Examples from ECK not working propertly

[weyderfs (Weyder Ferreira)]

Hi,
I've been creating a YAML for deployment of kind: Elasticsearch, after deployed with success the ECK Operator, but when try use multiples nodeSets return the following error:

Error from server (Forbidden): error when creating "stack-dev.yaml": admission webhook "elastic-es-validation-v1.k8s.elastic.co" denied the request: Elasticsearch.elasticsearch.k8s.elastic.co "eck-sentinel" is invalid: [spec.nodeSets[0].config: Forbidden: Detected a combination of node.roles and node.remote_cluster_client. Use only node.roles, spec.nodeSets[1].config: Forbidden: Detected a combination of node.roles and node.remote_cluster_client. Use only node.roles]

Following my YAML file:

apiVersion: elasticsearch.k8s.elastic.co/v1
kind: Elasticsearch
metadata:
  name: eck
  namespace: observability
spec:
  version: 8.13.0
  nodeSets:
  - name: es-masters
    count: 1
    podTemplate:
      spec:
        initContainers:
        - name: sysctl
          securityContext:
            privileged: true
            runAsUser: 0
          command: ['sh', '-c', 'sysctl -w vm.max_map_count=262144']    
    config:
      node.roles: ["master"]
      xpack.ml.enabled: true      
      node.remote_cluster_client: false
  - name: es-data
    count: 1
    podTemplate:
      spec:
        initContainers:
        - name: sysctl
          securityContext:
            privileged: true
            runAsUser: 0
          command: ['sh', '-c', 'sysctl -w vm.max_map_count=262144']       
    config:
      node.roles: ["data", "ingest", "ml", "transform"]
      node.remote_cluster_client: false        

Is someone know how to solve?

[stephenb (Stephen Brown)]

@weyderfs

node.remote_cluster_client: false

Hi @weyderfs did you try to remove that line as suggested by the error?

[weyderfs (Weyder Ferreira)]

I removed, but now I can´t use the Stack Monitoring, because needs the definition previously mentioned

Access Denied

You are not authorized to access Monitoring. To use Monitoring, you need the privileges granted by both the `kibana_admin` and `monitoring_user ` roles.

If you are attempting to access a dedicated monitoring cluster, this might be because you are logged in as a user that is not configured on the monitoring cluster.

Since Cross Cluster Search is enabled (`monitoring.ui.ccs.enabled` is set to `true`), make sure your cluster has the `remote_cluster_client` role on at least one node.

[stephenb (Stephen Brown)]

Perhaps try

node.roles: ["data", "ingest", "ml", "transform", "remote_cluster_client"]

[weyderfs (Weyder Ferreira)]

@stephenb

node.roles: ["data", "ingest", "ml", "transform", "remote_cluster_client"]

Now, looks like working fine, I guess that needs update the documentation here, because in the example the config it's out of the array mentioned previously.

[stephenb (Stephen Brown)]

I think that is technically correct (set to false), but yes Corrected... they should show the role in the array.

[weyderfs (Weyder Ferreira)]

On ECK deployment, if set to false returns the error:

Name: "eck-elasticsearch", Namespace: "observability"
for: "stack-dev.yaml": error when patching "stack-dev.yaml": admission webhook "elastic-es-validation-v1.k8s.elastic.co" denied the request: Elasticsearch.elasticsearch.k8s.elastic.co "eck-elasticsearch" is invalid: spec.nodeSets[1].config: Forbidden: Detected a combination of node.roles and node.remote_cluster_client. Use only node.roles
}}

[stephenb (Stephen Brown)]

Hmmm, it looks like you are right; sorry, that's interesting.
Perhaps you can open an issue against the repository for a document update.