danielmeint commented on code in PR #854:
URL: https://github.com/apache/solr-operator/pull/854#discussion_r4341567795
##########
controllers/util/solr_security_util.go:
##########
@@ -508,19 +508,22 @@ func useSecureProbe(solrCloud *solr.SolrCloud, probe
*corev1.Probe, mountPath st
}
// construct the probe command to invoke the SolrCLI "api" action
+ solrApiCommand := fmt.Sprintf("solr api -get
\"%s://${SOLR_HOST}:%d%s\"", solrCloud.UrlScheme(false),
probe.HTTPGet.Port.IntVal, probe.HTTPGet.Path)
// Future work - SOLR_TOOL_OPTIONS is only in 9.4.0, use
JAVA_TOOL_OPTIONS until that is the minimum supported version
- var javaToolOptionsStr string
- var javaToolOptionsOutputFilter string
+ var probeCommand string
if len(javaToolOptions) > 0 {
- javaToolOptionsStr = fmt.Sprintf("JAVA_TOOL_OPTIONS=%q ",
strings.Join(javaToolOptions, " "))
- javaToolOptionsOutputFilter = " 2>&1 | grep -v
JAVA_TOOL_OPTIONS"
+ // The JVM echoes "Picked up JAVA_TOOL_OPTIONS: ..." on
startup, which would leak the basic auth
+ // credentials into the probe output that Kubernetes surfaces
in pod events, so that line has to be
+ // filtered out. The filter must not swallow the exit code of
'solr api' though, otherwise a failing
+ // probe (e.g. a 401) looks like a successful one. Capture the
output first, then filter it, then
+ // exit with the status saved before the filter ran. Written
for POSIX 'sh', so no 'pipefail'.
+ probeCommand = fmt.Sprintf(
+ "probe_output=$(JAVA_TOOL_OPTIONS=%q %s 2>&1);
probe_status=$?; echo \"$probe_output\" | grep -v JAVA_TOOL_OPTIONS; exit
$probe_status",
+ strings.Join(javaToolOptions, " "), solrApiCommand)
Review Comment:
Found this as well and it seems more straightforward to solve this via
`bin/solr` env vars:
```
SOLR_AUTH_TYPE=basic SOLR_AUTHENTICATION_OPTS="-Dbasicauth=$(cat
<dir>/username):$(cat <dir>/password)" solr api -get "<url>"
```
Passing `-Dbasicauth` via `JAVA_TOOL_OPTIONS` also seems to break on Solr
10; and it avoids the "Picked up JAVA_TOOL_OPTIONS" banner
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
