# Configsync problem with ElasticSearch recent releases

**URL:** <https://discuss.codelibs.org/t/configsync-problem-with-elasticsearch-recent-releases/1582>\
**Category:** English:Fess\
**Created:** [June 3, 2021, 6:15pm UTC](https://discuss.codelibs.org/t/configsync-problem-with-elasticsearch-recent-releases/1582 "2021-06-03T18:15:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![luigigf49](https://discuss.codelibs.org/letter_avatar_proxy/v4/letter/l/bb73d2/32.png) [@luigigf49](https://discuss.codelibs.org/u/luigigf49)\
**Post date:** [June 3, 2021, 6:15pm UTC](https://discuss.codelibs.org/t/configsync-problem-with-elasticsearch-recent-releases/1582/1 "2021-06-03T18:15:56Z")

</div>

Hi Marevol,

ElasticSearch introduced some restrictions on the use of plugins from versions above 7.11  
In fact it seems that the **configsync**  **plugin is no longer usable due to the new restrictions.**  
Fess requires the installation of the plugin which to be visible must be defined its path in **elasticsearch.yml** ; for example :

_ **configsync.config\_path: D: / Elastic / Elasticsearch / config /** _

But installation of this plugin fails with this error :

**…**  
**…**  
**Exception in thread “main” java.lang.IllegalArgumentException: plugin policy [C:\Program Files\Elastic\Elasticsearch\7.12.1\plugins.installing-14280001803523461252\plugin-security.policy] contains illegal permission (“java.io.FilePermission” “\<\>” “read,write”) in global grant**  
**…**  
**…**

This link

> <https://github.com/elastic/elasticsearch/issues/69464>
>
> \*\*Elasticsearch version\*\* (\`bin/elasticsearch --version\`):
> Version: 7.11.1, B…uild: default/tar/ff17057114c2199c9c1bbecc727003a907c0db7a/2021-02-15T13:44:09.394032Z, JVM: 11.0.6
> 
> \*\*Plugins installed\*\*: \[\]
> 
> \*\*JVM version\*\* (\`java -version\`):
> java version "11.0.6" 2020-01-14 LTS
> 
> \*\*OS version\*\* (\`uname -a\` if on a Unix-like system):
> 18.7.0 Darwin Kernel Version 18.7.0: Fri Oct 30 12:37:06 PDT 2020; root:xnu-4903.278.44.0.2~1/RELEASE\_X86\_64 x86\_64
> 
> \*\*Description of the problem including expected versus actual behavior\*\*:
> We manage our own ES cluster on k8s, and have developed a custom plug-in that needs to read a secret installed on a pod. For this we added the following to plugin-security.policy file:
> \`\`\`
> permission java.io.FilePermission "/var/run/secrets/kubernetes.io/serviceaccount/token", "read";
> \`\`\`
> With 7.10, this works as expected. However, the installation of the plugin fails with 7.11.1:
> \`\`\`
> Exception in thread "main" java.lang.IllegalArgumentException: plugin policy \[/Users/plebedev/elasticsearch-7.11.1/plugins/.installing-7543768861641787116/plugin-security.policy\] contains illegal permission ("java.io.FilePermission" "/var/run/secrets/kubernetes.io/serviceaccount/token#plus" "read") in global grant
> \`\`\`
> (see stack trace below). 
> 
> Here is the full file:
> \`\`\`
> grant {
> permission java.net.SocketPermission "\*", "resolve, connect";
> permission java.lang.RuntimePermission "getClassLoader";
> permission java.lang.RuntimePermission "setContextClassLoader";
> permission java.util.PropertyPermission "guava.concurrent.generate\_cancellation\_cause", "read";
> permission java.io.FilePermission "/var/run/secrets/kubernetes.io/serviceaccount/token", "read";
> permission java.lang.RuntimePermission "setFactory";
> permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
> permission java.lang.RuntimePermission "accessDeclaredMembers";
> };
> \`\`\`
> 
> In 7.11, the following file was added:
> https://github.com/elastic/elasticsearch/blob/v7.11.0/server/src/main/java/org/elasticsearch/bootstrap/PolicyUtil.java
> that explicitly list permissions allowed for plug-ins, and java.io.FilePermission is not part of it.
> If I simply remove this grant I will get this error:
> \`\`\`
> Caused by: java.security.AccessControlException: access denied ("java.io.FilePermission" "/var/run/secrets/kubernetes.io/serviceaccount/token" "read")
> at java.security.AccessControlContext.checkPermission(AccessControlContext.java:472) ~\[?:?\]
> at java.security.AccessController.checkPermission(AccessController.java:897) ~\[?:?\]
> at java.lang.SecurityManager.checkPermission(SecurityManager.java:322) ~\[?:?\]
> at java.lang.SecurityManager.checkRead(SecurityManager.java:661) ~\[?:?\]
> at java.io.File.canRead(File.java:764) ~\[?:?\]
> \`\`\`
> 
> If this is a bug, this needs to be fixed. If this is an intended behavior, the documentation needs to be updated that this is a breaking change, and the appropriate alternative provided. 
> 
> \*\*Steps to reproduce\*\*:
> You can use https://github.com/elastic/elasticsearch/tree/v7.11.1/plugins/examples/painless-whitelist as a baseline, add plugin-security.policy file (as described https://www.elastic.co/guide/en/elasticsearch/plugins/current/plugin-authors.html#plugin-authors-jsm) with the permission above and try to install on 7.11.1.
> 
> \*\*Provide logs (if relevant)\*\*:
> \`\`\`
> Exception in thread "main" java.lang.IllegalArgumentException: plugin policy \[/Users/plebedev/elasticsearch-7.11.1/plugins/.installing-7543768861641787116/plugin-security.policy\] contains illegal permission ("java.io.FilePermission" "/var/run/secrets/kubernetes.io/serviceaccount/token#plus" "read") in global grant
> at org.elasticsearch.bootstrap.PolicyUtil.validatePolicyPermissionsForJar(PolicyUtil.java:300)
> at org.elasticsearch.bootstrap.PolicyUtil.validatePolicyPermissions(PolicyUtil.java:310)
> at org.elasticsearch.bootstrap.PolicyUtil.getPluginPolicyInfo(PolicyUtil.java:321)
> at org.elasticsearch.plugins.InstallPluginCommand.installPlugin(InstallPluginCommand.java:861)
> at org.elasticsearch.plugins.InstallPluginCommand.execute(InstallPluginCommand.java:245)
> at org.elasticsearch.plugins.InstallPluginCommand.execute(InstallPluginCommand.java:215)
> at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:75)
> at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:116)
> at org.elasticsearch.cli.MultiCommand.execute(MultiCommand.java:80)
> at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:116)
> at org.elasticsearch.cli.Command.main(Command.java:79)
> at org.elasticsearch.plugins.PluginCli.main(PluginCli.java:36)
> \`\`\`

contains the report of a problem similar to mine and the response of an ElasticSearch technician.

Many thanks  
Luigi

---

<div class="post-metadata">

**Author:** ![shinsuke](https://discuss.codelibs.org/user_avatar/discuss.codelibs.org/shinsuke/32/6_2.png) [@shinsuke](https://discuss.codelibs.org/u/shinsuke)\
**Post date:** [June 3, 2021, 9:14pm UTC](https://discuss.codelibs.org/t/configsync-problem-with-elasticsearch-recent-releases/1582/2 "2021-06-03T21:14:59Z")

</div>

Configsync is not a plugin. Please see [Installation Guide](https://fess.codelibs.org/13.12/install/install.html).

---

<div class="post-metadata">

**Author:** ![luigigf49](https://discuss.codelibs.org/letter_avatar_proxy/v4/letter/l/bb73d2/32.png) [@luigigf49](https://discuss.codelibs.org/u/luigigf49)\
**Post date:** [June 4, 2021, 7:02am UTC](https://discuss.codelibs.org/t/configsync-problem-with-elasticsearch-recent-releases/1582/4 "2021-06-04T07:02:01Z")

</div>

Hi Marevol,

now I have this error from Fess startup :

**org.lastaflute.di.exception.ContainerInitFailureException: Look! Read the message below.**  
\*_/_ \* \* \* \* \* \* \* \* \* \* \* \* \* \* \* \* \* \* \* \* \* \* \* \* \* \* \* \* \* \* \* \* \*\*\*  
**Failed to initialize the container.**

**[Path]**  
**esclient.xml**

**[Namespace]**  
**null**

**[Included by]**  
**esflute\_config.xml**  
**esflute\_user.xml**  
**esflute\_log.xml**  
\*\*\* \* \* \* \* \* \* \* \* _/_\*  
\*\* at org.lastaflute.di.core.meta.impl.LaContainerImpl.throwContainerInitFailureException(LaContainerImpl.java:463)\*\*  
\*\* at org.lastaflute.di.core.meta.impl.LaContainerImpl.init(LaContainerImpl.java:415)\*\*  
\*\* at org.lastaflute.di.core.meta.impl.LaContainerImpl.doInit(LaContainerImpl.java:431)\*\*  
\*\* at org.lastaflute.di.core.meta.impl.LaContainerImpl.init(LaContainerImpl.java:413)\*\*  
\*\* at org.lastaflute.di.core.meta.impl.LaContainerImpl.doInit(LaContainerImpl.java:431)\*\*  
\*\* at org.lastaflute.di.core.meta.impl.LaContainerImpl.init(LaContainerImpl.java:413)\*\*  
\*\* at org.lastaflute.di.core.meta.impl.LaContainerImpl.doInit(LaContainerImpl.java:431)\*\*  
\*\* at org.lastaflute.di.core.meta.impl.LaContainerImpl.init(LaContainerImpl.java:413)\*\*  
\*\* at org.lastaflute.di.core.factory.SingletonLaContainerFactory.init(SingletonLaContainerFactory.java:67)\*\*  
\*\* at org.lastaflute.web.container.WebLastaContainerInitializer.doInitContainer(WebLastaContainerInitializer.java:81)\*\*  
\*\* at org.lastaflute.web.container.WebLastaContainerInitializer.initialize(WebLastaContainerInitializer.java:45)\*\*  
\*\* at org.lastaflute.web.servlet.filter.LastaPrepareFilter.initializeContainer(LastaPrepareFilter.java:137)\*\*  
\*\* at org.lastaflute.web.servlet.filter.LastaPrepareFilter.init(LastaPrepareFilter.java:94)\*\*  
\*\* at org.apache.catalina.core.ApplicationFilterConfig.initFilter(ApplicationFilterConfig.java:270)\*\*  
\*\* at org.apache.catalina.core.ApplicationFilterConfig.getFilter(ApplicationFilterConfig.java:251)\*\*  
\*\* at org.apache.catalina.core.ApplicationFilterConfig.(ApplicationFilterConfig.java:102)\*\*  
\*\* at org.apache.catalina.core.StandardContext.filterStart(StandardContext.java:4566)\*\*  
\*\* at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5203)\*\*  
\*\* at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)\*\*  
\*\* at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1384)\*\*  
\*\* at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1374)\*\*  
\*\* at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)\*\*  
\*\* at org.apache.tomcat.util.threads.InlineExecutorService.execute(InlineExecutorService.java:75)\*\*  
\*\* at java.base/java.util.concurrent.AbstractExecutorService.submit(AbstractExecutorService.java:140)\*\*  
\*\* at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:909)\*\*  
\*\* at org.apache.catalina.core.StandardHost.startInternal(StandardHost.java:843)\*\*  
\*\* at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)\*\*  
\*\* at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1384)\*\*  
\*\* at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1374)\*\*  
\*\* at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)\*\*  
\*\* at org.apache.tomcat.util.threads.InlineExecutorService.execute(InlineExecutorService.java:75)\*\*  
\*\* at java.base/java.util.concurrent.AbstractExecutorService.submit(AbstractExecutorService.java:140)\*\*  
\*\* at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:909)\*\*  
\*\* at org.apache.catalina.core.StandardEngine.startInternal(StandardEngine.java:262)\*\*  
\*\* at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)\*\*  
\*\* at org.apache.catalina.core.StandardService.startInternal(StandardService.java:434)\*\*  
\*\* at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)\*\*  
\*\* at org.apache.catalina.core.StandardServer.startInternal(StandardServer.java:930)\*\*  
\*\* at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)\*\*  
\*\* at org.apache.catalina.startup.Tomcat.start(Tomcat.java:486)\*\*  
\*\* at org.dbflute.tomcat.TomcatBoot.startServer(TomcatBoot.java:713)\*\*  
\*\* at org.dbflute.tomcat.TomcatBoot.go(TomcatBoot.java:402)\*\*  
\*\* at org.dbflute.tomcat.TomcatBoot.bootAwait(TomcatBoot.java:347)\*\*  
\*\* at org.codelibs.fess.FessBoot.main(FessBoot.java:96)\*\*  
**Caused by: org.lastaflute.di.core.exception.IllegalMethodRuntimeException: [ESSR0060]Can not configure method(open) of org.codelibs.fess.es.client.SearchEngineClient, because [fess.20210604] IndexNotFoundException[no such index [fess.20210604]]**  
\*\* at org.lastaflute.di.core.assembler.AbstractMethodAssembler.invoke(AbstractMethodAssembler.java:61)\*\*  
\*\* at org.lastaflute.di.core.assembler.DefaultInitMethodAssembler.assemble(DefaultInitMethodAssembler.java:40)\*\*  
\*\* at org.lastaflute.di.core.deployer.SingletonComponentDeployer.assemble(SingletonComponentDeployer.java:57)\*\*  
\*\* at org.lastaflute.di.core.deployer.SingletonComponentDeployer.deploy(SingletonComponentDeployer.java:41)\*\*  
\*\* at org.lastaflute.di.core.deployer.SingletonComponentDeployer.init(SingletonComponentDeployer.java:35)\*\*  
\*\* at org.lastaflute.di.core.meta.impl.ComponentDefImpl.init(ComponentDefImpl.java:85)\*\*  
\*\* at org.lastaflute.di.core.meta.impl.LaContainerImpl.doInit(LaContainerImpl.java:434)\*\*  
\*\* at org.lastaflute.di.core.meta.impl.LaContainerImpl.init(LaContainerImpl.java:413)\*\*  
\*\* … 42 more\*\*  
**Caused by: [fess.20210604] IndexNotFoundException[no such index [fess.20210604]]**  
\*\* at org.codelibs.fesen.client.action.HttpGetMappingsAction.lambda$execute$0(HttpGetMappingsAction.java:47)\*\*  
\*\* at org.codelibs.curl.CurlRequest.lambda$execute$4(CurlRequest.java:220)\*\*  
\*\* at org.codelibs.curl.CurlRequest.lambda$connect$3(CurlRequest.java:199)\*\*  
\*\* at java.base/java.util.concurrent.ForkJoinTask$RunnableExecuteAction.exec(ForkJoinTask.java:1429)\*\*  
\*\* at java.base/java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:290)\*\*  
\*\* at java.base/java.util.concurrent.ForkJoinPool$WorkQueue.topLevelExec(ForkJoinPool.java:1016)\*\*  
\*\* at java.base/java.util.concurrent.ForkJoinPool.scan(ForkJoinPool.java:1665)\*\*  
\*\* at java.base/java.util.concurrent.ForkJoinPool.runWorker(ForkJoinPool.java:1598)\*\*  
\*\* at java.base/java.util.concurrent.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:183)\*\*  
**WARNING: An illegal reflective access operation has occurred**  
**WARNING: Illegal reflective access by org.apache.catalina.loader.WebappClassLoaderBase (file:/D:/Fess/fess-13.12.2/lib/classes/) to field java.io.ObjectStreamClass$Caches.localDescs**  
**WARNING: Please consider reporting this to the maintainers of org.apache.catalina.loader.WebappClassLoaderBase**  
**WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations**  
**WARNING: All illegal access operations will be denied in a future release**

Thankyou  
Luigi

---

<div class="post-metadata">

**Author:** ![luigigf49](https://discuss.codelibs.org/letter_avatar_proxy/v4/letter/l/bb73d2/32.png) [@luigigf49](https://discuss.codelibs.org/u/luigigf49)\
**Post date:** [June 4, 2021, 7:14am UTC](https://discuss.codelibs.org/t/configsync-problem-with-elasticsearch-recent-releases/1582/5 "2021-06-04T07:14:09Z")

</div>

Hi Marevol,

I restarted the ElasticSearch service a couple of times and now everything seems to work!  
I would ask you to clarify, if possible, the doubt of the path of **… / data / config /** otherwise it’s okay as everything is working.

Many thanks  
Luigi