github-mirrors/elasticsearch
1
0
Fork 0
mirror of https://github.com/elastic/elasticsearch.git synced 2025-06-28 17:34:17 -04:00
Code Issues Projects Releases Packages Wiki Activity

Docs for hot-reloadable remote cluster credentials (#105483)

Browse source 
Docs PR to accompany
https://github.com/elastic/elasticsearch/pull/103215.

Resolves: ES-7625
This commit is contained in:
Nikolaj Volgushev 2024-02-15 12:02:13 +01:00 • committed by GitHub
parent ac2e54d56e
commit e241a91a4e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
5 changed files with 37 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

5
docs/reference/modules/cluster/remote-clusters-api-key.asciidoc
View file

@ -183,7 +183,10 @@ Replace `ALIAS` with the same name that you will use to create the remote cluste
later. When prompted, enter the encoded cross-cluster API key created on the
remote cluster earlier.
. Restart the local cluster to load the keystore change.
. Restart the local cluster to load changes to the keystore and settings.
**Note:** If you are configuring only the cross-cluster API key, you can call the <<cluster-nodes-reload-secure-settings>> API, instead of restarting the cluster.
Configuring the `remote_cluster_client` settings in `elasticsearch.yml` still requires a restart.
[[remote-clusters-connect-api-key]]
==== Connect to a remote cluster

2
docs/reference/modules/cluster/remote-clusters-migration.asciidoc
View file

@ -123,7 +123,7 @@ created on the remote cluster earlier.
. If you've dynamically configured the remote cluster (via the cluster settings
API):
.. Restart the local cluster to load changes to the keystore.
.. Restart the local cluster to load changes to the keystore and settings.
.. Re-add the remote cluster. Use the same remote cluster alias, and change the
transport port into the remote cluster port. For example:

5
docs/reference/modules/cluster/remote-clusters-settings.asciidoc
View file

@ -65,7 +65,8 @@ mode are described separately.
is used as the fallback setting.
`cluster.remote.<cluster_alias>.credentials` (<<secure-settings,Secure>>)::
`cluster.remote.<cluster_alias>.credentials` (<<secure-settings,Secure>>, <<reloadable-secure-settings,Reloadable>>)::
[[remote-cluster-credentials-setting]]
beta:[]
Per cluster setting for configuring <<remote-clusters-api-key,remote clusters with the API Key based model>>.
@ -75,6 +76,8 @@ beta:[]
The presence (or not) of this setting determines which model a remote cluster uses.
If present, the remote cluster uses the API key based model.
Otherwise, it uses the certificate based model.
If the setting is added, removed, or updated in the <<secure-settings,{es} keystore>> and reloaded via the
<<cluster-nodes-reload-secure-settings>> API, the cluster will automatically rebuild its connection to the remote.
[[remote-cluster-sniff-settings]]
==== Sniff mode remote cluster settings

11
docs/reference/modules/cluster/remote-clusters-troubleshooting.asciidoc
View file

@ -275,7 +275,7 @@ This does not show up in the logs of the remote cluster.
====== Resolution
Add the cross-cluster API key to {es} keystore on every node of the local
cluster. Restart the local cluster to reload the keystore.
cluster. Use the <<cluster-nodes-reload-secure-settings>> API to reload the keystore.
[[remote-clusters-troubleshooting-wrong-api-key-type]]
===== Using the wrong API key type
@ -302,8 +302,7 @@ This does not show up in the logs of the remote cluster.
Ask the remote cluster administrator to create and distribute a
<<security-api-create-cross-cluster-api-key,cross-cluster API key>>. Replace the
existing API key in the {es} keystore with this cross-cluster API key on every
node of the local cluster. Restart the local cluster for keystore changes to
take effect.
node of the local cluster. Use the <<cluster-nodes-reload-secure-settings>> API to reload the keystore.
[[remote-clusters-troubleshooting-non-valid-api-key]]
===== Invalid API key
@ -334,8 +333,7 @@ The remote cluster logs `Authentication using apikey failed`:
Ask the remote cluster administrator to create and distribute a
<<security-api-create-cross-cluster-api-key,cross-cluster API key>>. Replace the
existing API key in the {es} keystore with this cross-cluster API key on every
node of the local cluster. Restart the local cluster for keystore changes to
take effect.
node of the local cluster. Use the <<cluster-nodes-reload-secure-settings>> API to reload the keystore.
[[remote-clusters-troubleshooting-insufficient-privileges]]
===== API key or local user has insufficient privileges
@ -366,8 +364,7 @@ This does not show up in any logs.
create and distribute a
<<security-api-create-cross-cluster-api-key,cross-cluster API key>>. Replace the
existing API key in the {es} keystore with this cross-cluster API key on every
node of the local cluster. Restart the local cluster for keystore changes to
take effect.
node of the local cluster. Use the <<cluster-nodes-reload-secure-settings>> API to reload the keystore.
[[remote-clusters-troubleshooting-no-remote_indices-privileges]]
===== Local user has no `remote_indices` privileges

1
docs/reference/setup/secure-settings.asciidoc
View file

@ -64,3 +64,4 @@ There are reloadable secure settings for:
* <<ref-jwt-settings, JWT realm>>
* <<ref-ad-settings, Active Directory realm>>
* <<ref-ldap-settings, LDAP realm>>
* <<remote-cluster-credentials-setting, Remote cluster credentials for the API key based security model>>