Disable searchguard for particular URL

Search Guard
#1

Hi, is it possible to disable searchguard for particular URL?

I am VERY affected by being unable to disable safeguard for healthchecks.

When running in kubernetes, the healtchecks are created automatically and I am unable to tweak it to either point to the TCP or tell the healthcheck that 401 is OK (I am speaking of Ingress loadbalancing healtchecks, not readiness/health probes)

So the only solution I can think of unless Searchguard implements unauthenticated requests for healthcheck is to disable searchguard for particular request, is that possible? thanks

#2

No, that’s not possible, but we do have a healthcheck endpoint which you can access without any credentials:

https://:9200/_searchguard/health

Documented here:

http://docs.search-guard.com/latest/search-guard-installation

(“Search Guard Health Check”)

Would that fit your needs?

···

On Monday, January 22, 2018 at 1:32:42 PM UTC+1, Jakub Racek wrote:

Hi, is it possible to disable searchguard for particular URL?

I am VERY affected by being unable to disable safeguard for healthchecks.

When running in kubernetes, the healtchecks are created automatically and I am unable to tweak it to either point to the TCP or tell the healthcheck that 401 is OK (I am speaking of Ingress loadbalancing healtchecks, not readiness/health probes)

So the only solution I can think of unless Searchguard implements unauthenticated requests for healthcheck is to disable searchguard for particular request, is that possible? thanks

#3

Yes, as soon as it returns 200, hehe. I imagine this was added just recently, correct? I will have to update ES and the searchguard itself as I am running com.floragunn:search-guard-5:5.6.4-18

···

On Monday, 22 January 2018 13:39:14 UTC+1, Jochen Kressin wrote:

No, that’s not possible, but we do have a healthcheck endpoint which you can access without any credentials:

https://:9200/_searchguard/healt

Documented here:

http://docs.search-guard.com/latest/search-guard-installation

(“Search Guard Health Check”)

Would that fit your needs?

On Monday, January 22, 2018 at 1:32:42 PM UTC+1, Jakub Racek wrote:

Hi, is it possible to disable searchguard for particular URL?

I am VERY affected by being unable to disable safeguard for healthchecks.

When running in kubernetes, the healtchecks are created automatically and I am unable to tweak it to either point to the TCP or tell the healthcheck that 401 is OK (I am speaking of Ingress loadbalancing healtchecks, not readiness/health probes)

So the only solution I can think of unless Searchguard implements unauthenticated requests for healthcheck is to disable searchguard for particular request, is that possible? thanks

#4

yes, this feature was added to SG6, it’s available from the first GA release onwards (6.1.0)

···

On Monday, January 22, 2018 at 1:56:57 PM UTC+1, Jakub Racek wrote:

No, that’s not possible, but we do have a healthcheck endpoint which you can access without any credentials:

https://:9200/_searchguard/healt

Documented here:

http://docs.search-guard.com/latest/search-guard-installation

(“Search Guard Health Check”)

Would that fit your needs?

On Monday, January 22, 2018 at 1:32:42 PM UTC+1, Jakub Racek wrote:

Hi, is it possible to disable searchguard for particular URL?

I am VERY affected by being unable to disable safeguard for healthchecks.

When running in kubernetes, the healtchecks are created automatically and I am unable to tweak it to either point to the TCP or tell the healthcheck that 401 is OK (I am speaking of Ingress loadbalancing healtchecks, not readiness/health probes)

So the only solution I can think of unless Searchguard implements unauthenticated requests for healthcheck is to disable searchguard for particular request, is that possible? thanks

Yes, as soon as it returns 200, hehe. I imagine this was added just recently, correct? I will have to update ES and the searchguard itself as I am running com.floragunn:search-guard-5:5.6.4-18

On Monday, 22 January 2018 13:39:14 UTC+1, Jochen Kressin wrote:

#5

Thanks Jochen, I am going to update then.

···

On Monday, 22 January 2018 14:05:47 UTC+1, Jochen Kressin wrote:

yes, this feature was added to SG6, it’s available from the first GA release onwards (6.1.0)

On Monday, January 22, 2018 at 1:56:57 PM UTC+1, Jakub Racek wrote:

No, that’s not possible, but we do have a healthcheck endpoint which you can access without any credentials:

https://:9200/_searchguard/healt

Documented here:

http://docs.search-guard.com/latest/search-guard-installation

(“Search Guard Health Check”)

Would that fit your needs?

On Monday, January 22, 2018 at 1:32:42 PM UTC+1, Jakub Racek wrote:

Hi, is it possible to disable searchguard for particular URL?

I am VERY affected by being unable to disable safeguard for healthchecks.

When running in kubernetes, the healtchecks are created automatically and I am unable to tweak it to either point to the TCP or tell the healthcheck that 401 is OK (I am speaking of Ingress loadbalancing healtchecks, not readiness/health probes)

So the only solution I can think of unless Searchguard implements unauthenticated requests for healthcheck is to disable searchguard for particular request, is that possible? thanks

Yes, as soon as it returns 200, hehe. I imagine this was added just recently, correct? I will have to update ES and the searchguard itself as I am running com.floragunn:search-guard-5:5.6.4-18

On Monday, 22 January 2018 13:39:14 UTC+1, Jochen Kressin wrote: