[Entitlements] NotEntitledException with Dynatrace agent in place

[sephiroth-j]

Elasticsearch Version

8.18.0

Installed Plugins

No response

Java Version

openjdk version "21.0.7" 2025-04-15 LTS

OS Version

Linux elasticsearch-master-0 5.14.0-427.62.1.el9_4.x86_64 #1 SMP PREEMPT_DYNAMIC Sat Mar 22 10:20:42 EDT 2025 x86_64 GNU/Linux

Problem Description

Since upgrading from 8.17.4 to 8.18.0, we are seeing warnings of a NotEntitledException caused by our Dynatrace agent. ES is deployed in OpenShift 4.16 using the bitnami/elasticsearch image in version 8.18.0.

The log messages do not contain any entitlement, so it is unclear for us how to handle it and create a proper patch file as described here.

Steps to Reproduce

.

Logs (if relevant)

[2025-05-08T13:36:25,346][WARN ][o.e.e.r.p.P.(.ALL-UNNAMED] [camunda-elasticsearch-master-0] Not entitled: component [(unknown)], module [ALL-UNNAMED], class [class com.dynatrace.agent.casp.thirdparty.io.UrlUtils], operation [$java_net_URL$] org.elasticsearch.entitlement.runtime.api.NotEntitledException: component [(unknown)], module [ALL-UNNAMED], class [class com.dynatrace.agent.casp.thirdparty.io.UrlUtils], operation [$java_net_URL$]
at org.elasticsearch.entitlement@8.18.0/org.elasticsearch.entitlement.runtime.policy.PolicyManager.notEntitled(PolicyManager.java:572)
at org.elasticsearch.entitlement@8.18.0/org.elasticsearch.entitlement.runtime.policy.PolicyManager.neverEntitled(PolicyManager.java:277)
at org.elasticsearch.entitlement@8.18.0/org.elasticsearch.entitlement.runtime.policy.PolicyManager.checkChangeJVMGlobalState(PolicyManager.java:303)
at org.elasticsearch.entitlement@8.18.0/org.elasticsearch.entitlement.runtime.policy.PolicyManager.checkChangeNetworkHandling(PolicyManager.java:326)
at org.elasticsearch.entitlement@8.18.0/org.elasticsearch.entitlement.runtime.api.ElasticsearchEntitlementChecker.check$java_net_URL$(ElasticsearchEntitlementChecker.java:485)
at java.base/java.net.URL.<init>(URL.java)
at com.dynatrace.agent.casp.thirdparty.io.UrlUtils.createRestrictedURL(UrlUtils.java:350)
at com.dynatrace.agent.casp.thirdparty.codesource.CodeSourceLocationFactory.codeSourceLocationToUri(CodeSourceLocationFactory.java:164)
at com.dynatrace.agent.casp.thirdparty.codesource.CodeSourceLocationFactory.fromClass(CodeSourceLocationFactory.java:124)
at com.dynatrace.agent.casp.thirdparty.collectors.CodeSourceCollector.getFrom(CodeSourceCollector.java:57)
at com.dynatrace.agent.casp.thirdparty.SoftwareComponentInformationCreator.createFrom(SoftwareComponentInformationCreator.java:122)
at com.dynatrace.agent.casp.thirdparty.SoftwareComponentExtractor.doExtract(SoftwareComponentExtractor.java:103)
at com.dynatrace.agent.casp.thirdparty.SoftwareComponentExtractor.extract(SoftwareComponentExtractor.java:74)

[elasticsearchmachine]

Pinging @elastic/es-core-infra (Team:Core/Infra)

[rjernst]

Running Java agents with Elasticsearch is not recommended.

With that said, the warning here is in the new entitlements system (when trying to open a URL), but it should have similarly failed with Security Manager.

Is the system actually crashing, or is it just the log message? If it's the latter, the message is benign, I suspect Dynatrace is catching SecurityException and moving on (this was a common pattern with 3rd party integration with security manager).