# Error in Elasticsearch cluster on Openshift after restarting nodes
**URL:** https://discuss.elastic.co/t/error-in-elasticsearch-cluster-on-openshift-after-restarting-nodes/280010
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [July 29, 2021, 6:52pm UTC](https://discuss.elastic.co/t/error-in-elasticsearch-cluster-on-openshift-after-restarting-nodes/280010 "2021-07-29T18:52:06Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@fefontana](https://discuss.elastic.co/u/fefontana)
#### Post date: [July 29, 2021, 6:52pm UTC](https://discuss.elastic.co/t/error-in-elasticsearch-cluster-on-openshift-after-restarting-nodes/280010/1 "2021-07-29T18:52:06Z")
Hi there, I have an Elasticsearch cluster 7.13.2 :
- 2 data nodes
- 3 master nodes
- 2 client nodes
all of them deployed on Openshift with minimal security enabled.
TLS security is not enabled, is not necessary in our case, and we don't want to enable.
elasticsearch.yml is set with:
xpack:
security.enabled: "true"
At first time all is working fine, but if a master o data node are restarted, the node gets the following error:
```auto
2021-07-29T18:35:42,762][INFO][o.e.b.BootstrapChecks] [es-master-0] bound or publishing to a non-loopback address, enforcing bootstrap checks
ERROR: [1] bootstrap checks failed. You must address the points described in the following [1] lines before starting Elasticsearch.
bootstrap check failure [1] of [1]: Transport SSL must be enabled if security is enabled on a [basic] license. Please set [xpack.security.transport.ssl.enabled] to [true] or disable security by setting [xpack.security.enabled] to [false]
ERROR: Elasticsearch did not exit normally - check the logs at /elasticsearch/pv1/logs/elasticsearch.log
[2021-07-29T18:35:43,365][INFO][o.e.n.Node] [es-master-0] stopping ...
[2021-07-29T18:35:43,366][DEPRECATION][o.e.d.c.s.Settings] [es-master-0] [node.data] setting was deprecated in Elasticsearch and will be removed in a future release! See the breaking changes documentation for the next major version.
.....
.....
.....
[2021-07-29T18:35:43,869][INFO][o.e.n.Node] [es-master-0] stopped
[2021-07-29T18:35:43,869][INFO][o.e.n.Node] [es-master-0] closing ...
```
**Restarting nodes without security enabled works fine.**
Do I'm missing some security configuration for minimal security (not TLS) ?.
---
### Author:  [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)
#### Post date: [July 29, 2021, 7:30pm UTC](https://discuss.elastic.co/t/error-in-elasticsearch-cluster-on-openshift-after-restarting-nodes/280010/2 "2021-07-29T19:30:06Z")
Did you try doing either of the two things the message tells you to do?
> [@fefontana](#):
>
> `set [xpack.security.transport.ssl.enabled] to [true] or disable security by setting [xpack.security.enabled] to [false]`
Unfortunately these are your only options, you can't use security without transport TLS.
---
### Author:  [@fefontana](https://discuss.elastic.co/u/fefontana)
#### Post date: [July 29, 2021, 8:14pm UTC](https://discuss.elastic.co/t/error-in-elasticsearch-cluster-on-openshift-after-restarting-nodes/280010/3 "2021-07-29T20:14:04Z")
Thank you David for you answer.
But, why the cluster works fine with minimal security until a node is restarted ?. We really don't need to enable TLS security because the cluster is already secured in Openshift. Also the procedure in order to enable TLS it's very long and complex, even more in Openshift.
I'll really appreciate any complementary comment about how to face this issue!.
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [July 29, 2021, 8:20pm UTC](https://discuss.elastic.co/t/error-in-elasticsearch-cluster-on-openshift-after-restarting-nodes/280010/4 "2021-07-29T20:20:42Z")
Enabling TLS [is required in order to enable security in a multi-node cluster](https://www.elastic.co/guide/en/elasticsearch/reference/7.13/bootstrap-checks-xpack.html#bootstrap-checks-tls). You can not get around this requirement.
---
### Author:  [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)
#### Post date: [July 29, 2021, 8:33pm UTC](https://discuss.elastic.co/t/error-in-elasticsearch-cluster-on-openshift-after-restarting-nodes/280010/5 "2021-07-29T20:33:12Z")
> [@fefontana](#):
>
> why the cluster works fine with minimal security until a node is restarted ?
It's complicated. At some point in the past we permitted a superficially-similar config, and we care about avoiding breaking changes so we can't just reject it. The trouble is that we can't tell if we're in the legacy setup or not until we join the cluster for the first time, so we have to let you get away with the bad setup on the first start.
Enabling TLS is fairly straightforward in most environments. Maybe there's something special about Openshift that makes it unusually difficult? I'm guessing that satisfying hostname verification might be the tricky bit, but if you really don't care about security you can set `xpack.security.transport.ssl.verification_mode: certificate` to bypass that.
---
### Author:  [@fefontana](https://discuss.elastic.co/u/fefontana)
#### Post date: [July 29, 2021, 11:34pm UTC](https://discuss.elastic.co/t/error-in-elasticsearch-cluster-on-openshift-after-restarting-nodes/280010/6 "2021-07-29T23:34:38Z")
I added the
`"xpack.security.transport.ssl.verification_mode: certificate"`
entry to the elasticsearch.yml file, but I'm still getting the same error when the node is restarted.
Do I have to set something else in order to avoid TLS security ?.
---
### Author:  [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)
#### Post date: [July 30, 2021, 12:40am UTC](https://discuss.elastic.co/t/error-in-elasticsearch-cluster-on-openshift-after-restarting-nodes/280010/7 "2021-07-30T00:40:12Z")
> [@fefontana](#):
>
> why the cluster works fine with minimal security until a node is restarted ?
We have an [open issue](https://github.com/elastic/elasticsearch/issues/48912) for this. But as suggested above, the recommended approach is to enable TLS for transport.
> [@fefontana](#):
>
> I added the
>
> `"xpack.security.transport.ssl.verification_mode: certificate"`
>
> entry to the elasticsearch.yml file, but I'm still getting the same error when the node is restarted.
>
> Do I have to set something else in order to avoid TLS security ?.
Enable TLS on transport involves more than just this single setting. You can refer to the instruction for [setting up basic security](https://www.elastic.co/guide/en/elasticsearch/reference/7.13/security-basic-setup.html)
---
### Author:  [@fefontana](https://discuss.elastic.co/u/fefontana)
#### Post date: [July 30, 2021, 1:20am UTC](https://discuss.elastic.co/t/error-in-elasticsearch-cluster-on-openshift-after-restarting-nodes/280010/8 "2021-07-30T01:20:02Z")
Thank you Yang, I was trying to make it work without TLS. But I understand you are telling me that this is not possible.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 27, 2021, 1:20am UTC](https://discuss.elastic.co/t/error-in-elasticsearch-cluster-on-openshift-after-restarting-nodes/280010/9 "2021-08-27T01:20:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.