[BUG] Installing OpenSearch, the prompt "Unable to read the file root-ca.pem." appears. #642
Comments
tianxin8206
added
bug
|
Transferring to helm-charts repo. |
|
@tianxin8206 Are you deploying with changes to the values? Can you provide the values you're using? Specifically, are you disabling the demo installation / demo stuff via the env? If you do this, it will not run the demo configuration script, resulting in you needing to provide your own certificates for transport SSL between the nodes. |
|
@DandyDeveloper I modified the value of OPENSEARCH_INITIAL_ADMIN_PASSWORD as required in the document, and made no other changes.These are my values. |
|
I have the same problem. I added only: OPENSEARCH_INITIAL_ADMIN_PASSWORD and storageClass: MyNameHere Chart version: 2.30.1 Also I have tested charts 2.27.1 and 2.26.1 - similar situation. Probably it some kind of infra issue, but i have no idea what kind of. In my case one of three pods is running, but another two have status CrashLoopBackOff. |
|
@scobit Can you tell me a little more about your k8s cluster? The fact its other nodes, might mean:
Just as an example, I've got a rootless implementation of Minikube running locally and I've used your values and it's working fine: Something to try - Override the Then, exec into the failing nodes and see what's in dir: |
|
I have the same problem. |
|
@gurlov Throw me a complete node log please, looks to me like the demo stuff is failing for some reason. |
|
@DandyDeveloper with the section |
|
@DandyDeveloper in my case, using this code for StatefulSet: And running these commands: I figured out that every pod at start has this file. But after some time one of the pods changed status to failed. I am using k8s by RKE v2.10. Above test was without persistence storage. |
This line suggests to me that you're doing something with the I don't get this on my local env, and specifically this will be the reason no certificates are being provisioned. Are you absolutely sure you're not editing the opensearch.yml in some way? Maybe you have an older persisted volume that shouldn't be there and inherited some bad values? |
|
I encountered the same problem using the helm chart of the version 2.30.1. # such as opensearch.yml and log4j2.properties
config:
opensearch.yml: |
cluster.name: opensearch-cluster
# Bind to all interfaces because we don't know what IP address Docker will assign to us.
network.host: 0.0.0.0
# Setting network.host to a non-loopback address enables the annoying bootstrap checks. "Single-node" mode disables them again.
# Implicitly done if ".singleNode" is set to "true".
# discovery.type: single-node
# Start OpenSearch Security Demo Configuration
# WARNING: revise all the lines below before you go into production
plugins:
security:
ssl:
# transport:
# pemcert_filepath: esnode.pem
# pemkey_filepath: esnode-key.pem
# pemtrustedcas_filepath: root-ca.pem
# enforce_hostname_verification: false
http:
enabled: false
# pemcert_filepath: esnode.pem
# pemkey_filepath: esnode-key.pem
# pemtrustedcas_filepath: root-ca.pem
# allow_unsafe_democertificates: trueAnd : extraEnvs:
# - name: MY_ENVIRONMENT_VAR
# value: the_value_goes_here
# Chart version 2.18.0 and App Version OpenSearch 2.12.0 onwards a custom strong password needs to be provided in order to setup demo admin user.
# Cluster will not spin-up without this unless demo config install is disabled.
- name: OPENSEARCH_INITIAL_ADMIN_PASSWORD
value: Knowdee666Excluding the config above ,I didn't change any other configuration. |
|
@cyxinda In your example, the problem makes sense: You've configured things that would exclude the demo provisioning and tried to disable the TLS transport options. You cannot disable these. You must have SSL transport enabled. With this, you'll need to provision your own self-signed certificates and mount them into the nodes for transport SSL. |
|
@DandyDeveloper Then, exec into the failing nodes and see what's in dir: /usr/share/opensearch/config/root-ca.pem Where does opensearch look for root-ca.pem? at /usr/share/opensearch/config/ or /usr/share/opensearch/config/certs/ ? |
What is the bug?
Installing opensearch with helm did not start properly.
How can one reproduce the bug?
Steps to reproduce the behavior:
What is the expected behavior?
The program starts normally.
What is your host/environment?
Do you have any screenshots?
Do you have any additional context?
It looks like opensearch-project/security#4923 .Please confirm that the BUG has been fixed.
The text was updated successfully, but these errors were encountered: