I help the migration from 2.4.0 to 2.5.0 stopped all my service

OpenSearch
1

yesterday I downloaded docker version 2.5 and replaces only the version number in docker compose.
as it was at the end of the day I did not validate it.
today in the morning many desperate users.
Error lines in log:

1-
[2023-01-26T11:39:53,692][WARN ][stderr ] [bbsearch-d1] SLF4J: Failed to load class “org.slf4j.impl.StaticLoggerBinder”.

2-
[2023-01-26T11:40:45,414][ERROR][o.o.s.s.h.n.SecuritySSLNettyHttpServerTransport] [bbsearch-d1] Exception during establishing a SSL connection: javax.net.ssl.SSLHandshakeException: Received fatal alert: unknown_ca

3-
[2023-01-26T11:40:49,264][ERROR][o.o.s.a.BackendRegistry ] [bbsearch-d1] Not yet initialized (you may need to run securityadmin)

4-
[2023-01-26T11:41:02,459][ERROR][o.o.s.c.ConfigurationRepository] [search-d1] Cannot apply default config (this is maybe not an error!)

5- (this error keeps repeating)
[2023-01-26T11:41:02,465][ERROR][o.o.s.c.ConfigurationLoaderSecurity7] [bbsearch-d1] Exception while retrieving configuration for [INTERNALUSERS, ACTIONGROUPS, CONFIG, ROLES, ROLESMAPPING, TENANTS, NODESDN, WHITELIST, ALLOWLIST, AUDIT] (index=.opendistro_security)

I tried to downgrade and the error was this:

[2023-01-26T11:35:45,344][ERROR][o.o.b.OpenSearchUncaughtExceptionHandler] [search-d1] uncaught exception in thread [main]
org.opensearch.bootstrap.StartupException: java.lang.IllegalStateException: cannot downgrade a node from version [2.5.0] to version [2.4.0]

2

I tried to give the command
curl https://localhost:9200 -ku ‘admin:admin’
and the answer was
OpenSearch Security not initialized.

3

Hi @angelogabeira,
it seems that the main Problem is the SSL Connection between the Nodes.
Maybe you are not able to build a Cluster and therefor your Cluster doesn’t find the System Indices.
Can you please share your OpenSearch config and test to disable the Certificate verification?

4

Hello!

have you tried accessing a shell on the container and re-applying your security configuration using securityadm?

Here is the link to the OpenSearch article for troubleshooting OS Securityadm:

BR, AES