Mateusz,
Can you please share the elasticsearch.yml content which you tested along with ror-1.21.0-pre5 on single-node es-7.8.0 cluster in DEV mode (127.0.0.1:9210) ?
Thanks in advance
I setup and deployed another ES-7.8.0 in DEV mode (single node cluster) and started it with default es yml in which all lines are commented out - it started ok. Then I shut it down, deployed ror-1.20.0, configured ror yml as you did.
Now, before restarting ES should I add to es yml just these 2 lines and start es ?
yes, this is correct
Hi Mateusz,
[1]I got my multinode cluster ES-7.8.0 & ROR-1.20.0 up and running as it should (2 hosts, 4 nodes, ROR setup and configured on one master dedicated node)
[2]Here is what I did to make it function as expected
in elasticsearch.yml
#disable xpack security
xpack.security.enabled: false
readonlyrest.force_load_from_file: true
#otherwise node with deployed and enabled ROR started and worked OK but there is the ERROR in log
#[ERROR][t.b.r.e.s.Es.Index.JsonContentService] node_name Cannot get source of document [.readonlyrest ID=1]
#java.lang.IllegalStateException: NodeClient has not been initialized
Any guess what does this [.readonlyrest ID=1] mean ?
in regards to readonlyrest.yml
-encrypt pair user:password in Base64 and use encrypted value as <ACCESS_TOKEN> in the header of url request, like -H ‘Authorization: Basic <ACCESS_TOKEN>’
-encrypt password in SHA256 and use encrypted value in readonlyrest.yml
-encrypt password only in SHA256 (not pair user_name:password as I did for old ES-5.6.3)
-SHA256 encrypted value should contain lowercase letters, otherwise ROR will Not work properly with capitals
-in readonlyrest.yml use the following format
username: <user_name>
auth_key_sha256: <user_name>:<ACCESS_TOKEN>
[3]All these things were not obvious and required me switching between single-node cluster in DEV mode and multi-node cluster in PROD mode with trial and error
[4]There are No ERRORs in the ES log now, but I’m still experiencing the following WARNING/UnsatisfiedLinkError when starting node with deployed and enabled ROR (b.t.w.I’m using java 1.8.0_65, not bundled java with the ES-7.8.0 package):
[WARN][o.e.b.Natives ] node_name unable to load JNA native support library, native methods will be disabled.
java.lang.UnsatisfiedLinkError: /tmp/jna/–146…tmp: /lib64/libc.so.6: version GLIBC_2.7 not found (required by /tmp/jna/–1462778291/jna473135465896030289.tmp)
at java.lang.ClassLoader$NativeLibrary.load(NativeMethod) ~[?1.8.0_65]
at java.lang.ClassLoader.loadLibrary(ClassLoader.java:1938) ~[?1.8.0_65]
Any guess why this java.lang.UnsatisfiedLinkError comes up here and how it might be fixed ?
Thanks a lot for your help and support
ROR tries to load configuration from index at startup. ATM when there is no such index, there is a fallback to readonlyrest.yml file. So this is expected
Thanks a lot Mateusz, I’ll follow up
To remove any kind of ambiguity, have you tried with most basic config - change to auth_key instead of auth_key_sha256 and then open the URL http://host:port/_cat/indices?v in Chrome and type in id/pwd once you get the prompt. Does that work for you?
Thanks Askids for the attention and feedback.
As I said, finally I got my multi-node ES cluster with ROR works good as it should and I’d like to address one issue mentioned above. Repeating it again here:
[4]There are No ERRORs in the ES log now, but I’m still experiencing the following WARNING/UnsatisfiedLinkError when starting node with deployed and enabled ROR (b.t.w.I’m using java 1.8.0_65, not bundled java with the ES-7.8.0 package):
[WARN][o.e.b.Natives ] node_name unable to load JNA native support library, native methods will be disabled.
java.lang.UnsatisfiedLinkError: /tmp/jna/–146…tmp: /lib64/libc.so.6: version GLIBC_2.7 not found (required by /tmp/jna/–1462778291/jna473135465896030289.tmp)
at java.lang.ClassLoader$NativeLibrary.load(NativeMethod) ~[?1.8.0_65]
at java.lang.ClassLoader.loadLibrary(ClassLoader.java:1938) ~[?1.8.0_65]
…
Node with deployed and enabled ROR starts and functions good as expected.
This is probably be due to the very old linux version you are using. RHEL 5.11 right?
Thanks a lot for the feedback Simone,
I agree with you, this java.lang.UnsatisfiedLinkError might be related to old RHEL 5.11, I’ll try to test this on the higher version of RHEL.
I’d like to confirm with you one thing yet, this ROR-1.20.0 might be deployed and enabled either on (1)master eligible & and data node (master:true, data:true) or nodes only, (2)or master eligible only (master:true, data:false) node or nodes, (3)or data only (master:false, data:true) node or nodes, no need to deploy ROR-1.20.0 on each and every node of the cluster, correct ?
Thanks in advance
OK the rule is:
if you use internode SSL, you need ROR in every node
if you use fields rule, you should install ROR in nodes with Elasticsearch HTTP API enabled (port 9200), and in all nodes that contain data.
If you don’t use internode SSL, or fields rule, it’s fine to just install ROR just in the nodes in which you plan to enable Elasticsearch HTTP API (port 9200).
Thank you so much for the confirmation and great support Simone and your team!
1 Like