Bug 1705589

I did not see anything in the logs which would indicate permissions are not seeding properly.  Consider the following:

* Have they cleared their browser cache?  Does this problem still exist when using an incognito browser?
* Are there any errors on the browser side that can be posted here
* Is their high network latency between ES and Kibana which could be causing issues [1]
* Can you ask them to log in again and dump the permissions within 60s [2]

Any latency may require them to bump the request timeout [3] which we patched into Kibana 5 with [4]


[1] https://github.com/jcantrill/cluster-logging-tools/blob/master/scripts/check-kibana-to-es-connectivity
[2] https://github.com/jcantrill/cluster-logging-tools/blob/master/scripts/view-es-permissions
[3] https://github.com/openshift/origin-aggregated-logging/tree/master/kibana#configuration-modifications
[4] https://bugzilla.redhat.com/show_bug.cgi?id=1679159

Try the following:

1. rsh into one of the ES pods
2. change to the $HOME/sgconfig dir which should be a child to the one in which you are initially placed
3. Edit the sg_action_group.yaml file and add SEARCH to this group [1] 
4. Run 'es_seed_acl' - this will reseed the permissions

Note this is a work around and only temporary.  If any of the pods are restarted, you will need to re-execute these steps.

Also note the permission script from c#3 is only useful when run within 60s of the initial failure.  Permissions are expired after that time.


[1] https://github.com/openshift/origin-aggregated-logging/blob/master/elasticsearch/sgconfig/sg_action_groups.yml#L68

Josh,

I am unable to reproduce locally.  Can you provide the all the steps interacting with Kibana? (e.g. log in, click discover, execute search, etc0

Josh,

I dont see any response to my request for:

> Try the following:
> 
> 1. rsh into one of the ES pods
> 2. change to the $HOME/sgconfig dir which should be a child to the one in
> which you are initially placed
> 3. Edit the sg_action_group.yaml file and add SEARCH to this group [1] 
> 4. Run 'es_seed_acl' - this will reseed the permissions
> 
> Note this is a work around and only temporary.  If any of the pods are
> restarted, you will need to re-execute these steps.
> 
> Also note the permission script from c#3 is only useful when run within 60s
> of the initial failure.  Permissions are expired after that time.
> 
> 
> [1]
> https://github.com/openshift/origin-aggregated-logging/blob/master/
> elasticsearch/sgconfig/sg_action_groups.yml#L68

*** Bug 1705026 has been marked as a duplicate of this bug. ***

Couldn't reproduce this bug.  Move to verified as regression testing pass.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:2922

The needinfo request[s] on this closed bug have been removed as they have been unresolved for 1000 days