apache / apache/solr-operator

Default liveliness and readiness probes return 401

Open
#533 5 comments 2 reactions 0 assignees View on GitHub
question security
Dominant language
Go
Stars
283
Forks
148
PR merge metrics
No merged PRs in 30d

Description

I have installed the solr operator, and I'm now trying to install solr. To do so, I'm using the chart i found [here](https://artifacthub.io/packages/helm/apache-solr/solr). I would like to install it and have LDAP authentication, so I went for the option of providing my own security.json in a Secret. The content of the Secret stringData is as follows
```
{
"authentication": {
"class": "solr.HadoopAuthPlugin",
"sysPropPrefix": "solr.",
"type": "ldap",
"authConfigs": [
"ldap.providerurl",
"ldap.basedn",
"ldap.enablestarttls"
],
"defaultConfigs": {
"ldap.providerurl": ,
"ldap.basedn": ,
"ldap.enablestarttls": "false"
}
},
"authorization": {
"class": "solr.RuleBasedAuthorizationPlugin",
"user-role": {
"solr-admin": ["admin", "k8s"],
"k8s-oper": ["k8s"],
"solr": ["users", "k8s"]
},
"permissions": [
{ "name": "k8s-probe-0", "role": null, "collection": null, "path":"/admin/info/system" },
{ "name": "k8s-probe-1", "role": null, "collection": null, "path":"/admin/info/health" },
{ "name": "k8s-status", "role": "k8s", "collection": null, "path":"/admin/collections" },
{ "name": "k8s-metrics", "role": null, "collection": null, "path":"/admin/metrics" },
{ "name": "k8s-zk", "role": "k8s", "collection": null, "path":"/admin/zookeeper/status" },
{ "name": "k8s-ping", "role": "k8s", "collection": "*", "path":"/admin/ping" },
{ "name": "read", "role": ["admin","users"] },
{ "name": "update", "role": ["admin"] },
{ "name": "security-read", "role": ["admin"] },
{ "name": "security-edit", "role": ["admin"] },
{ "name": "all", "role": ["admin"] }
]
}
}
```
I've also modified the relevant values of the helm chart in the following way
```
solrOptions
security:
authenticationType: Basic
basicAuthSecret: solr-basic-auth
probesRequireAuth: false
bootstrapSecurityJson:
name: security-json-secret
key: security.json
```

Now, if I do not add custom probes in the podOptions section of the values, my pod gets killed because both probes return 401.
I've followed the documentation found [here](https://apache.github.io/solr-operator/docs/solr-cloud/solr-cloud-crd.html#option-2-user-provided-securityjson-and-credentials-secret), but this doesn't even mention the possibility of getting a 401.

I've also tried to add some custom probes as explained in [this](https://apache.github.io/solr-operator/docs/solr-cloud/solr-cloud-crd.html#liveness-and-readiness-probes) section, but they still return 401 and kill my pod.

The only way I was able to have the pod survive was by adding some custom probes that make a curl with the credentials, but, as also mentioned in the docs, probes shouldn't have authentication.

Am i doing something wrong? The docs explicitly tell that one can set the probes to require no auth and it seems to me I have done the necessary steps.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the installation with the supplied security.json, solrOptions.security.probesRequireAuth: false, and the default or podOptions probes, then inspect how the Helm chart configures those probes. Done means the default or custom probes do not return 401 and the Solr pod remains healthy without probe credentials.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm, kubernetes
Domain
authentication, devops, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.