readonlyrest-plugin break "cluster status" plugins about elasticsearch-readonlyrest-plugin HOT 19 CLOSED

I just tried kopf here. It prompted me to login...then I was good.

Thanks for this plugin. Kind of saved my bacon when management balked at the price of Shield.

from elasticsearch-readonlyrest-plugin.

I use this in elasticsearch:

# ADMIN
    - name: Accept admin user
      type: allow
      auth_key: admin:(password)

Then in kopf page, in the top right corner, i changed the server url to http://admin:(password)@es-server:9200

This should work.
if something fails, try to clean the cache, reset the url to the clean kopf url and try again...
kopf is always doing something in the background, so only really a clean full session will work, reusing one that failed somewhere will keep reusing the bad connection/config/cache and keeps nagging about the auth.

in your case, probably the esadmin user is reusing some bad cached data

Finally, make sure you applied the correct config to all the ES cluster. One bad config may put kopf and the other GUIs in a crazy loop

from elasticsearch-readonlyrest-plugin.

http://192.168.60.100:9200/_nodes/lgqV5l70QUG_aGH-N60CeQ/stats?all=1 also fails

the http returns this:

{error: {root_cause: [{type: "class_cast_exception",…}], type: "class_cast_exception",…}, status: 500}
error: {root_cause: [{type: "class_cast_exception",…}], type: "class_cast_exception",…}
reason: "org.elasticsearch.action.admin.indices.stats.CommonStatsFlags cannot be cast to [Ljava.lang.String;"
root_cause: [{type: "class_cast_exception",…}]
type: "class_cast_exception"
status: 500

from elasticsearch-readonlyrest-plugin.

I should definitely handle those exceptions. In the meanwhile I suggest you create another allow block with a uri_re rule that lets these requests go through.

Thanks for reporting!

from elasticsearch-readonlyrest-plugin.

Strange, after another restart round of all elastic search nodes, it started to work fine, without any change!!

Maybe some browser cache that expired or node/cluster state that was shared between nodes, but it was something that got cleanup after a restart.

Thanks for the help and for the plugin.

for me this can be closed, i don't know if you want to keep this open to handle this exception later on.

from elasticsearch-readonlyrest-plugin.

I made a new build (v1.9.0) that doesn't throw an exception when the request at hand refers to no indices (as in this example).
It's not yet possible to specify a behaviour for a specific class of actions (i.e. cluster:*). I probably need to create an "actions" rule soon and will have that and other things covered.

from elasticsearch-readonlyrest-plugin.

I think i also found why this was giving the error and the disappeared.

After a cluster restart, entering the kopf plugin will give errors about the nodes and cluster until the cluster is green and will fail totally... if i already have the kopf open and then restart the cluster, kopf will probably give errors in the background, but it will update the other fields, making it look as everything is working... and after the cluster is green, it will work as normal

so this might be a kopf (and other tools) bug, or just that your plugin is now logging those failed requests and without the plugin, they are just silently ignore?

Either way, the exception disappeared after the cluster is green, everything works.

from elasticsearch-readonlyrest-plugin.

I saw kopf supports http basic auth, why you're not using this feature?

On Thu, Mar 31, 2016 at 7:17 PM, Daniel Mota Leite <[email protected]

wrote:

I think i also found why this was giving the error and the disappeared.

After a cluster restart, entering the kopf plugin will give errors about
the nodes and cluster until the cluster is green and will fail totally...
if i already have the kopf open and then restart the cluster, kopf will
probably give errors in the background, but it will update the other
fields, making it look as everything is working... and after the cluster is
green, it will work as normal

so this might be a kopf (and other tools) bug, or just that your plugin is
now logging those failed requests and without the plugin, they are just
silently ignore?

Either way, the exception disappeared after the cluster is green,
everything works.

—
You are receiving this because you commented.
Reply to this email directly or view it on GitHub
#33 (comment)

from elasticsearch-readonlyrest-plugin.

as the browser was asking the auth, i never bother to check how kopf do it!! :)

i just enabled it and i will test

from elasticsearch-readonlyrest-plugin.

@danielmotaleite any luck with authenticated Kopf?

from elasticsearch-readonlyrest-plugin.

Thanks @sdcharle, glad to help. Apparently this thing saved a lot of people's bacon indeed. Proud of that.
Will close this issue.

from elasticsearch-readonlyrest-plugin.

Sorry about the delay
yes, just updated everything (full ELK stack+plugin) and everything is working fine. kopf after saving the auth do not give me errors any more

by the way, elasticsearch is now at 2.3.1 ...
i had to updated the file /usr/share/elasticsearch/plugins/readonlyrest/plugin-descriptor.properties manually to 2.3.1 😃

Thanks a lot for the help and for the plugin

from elasticsearch-readonlyrest-plugin.

Thanks for coming back on this one! I will make a new build today.

from elasticsearch-readonlyrest-plugin.

@danielmotaleite Build released! 🚀 (see #45)

from elasticsearch-readonlyrest-plugin.

Hi everyone,

I can't manage to make Kopf and other cluster management plugins (Elasticsearch-GUI for instance) work with ReadOnlyREST.
It keeps asking me for a user/pass.

Could you please explain the settings you used to make it work ?

from elasticsearch-readonlyrest-plugin.

@danielmotaleite would be really cool if you can share your experience! :)

from elasticsearch-readonlyrest-plugin.

I almost get what I need but I'm facing a strange behavior with the following settings :

- name: Kibana Server
  type: allow
  auth_key: server:XXXXX

- name: Kibana Admin (read write)
  type: allow
  kibana_access: rw
  auth_key: kibadmin:XXXXX

- name: Elasticsearch Admin
  type: allow
  auth_key: esadmin:XXXXX

With this configuration. I try to log into 2 different ES admin plugins : Kopf and "Elasticsearch GUI".
I can log to Elasticsearch GUI with usernames : server AND esadmin.
But i can only log to Kopf with "server" username.

I can't understand why...

from elasticsearch-readonlyrest-plugin.

I hate browsers 👎 Glad you made sense of it!

from elasticsearch-readonlyrest-plugin.

@danielmotaleite well said, thanks.
I'd add myself to the choir saying that when you're in a cluster environment all the configuration files and installed plugins should be identical, as readonly rest is not anymore working only on the REST interface (which is local), but on the internal ElasticSearch API and messages can be routed to any node.

from elasticsearch-readonlyrest-plugin.