Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Stash thread context for every CRUD operation on .opendistro-job-scheduler-lock index #496

Closed
joshpalis opened this issue Sep 13, 2023 · 1 comment
Labels
enhancement New feature or request untriaged

Comments

@joshpalis
Copy link
Member

Is your feature request related to a problem?
Since Job Scheduler's lock index has been added to security plugin's list of protected indices (PR), it is necessary to stash the thread context for every CRUD operation on the lock index.

The following errors have been observed in dependent plugins that attempt to retrieve and release a lock from the lock index during job execution with security enabled.

org.opensearch.client.ResponseException: method [PUT], host [https://localhost:9200/], URI [_plugins/geospatial/ip2geo/datasource/updatedatasourceitnz], status line [HTTP/1.1 403 Forbidden]
    Warnings: [this request accesses system indices: [.opendistro-job-scheduler-lock], but in a future major version, direct access to system indices will be prevented by default]
    {"error":{"root_cause":[{"type":"security_exception","reason":"no permissions for [] and User [name=admin, backend_roles=[admin], requestedTenant=null]"}],"type":"security_exception","reason":"no permissions for [] and User [name=admin, backend_roles=[admin], requestedTenant=null]"},"status":403}
        at __randomizedtesting.SeedInfo.seed([2B29E33EB32391D4:5305C83A89F8B2E]:0)
        at app//org.opensearch.client.RestClient.convertResponse(RestClient.java:376)
        at app//org.opensearch.client.RestClient.performRequest(RestClient.java:346)
        at app//org.opensearch.client.RestClient.performRequest(RestClient.java:321)
        at app//org.opensearch.geospatial.GeospatialRestTestCase.createDatasource(GeospatialRestTestCase.java:122)
        at app//org.opensearch.geospatial.ip2geo.action.UpdateDatasourceIT.testUpdateDatasource_whenIncompatibleFields_thenFails(UpdateDatasourceIT.java:77)

Reference PR : #492

@joshpalis
Copy link
Member Author

Closing as Job Scheduler's opendistro-job-scheduler-lock index has been removed from the security plugin's list protected indices for 3.x/2.x: opensearch-project/security#3383

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request untriaged
Projects
None yet
Development

No branches or pull requests

1 participant