Open malayh opened 7 months ago
stephen-crawford
commented
7 months ago [Triage] Hi @malayh, can you confirm whether this behavior was consistent across multiple attempts?
The issue you linked is definitely similar and a really challenging one we have faced for some time. That said, it tends to be intermittent so if you are seeing this behavior consistently you may be able to submit a PR to help fix it!
malayh
commented
6 months ago @scrawfor99 It has been consistent across attempts.
Although I got it working with a different approach.
Here is my current opensearch.yml. With DISABLE_INSTALL_DEMO_CONFIG=true
cluster:
name: "opensearch"
path:
data: /usr/share/opensearch/data
network:
bind_host: 0.0.0.0
node:
max_local_storage_nodes: 1
discovery:
seed_hosts:
- opensearch-master-0.opensearch-cluster-master-headless.logging.svc.cluster.local
- opensearch-data-0.opensearch-cluster-data-headless.logging.svc.cluster.local
- opensearch-data-1.opensearch-cluster-data-headless.logging.svc.cluster.local
plugins:
security:
disabled: false
nodes_dn:
- CN=opensearch
ssl:
transport:
pemcert_filepath: /usr/share/opensearch/config/certs/tls.crt
pemkey_filepath: /usr/share/opensearch/config/c`erts/tls.key
pemtrustedcas_filepath: /usr/share/opensearch/config/certs/ca.crt
enforce_hostname_verification: false
http:
enabled: true
pemcert_filepath: /usr/share/opensearch/config/certs/tls.crt
pemkey_filepath: /usr/share/opensearch/config/certs/tls.key
pemtrustedcas_filepath: /usr/share/opensearch/config/certs/ca.crt
allow_unsafe_democertificates: true
allow_default_init_securityindex: true
authcz:
admin_dn:
- CN=admin
audit.type: internal_opensearch
enable_snapshot_restore_privilege: true
check_snapshot_restore_write_privileges: true
restapi:
roles_enabled: ["all_access", "security_rest_api_access"]
system_indices:
enabled: true
indices:
[
".opendistro-alerting-config",
".opendistro-alerting-alert*",
".opendistro-anomaly-results*",
".opendistro-anomaly-detector*",
".opendistro-anomaly-checkpoints",
".opendistro-anomaly-detection-state",
".opendistro-reports-*",
".opendistro-notifications-*",
".opendistro-notebooks",
".opendistro-asynchronous-search-response*",
]And since my setup is in k8s, I am using cert-manager to create the certificates and follow, then mounting the files
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: opensearch
namespace: {{ .Release.Namespace }}
spec:
dnsNames:
- "localhost"
- "*.{{ .Release.Namespace }}.svc.cluster.local"
- "*.{{ .Release.Namespace }}.pod.cluster.local"
commonName: "opensearch"
issuerRef:
kind: ClusterIssuer
name: local-ca-issuer
secretName: cert-manager
privateKey:
algorithm: RSA
encoding: PKCS8
size: 2048After that I use securtiry_admin.sh to create the internal_user.yaml and config.yaml, which works perfectly
Here is my current theory:
opensearch.yml.commonName and DNS names. The current setup makes it efficient to do so. And I don't have to create the keys beforehand, which makes the process significantly less error prone.stephen-crawford
commented
6 months ago [Triage] Hi @malayh thank you for following up. It sounds like you were able to find a workaround (yay!), but that the issue still occurs. The demo_installer would be handled under the Kubernetes/Helm repo for since there are some processes they handled around how the cluster comes up. I would recommend filing an issue over there and linking back to this one.
In the meantime, someone will try to review these configurations and see if anything stands out.
stephen-crawford
commented
6 months ago [Triage] Marking as triaged so that someone takes a look at the configuration and closes this issue assuming nothing stands out.
What is the bug? I am trying to install opensearch (using the 2.13.0 docker image). The setup works with the demo security configs. I have done the following steps to update the security configs
Generate keys and certs Using the following makefile to generate keys.
Update opensearch.yml as follows
Ran security_admin.sh as follows:
Following is the error I am getting after that
What am I missing?
Possible related issue: https://github.com/opensearch-project/security/issues/3299