I did not see anything in the logs which would indicate permissions are not seeding properly. Consider the following: * Have they cleared their browser cache? Does this problem still exist when using an incognito browser? * Are there any errors on the browser side that can be posted here * Is their high network latency between ES and Kibana which could be causing issues [1] * Can you ask them to log in again and dump the permissions within 60s [2] Any latency may require them to bump the request timeout [3] which we patched into Kibana 5 with [4] [1] https://github.com/jcantrill/cluster-logging-tools/blob/master/scripts/check-kibana-to-es-connectivity [2] https://github.com/jcantrill/cluster-logging-tools/blob/master/scripts/view-es-permissions [3] https://github.com/openshift/origin-aggregated-logging/tree/master/kibana#configuration-modifications [4] https://bugzilla.redhat.com/show_bug.cgi?id=1679159
Try the following: 1. rsh into one of the ES pods 2. change to the $HOME/sgconfig dir which should be a child to the one in which you are initially placed 3. Edit the sg_action_group.yaml file and add SEARCH to this group [1] 4. Run 'es_seed_acl' - this will reseed the permissions Note this is a work around and only temporary. If any of the pods are restarted, you will need to re-execute these steps. Also note the permission script from c#3 is only useful when run within 60s of the initial failure. Permissions are expired after that time. [1] https://github.com/openshift/origin-aggregated-logging/blob/master/elasticsearch/sgconfig/sg_action_groups.yml#L68
Josh, I am unable to reproduce locally. Can you provide the all the steps interacting with Kibana? (e.g. log in, click discover, execute search, etc0
Josh, I dont see any response to my request for: > Try the following: > > 1. rsh into one of the ES pods > 2. change to the $HOME/sgconfig dir which should be a child to the one in > which you are initially placed > 3. Edit the sg_action_group.yaml file and add SEARCH to this group [1] > 4. Run 'es_seed_acl' - this will reseed the permissions > > Note this is a work around and only temporary. If any of the pods are > restarted, you will need to re-execute these steps. > > Also note the permission script from c#3 is only useful when run within 60s > of the initial failure. Permissions are expired after that time. > > > [1] > https://github.com/openshift/origin-aggregated-logging/blob/master/ > elasticsearch/sgconfig/sg_action_groups.yml#L68
*** Bug 1705026 has been marked as a duplicate of this bug. ***
Couldn't reproduce this bug. Move to verified as regression testing pass.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:2922
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 1000 days