[Bug] Unable to get a user/role #377
Comments
|
i'm not clear on where this was tested. On a basic licensed cluster, or on Elastic Cloud? if so, it seems the problem is the basic license. |
|
Hi @Kushmaro, We're using Elastic Cloud with a single Elasticsearch instance and a Kibana instance. Our Terraform code was working before. But as mentioned we're not able to identify what specifically broke it. |
|
@orlandothoeny well its quite hard to determine what broke with the code itself. Can you share the relevant piece? |
|
Here is a simplified version of the code we're using.
provider "ec" {
// ...
}
resource "ec_deployment" "deployment" {
name = "my-deployment-dev"
alias = "my-deployment-dev"
region = "europe-west4"
version = "7.17.9"
deployment_template_id = "gcp-storage-optimized"
elasticsearch = {
ref_id = "main-elasticsearch"
autoscale = "false"
hot = {
autoscaling = {}
}
topology = {
id = "hot_content"
zone_count = 1
size = "2g"
size_resource = "memory"
}
}
kibana = {
ref_id = "kibana"
topology = {
size = "1g"
size_resource = "memory"
}
}
observability = {
deployment_id = "self"
logs = false
metrics = true
}
}
provider "elasticstack" {
elasticsearch {
endpoints = [ec_deployment.deployment.elasticsearch.https_endpoint]
username = ec_deployment.deployment.elasticsearch_username
password = ec_deployment.deployment.elasticsearch_password
}
}
resource "elasticstack_elasticsearch_security_user" "terraform_user" {
username = "terraform"
password = "foo"
roles = ["superuser"]
}
resource "elasticstack_elasticsearch_security_user" "datadog_user" {
username = "datadog"
password = "bar"
/* We still need the "monitoring_user" user role, because we cannot assign the Kibana "Stack Monitoring" permission to our own custom "datadog" role.
These are only available via this built-in role */
roles = [elasticstack_elasticsearch_security_role.datadog_role.name, "monitoring_user"]
}
resource "elasticstack_elasticsearch_security_role" "datadog_role" {
name = "datadog"
indices {
names = [".monitoring-*", "metricbeat-*"]
privileges = ["read", "read_cross_cluster", "monitor"]
}
cluster = ["monitor"]
run_as = []
} |
|
Hi @Kushmaro, I also tried it by using explicit per-resource definitions ( provider "ec" {
// ...
}
resource "ec_deployment" "deployment" {
name = "my-deployment-dev"
alias = "my-deployment-dev"
region = "europe-west4"
version = "7.17.9"
deployment_template_id = "gcp-storage-optimized"
elasticsearch = {
ref_id = "main-elasticsearch"
autoscale = "false"
hot = {
autoscaling = {}
}
topology = {
id = "hot_content"
zone_count = 1
size = "2g"
size_resource = "memory"
}
}
kibana = {
ref_id = "kibana"
topology = {
size = "1g"
size_resource = "memory"
}
}
observability = {
deployment_id = "self"
logs = false
metrics = true
}
}
provider "elasticstack" {
elasticsearch {}
}
resource "elasticstack_elasticsearch_security_user" "terraform_user" {
username = "terraform"
password = "foo"
roles = ["superuser"]
elasticsearch_connection {
endpoints = [ec_deployment.deployment.elasticsearch.https_endpoint]
username = ec_deployment.deployment.elasticsearch_username
password = ec_deployment.deployment.elasticsearch_password
}
}
resource "elasticstack_elasticsearch_security_user" "datadog_user" {
username = "datadog"
password = "bar"
/* We still need the "monitoring_user" user role, because we cannot assign the Kibana "Stack Monitoring" permission to our own custom "datadog" role.
These are only available via this built-in role */
roles = [elasticstack_elasticsearch_security_role.datadog_role.name, "monitoring_user"]
elasticsearch_connection {
endpoints = [ec_deployment.deployment.elasticsearch.https_endpoint]
username = ec_deployment.deployment.elasticsearch_username
password = ec_deployment.deployment.elasticsearch_password
}
}
resource "elasticstack_elasticsearch_security_role" "datadog_role" {
name = "datadog"
indices {
names = [".monitoring-*", "metricbeat-*"]
privileges = ["read", "read_cross_cluster", "monitor"]
}
cluster = ["monitor"]
run_as = []
elasticsearch_connection {
endpoints = [ec_deployment.deployment.elasticsearch.https_endpoint]
username = ec_deployment.deployment.elasticsearch_username
password = ec_deployment.deployment.elasticsearch_password
}
} |
|
Seems like the root cause is actually #370 Managed to get it to work by using the workaround described in that issue. |
Hello,
We are running an Elastic Cloud instance, which is managed using Terraform.
We use the
elasticstack_elasticsearch_security_user&elasticstack_elasticsearch_security_roleresources to create users & roles.The following error occurs during the state refresh when Elasticsearch users/roles are fetched while running
terraform apply: "Security must be explicitly enabled when using a [basic] license. Enable security by setting [xpack.security.enabled] to [true] in the elasticsearch.yml file and restart the node."Our code was working before, it broke at some point. Unfortunately, I cannot identify the exact reason. Might be due to an elasticstack provider update or an Elasticsearch server update.
The weird thing is, calling the API using curl works, the following returns JSON containing our Elasticsearch users.
I tried setting the
xpack.security.enabled: trueconfig explicitly but that's not possible on Elastic Cloud:Terraform errors
Debug output
Versions (please complete the following information):
The text was updated successfully, but these errors were encountered: