# Does an execution of securityadmin.sh on one node is enough to update the configuration of the whole cluster? **URL:** \ **Category:** Security\ **Created:** [May 6, 2021, 9:35am UTC](https://forum.opensearch.org/t/does-an-execution-of-securityadmin-sh-on-one-node-is-enough-to-update-the-configuration-of-the-whole-cluster/5853 "2021-05-06T09:35:59Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Kamikague](https://avatars.discourse-cdn.com/v4/letter/k/e79b87/32.png) [@Kamikague](https://forum.opensearch.org/u/Kamikague)\ **Post date:** [May 6, 2021, 9:35am UTC](https://forum.opensearch.org/t/does-an-execution-of-securityadmin-sh-on-one-node-is-enough-to-update-the-configuration-of-the-whole-cluster/5853/1 "2021-05-06T09:35:59Z")
Hi I run the securityadmin.sh (option -cd) script to deploy modifications done on security configuration files such as roles.yml, roles\_mapping.yml, config.yml and so no. Using a script I trigger the execution of the securityadmin.sh script on all data, master and client nodes from outside of the node (using ssh or kubectl exec for k8s) As a result I get some node sending the folliwing output > Open Distro Security Admin v7 > Will connect to localhost:9300 … done > Connected as CN=kirk,OU=client,O=client,L=test,C=de > Elasticsearch Version: 7.10.2 > Open Distro Security Version: 1.13.1.0 > Contacting elasticsearch cluster ‘elasticsearch’ and wait for YELLOW clusterstate … > Clustername: elasticsearch > Clusterstate: YELLOW > Number of nodes: 3 > Number of data nodes: 1 > .opendistro\_security index already exists, so we do not need to create one. > Populate config from /usr/share/elasticsearch/plugins/opendistro\_security/securityconfig/ > Will update ‘\_doc/config’ with /usr/share/elasticsearch/plugins/opendistro\_security/securityconfig/config.yml > SUCC: Configuration for ‘config’ created or updated > Will update ‘\_doc/roles’ with /usr/share/elasticsearch/plugins/opendistro\_security/securityconfig/roles.yml > SUCC: Configuration for ‘roles’ created or updated > Will update ‘\_doc/rolesmapping’ with /usr/share/elasticsearch/plugins/opendistro\_security/securityconfig/roles\_mapping.yml > SUCC: Configuration for ‘rolesmapping’ created or updated > Will update ‘\_doc/internalusers’ with /usr/share/elasticsearch/plugins/opendistro\_security/securityconfig/internal\_users.yml > SUCC: Configuration for ‘internalusers’ created or updated > Will update ‘\_doc/actiongroups’ with /usr/share/elasticsearch/plugins/opendistro\_security/securityconfig/action\_groups.yml > SUCC: Configuration for ‘actiongroups’ created or updated > Will update ‘\_doc/tenants’ with /usr/share/elasticsearch/plugins/opendistro\_security/securityconfig/tenants.yml > SUCC: Configuration for ‘tenants’ created or updated > Will update ‘\_doc/nodesdn’ with /usr/share/elasticsearch/plugins/opendistro\_security/securityconfig/nodes\_dn.yml > SUCC: Configuration for ‘nodesdn’ created or updated > Will update ‘\_doc/whitelist’ with /usr/share/elasticsearch/plugins/opendistro\_security/securityconfig/whitelist.yml > SUCC: Configuration for ‘whitelist’ created or updated > Will update ‘\_doc/audit’ with /usr/share/elasticsearch/plugins/opendistro\_security/securityconfig/audit.yml > SUCC: Configuration for ‘audit’ created or updated > Done with success While others send the following output > Open Distro Security Admin v7 > Will connect to localhost:9300 … done > command terminated with exit code 137 As a result the updated configuration is well deployed and usable on kibana My questions are two fold, 1. what does return code 137 means for securityadmin.sh ? 2. Does an execution of securityadmin.sh on one node is enough to update the configuration of the whole cluster ? ---
**Author:** ![spapadop](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/spapadop/32/950_2.png) [@spapadop](https://forum.opensearch.org/u/spapadop)\ **Post date:** [May 6, 2021, 12:27pm UTC](https://forum.opensearch.org/t/does-an-execution-of-securityadmin-sh-on-one-node-is-enough-to-update-the-configuration-of-the-whole-cluster/5853/2 "2021-05-06T12:27:28Z")
1. No idea, maybe you could run the script with [–diagnose](https://opendistro.github.io/for-elasticsearch-docs/docs/troubleshoot/security-admin/#use-the-diagnose-option) option, hopefully it will give you some more insight. 2. Yes, running securityadmin.sh on one node is enough. ---
**Author:** ![oscark](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/oscark/32/866_2.png) [@oscark](https://forum.opensearch.org/u/oscark)\ **Post date:** [May 7, 2021, 2:19pm UTC](https://forum.opensearch.org/t/does-an-execution-of-securityadmin-sh-on-one-node-is-enough-to-update-the-configuration-of-the-whole-cluster/5853/3 "2021-05-07T14:19:06Z")
I’m not sure but 137 at least sometimes is the OS that killed the process for example OOM-killer. Are you low on memory? At least OOM-killer should be visible in /var/log/messages in CentOS but I’m not sure how it works in k8s. ---
**Author:** ![blaklabz](https://avatars.discourse-cdn.com/v4/letter/b/73ab20/32.png) [@blaklabz](https://forum.opensearch.org/u/blaklabz)\ **Post date:** [September 7, 2021, 8:48pm UTC](https://forum.opensearch.org/t/does-an-execution-of-securityadmin-sh-on-one-node-is-enough-to-update-the-configuration-of-the-whole-cluster/5853/4 "2021-09-07T20:48:59Z")
Hey, looks like you are able to get this working. I’m having trouble getting any of the configurations to be set. How did you get this working? Is there a copy of your working values.yaml that I can take a look at? I can get this thing running on stand alone node, but having a tough time with kubernetes.