Issue
## Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
- OpenSearch Version: 2.15.0
## Describe the issue:
We are experiencing an issue with the OpenSearch cluster where the transport client authentication is no longer supported, leading to repeated `OpenSearchException` errors in the log files.
## Configuration:
Here is the relevant portion of our configuration file:
---
clusterName: "opensearch-cluster"
nodeGroup: "master"
discovery.seed_hosts: ["opensearch-cluster-master-0", "opensearch-cluster-master-1"]
singleNode: false
masterService: "opensearch-cluster-master"
roles:
- cluster_manager
- ingest
- data
- remote_cluster_client
replicas: 2
global:
dockerRegistry: ""
opensearchHome: /usr/share/opensearch
config:
opensearch.yml: |
cluster.name: opensearch-cluster
http.host: "0.0.0.0"
# Configurazione SSL/TLS per il trasporto
plugins.security.ssl.transport.enabled: true
plugins.security.ssl.transport.pemcert_filepath: /usr/share/opensearch/config/certs/node1.pem
plugins.security.ssl.transport.pemkey_filepath: /usr/share/opensearch/config/certs/node1-key.pem
plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/opensearch/config/certs/root-ca-node1.pem
# Configurazione SSL/TLS per HTTP
plugins.security.ssl.http.enabled: true
plugins.security.ssl.http.pemcert_filepath: /usr/share/opensearch/config/certs/node1.pem
plugins.security.ssl.http.pemkey_filepath: /usr/share/opensearch/config/certs/node1-key.pem
plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/opensearch/config/certs/root-ca-node1.pem
# # Configurazione dei DN autorizzati
plugins.security.nodes_dn:
- "CN=opensearch-cluster-master:9300,OU=..., O=..., L=..., ST=..., C=..."
# Altre impostazioni di sicurezza
plugins.security.allow_unsafe_democertificates: true
plugins.security.allow_default_init_securityindex: true
plugins.security.authcz.admin_dn:
- "CN=ADMIN, OU=..., O=..., L=..., ST=..., C=..."
plugins.security.audit.type: internal_opensearch
plugins.security.enable_snapshot_restore_privilege: true
plugins.security.check_snapshot_restore_write_privileges: true
plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]
plugins.security.system_indices.enabled: true
plugins.security.system_indices.indices: [ ".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opendistro-notifications-*", ".opendistro-notebooks", ".opendistro-asynchronous-search-response*"]
logger.org.opensearch.transport: DEBUG
logger.org.opensearch.security: DEBUG
extraEnvs:
- name: "OPENSEARCH_INITIAL_ADMIN_PASSWORD"
value: "<REDACTED>"
- name: DISABLE_INSTALL_DEMO_CONFIG
value: "true"
envFrom: []
secretMounts:
- name: open-certificates
secretName: open-certificates
path: /usr/share/opensearch/config/certs/
hostAliases: []
image:
repository: "opensearchproject/opensearch"
tag: "2.15.0"
pullPolicy: "IfNotPresent"
podAnnotations: {}
openSearchAnnotations: {}
labels: {}
opensearchJavaOpts: "-Xmx512M -Xms512M"
resources:
requests:
cpu: "1000m"
memory: "100Mi"
initResources: {}
sidecarResources: {}
networkHost: "0.0.0.0"
rbac:
create: false
serviceAccountAnnotations: {}
serviceAccountName: ""
automountServiceAccountToken: false
podSecurityPolicy:
create: false
name: ""
spec:
privileged: true
fsGroup:
rule: RunAsAny
runAsUser:
rule: RunAsAny
seLinux:
rule: RunAsAny
supplementalGroups:
rule: RunAsAny
volumes:
- secret
- configMap
- persistentVolumeClaim
- emptyDir
persistence:
enabled: true
enableInitChown: true
labels:
enabled: false
accessModes:
- ReadWriteOnce
size: 8Gi
annotations: {}
extraVolumes: []
extraVolumeMounts: []
extraContainers: []
extraInitContainers: []
priorityClassName: ""
antiAffinityTopologyKey: "kubernetes.io/hostname"
antiAffinity: "soft"
customAntiAffinity: {}
nodeAffinity: {}
podAffinity: {}
topologySpreadConstraints: []
podManagementPolicy: "Parallel"
enableServiceLinks: true
protocol: https
httpPort: 9200
transportPort: 9300
metricsPort: 9600
httpHostPort: ""
transportHostPort: ""
service:
labels: {}
labelsHeadless: {}
headless:
annotations: {}
type: ClusterIP
nodePort: ""
annotations: {}
httpPortName: http
transportPortName: transport
metricsPortName: metrics
loadBalancerIP: ""
loadBalancerSourceRanges: []
externalTrafficPolicy: ""
updateStrategy: RollingUpdate
maxUnavailable: 1
podSecurityContext:
fsGroup: 1000
runAsUser: 1000
securityContext:
capabilities:
drop:
- ALL
runAsNonRoot: true
runAsUser: 1000
securityConfig:
enabled: true
path: "/usr/share/opensearch/config/opensearch-security"
config:
data:
config.yml: |
_meta:
type: "config"
config_version: 2
config:
dynamic:
authc:
basic_internal_auth_domain:
http_enabled: true
transport_enabled: true
order: 0
http_authenticator:
type: basic
challenge: false
authentication_backend:
type: internal
openid_auth_domain:
http_enabled: true
transport_enabled: true
order: 1
http_authenticator:
type: openid
challenge: false
config:
subject_key: admin
openid_connect_url: https://keycloak.example.com/realms/master/.well-known/openid-configuration
authentication_backend:
type: noop
terminationGracePeriod: 120
sysctlVmMaxMapCount: 262144
startupProbe:
tcpSocket:
port: 9200
initialDelaySeconds: 5
periodSeconds: 10
timeoutSeconds: 3
failureThreshold: 30
livenessProbe: {}
readinessProbe:
tcpSocket:
port: 9200
periodSeconds: 5
timeoutSeconds: 3
failureThreshold: 3
schedulerName: ""
imagePullSecrets: []
nodeSelector: {}
tolerations: []
ingress:
enabled: false
ingressClassName: nginx
path: /
hosts:
- opensearch.example.local
tls:
- hosts:
- opensearch.example.local
annotations:
nginx.ingress.kubernetes.io/proxy-connect-timeout: "60s"
nginx.ingress.kubernetes.io/proxy-read-timeout: "600s"
nginx.ingress.kubernetes.io/proxy-send-timeout: "600s"
nginx.ingress.kubernetes.io/proxy-buffering: "on"
nginx.ingress.kubernetes.io/proxy-buffer-size: "64k"
nameOverride: ""
fullnameOverride: ""
masterTerminationFix: false
opensearchLifecycle: {}
lifecycle: {}
keystore: []
networkPolicy:
create: false
http:
enabled: false
sysctl:
enabled: false
sysctlInit:
enabled: false
plugins:
enabled: true
installList: []
extraObjects: []
Relevant Logs
## Relevant Logs or Screenshots:
Below are the error logs indicating the issue:
```plaintext
opensearch [2024-07-22T12:07:33,202][ERROR][o.o.s.t.SecurityRequestHandler] [opensearch-cluster-master-1] OpenSearchException[Transport client authentication no longer supported.]
opensearch [2024-07-22T12:07:34,202][ERROR][o.o.s.t.SecurityRequestHandler] [opensearch-cluster-master-1] OpenSearchException[Transport client authentication no longer supported.]
opensearch [2024-07-22T12:07:35,205][ERROR][o.o.s.t.SecurityRequestHandler] [opensearch-cluster-master-1] OpenSearchException[Transport client authentication no longer supported.]
opensearch [2024-07-22T12:07:36,204][ERROR][o.o.s.t.SecurityRequestHandler] [opensearch-cluster-master-1] OpenSearchException[Transport client authentication no longer supported.]
opensearch [2024-07-22T12:07:37,203][ERROR][o.o.s.t.SecurityRequestHandler] [opensearch-cluster-master-1] OpenSearchException[Transport client authentication no longer supported.]
opensearch [2024-07-22T12:07:38,205][ERROR][o.o.s.t.SecurityRequestHandler] [opensearch-cluster-master-1] OpenSearchException[Transport client authentication no longer supported.]
opensearch [2024-07-22T12:07:39,204][ERROR][o.o.s.t.SecurityRequestHandler] [opensearch-cluster-master-1] OpenSearchException[Transport client authentication no longer supported.]
opensearch [2024-07-22T12:07:40,203][ERROR][o.o.s.t.SecurityRequestHandler] [opensearch-cluster-master-1] OpenSearchException[Transport client authentication no longer supported.]
opensearch [2024-07-22T12:07:41,110][DEBUG][o.o.s.c.ConfigurationRepository] [opensearch-cluster-master-1] Unable to load configuration due to java.util.concurrent.TimeoutException: Timeout after 10SECONDS while retrieving configuration for [ACTIONGROUPS, ALLOWLIST, AUDIT, CONFIG, INTERNALUSERS, NODESDN, ROLES, ROLESMAPPING, TENANTS, WHITELIST](index=.opendistro_security)
I tried everything but i can’t fix this error. Can someone help me please?
