-
Notifications
You must be signed in to change notification settings - Fork 2.5k
Open
Labels
Description
Describe the bug
With introduction of CatShardsAction, the _cat/shard call requires extra cluster permission cluster:monitor/shards for a non-admin user to call the API which was not required for versions prior to 2.17. We need to fix this to retain the old behaviour
(failed -{"root_cause":[{"type":"security_exception","reason":"no permissions for [cluster:monitor/shards] and User [name=regular, backend_roles=[], requestedTenant=null]"}],"type":"security_exception","reason":"no permissions for [cluster:monitor/shards] and User [name=regular, backend_roles=[], requestedTenant=null]"},"status":403}'})
Related component
Cluster Manager
To Reproduce
Make a _cat/shards call for a non-admin user on 2.17.
Expected behavior
The API call should work without providing user permission for cluster:monitor/shards
Additional Details
Impact: Opensearch versions 2.17 and above.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
Type
Projects
Status
🆕 New