janhoy commented on issue #786:
URL: https://github.com/apache/solr-operator/issues/786#issuecomment-6475724327
Resolved in-thread: Solr blocks reading the projected service-account token
unless its path is allow-listed, so S3 backups fail with a 403 that looks like
a bucket-permissions error. The fix is to add the token path to
`solr.allowPaths`, via the chart:
```yaml
solrOptions:
javaOpts:
"-Dsolr.allowPaths=/var/run/secrets/eks.amazonaws.com/serviceaccount/token"
```
The path differs by mechanism — IRSA uses
`/var/run/secrets/eks.amazonaws.com/serviceaccount/token`, while EKS Pod
Identity uses
`/var/run/secrets/pods.eks.amazonaws.com/serviceaccount/eks-pod-identity-token`.
Thanks @elangelo and @gboor for working that out here.
Closing this one as answered. #775 stays open for the underlying
improvement, so that the operator allow-lists the token path itself rather than
making every user discover this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
