Fix search admin page error when ES server returns forbidden
What does this MR do and why?
I ran into this while testing an omnibus instance and tried to connect to OpenSearch where the cluster returned a forbidden response.
This change adds coverage for all Elastic transport errors when setting up advanced search in the admin ui
more logs from debugging
I tested this in AWS using an EC2 instance running GitLab EE. I added a newly created OpenSearch cluster and saved the admin page. I got a 500 error and the backtrace showed this method being responsible for the error
elasticsearch-transport (7.17.11) lib/elasticsearch/transport/transport/base.rb:218:in `__raise_transport_error'
elasticsearch-transport (7.17.11) lib/elasticsearch/transport/transport/base.rb:341:in `perform_request'
elasticsearch-transport (7.17.11) lib/elasticsearch/transport/transport/http/faraday.rb:36:in `perform_request'
elasticsearch-transport (7.17.11) lib/elasticsearch/transport/client.rb:197:in `perform_request'
lib/gitlab/instrumentation/elasticsearch_transport.rb:12:in `perform_request'
elasticsearch (7.17.11) lib/elasticsearch.rb:41:in `method_missing'
elasticsearch-api (7.17.11) lib/elasticsearch/api/namespace/common.rb:38:in `perform_request'
elasticsearch-api (7.17.11) lib/elasticsearch/api/actions/indices/exists.rb:51:in `block in exists'
elasticsearch-api (7.17.11) lib/elasticsearch/api/utils.rb:218:in `__rescue_from_not_found'
elasticsearch-api (7.17.11) lib/elasticsearch/api/actions/indices/exists.rb:50:in `exists'
ee/lib/gitlab/elastic/helper.rb:232:in `index_exists?'
ee/lib/gitlab/elastic/helper.rb:429:in `create_index'
ee/lib/gitlab/elastic/helper.rb:208:in `create_empty_index'
ee/app/services/ee/application_settings/update_service.rb:121:in `find_or_create_elasticsearch_index'
ee/app/services/ee/application_settings/update_service.rb:29:in `execute'
app/controllers/admin/application_settings_controller.rb:223:in `perform_update'
ee/app/controllers/ee/admin/application_settings_controller.rb:134:in `block (2 levels) in <module:ApplicationSettingsController>'
AI summary
This change improves error handling in the Elasticsearch search functionality by catching an additional type of error that can occur when the system tries to connect to or interact with Elasticsearch. Previously, the code only caught network-related errors, but now it also handles authorization and transport errors from Elasticsearch itself.
The update also adds a new test to verify that when Elasticsearch returns a "Forbidden" error (meaning the system doesn't have permission to perform an action), the application handles it gracefully without crashing. Additionally, some organizational labels were added to the test file to better categorize the different test scenarios for easier maintenance.
References
Screenshots or screen recordings
Before | After |
---|---|
How to set up and validate locally
-
enable elasticsearch in gdk
-
edit the
elasticsearch.yml
file inGDK_DIR/elasticsearch/config
directory# comment out the line below (it should be set to false) # xpack.security.enabled: false # add two new lines xpack.security.enabled: true xpack.security.authc.anonymous.roles: [] # Disable anonymous access
-
restart elasticsearch
gdk restart elasticsearch
-
navigate to Admin settings - Settings - Search - Advanced search
-
check elasticsearch indexing
-
click save <-- you will get an error on master but not on this branch
MR acceptance checklist
Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.