apache / apache/solr-operator

Backup to S3 is broken when enabling IRSA as the mounted secret is not accessible for Solr.

Open
#775 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
Go
Stars
283
Forks
148
PR merge metrics
No merged PRs in 30d

Description

When running with service accounts on a pod in EKS, a secret containing security information gets automatically mounted on /var/run/secrets/eks.amazonaws.com/serviceaccount/token
When trying to make a backup this token is unreachable for Solr and hence the backup fails with unclear error messages (In my case it was saying that the noderole under which my kuberenetes nodes are running did not have access on the S3 bucket). It was very difficult to figure out that it actually tried to access that file but couldn't do so because it was not in the allowPath.

I solved it by adding
`-Dsolr.allowPaths=/var/run/secrets/eks.amazonaws.com/serviceaccount/token`

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the backup path and the Solr configuration handling around solr.allowPaths, using the EKS service-account token path shown in the issue as the reproduction case. Verify that a backup can access the mounted token and that failures report the inaccessible path clearly rather than an S3 node-role permission error.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, kubernetes
Domain
cloud, infrastructure, search
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.