# We already have an ES cluster running WITHOUT authentication and TLS. We are trying to enable the security feature. Is it possible to achieve this with zero down time? **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [January 5, 2021, 3:18am UTC](https://discuss.elastic.co/t/we-already-have-an-es-cluster-running-without-authentication-and-tls-we-are-trying-to-enable-the-security-feature-is-it-possible-to-achieve-this-with-zero-down-time/260153 "2021-01-05T03:18:44Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![liwanjie](https://avatars.discourse-cdn.com/v4/letter/l/c4cdca/32.png) [@liwanjie](https://discuss.elastic.co/u/liwanjie)\ **Post date:** [January 5, 2021, 3:18am UTC](https://discuss.elastic.co/t/we-already-have-an-es-cluster-running-without-authentication-and-tls-we-are-trying-to-enable-the-security-feature-is-it-possible-to-achieve-this-with-zero-down-time/260153/1 "2021-01-05T03:18:44Z")
Hello, I have encountered the problem mentioned above. I encountered it during the rolling upgrade of elasticsearch 6.8.1 to 7.8.1. Because my 6.8.1 did not configure xpack related configuration, but I want to configure this function in 7.8.1. My approach is this: 1. On the basis that the cluster is 6.8.1, first offline a datanode node 2. Upgrade this node to 7.8.1, and configure xpack in elasticsearch.yml, and then start it 3. But it is found that it cannot join the current cluster, and the error reported in the log is consistent with your example 1. So I want to ask how to solve it? Our cluster does not want to stop the service, so it must be upgraded on a rolling basis Thank you very much。 I saw this issue mentioned in 2019, so I would like to ask if it has been resolved now? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 5, 2021, 3:21am UTC](https://discuss.elastic.co/t/we-already-have-an-es-cluster-running-without-authentication-and-tls-we-are-trying-to-enable-the-security-feature-is-it-possible-to-achieve-this-with-zero-down-time/260153/2 "2021-01-05T03:21:23Z")
Welcome to our community! 😃 You cannot enable TLS without a cluster wide outage. If you want zero downtime, you might need to setup a new cluster with TLS, run a snapshot+restore or remote reindex, then point your clients to the new cluster. ---
**Author:** ![liwanjie](https://avatars.discourse-cdn.com/v4/letter/l/c4cdca/32.png) [@liwanjie](https://discuss.elastic.co/u/liwanjie)\ **Post date:** [January 5, 2021, 3:46am UTC](https://discuss.elastic.co/t/we-already-have-an-es-cluster-running-without-authentication-and-tls-we-are-trying-to-enable-the-security-feature-is-it-possible-to-achieve-this-with-zero-down-time/260153/3 "2021-01-05T03:46:18Z")
Ok, thanks a lot. But I would like to ask again, will this problem be solved in the future, such as 8.x version or even 9.x version? Because there are 80 machines in our cluster at present, we have no budget to buy machines, and the data volume is also large, so it is not easy to back up ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 5, 2021, 3:48am UTC](https://discuss.elastic.co/t/we-already-have-an-es-cluster-running-without-authentication-and-tls-we-are-trying-to-enable-the-security-feature-is-it-possible-to-achieve-this-with-zero-down-time/260153/4 "2021-01-05T03:48:27Z")
The limitation is that the entire cluster needs to be on TLS comms or not to communicate with itself. I don't know if there are plans to change this. ---
**Author:** ![liwanjie](https://avatars.discourse-cdn.com/v4/letter/l/c4cdca/32.png) [@liwanjie](https://discuss.elastic.co/u/liwanjie)\ **Post date:** [January 5, 2021, 3:53am UTC](https://discuss.elastic.co/t/we-already-have-an-es-cluster-running-without-authentication-and-tls-we-are-trying-to-enable-the-security-feature-is-it-possible-to-achieve-this-with-zero-down-time/260153/5 "2021-01-05T03:53:52Z")
OK，thanks again 😄 ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [January 5, 2021, 6:38am UTC](https://discuss.elastic.co/t/we-already-have-an-es-cluster-running-without-authentication-and-tls-we-are-trying-to-enable-the-security-feature-is-it-possible-to-achieve-this-with-zero-down-time/260153/6 "2021-01-05T06:38:11Z")
Please note that you must first upgrade to the latest 6.8 version (6.8.13 I think) before doing a rolling upgrade to 7.x. You should pick the 7.10.1 version BTW as your target version as this is the latest. ---
**Author:** ![liwanjie](https://avatars.discourse-cdn.com/v4/letter/l/c4cdca/32.png) [@liwanjie](https://discuss.elastic.co/u/liwanjie)\ **Post date:** [January 5, 2021, 7:15am UTC](https://discuss.elastic.co/t/we-already-have-an-es-cluster-running-without-authentication-and-tls-we-are-trying-to-enable-the-security-feature-is-it-possible-to-achieve-this-with-zero-down-time/260153/7 "2021-01-05T07:15:12Z")
> [@liwanjie](#): > > 我在Elasticsearch 6.8.1到7.8.1的滚动升级中遇到了它。 Thank you very much for your advice. I didn't think about it before, and I think what you said is quite reasonable ---
**Author:** ![liwanjie](https://avatars.discourse-cdn.com/v4/letter/l/c4cdca/32.png) [@liwanjie](https://discuss.elastic.co/u/liwanjie)\ **Post date:** [January 5, 2021, 7:30am UTC](https://discuss.elastic.co/t/we-already-have-an-es-cluster-running-without-authentication-and-tls-we-are-trying-to-enable-the-security-feature-is-it-possible-to-achieve-this-with-zero-down-time/260153/9 "2021-01-05T07:30:39Z")
I'm sorry to bother you again. Because when upgrading ElasticSearch, ELK Statck related products need to be upgraded together. So should I first upgrade ElasticSearch to the corresponding version and then upgrade Logstash and Kibana related products? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 5, 2021, 7:30am UTC](https://discuss.elastic.co/t/we-already-have-an-es-cluster-running-without-authentication-and-tls-we-are-trying-to-enable-the-security-feature-is-it-possible-to-achieve-this-with-zero-down-time/260153/10 "2021-01-05T07:30:57Z")
Yep that is the best path. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [January 5, 2021, 8:46am UTC](https://discuss.elastic.co/t/we-already-have-an-es-cluster-running-without-authentication-and-tls-we-are-trying-to-enable-the-security-feature-is-it-possible-to-achieve-this-with-zero-down-time/260153/11 "2021-01-05T08:46:05Z")
Yes. And please look at the stack upgrade documentation > **[Upgrading the Elastic Stack | Installation and Upgrade Guide \[7.10\] | Elastic](https://www.elastic.co/guide/en/elastic-stack/current/upgrading-elastic-stack.html)** ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 2, 2021, 8:46am UTC](https://discuss.elastic.co/t/we-already-have-an-es-cluster-running-without-authentication-and-tls-we-are-trying-to-enable-the-security-feature-is-it-possible-to-achieve-this-with-zero-down-time/260153/12 "2021-02-02T08:46:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.