.opendistro_security index blocks "read_only_allow_delete"

Security
1

subj
And nobody has permission for change settings

PUT .opendistro_security/_settings
{
  "index": {
    "blocks": {
      "read_only_allow_delete": "false"
    }
  }
}

"type": "security_exception",
    "reason": "no permissions for [] and User [name=admin, roles=[admin], requestedTenant=null]"

What can I do?
One way: export current config with securityadmin, delete index and recreate. May be exists more simple way?

2

Can you try to add opendistro_security.disabled: true in to elasticsearch.yml
Than restart elasticsearch and

    curl -u <user>:<password> -XPUT 'http://<your_host_ip>:9200/_settings' -H 'Content-Type: application/json' -d'
    {
    "index": {
    "blocks": {
    "read_only_allow_delete": "false"
    }
    }
    }
    '

And don`t forget to comment opendistro_security.disabled: true after all

3

Must I restart cluster? all 14 nodes?

4

I think no. Just one node on which you will do this change. However you can try on one node and look on result.

5

Easiest way: use securityadmin.sh to export current config, delete index and recreate from config.
I think the option ‘set index.blocks.read_only_allow_delete: false’ in securityadmin.sh could be useful

6

curl -k --key admin.key --cert admin.crt -XPUT 'https://<<host_ip>>:9200/_settings' -H 'Content-Type: application/json' -d'{"index":{ "blocks": { "read_only_allow_delete": "false" } }}'

This is the best way if you have access to admin cert and key (client certificate).