Support for updating security.json through Operator / Helm
- Dominant language
- Go
- Stars
- 283
- Forks
- 148
- PR merge metrics
- No merged PRs in 30d
Description
A user can now bootstrap `security.json` through operator, even by providing the raw `security.json` file in a Secret that will be uploaded to ZK on first Solr Pod start through an init-container.
Users may want to also manage changes to `security.json` in the same manner, i.e. if they use GitOps. This won't work today, as the `bootstrapSecurityJson` feature only works if `security.json` is missing in ZK. So a workaround now is to delete the file manually from Zk and then trigger a restart of a Solr Pod, which will then bootstrap security once again.
I'm not suggesting to change default behavior, as the pure 1st-time boostrap feature is useful for those who just want to bootstrap and then continue editing security through Solr's Auth APIs or AdminUI's nice Securty editor.
My proposal is therefore to add an `overwrite: true` property to existing `bootstrapSecurityJson`, which would cause an upload on every node restart. We'd still need to figure out a way to trigger the upload anytime the Secret changes.
```yaml
bootstrapSecurityJson:
name: security-json-secret
key: security_json
overwrite: true
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start at the operator's bootstrapSecurityJson handling, including the init-container upload path and the Helm values shown in the issue. Trace how Secret changes or Solr Pod restarts are detected. Done means an optional overwrite setting can upload security.json beyond first bootstrap without changing the existing default behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, helm, kubernetes
- Domain
- devops, infrastructure, search
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100