Repository-gcs plugin not working

OpenSearch
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
opensearch: 2.10.0
repository-gcs: 2.10.0

Describe the issue:
Hi All,
i am trying to configure gcs plugin for Opensearch snapshot. when i hardcode it on docker image it works fine.
but when i try to do the same via helm chart i am facing the issue. please find the below details for the same.

Configuration:
values.yaml

extraInitContainers:
  - name: install-plugin
    image: "opensearchproject/opensearch:2.10.0"
    imagePullPolicy: "IfNotPresent"
    command:
      - /bin/sh
      - "-c"
      - |
        ./bin/opensearch-plugin list | grep repository-gcs
        [[ $? -ne 0 ]] && ./bin/opensearch-plugin install --batch "https://artifacts.opensearch.org/releases/plugins/repository-gcs/2.10.0/repository-gcs-2.10.0.zip" || true
         sleep 3
    volumeMounts:
    - name: plugins
      mountPath: /usr/share/opensearch/plugins

extraVolumeMounts:
  - name: plugins
    mountPath: /usr/share/opensearch/plugins
    readOnly: false

extraVolumes:
   - name: plugins
     emptyDir: {}

and i am getting the below output for the init container.


-> Installing https://artifacts.opensearch.org/releases/plugins/repository-gcs/2.10.0/repository-gcs-2.10.0.zip
-> Downloading https://artifacts.opensearch.org/releases/plugins/repository-gcs/2.10.0/repository-gcs-2.10.0.zip
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@     WARNING: plugin requires additional permissions     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
* java.lang.RuntimePermission accessDeclaredMembers
* java.lang.RuntimePermission setFactory
* java.lang.reflect.ReflectPermission suppressAccessChecks
* java.net.NetPermission setDefaultAuthenticator
* java.net.SocketPermission * connect,resolve
See http://docs.oracle.com/javase/8/docs/technotes/guides/security/permissions.html
for descriptions of what these permissions allow and the associated risks.
-> Installed repository-gcs with folder name repository-gcs

Relevant Logs or Screenshots:
but opensearch container is going CrashLoopBackOff with below error.

[2023-11-10T02:39:28,450][ERROR][o.o.b.OpenSearchUncaughtExceptionHandler] [opensearch-cluster-master-0] uncaught exception in thread [main]
org.opensearch.bootstrap.StartupException: java.lang.IllegalArgumentException: unknown setting [plugins.security.ssl.transport.pemkey_filepath] please check that any required plugins are installed, or check the breaking changes documentation for removed settings
        at org.opensearch.bootstrap.OpenSearch.init(OpenSearch.java:184) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.bootstrap.OpenSearch.execute(OpenSearch.java:171) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:104) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.cli.Command.mainWithoutErrorHandling(Command.java:138) ~[opensearch-cli-2.10.0.jar:2.10.0]
        at org.opensearch.cli.Command.main(Command.java:101) ~[opensearch-cli-2.10.0.jar:2.10.0]
        at org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:137) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:103) ~[opensearch-2.10.0.jar:2.10.0]
Caused by: java.lang.IllegalArgumentException: unknown setting [plugins.security.ssl.transport.pemkey_filepath] please check that any required plugins are installed, or check the breaking changes documentation for removed settings
        at org.opensearch.common.settings.AbstractScopedSettings.validate(AbstractScopedSettings.java:608) ~[opensearch-2.10.0.jar:2.10.0]
        at org.opensearch.common.settings.AbstractScopedSettings.validate(AbstractScopedSettings.java:549) ~[opensearch-2.10.0.jar:2.10.0]

can someone please help here.
Thanks in advance.

2

@arun_udaiyar The error doesn’t regard the gcs plugin. OpenSearch complains about plugins.security.ssl.transport.pemkey_filepath setting that is configured in opensearch.yml.

This could be caused by a disabled security plugin.

You have two choices here, either comment out this option in the opensearch.yml (not recommended) or enable the security plugin (recommended).

3

Hi @pablo ,
Thanks for your response.

i have removed the init-container and deployed the cluster which works fine. seems like the mount path directory just having gsc plugin.

#kubectl exec -it opensearch-cluster-master-0 -n namespace – ls -lrth /usr/share/opensearch/plugins

Defaulted container "opensearch" out of: opensearch, fsgroup-volume (init), sysctl (init), install-plugin (init)
total 4.0K
drwxr-xr-x 2 opensearch opensearch 4.0K Nov 13 11:50 repository-gcs
Defaulted container "opensearch" out of: opensearch, fsgroup-volume (init), sysctl (init), install-plugin (init)

when i use the mount path all other plugins were removed i guess any suggestion on this.

4

Hi @pablo
My bad, i missed the below configuration on helm chart.

plugins:
  enabled: true
  installList:
     - https://artifacts.opensearch.org/releases/plugins/repository-gcs/2.10.0/repository-gcs-2.10.0.zip

It works fine. Thank you.