[
https://issues.apache.org/jira/browse/SOLR-14216?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17044758#comment-17044758
]
Anshum Gupta commented on SOLR-14216:
-------------------------------------
I'm still not convinced about opening up the response to "is this node healthy"
to the outside world if auth is enabled. This is just coming from my experience
with security folks (I'm not there yet, no plans either).
I like the idea of documenting this well, and supporting some mechanism that
makes it easy to open up endpoints for such purposes.
> Exclude HealthCheck from authentication
> ---------------------------------------
>
> Key: SOLR-14216
> URL: https://issues.apache.org/jira/browse/SOLR-14216
> Project: Solr
> Issue Type: Improvement
> Security Level: Public(Default Security Level. Issues are Public)
> Components: Authentication
> Reporter: Jan Høydahl
> Assignee: Jan Høydahl
> Priority: Major
> Time Spent: 10m
> Remaining Estimate: 0h
>
> The {{HealthCheckHandler}} on {{/api/node/health}} and
> {{/solr/admin/info/health}} should by default not be subject to
> authentication, but be open for all. This allows for load balancers and
> various monitoring to probe Solr's health without having to support the auth
> scheme in place. I can't see any reason we need auth on the health endpoint.
> It is possible to achieve the same by setting blockUnknown=false and
> configuring three RBAC permissions: One for v1 endpoint, one for v2 endpoint
> and one "all" catch all at the end of the chain. But this is cumbersome so
> better have this ootb.
> An alternative solution is to create a separate HttpServer for health check,
> listening on a different port, just like embedded ZK and JMX.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscr...@lucene.apache.org
For additional commands, e-mail: issues-h...@lucene.apache.org
