1245481 - Disable dynamic scripting on the OrangeFactor Elasticsearch cluster

Status: RESOLVED FIXED

(Infrastructure & Operations :: IT-Managed Tools, task)

Description

[Ed Morley [:emorley]]

In bug 1142538 / bug 1143123, a separate Elasticsearch cluster was created for OrangeFactor, since it's only compatible with ES v0.9x:

If it's not already, please can dynamic scripting be disabled on this cluster, for increased security:
https://www.elastic.co/guide/en/elasticsearch/reference/0.90/modules-scripting.html#_disabling_dynamic_scripts

The cluster is behind:
of-elasticsearch-zlb.webapp.scl3.mozilla.com
...and the individual VM hostnames are in bug 1143123.

Many thanks :-)

Comment 1

[C. Liang [:cyliang]]

I've pushed out the configuration change to the OrangeFactor ES servers and, after a quick check over IRC, restarted the cluster to force the configuration change.  Attempts to use a dynamic script are met with a 400 error ("ScriptException[dynamic scripting disabled]").

If you find that this has produced unpleasant side effects, please re-open this bug and flag me down in IRC.

[1] curl -XGET "http://localhost:9200/bugs-20160203/_search?q=*&pretty" -d' { "query": { "function_score": { "script_score": { "script": "Math.pow(doc[\"run\"].value, 2)", "lang": "groovy" } } } }'

Comment 2

[Ed Morley [:emorley]]

That's great, thank you for sorting this :-)