Backup to S3 is broken when enabling IRSA as the mounted secret is not accessible for Solr.
- Dominant language
- Go
- Stars
- 283
- Forks
- 148
- PR merge metrics
- No merged PRs in 30d
Description
When running with service accounts on a pod in EKS, a secret containing security information gets automatically mounted on /var/run/secrets/eks.amazonaws.com/serviceaccount/token
When trying to make a backup this token is unreachable for Solr and hence the backup fails with unclear error messages (In my case it was saying that the noderole under which my kuberenetes nodes are running did not have access on the S3 bucket). It was very difficult to figure out that it actually tried to access that file but couldn't do so because it was not in the allowPath.
I solved it by adding
`-Dsolr.allowPaths=/var/run/secrets/eks.amazonaws.com/serviceaccount/token`
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the backup path and the Solr configuration handling around solr.allowPaths, using the EKS service-account token path shown in the issue as the reproduction case. Verify that a backup can access the mounted token and that failures report the inaccessible path clearly rather than an S3 node-role permission error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, kubernetes
- Domain
- cloud, infrastructure, search
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100