elastic 删除 index 错误action [indices:admin/delete] is unauthorized for user [admin] with roles

DELETE index

问题描述

集群状态为 red, 查看 shared 的状态，部分 index 一直为 CLUSTER_RECOVERED, 通过 _cluster/allocation/explain 看到的结果为

{
  "note": "No shard was specified in the explain API request, so this response explains a randomly chosen unassigned shard. There may be other unassigned shards in this cluster which cannot be assigned for different reasons. It may not be possible to assign this shard until one of the other shards is assigned correctly. To explain the allocation of other shards (whether assigned or unassigned) you must specify the target shard in the request to this API.",
  "index": ".kibana_task_manager_8.2.3_001",
  "shard": 0,
  "primary": true,
  "current_state": "unassigned",
  "unassigned_info": {
    "reason": "CLUSTER_RECOVERED",
    "at": "2023-09-01T06:11:54.630Z",
    "last_allocation_status": "no_valid_shard_copy"
  },
  "can_allocate": "no_valid_shard_copy",
  "allocate_explanation": "Elasticsearch can't allocate this shard because all the copies of its data in the cluster are stale or corrupt. Elasticsearch will allocate this shard when a node containing a good copy of its data joins the cluster. If no such node is available, restore this index from a recent snapshot.",
  "node_allocation_decisions": [
    {
      "node_id": "L5DqEInQQ9a4vrzyxwIqiA",
      "node_name": "x-es-cluster-1",
      "transport_address": "10.233.100.162:9300",
      "node_attributes": {
        "k8s_node_name": "node7",
        "xpack.installed": "true"
      },
      "node_decision": "no",
      "store": {
        "found": false
      }
    },
    {
      "node_id": "lL2MB_xLReCMpltUjHtkaw",
      "node_name": "x-es-cluster-2",
      "transport_address": "10.233.90.2:9300",
      "node_attributes": {
        "k8s_node_name": "node8",
        "xpack.installed": "true"
      },
      "node_decision": "no",
      "store": {
        "found": false
      }
    },
    {
      "node_id": "qYFVkdZlSvKhb_7Jf433qA",
      "node_name": "x-es-cluster-0",
      "transport_address": "10.233.111.239:9300",
      "node_attributes": {
        "k8s_node_name": "node9",
        "xpack.installed": "true"
      },
      "node_decision": "no",
      "store": {
        "in_sync": false,
        "allocation_id": "R5Jj43pgSYOfLpPEwzXUVg"
      }
    }
  ]
}

尝试删除该 index,结果

security_exception: action [indices:admin/delete] is unauthorized for user [admin] with roles [superuser] on indices [.kibana_task_manager_8.2.3_001], this action is granted by the index privileges [delete_index,manage,all]

处理方法

Cannot DELETE Index with Superuser
Implement allowing administrators to manage any report or reporting index
主要是这个: Resolve migration failures

新建用户并赋予权限，用新的用户去删除索引

### 创建角色
# curl -XPUT --user "elastic:tXtnQMOn"  -H 'Content-Type: application/json' -k 'https://10.233.6.191:9200/_security/role/grant_kibana_system_indices' -d '{
>   "indices": [
>     {
>       "names": [
>         ".kibana*"
>       ],
>       "privileges": [
>         "all"
>       ],
>       "allow_restricted_indices": true
>     }
>   ]
> }'
{"role":{"created":true}}
### 为该角色创建用户
# curl -XPUT --user "elastic:tXtnQMOn"  -H 'Content-Type: application/json' -k 'https://10.233.6.191:9200/_security/user/temporarykibanasuperuser' -d '{
>   "password" : "l0ng-r4nd0m-p@ssw0rd",
>   "roles" : [ "superuser", "grant_kibana_system_indices" ]
> }'
{"created":true}
### 该用户删除索引
# curl -XDELETE --user "temporarykibanasuperuser:l0ng-r4nd0m-p@ssw0rd" -k 'https://10.233.6.191:9200/.kibana_task_manager_8.2.3_001'
{"acknowledged":true}

TODO

为什么默认的用户不能删除，调查一下机制