Open pawelw1 opened 1 month ago
same problem when use chart 2.21.0, if we remove default plugins.security
setting (check values.yaml), then no duplicated security config.
but if we want to disable "OpenSearch Security Demo Installer" (seen in log), we have not found a method in Setting up a demo configuration. search source and got SecuritySettingsConfigurer.java:
void checkIfSecurityPluginIsAlreadyConfigured() {
// Check if the configuration file contains the 'plugins.security' string
if (installer.OPENSEARCH_CONF_FILE != null && new File(installer.OPENSEARCH_CONF_FILE).exists()) {
try (BufferedReader br = new BufferedReader(new FileReader(installer.OPENSEARCH_CONF_FILE, StandardCharsets.UTF_8))) {
String line;
while ((line = br.readLine()) != null) {
if (line.toLowerCase().contains("plugins.security")) {
System.out.println(installer.OPENSEARCH_CONF_FILE + " seems to be already configured for Security. Quit.");
System.exit(installer.skip_updates);
}
}
but default values are:
config:
opensearch.yml: |
cluster.name: opensearch-cluster
network.host: 0.0.0.0
plugins:
security:
......
not plugins.security...
. so we tried:
config:
opensearch.yml: |
cluster.name: opensearch-cluster
network.host: 0.0.0.0
plugins.security.disabled: true
check /usr/share/opensearch/config/opensearch.yml
there is no OpenSearch Security Demo Configuration
added, if we changed back:
config:
opensearch.yml: |
cluster.name: opensearch-cluster
network.host: 0.0.0.0
plugins:
security:
disabled: true
OpenSearch Security Demo Configuration
added.
The issue appears to be due to demo configuration script being run by default on Helm charts even if you made changes to the security config.
To get past this issue you can disable the demo security configuration by setting DISABLE_INSTALL_DEMO_CONFIG to "true" in the extraEnvs section of your values.yaml file.
extraEnvs:
- name: DISABLE_INSTALL_DEMO_CONFIG
value: "true"
It looks like the custom configuration is added to opensearch.yml after the OpenSearch service is up. Otherwise, the service would fail to start due to duplicated entries.
Any update on this bug?. we are unable to use latest version due to this.
Describe the bug
Bug Fix for configMap Read-only file system error in statefulset.yml https://github.com/opensearch-project/helm-charts/pull/516 creates duplicated security config in opensearch.yml
https://github.com/opensearch-project/helm-charts/commit/a1c5b8f301d68649f0534b63bf545a61844ce651#diff-08885706cd45ad445d2696cd7e39cf7d4b5e82cb51b0ee6bd86e6ee9f818e158
To Reproduce
Steps to reproduce the behaviour:
Example:
Expected behavior opensearch.yml must contain only a single security configuration provided through values.yaml.
Chart Name Specify the Chart which is affected? All charts from OpenSearch version 2.11.1 to the latest.