Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Solr 9 SSL incompatibilities #599

Closed
sarkaramrit2 opened this issue Aug 10, 2023 · 2 comments
Closed

Solr 9 SSL incompatibilities #599

sarkaramrit2 opened this issue Aug 10, 2023 · 2 comments
Labels
bug Something isn't working cloud security TLS or Auth for Solr
Milestone

Comments

@sarkaramrit2
Copy link

sarkaramrit2 commented Aug 10, 2023

Solr 9.2.1 facing two issues:

  • except solr home dir, read/write permissions are needed and hence fails
                    "solrClientTLS": {
                        "mountedTLSDir": {
                            "path": "/abv-client-tls",  # see `spec.customSolrKubeOptions.podOptions.volumes` below
                            "path": "/opt/solr-9.2.1/abc-client-tls",
  • SNI 400s
2023-07-25 17:19:34.649 WARN  (qtp912747546-98) [] o.e.j.s.HttpChannel handleException /solr/admin/info/system org.eclipse.jetty.http.BadMessageException: 400: Invalid SNI
2023-07-25 17:19:34.656 WARN  (qtp912747546-35) [] o.e.j.s.HttpChannel handleException /solr/admin/info/system org.eclipse.jetty.http.BadMessageException: 400: Invalid SNI
@HoustonPutman HoustonPutman changed the title Solr 9.2.1 K8s issue Solr 9 SSL incompatibilities Aug 22, 2023
@HoustonPutman
Copy link
Contributor

HoustonPutman commented Aug 22, 2023

The first one is SOLR-16934, and will be fixed in Solr 9.4.

The second one is an issue with how the Solr Operator calls the Solr API. Basically we don't always use a "correct" hostname, and instead use localhost. There is a new option in Solr 9.2.1 (SOLR-16735), -Dsolr.jetty.ssl.sniHostCheck, that acts in the same way that verifyHostName does. So we need to set both options according to what the user wants regarding verifyHostName. If they want to verifyHostName, then we need to make sure that the correct hostname is used when executing the liveness/readiness probes.

@HoustonPutman HoustonPutman added bug Something isn't working cloud security TLS or Auth for Solr labels Aug 24, 2023
@HoustonPutman HoustonPutman added this to the main (v0.8.0) milestone Oct 6, 2023
@HoustonPutman
Copy link
Contributor

This has been fixed by #610

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working cloud security TLS or Auth for Solr
Projects
None yet
Development

No branches or pull requests

2 participants