Opensearch does not refresh AWS Web Identity Token

OpenSearch
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
2.13 (2.19.0 chart version)

Describe the issue:
Opensearch does not refresh AWS Web Identity Token. Repository-s3 fails to take a snapshot when AWS Web Identity Token expires. The only way to refresh it is to restart all master and data nodes.

Configuration:
opensearch:
plugins:
enabled: true
installList:
…
- ‘repository-s3’
extraEnvs:
…
- name: AWS_WEB_IDENTITY_TOKEN_FILE
value: ‘/usr/share/opensearch/config/irsa-token’
extraVolumeMounts:
- mountPath: /usr/share/opensearch/config/irsa-token
name: aws-iam-token
readOnly: true
subPath: token
config:
s3.client.default.region: us-west-2
s3.client.default.endpoint: s3.us-west-2.amazonaws.com
s3.client.default.identity_token_file: /usr/share/opensearch/config/irsa-token
keystore:
- secretName: opensearch-keystore
extraObjects:

  • apiVersion: v1
    kind: Secret
    metadata:
    name: opensearch-keystore
    type: Opaque
    data:
    s3.client.default.role_arn: #segamega
    s3.client.default.role_session_name: #bujaga

Relevant Logs or Screenshots:
“Token expired: current date/time 1730190842 must be before the expiration date/time 1729863829 (Service: Sts, Status Code: 400, Request ID…”

2

@sblatnjak could you please open an issue here [1] ? Thank you.

[1] Issues · opensearch-project/OpenSearch · GitHub

3

Done
Thanks @reta