Default liveliness and readiness probes return 401
- Dominant language
- Go
- Stars
- 283
- Forks
- 148
- PR merge metrics
- No merged PRs in 30d
Description
I have installed the solr operator, and I'm now trying to install solr. To do so, I'm using the chart i found [here](https://artifacthub.io/packages/helm/apache-solr/solr). I would like to install it and have LDAP authentication, so I went for the option of providing my own security.json in a Secret. The content of the Secret stringData is as follows
```
{
"authentication": {
"class": "solr.HadoopAuthPlugin",
"sysPropPrefix": "solr.",
"type": "ldap",
"authConfigs": [
"ldap.providerurl",
"ldap.basedn",
"ldap.enablestarttls"
],
"defaultConfigs": {
"ldap.providerurl": ,
"ldap.basedn": ,
"ldap.enablestarttls": "false"
}
},
"authorization": {
"class": "solr.RuleBasedAuthorizationPlugin",
"user-role": {
"solr-admin": ["admin", "k8s"],
"k8s-oper": ["k8s"],
"solr": ["users", "k8s"]
},
"permissions": [
{ "name": "k8s-probe-0", "role": null, "collection": null, "path":"/admin/info/system" },
{ "name": "k8s-probe-1", "role": null, "collection": null, "path":"/admin/info/health" },
{ "name": "k8s-status", "role": "k8s", "collection": null, "path":"/admin/collections" },
{ "name": "k8s-metrics", "role": null, "collection": null, "path":"/admin/metrics" },
{ "name": "k8s-zk", "role": "k8s", "collection": null, "path":"/admin/zookeeper/status" },
{ "name": "k8s-ping", "role": "k8s", "collection": "*", "path":"/admin/ping" },
{ "name": "read", "role": ["admin","users"] },
{ "name": "update", "role": ["admin"] },
{ "name": "security-read", "role": ["admin"] },
{ "name": "security-edit", "role": ["admin"] },
{ "name": "all", "role": ["admin"] }
]
}
}
```
I've also modified the relevant values of the helm chart in the following way
```
solrOptions
security:
authenticationType: Basic
basicAuthSecret: solr-basic-auth
probesRequireAuth: false
bootstrapSecurityJson:
name: security-json-secret
key: security.json
```
Now, if I do not add custom probes in the podOptions section of the values, my pod gets killed because both probes return 401.
I've followed the documentation found [here](https://apache.github.io/solr-operator/docs/solr-cloud/solr-cloud-crd.html#option-2-user-provided-securityjson-and-credentials-secret), but this doesn't even mention the possibility of getting a 401.
I've also tried to add some custom probes as explained in [this](https://apache.github.io/solr-operator/docs/solr-cloud/solr-cloud-crd.html#liveness-and-readiness-probes) section, but they still return 401 and kill my pod.
The only way I was able to have the pod survive was by adding some custom probes that make a curl with the credentials, but, as also mentioned in the docs, probes shouldn't have authentication.
Am i doing something wrong? The docs explicitly tell that one can set the probes to require no auth and it seems to me I have done the necessary steps.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the installation with the supplied security.json, solrOptions.security.probesRequireAuth: false, and the default or podOptions probes, then inspect how the Helm chart configures those probes. Done means the default or custom probes do not return 401 and the Solr pod remains healthy without probe credentials.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- helm, kubernetes
- Domain
- authentication, devops, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100