带有Search Guard的Elasticsearch 7.1不允许我恢复快照

Question

我们最近将Elasticsearch从6.4.3升级到7.1.1。我将searchguard索引和配置迁移到了新的格式。

在升级之前，我可以创建或恢复快照，现在，在升级后，我仍然可以创建快照，但无法恢复它们：

{
  "error": {
    "root_cause": [
      {
        "type": "security_exception",
        "reason": "no permissions for [] and User [name=admin, roles=[admin], requestedTenant=null]"
      }
    ],
    "type": "security_exception",
    "reason": "no permissions for [] and User [name=admin, roles=[admin], requestedTenant=null]"
  },
  "status": 403
}

如果我打开SG的调试日志，它会告诉我我的请求被允许：

[2019-07-22T13:11:24,063][DEBUG][c.f.s.a.BackendRegistry  ] [client-elasticsearch-cluster-0] Check authdomain for rest internal/0 or 2 in total
[2019-07-22T13:11:24,063][DEBUG][c.f.s.a.BackendRegistry  ] [client-elasticsearch-cluster-0] Rest user 'User [name=admin, roles=[admin], requestedTenant=null]' is authenticated
[2019-07-22T13:11:24,063][DEBUG][c.f.s.a.BackendRegistry  ] [client-elasticsearch-cluster-0] sgtenant 'null'
[2019-07-22T13:11:24,064][DEBUG][c.f.s.p.PrivilegesEvaluator] [client-elasticsearch-cluster-0] ### evaluate permissions for User [name=admin, roles=[admin], requestedTenant=null] on client-elasticsearch-cluster-0
[2019-07-22T13:11:24,064][DEBUG][c.f.s.p.PrivilegesEvaluator] [client-elasticsearch-cluster-0] action: cluster:admin/snapshot/restore (RestoreSnapshotRequest)
[2019-07-22T13:11:24,064][DEBUG][c.f.s.r.IndexResolverReplacer] [client-elasticsearch-cluster-0] Resolve aliases, indices and types from RestoreSnapshotRequest
[2019-07-22T13:11:24,064][DEBUG][c.f.s.p.PrivilegesEvaluator] [client-elasticsearch-cluster-0] requestedResolved : Resolved [aliases=[*], indices=[*], allIndices=[*], types=[*], originalRequested=[], remoteIndices=[]]
[2019-07-22T13:11:24,064][DEBUG][c.f.s.f.SearchGuardFilter] [client-elasticsearch-cluster-0] PrivEvalResponse [allowed=true, missingPrivileges=[], allowedFlsFields=null, maskedFields=null, queries=null]

我需要做什么才能在ES 7上恢复快照？从6.4开始有什么变化？

Answer 1

原来elasticsearch和我都很愚蠢...

如果我尝试恢复一个不存在的快照，并在POST有效负载中发送一些参数，ES会报告缺少权限。一旦我移除了有效载荷，它就会告诉我快照丢失了...