# Is it possible to exclude the health/status page from username/pwd when using buckler or xpac as my load balancer doesn’t support credentials **URL:** \ **Category:** Elasticsearch\ **Created:** [January 24, 2020, 11:54pm UTC](https://discuss.elastic.co/t/is-it-possible-to-exclude-the-health-status-page-from-username-pwd-when-using-buckler-or-xpac-as-my-load-balancer-doesn-t-support-credentials/216501 "2020-01-24T23:54:18Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![nandersen674](https://avatars.discourse-cdn.com/v4/letter/n/f07891/32.png) [@nandersen674](https://discuss.elastic.co/u/nandersen674)\ **Post date:** [January 24, 2020, 11:54pm UTC](https://discuss.elastic.co/t/is-it-possible-to-exclude-the-health-status-page-from-username-pwd-when-using-buckler-or-xpac-as-my-load-balancer-doesn-t-support-credentials/216501/1 "2020-01-24T23:54:18Z")
Is it possible to exclude the health/status page from username/pwd when using buckler or space as my load balancer doesn’t support credentials Like an exclude tag in buckler.yml ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [January 25, 2020, 1:07am UTC](https://discuss.elastic.co/t/is-it-possible-to-exclude-the-health-status-page-from-username-pwd-when-using-buckler-or-xpac-as-my-load-balancer-doesn-t-support-credentials/216501/2 "2020-01-25T01:07:09Z")
Welcome ! Is that related to elasticsearch ? ---
**Author:** ![nandersen674](https://avatars.discourse-cdn.com/v4/letter/n/f07891/32.png) [@nandersen674](https://discuss.elastic.co/u/nandersen674)\ **Post date:** [January 25, 2020, 9:17am UTC](https://discuss.elastic.co/t/is-it-possible-to-exclude-the-health-status-page-from-username-pwd-when-using-buckler-or-xpac-as-my-load-balancer-doesn-t-support-credentials/216501/3 "2020-01-25T09:17:12Z")
I use an avi load balancer in front of my els master nodes, the client nodes are integrated on the bitbucket side. I have data nodes behind the master nodes, but not presented on the load balancer.i have a quorum of 3 or 5 masters. I use the load balancer to direct traffic to the least loaded master node on http status 200 and ‘green’. From the \_cluster/health (5.x) or /status (6.x,7.x) pages. But if I enable username/password protection with the buckler plugin or with XPAC security, even the health check page requires a credential to be passed. Avi does not support passing credentials, and the whole idea of securing the site is not to then put the credentials in the load balancer. The /status page on bitbucket is excluded from access control. ---
**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\ **Post date:** [January 25, 2020, 10:54am UTC](https://discuss.elastic.co/t/is-it-possible-to-exclude-the-health-status-page-from-username-pwd-when-using-buckler-or-xpac-as-my-load-balancer-doesn-t-support-credentials/216501/4 "2020-01-25T10:54:11Z")
> [@nandersen674](#): > > I use an avi load balancer in front of my els master nodes, the client nodes are integrated on the bitbucket side. I have data nodes behind the master nodes, but not presented on the load balancer. It sounds like you have things the wrong way round. You should avoid sending any client traffic to master-eligible nodes if you can, so they can focus on managing the cluster. Expose your data nodes to the load balancer and not the master-eligible nodes. > [@nandersen674](#): > > I use the load balancer to direct traffic to the least loaded master node on http status 200 and ‘green’ Cluster health is a very coarse measure of availability, and requiring `green` health means that your load balancer will start rejecting requests if you have a single unassigned replica anywhere in the cluster. This sounds unnecessarily harsh and will likely cause you trouble in future. > [@nandersen674](#): > > Avi does not support passing credentials That is a pretty enormous missing feature IMO. Some suggestions: - use a load balancer that supports this feature. There are lots out there. - use a different authentication mechanism (e.g. [client certificates](https://www.elastic.co/guide/en/elasticsearch/reference/current/pki-realm.html)) - use a different health check (e.g. just check the port is open, don't request anything) - enable [anonymous access](https://www.elastic.co/guide/en/elasticsearch/reference/current/anonymous-access.html) to the routes you want > [@nandersen674](#): > > the whole idea of securing the site is not to then put the credentials in the load balancer This doesn't make sense. The load balancer is a client of the cluster and needs to prove its identity somehow. It shouldn't have more permissions than it needs to do its job. ---
**Author:** ![nandersen674](https://avatars.discourse-cdn.com/v4/letter/n/f07891/32.png) [@nandersen674](https://discuss.elastic.co/u/nandersen674)\ **Post date:** [January 25, 2020, 8:50pm UTC](https://discuss.elastic.co/t/is-it-possible-to-exclude-the-health-status-page-from-username-pwd-when-using-buckler-or-xpac-as-my-load-balancer-doesn-t-support-credentials/216501/5 "2020-01-25T20:50:59Z")
Hi David Thanks for all the feedback. I will switch the masters away from the lb. I guess my question is about enabling the anonymous access on the status page only when using buckler or xpac, but you are right, I have seen nodes drop off when status changes to orange. I really have only one source of data and one client, that is bitbucket. There are 8 nodes in the cluster, and I need to protect the data from being accessed by anyone other than bitbucket. So I will change the health check to port 9200 up Niels ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 22, 2020, 8:51pm UTC](https://discuss.elastic.co/t/is-it-possible-to-exclude-the-health-status-page-from-username-pwd-when-using-buckler-or-xpac-as-my-load-balancer-doesn-t-support-credentials/216501/6 "2020-02-22T20:51:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.