permission required to write to index about elasticsearch-operator HOT 6 CLOSED

Permissions are only loosely based on openshift and in 4.4 and early [1] are defined by [1]. The remaining roles and permissions are essentially static and would require you to update these directly. Note, however, these are re-initialized on pod restart.

[1] https://github.com/openshift/origin-aggregated-logging/blob/master/docs/access-control.md
[2] https://github.com/openshift/origin-aggregated-logging/blob/release-4.4/elasticsearch/sgconfig/sg_roles_mapping.yml

from elasticsearch-operator.

Ok, thanks. I guess a serviceaccount won't ever do a login from a UI so it won't follow that path to generation. Presumably the only static roles available to it then are roles like cluster-admin and cluster-reader.

from elasticsearch-operator.

Am now trying with openshift 4.6 and discovering that oc adm policy add-cluster-role-to-user cluster-admin system:serviceaccount:logs:elasticseldon does not give the service account write permissions anymore. I guess something has changed since 4.4. I've tried using roles like clusterlogforwarders.logging.openshift.io-v1-admin but not found one that gives write access to the service account. I think I'm not understanding the permission model. @jcantrill Is there an easy way to grant write permission to a service account for 4.6?

from elasticsearch-operator.

The collector deployed by the CLO is intentionally the only one generally allowed to write to the cluster. This is to limit the exposure of who can create indices and possible destabilize the cluster. EO is designed around the cluster logging use-case with the intention to make it more generic but it is not there yet, if ever. You would need to alter permissions contained in the image as advised #338 (comment) but note the draw backs

from elasticsearch-operator.

Ok, will use the ECK operator instead. Thanks.

from elasticsearch-operator.

Hi @ryandawsonuk ,
Can you please let me know if you are able to get around with this issue? I am in same situation, where I need a service account to be able to manage Elasticsearch indices. We are running on OCP4.7. I am not able to find a way to achieve this.

from elasticsearch-operator.