. This will be resolved in the kibana 5.x release, and it sounds like we don't need to do anything about it in the meantime. I'm going to close this, but @mogul please reopen if I'm misunderstanding.

mogul commented 7 years ago

I'm reopening, but applying the label blocked so it's clear we can't progress this until another thing happens (eg the Kibana 5.x release).

mogul commented 7 years ago

(I also moved it back to the Backlog just to emphasize that other things have to take priority.)

mogul commented 7 years ago

Just an update... There's an RC for Kibana 5 now: https://github.com/elastic/kibana/releases/tag/v5.0.0-rc1

jmcarp commented 7 years ago

By the way, for this change to reach us, it has to propagate through logsearch-boshrelease and logsearch-for-cloudfoundry, which likely means us or altoros spending time updating the cf auth kibana plugin, since the kibana plugin interface breaks from 4.x to 5.x. In other words, we're probably looking at more time after the release comes out, and the timing might not be under our control unless we want to fork things.

mogul commented 7 years ago

OK, well, one milestone reached: Kibana 5.00 is available as of six days ago

brittag commented 7 years ago

Might be worth checking in on those upstream projects since it's been a few weeks - not sure how to check for this myself.

brittag commented 7 years ago

I checked on this as part of our monthly update of our POAM, and for my own future reference, here are the two files that seem helpful to check for Kibana version status: