[issue] upgraded from 1.18.10 to 1.20.0 (on elk 7.4.2)

1

Hi guys,

i just upgraded Ror entreprise plugin, from 1.18.10 to 1.20.0 , everything is ok, but
the menu to change access in kibana disappeared.

(access seems working, meaning it reads from index, but just i have no more the menu).

did you do a fundamental change ?

kr

ld

2

could it be related to an improvementon the way the block for admin is defined ?

3

the detail in this post may be of help:

particularly the posts towards the end re. unrestricted user access?

1 Like
4

Hi simone,

yep i also saw this thread

then, what do you recommand as upgrade path ?

  1. i rollback to 1.18.10 ( to get back menu to be able to change the admin to unrestricted)
  2. i change from admin, to unrestricted (but will the 1.18.10 will accept that and still work)?
  3. i stop cluster and upgrade Ror from 1.18.10 to 1.20.0

am i right way ?

Kr

fred

5

@ld57 Your readonly rest access control is a document in an index .readonlyrest

If you do:
GET .readonlyrest/_search
You’ll see one result, probably with _id: 1

I had the same issue as you, followed by the issue you linked to about not being able to delete indices. To fix it, I (in Kibana):

  1. Copied the _source document from the ROR index
  2. Pasted into the dev console
  3. Added kibana_access: admin to my kibana ACL rule
  4. POST .readonlyrest/_doc/1 the document you have just edited to update the access control rules.
  5. I can’t remember, but you may need to logout/login again to see the change but the ROR settings are now under the logout button. If you set it to admin you’ll get an “a” in the red box, the “u” means unrestricted.
    image

Obviously make sure you have a copy before you POST in case you made a mistake and need to change it. It will save you downgrading and upgrading, but that might be safer.

I have made a PR for the docs to add information about the unrestricted flag.

6

maybe an easier upgrade path , i can try :

if still in 1.18.10

  • add an new admin block , with an another account
    with kibana_access: unrestricted

  • then upgrade to 1.20.0

  • log with this new unrestricted account

  • edit RoR config to needed things

i gonna try this way, just by curiosity

7

mmmh in fact,

something’s seems strange , as i looked at screenshot @sscarduzio shared above :

here that i see currently, with 1.20.0 on 7.4.2 , and existing RoR index

image
image1911×1122 231 KB

see as i do not see the new form of the button .

also, here the rule block currently in the RoR index for this user

    - name: ELKG admin kibana
      auth_key_sha1: 9907XXXXXXXXXXXXXXXXXXXXX20bd
      type: allow
      kibana_access: admin
      kibana_index: ".kibana"
      verbosity: info

Then i should see (but with Adm_elkg)
image

i keep going to read doc, as sure i missed something

and yep, plugin on Es and on kbn are both 1.20.0 (and ent for kibana)

8

I found in doc this example :
image

I see double quote now around admin word, for kibana_access setting

is it mandatory now ?

I see only this difference far for now

9

Well,

unfortunately I tested both entries (admin or unregistered) , but no way, with 1.20 on 7.4.2 , give no result ,
i mean no interface for RoR, no button…

Fred

10

bah i goona give a try to migrating from 7.4.2 to 7.8