gabriel-suela
commented
2 months ago Same problem here
Open jerry0li opened 2 months ago
gabriel-suela
commented
2 months ago Same problem here
prudhvigodithi
commented
2 months ago [Triage]
The same setting is added to the docker-compose file https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/docker-compose.yml#L18-L19 part of the terraform repo, without the DISABLE_INSTALL_DEMO_CONFIG and was able to connect to the cluster with http endpoint https://github.com/opensearch-project/terraform-provider-opensearch/blob/main/.github/workflows/test.yml#L103.
jerry0li
commented
1 month ago solved using below configuration. @gabriel-suela
contents in values.yaml:
config:
opensearch.yml: |
cluster.name: opensearch-cluster
# Bind to all interfaces because we don't know what IP address Docker will assign to us.
network.host: 0.0.0.0
# Start OpenSearch Security Demo Configuration
# WARNING: revise all the lines below before you go into production
plugins:
security:
ssl:
transport:
pemcert_filepath: esnode.pem
pemkey_filepath: esnode-key.pem
pemtrustedcas_filepath: root-ca.pem
enforce_hostname_verification: false
http:
enabled: true
pemcert_filepath: esnode.pem
pemkey_filepath: esnode-key.pem
pemtrustedcas_filepath: root-ca.pem
allow_unsafe_democertificates: true
allow_default_init_securityindex: true
authcz:
admin_dn:
- CN=kirk,OU=client,O=client,L=test,C=de
audit.type: internal_opensearch
enable_snapshot_restore_privilege: true
check_snapshot_restore_write_privileges: true
restapi:
roles_enabled: ["all_access", "security_rest_api_access"]
system_indices:
enabled: true
indices:
[
".opendistro-alerting-config",
".opendistro-alerting-alert*",
".opendistro-anomaly-results*",
".opendistro-anomaly-detector*",
".opendistro-anomaly-checkpoints",
".opendistro-anomaly-detection-state",
".opendistro-reports-*",
".opendistro-notifications-*",
".opendistro-notebooks",
".opendistro-asynchronous-search-response*",
]
extraEnvs:
- name: OPENSEARCH_INITIAL_ADMIN_PASSWORD
value: <your_admin_password | change it>Helm Chart Version: opensearch-2.25.0
Installation command:
helm install -n opensearch opensearch ./opensearch-2.25.0.tgz -f values.yaml
timbastin
commented
1 month ago @jerry0li I am still getting an error when trying to connect with plain http:
[2024-10-16T11:49:08,552][WARN ][o.o.h.AbstractHttpServerTransport] [opensearch-cluster-master-0] caught exception while handling client http traffic, closing connection Netty4HttpChannel{localAddress=/10.244.126.31:9200, remoteAddress=/10.244.127.237:51388}
io.netty.handler.codec.DecoderException: io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record: 474554202f5f636c75737465722f73657474696e67733f696e636c7564655f64656661756c74733d7472756520485454502f312e310d0a557365722d4167656e743a206f70656e7365617263682d6a6176612f322e352e3020284a6176612f31372e302e37290d0a4163636570743a206170706c69636174696f6e2f6a736f6e3b20636861727365743d5554462d380d0a436f6e74656e742d4c656e6774683a20300d0a486f73743a206f70656e7365617263682d636c75737465722d6d61737465723a393230300d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a417574686f72697a6174696f6e3a20426173696320595752746157343662464e70566b68725a5659316232524d0d0a0d0a
at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1407) [netty-transport-4.1.112.Final.jar:4.1.112.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440) [netty-transport-4.1.112.Final.jar:4.1.112.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420) [netty-transport-4.1.112.Final.jar:4.1.112.Final]
at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:918) [netty-transport-4.1.112.Final.jar:4.1.112.Final]
at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166) [netty-transport-4.1.112.Final.jar:4.1.112.Final]
at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:788) [netty-transport-4.1.112.Final.jar:4.1.112.Final]
at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:689) [netty-transport-4.1.112.Final.jar:4.1.112.Final]
at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:652) [netty-transport-4.1.112.Final.jar:4.1.112.Final]
at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:562) [netty-transport-4.1.112.Final.jar:4.1.112.Final]
at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:994) [netty-common-4.1.112.Final.jar:4.1.112.Final]
at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) [netty-common-4.1.112.Final.jar:4.1.112.Final]
at java.base/java.lang.Thread.run(Thread.java:1583) [?:?]
I just need to disable tls but would like to keep the authentication.
jerry0li
commented
3 days ago @timbastin Sry for the late response. You may give more details about your configuration I suppose.
It's hard to find the root cause of your error.
Description
It is more like a lack of documentation I guess. I don't want to cope with anything about certificate but only need to use user-password authentication as in an air-gap environment.
However, I can't find a precise documentation about this.
To Reproduce
Steps to reproduce the behavior:
contents in
values.yaml:install opensearch via the following cmd.
Error msg:
Chart Name opensearch
Host/Environment (please complete the following information):
Additional context Just thank you for reading this and helping a distressed developer 😄