Index creation permission about elasticsearch-operator HOT 9 CLOSED

I made some progress.
In ES pods I've manually added my service account to sg_role_admin role in roles_mapping.yaml followed by executing es_seed_acl command.
Is there any way to make this modification persistent using operator configuration?

from elasticsearch-operator.

Any plans to allow ES roles configuration from operator CRD?

from elasticsearch-operator.

We have been using Elastalert with OCP ES 4.4. After upgrading CLO and ES operators to 4.6, we couldn't use the logging admin user with the elastalert.

We have tried the workaround found by @jstakun but it's not a permanent solution. It'll be better if we have given the option to add additional admin users to 'sg_role_admin'.

For example - the openshift ES operator creates an 'elasticsearch' configmap. It has a separate section define admin users. But we can't define another admin user in the cluster logging operator instance.

$ oc get cm elastisearch -n openshift-logging -o yaml

...
opendistro_security:
  authcz.admin_dn:
  - CN=system.admin,OU=OpenShift,O=Logging
  config_index_name: ".security"
  restapi:
    roles_enabled: ["kibana_server"]
  ssl:
    transport:
      enabled: true
      enforce_hostname_verification: false
      keystore_type: JKS
      keystore_filepath: /etc/elasticsearch/secret/searchguard.key
      keystore_password: kspass
      truststore_type: JKS
      truststore_filepath: /etc/elasticsearch/secret/searchguard.truststore
      truststore_password: tspass
....

from elasticsearch-operator.

I made some progress.
In ES pods I've manually added my service account to sg_role_admin role in roles_mapping.yaml followed by executing es_seed_acl command.
Is there any way to make this modification persistent using operator configuration?

Where do you find this role_mappings.yaml? I have the same problem, but cannot find this config.

from elasticsearch-operator.

ah, found it, it's named .yml

from elasticsearch-operator.

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

from elasticsearch-operator.

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

from elasticsearch-operator.

Rotten issues close after 30d of inactivity.

Reopen the issue by commenting /reopen.
Mark the issue as fresh by commenting /remove-lifecycle rotten.
Exclude this issue from closing again by commenting /lifecycle frozen.

/close

from elasticsearch-operator.

@openshift-bot: Closing this issue.

from elasticsearch-operator.