# Opensearch cluster keep restart after setting securityconfig **URL:** \ **Category:** OpenSearch\ **Tags:** troubleshoot, configure\ **Created:** [August 28, 2024, 7:43am UTC](https://forum.opensearch.org/t/opensearch-cluster-keep-restart-after-setting-securityconfig/21003 "2024-08-28T07:43:29Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![harlan262612](https://avatars.discourse-cdn.com/v4/letter/h/50afbb/32.png) [@harlan262612](https://forum.opensearch.org/u/harlan262612)\ **Post date:** [August 28, 2024, 7:43am UTC](https://forum.opensearch.org/t/opensearch-cluster-keep-restart-after-setting-securityconfig/21003/1 "2024-08-28T07:43:29Z")
**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser): ([helm-charts | ☸ A community repository for Helm Charts of OpenSearch Project.](https://opensearch-project.github.io/helm-charts)) I’m using official helm chart to install both the cluster and dashboard. opensearch cluster ver: 2.16 dashboard ver: 2.16 **Describe the issue** : After I have configured the securityconfig, it did not take effect. The cluster is still using the demo config, and the cluster pod keeps restarting infinitely during the init phase (single-node). The log is as follows and keep repeat it: ```auto Enabling OpenSearch Security Plugin Enabling execution of install_demo_configuration.sh for OpenSearch Security Plugin OpenSearch 2.12.0 onwards, the OpenSearch Security Plugin a change that requires an initial password for 'admin' user. Please define an environment variable 'OPENSEARCH_INITIAL_ADMIN_PASSWORD' with a strong password string. If a password is not provided, the setup will quit. For more details, please visit: https://opensearch.org/docs/latest/install-and-configure/install-opensearch/docker/ ### OpenSearch Security Demo Installer ### **Warning: Do not use on production or public reachable systems** OpenSearch install type: rpm/deb on Linux 5.10.220-209.869.amzn2.x86_64 amd64 OpenSearch config dir: /usr/share/opensearch/config/ OpenSearch config file: /usr/share/opensearch/config/opensearch.yml OpenSearch bin dir: /usr/share/opensearch/bin/ OpenSearch plugins dir: /usr/share/opensearch/plugins/ OpenSearch lib dir: /usr/share/opensearch/lib/ Detected OpenSearch Version: 2.16.0 Detected OpenSearch Security Version: 2.16.0.0 ``` **Configuration** : config.yaml: ```auto securityConfig: enabled: true path: "/usr/share/opensearch/config/opensearch-security" actionGroupsSecret: configSecret: internalUsersSecret: rolesSecret: rolesMappingSecret: tenantsSecret: config: securityConfigSecret: "" dataComplete: true data: roles_mapping.yml: |- _meta: type: "rolesmapping" config_version: 2 all_access: reserved: true hidden: false backend_roles: - "admin" - "all_access" users: - "email@xxx.com" description: "Maps an openid user to all_access" config.yml: |- _meta: type: "config" config_version: 2 config: dynamic: http: anonymous_auth_enabled: false authc: basic_internal_auth_domain: http_enabled: true transport_enabled: true order: 0 http_authenticator: type: basic challenge: true authentication_backend: type: intern openid_auth_domain: http_enabled: true transport_enabled: true order: 1 http_authenticator: type: openid challenge: false config: subject_key: email roles_key: roles openid_connect_url: https://accounts.google.com/.well-known/openid-configuration jwt_header: Authorization openid_connect_idp: enable_ssl: false authentication_backend: type: noop ``` dashboard.yml: ```auto opensearch_dashboards.yml: | opensearch.hosts: ["https://my-opensearch-cluster-domain:9200"] opensearch.ssl.verificationMode: none opensearch.username: admin opensearch.password: xxxxx opensearch.requestHeadersAllowlist: ["securitytenant","Authorization"] opensearch_security.multitenancy.enabled: false opensearch_security.readonly_mode.roles: ["readall"] opensearch_security.cookie.secure: false server.host: "0.0.0.0" opensearch_security.auth.multiple_auth_enabled: true opensearch_security.auth.type: ["openid", "basicauth"] opensearch_security.openid.connect_url: "https://accounts.google.com/.well-known/openid-configuration" opensearch_security.openid.client_id: "xxxxx opensearch_security.openid.client_secret: "xxxxx opensearch_security.openid.verify_hostnames: false opensearch_security.openid.refresh_tokens: false opensearch_security.openid.base_redirect_url: "https://my-opensearch-dashboard-domain" **Relevant Logs or Screenshots** : ``` ---
**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\ **Post date:** [August 28, 2024, 10:01am UTC](https://forum.opensearch.org/t/opensearch-cluster-keep-restart-after-setting-securityconfig/21003/2 "2024-08-28T10:01:45Z")
Hi @harlan262612 , Have you added `OPENSEARCH_INITIAL_ADMIN_PASSWORD` to your values.yaml ? ---
**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\ **Post date:** [August 28, 2024, 10:06am UTC](https://forum.opensearch.org/t/opensearch-cluster-keep-restart-after-setting-securityconfig/21003/3 "2024-08-28T10:06:34Z")
If not, please have a have a look at the following example: > **[Helm](https://opensearch.org/docs/latest/install-and-configure/install-opensearch/helm/)** > > Helm ---
**Author:** ![merlinz01](https://avatars.discourse-cdn.com/v4/letter/m/b77776/32.png) [@merlinz01](https://forum.opensearch.org/u/merlinz01)\ **Post date:** [August 28, 2024, 4:40pm UTC](https://forum.opensearch.org/t/opensearch-cluster-keep-restart-after-setting-securityconfig/21003/4 "2024-08-28T16:40:28Z")
I’m not familiar with Kubernetes installation process, but is it running `plugins/opensearch-security/tools/securityadmin.sh` after updating `config.yml`? ---
**Author:** ![crossRT](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/crossrt/32/8712_2.png) [@crossRT](https://forum.opensearch.org/u/crossRT)\ **Post date:** [February 2, 2025, 8:19am UTC](https://forum.opensearch.org/t/opensearch-cluster-keep-restart-after-setting-securityconfig/21003/5 "2025-02-02T08:19:01Z")
hi there, recently i setup a new opensearch cluster with newer version and i get the same issue u had. not sure if my solution works for u. the installation stuck right after `Detected OpenSearch Security Version: xxx` and the pods keep restarting. no further exception is being thrown. i managed to figure out the root cause of this. it’s due to missing `securityConfig.config.data`. u may refer to [Modifying the YAML files - OpenSearch Documentation](https://opensearch.org/docs/latest/security/configuration/yaml/) for me, i have to specifically configure all the \*.yml files in `securityConfig.config.data`. once the \*.yml files are provided, u will notice the installation no longer stuck on the logs `Detected OpenSearch Security Version: xxx` and it continues to setup. btw, if `OPENSEARCH_INITIAL_ADMIN_PASSWORD` is not provided, the logs will explicitly mention it and the installation will quit. at the beginning i was confused with the potential issue everyone said that `OPENSEARCH_INITIAL_ADMIN_PASSWORD` is not provided. but end up i found it’s different error.