-
Notifications
You must be signed in to change notification settings - Fork 695
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Always enable file based user auth #1698
Conversation
The operator relies on file realm for creating all the internal users including the built-in elastic user. This commit makes sure the file realm is always enabled in case a user wants to configure additional realms. The order of the file realm is set to -100 to favor the fact that it is used first but there is no complete guarantee about that. The user can still configure a realm with an order less than -100 but it is very unlikely given this is not suggested in the documentation (order starts to 0). The main known issue could be to configure a realm that relies on a system (e.g. Active Directory) that has a temporary lock-out period after several successive failed login attempts, as being checked first (https://www.elastic.co/guide/en/elastic-stack-overview/current/trouble-shoot-active-directory.html).
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I am a bit unsure about how the configuration magic happens but otherwise LGTM.
I updated the PR to support the two syntaxes for the realm settings depending the major version (breaking changes in 7.0). I'm mixed to use a more advanced way to switch the config for this little variation, like we did in the past for ES and still have for Kibana. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
I think I tend to prefer what you implemented where we pass the version around and use it where it matters, instead of having several driver plugs. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
The operator relies on file realm for creating all the internal users
including the built-in elastic user. This commit makes sure the file
realm is always enabled in case a user wants to configure additional
realms.
The order of the file realm is set to -100 to favor the fact that it is
used first but there is no complete guarantee about that. The user can
still configure a realm with an order less than -100 but it is very
unlikely given this is not suggested in the documentation (order starts to 0).
The main known issue could be to configure a realm that relies on a
system (e.g. Active Directory) that has a temporary lock-out period
after several successive failed login attempts, as being checked first
(https://www.elastic.co/guide/en/elastic-stack-overview/current/trouble-shoot-active-directory.html).
Resolves #1629.