[BUG] Exception updating the admin password : /usr/share/opensearch/config/opensearch-security/internal_users.yml: Device or resource busy #3891
Assignees
Comments
ruanyl
added
bug
ruanyl
changed the title
|
[Triage] Hi @ruanyl, thank you for filing this issue. Someone will follow-up to try to diagnose this bug and make a fix if one is possible. Thank you for posting the logs and reproduction steps! |
stephen-crawford
added
triaged
|
@ruanyl seen the same issue with helm charts and with OpenSearch 2.12.0, One common cause is having multiple I was able to make this work by adding the following and creating the What it technically does it:
|
|
This error shows because the demo setup requires an admin password to be supplied, which demo config then generates hash and writes to internal_users.yml. But since docker has locked the file path with the mount for custom internal_users.yml, it throws this error. Currently, there is no way to just use demo certificates and supply custom internal_users. This could be added as a separate option in future and may require discussion among maintainers to implement this. |
|
Wouldn't it be better to check Seems to me it would be better to either read from the mounted internal_users.yml or read from environment variable. |
|
@geckiss We can do that, but that opens up the possibility to add any string as password for admin user. Since the values are stored as hash, there is no way to validate the strength of the updated password. I understand that this would solve the problem at hand, but the responsibility would then be onto the user to supply strong password. However, if the use-case for providing a custom internal_users.yml and utilizing the demo setup tool solely for demo certificates generation, wouldn't it be better if certificate generation would be a separate toggle-able feature? Update: Here's a change that could work with custom internal users.yml: https://github.com/DarshitChanpura/security/blob/d3b64419082b63cd020d82caf41773f6eac0ae74/src/main/java/org/opensearch/security/tools/democonfig/SecuritySettingsConfigurer.java#L133 |
3 tasks
|
I tried the workaround provided by @prudhvigodithi but the problem is that the directory To fix the issue, I opted for copying all the files from the opensearch image to the emptydir volume |
|
Hey @fmr-disy did you try with the |
Thanks for your quick reaction. I tested it setting the parameter |
|
Hey @fmr-disy, following are my values.yaml and internal_users.yml files, following the steps above #3891 (comment), can you please test agin? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
What is the bug?
Update(2023/12/23)
While I was debugging the issue in my stack, I found this commit 17748b9 might potentially be backward incompatible.
In my opensearch setup(for testing purpose), I manage the security configuration in
opensearch.ymlandinternal_users.ymlby myself(write permission to these files are removed). So I don't need security plugin to setup it for me. But I DO need security plugin to setup demo certificates files.Previously, with the old
install_demo_configuration.sh, demo certificates setup was happened before setting up admin user, so even the script exit when setting up admin user, the demo certificate files are still created.Now, in the new implementation, it seems admin user setup is before certificates setup, so if that failed, demo certificates won't be created.
Exception when running security plugin with opensearch on main branch(3.0.0)
OPENSEARCH_INITIAL_ADMIN_PASSWORDis setDISABLE_INSTALL_DEMO_CONFIGis set to falseSuspicious log
Exception updating the admin password : /usr/share/opensearch/config/opensearch-security/internal_users.yml: Device or resource busyError stack traces:
How can one reproduce the bug?
Steps to reproduce the behavior:
What is the expected behavior?
A clear and concise description of what you expected to happen.
What is your host/environment?
Do you have any screenshots?
If applicable, add screenshots to help explain your problem.
Do you have any additional context?
Add any other context about the problem.
The text was updated successfully, but these errors were encountered: