0

我们最近将 Elasticsearch 从 6.4.3 升级到了 7.1.1。我将 searchguard 索引和配置迁移到新格式。

升级之前，我可以创建或恢复快照，现在，升级后，我仍然可以创建快照，但我无法恢复它们：

{
  "error": {
    "root_cause": [
      {
        "type": "security_exception",
        "reason": "no permissions for [] and User [name=admin, roles=[admin], requestedTenant=null]"
      }
    ],
    "type": "security_exception",
    "reason": "no permissions for [] and User [name=admin, roles=[admin], requestedTenant=null]"
  },
  "status": 403
}

如果我打开 SG 的调试日志记录，它会告诉我允许我的请求：

[2019-07-22T13:11:24,063][DEBUG][c.f.s.a.BackendRegistry  ] [client-elasticsearch-cluster-0] Check authdomain for rest internal/0 or 2 in total
[2019-07-22T13:11:24,063][DEBUG][c.f.s.a.BackendRegistry  ] [client-elasticsearch-cluster-0] Rest user 'User [name=admin, roles=[admin], requestedTenant=null]' is authenticated
[2019-07-22T13:11:24,063][DEBUG][c.f.s.a.BackendRegistry  ] [client-elasticsearch-cluster-0] sgtenant 'null'
[2019-07-22T13:11:24,064][DEBUG][c.f.s.p.PrivilegesEvaluator] [client-elasticsearch-cluster-0] ### evaluate permissions for User [name=admin, roles=[admin], requestedTenant=null] on client-elasticsearch-cluster-0
[2019-07-22T13:11:24,064][DEBUG][c.f.s.p.PrivilegesEvaluator] [client-elasticsearch-cluster-0] action: cluster:admin/snapshot/restore (RestoreSnapshotRequest)
[2019-07-22T13:11:24,064][DEBUG][c.f.s.r.IndexResolverReplacer] [client-elasticsearch-cluster-0] Resolve aliases, indices and types from RestoreSnapshotRequest
[2019-07-22T13:11:24,064][DEBUG][c.f.s.p.PrivilegesEvaluator] [client-elasticsearch-cluster-0] requestedResolved : Resolved [aliases=[*], indices=[*], allIndices=[*], types=[*], originalRequested=[], remoteIndices=[]]
[2019-07-22T13:11:24,064][DEBUG][c.f.s.f.SearchGuardFilter] [client-elasticsearch-cluster-0] PrivEvalResponse [allowed=true, missingPrivileges=[], allowedFlsFields=null, maskedFields=null, queries=null]

我需要做什么才能在 ES 7 上恢复快照？自 6.4 以来发生了什么变化？

4

1 回答 1

1

原来elasticsearch和我自己都傻了……

如果我尝试恢复一个不存在的快照，并在 POST 有效负载中发送一些参数，ES 会抱怨缺少权限。一旦我删除有效负载，它就会告诉我快照丢失了......

于 2019-07-23T10:22:20.427 回答