Bug 2000309
| Summary: | Elasticsearch pods reports repetitive warning org.elasticsearch.ElasticsearchSecurityException: _opendistro_security_dls_query does not match (SG 900D) | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Dhruv Gautam <dgautam> |
| Component: | Logging | Assignee: | Sashank Agarwal <sasagarw> |
| Status: | CLOSED DUPLICATE | QA Contact: | Anping Li <anli> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 4.6 | CC: | afurbach, aos-bugs, periklis, sasagarw, tmicheli, tmichels |
| Target Milestone: | --- | Flags: | afurbach:
needinfo-
|
| Target Release: | 4.6.z | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | logging-exploration | ||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-11-18 13:53:30 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Hey @tmicheli It happens to be that someone is already investigating on this issue. This bug is same as https://bugzilla.redhat.com/show_bug.cgi?id=1985826. Hence, I am closing it as a DUPLICATE. Please follow the thread over here https://issues.redhat.com/browse/LOG-1868 to get further updates on the investigation for this issue. *** This bug has been marked as a duplicate of bug 1985826 *** The needinfo request[s] on this closed bug have been removed as they have been unresolved for 500 days |
Description of problem: Elaticsearch pods are reporting below warning: [2021-08-31T18:15:04,239][WARN ][r.suppressed ] [elasticsearch-cdm-lp4bg7d4-1] path: /_alias/infra-write, params: {name=infra-write} org.elasticsearch.transport.RemoteTransportException: [elasticsearch-cdm-lp4bg7d4-2][10.102.12.96:9300][indices:admin/aliases/get] Caused by: org.elasticsearch.ElasticsearchSecurityException: _opendistro_security_dls_query does not match (SG 900D) at com.amazon.opendistroforelasticsearch.security.privileges.DlsFlsEvaluator.evaluate(DlsFlsEvaluator.java:128) ~[?:?] at com.amazon.opendistroforelasticsearch.security.privileges.PrivilegesEvaluator.evaluate(PrivilegesEvaluator.java:443) ~[?:?] at com.amazon.opendistroforelasticsearch.security.filter.OpenDistroSecurityFilter.apply0(OpenDistroSecurityFilter.java:287) ~[?:?] All the elasticsearch-im jobs are completed successfully: $ oc -nopenshift-logging get jobs NAME COMPLETIONS DURATION AGE curator-1630467000 1/1 4s 15h elasticsearch-im-app-1630522800 1/1 4s 7m19s elasticsearch-im-audit-1630522800 1/1 4s 7m19s elasticsearch-im-infra-1630522800 1/1 4s 7m19s - Health of elasticsearch cluster is green. - Fluentd doesn't have any stuck buffers. - There is no time delay while viewing logs in kibana. - Elasticsearch and ClusterLogging operators are using 4.6 stable channel in subscription Version-Release number of selected component (if applicable): 4.6.43 How reproducible: NA Steps to Reproduce: 1. NA 2. 3. Actual results: Elasticsearch pod logs show below warning: [2021-08-31T18:15:04,239][WARN ][r.suppressed ] [elasticsearch-cdm-lp4bg7d4-1] path: /_alias/infra-write, params: {name=infra-write} org.elasticsearch.transport.RemoteTransportException: [elasticsearch-cdm-lp4bg7d4-2][10.102.12.96:9300][indices:admin/aliases/get] Caused by: org.elasticsearch.ElasticsearchSecurityException: _opendistro_security_dls_query does not match (SG 900D) Expected results: Elasticsearch should not report above said warning. Additional info: