diff --git a/CHANGELOG.md b/CHANGELOG.md index 1c906618..c5032ead 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,15 +15,18 @@ All notable changes to this project will be documented in this file. - Document Helm deployed RBAC permissions and remove unnecessary permissions ([#129]). - BREAKING: `configOverrides` now only accepts the known config file `opensearch.yml`. Previously, arbitrary file names were silently accepted and ignored ([#137]). -- Bump `stackable-operator` to 0.113.0 ([#137], [#147], [#149]). +- Bump `stackable-operator` to 0.113.1 ([#137], [#144], [#147], [#149]). - Move the framework code to operator-rs. This introduces no user-visible changes, except that the allowed length of role group names increases from 16 to 63 ([#147]). +- Replace the generic subject DN in the configuration setting `plugins.security.nodes_dn` with the + FQDNs of the OpenSearch nodes ([#144]). - test: Bump vector-aggregator to 0.55.0, replace /graphql call with gRPC call ([#146]). [#129]: https://github.com/stackabletech/opensearch-operator/pull/129 [#130]: https://github.com/stackabletech/opensearch-operator/pull/130 [#137]: https://github.com/stackabletech/opensearch-operator/pull/137 [#141]: https://github.com/stackabletech/opensearch-operator/pull/141 +[#144]: https://github.com/stackabletech/opensearch-operator/pull/144 [#146]: https://github.com/stackabletech/opensearch-operator/pull/146 [#147]: https://github.com/stackabletech/opensearch-operator/pull/147 [#148]: https://github.com/stackabletech/opensearch-operator/pull/148 diff --git a/Cargo.lock b/Cargo.lock index 48e21c84..a3efff68 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -108,9 +108,9 @@ dependencies = [ [[package]] name = "anyhow" -version = "1.0.102" +version = "1.0.103" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c" +checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3" [[package]] name = "arc-swap" @@ -1564,7 +1564,7 @@ dependencies = [ [[package]] name = "k8s-version" version = "0.1.3" -source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.0#310758d37c9e675a6549f68eb88af3458010023f" +source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#a609ce81f038b79c7cf2da19118bddc813a5c82e" dependencies = [ "darling", "regex", @@ -2979,8 +2979,8 @@ checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596" [[package]] name = "stackable-certs" -version = "0.4.0" -source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.0#310758d37c9e675a6549f68eb88af3458010023f" +version = "0.4.1" +source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#a609ce81f038b79c7cf2da19118bddc813a5c82e" dependencies = [ "const-oid", "ecdsa", @@ -3024,8 +3024,8 @@ dependencies = [ [[package]] name = "stackable-operator" -version = "0.113.0" -source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.0#310758d37c9e675a6549f68eb88af3458010023f" +version = "0.113.1" +source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#a609ce81f038b79c7cf2da19118bddc813a5c82e" dependencies = [ "base64", "clap", @@ -3070,7 +3070,7 @@ dependencies = [ [[package]] name = "stackable-operator-derive" version = "0.3.1" -source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.0#310758d37c9e675a6549f68eb88af3458010023f" +source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#a609ce81f038b79c7cf2da19118bddc813a5c82e" dependencies = [ "darling", "proc-macro2", @@ -3080,8 +3080,8 @@ dependencies = [ [[package]] name = "stackable-shared" -version = "0.1.1" -source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.0#310758d37c9e675a6549f68eb88af3458010023f" +version = "0.1.2" +source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#a609ce81f038b79c7cf2da19118bddc813a5c82e" dependencies = [ "jiff", "k8s-openapi", @@ -3097,8 +3097,8 @@ dependencies = [ [[package]] name = "stackable-telemetry" -version = "0.6.4" -source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.0#310758d37c9e675a6549f68eb88af3458010023f" +version = "0.6.5" +source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#a609ce81f038b79c7cf2da19118bddc813a5c82e" dependencies = [ "axum", "clap", @@ -3121,8 +3121,8 @@ dependencies = [ [[package]] name = "stackable-versioned" -version = "0.11.0" -source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.0#310758d37c9e675a6549f68eb88af3458010023f" +version = "0.11.1" +source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#a609ce81f038b79c7cf2da19118bddc813a5c82e" dependencies = [ "kube", "schemars", @@ -3135,8 +3135,8 @@ dependencies = [ [[package]] name = "stackable-versioned-macros" -version = "0.11.0" -source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.0#310758d37c9e675a6549f68eb88af3458010023f" +version = "0.11.1" +source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#a609ce81f038b79c7cf2da19118bddc813a5c82e" dependencies = [ "convert_case", "convert_case_extras", @@ -3153,8 +3153,8 @@ dependencies = [ [[package]] name = "stackable-webhook" -version = "0.9.1" -source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.0#310758d37c9e675a6549f68eb88af3458010023f" +version = "0.9.2" +source = "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#a609ce81f038b79c7cf2da19118bddc813a5c82e" dependencies = [ "arc-swap", "async-trait", diff --git a/Cargo.nix b/Cargo.nix index 14d87b7b..04d9bf9d 100644 --- a/Cargo.nix +++ b/Cargo.nix @@ -362,9 +362,9 @@ rec { }; "anyhow" = rec { crateName = "anyhow"; - version = "1.0.102"; + version = "1.0.103"; edition = "2021"; - sha256 = "0b447dra1v12z474c6z4jmicdmc5yxz5bakympdnij44ckw2s83z"; + sha256 = "1wsav2g6vxcvf2c0fv3jhxfr55l0p2g8nygy7rmmvcsfwgi8ahra"; authors = [ "David Tolnay " ]; @@ -4949,8 +4949,8 @@ rec { workspace_member = null; src = pkgs.fetchgit { url = "https://github.com/stackabletech/operator-rs.git"; - rev = "310758d37c9e675a6549f68eb88af3458010023f"; - sha256 = "0xw8nz7im6b2k9p87gggcqjn6lpl9y1cv1zh58fx9bjblm9vcr5p"; + rev = "a609ce81f038b79c7cf2da19118bddc813a5c82e"; + sha256 = "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33"; }; libName = "k8s_version"; authors = [ @@ -9770,13 +9770,13 @@ rec { }; "stackable-certs" = rec { crateName = "stackable-certs"; - version = "0.4.0"; + version = "0.4.1"; edition = "2024"; workspace_member = null; src = pkgs.fetchgit { url = "https://github.com/stackabletech/operator-rs.git"; - rev = "310758d37c9e675a6549f68eb88af3458010023f"; - sha256 = "0xw8nz7im6b2k9p87gggcqjn6lpl9y1cv1zh58fx9bjblm9vcr5p"; + rev = "a609ce81f038b79c7cf2da19118bddc813a5c82e"; + sha256 = "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33"; }; libName = "stackable_certs"; authors = [ @@ -9970,13 +9970,13 @@ rec { }; "stackable-operator" = rec { crateName = "stackable-operator"; - version = "0.113.0"; + version = "0.113.1"; edition = "2024"; workspace_member = null; src = pkgs.fetchgit { url = "https://github.com/stackabletech/operator-rs.git"; - rev = "310758d37c9e675a6549f68eb88af3458010023f"; - sha256 = "0xw8nz7im6b2k9p87gggcqjn6lpl9y1cv1zh58fx9bjblm9vcr5p"; + rev = "a609ce81f038b79c7cf2da19118bddc813a5c82e"; + sha256 = "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33"; }; libName = "stackable_operator"; authors = [ @@ -10174,8 +10174,8 @@ rec { workspace_member = null; src = pkgs.fetchgit { url = "https://github.com/stackabletech/operator-rs.git"; - rev = "310758d37c9e675a6549f68eb88af3458010023f"; - sha256 = "0xw8nz7im6b2k9p87gggcqjn6lpl9y1cv1zh58fx9bjblm9vcr5p"; + rev = "a609ce81f038b79c7cf2da19118bddc813a5c82e"; + sha256 = "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33"; }; procMacro = true; libName = "stackable_operator_derive"; @@ -10204,13 +10204,13 @@ rec { }; "stackable-shared" = rec { crateName = "stackable-shared"; - version = "0.1.1"; + version = "0.1.2"; edition = "2024"; workspace_member = null; src = pkgs.fetchgit { url = "https://github.com/stackabletech/operator-rs.git"; - rev = "310758d37c9e675a6549f68eb88af3458010023f"; - sha256 = "0xw8nz7im6b2k9p87gggcqjn6lpl9y1cv1zh58fx9bjblm9vcr5p"; + rev = "a609ce81f038b79c7cf2da19118bddc813a5c82e"; + sha256 = "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33"; }; libName = "stackable_shared"; authors = [ @@ -10285,13 +10285,13 @@ rec { }; "stackable-telemetry" = rec { crateName = "stackable-telemetry"; - version = "0.6.4"; + version = "0.6.5"; edition = "2024"; workspace_member = null; src = pkgs.fetchgit { url = "https://github.com/stackabletech/operator-rs.git"; - rev = "310758d37c9e675a6549f68eb88af3458010023f"; - sha256 = "0xw8nz7im6b2k9p87gggcqjn6lpl9y1cv1zh58fx9bjblm9vcr5p"; + rev = "a609ce81f038b79c7cf2da19118bddc813a5c82e"; + sha256 = "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33"; }; libName = "stackable_telemetry"; authors = [ @@ -10395,13 +10395,13 @@ rec { }; "stackable-versioned" = rec { crateName = "stackable-versioned"; - version = "0.11.0"; + version = "0.11.1"; edition = "2024"; workspace_member = null; src = pkgs.fetchgit { url = "https://github.com/stackabletech/operator-rs.git"; - rev = "310758d37c9e675a6549f68eb88af3458010023f"; - sha256 = "0xw8nz7im6b2k9p87gggcqjn6lpl9y1cv1zh58fx9bjblm9vcr5p"; + rev = "a609ce81f038b79c7cf2da19118bddc813a5c82e"; + sha256 = "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33"; }; libName = "stackable_versioned"; authors = [ @@ -10445,13 +10445,13 @@ rec { }; "stackable-versioned-macros" = rec { crateName = "stackable-versioned-macros"; - version = "0.11.0"; + version = "0.11.1"; edition = "2024"; workspace_member = null; src = pkgs.fetchgit { url = "https://github.com/stackabletech/operator-rs.git"; - rev = "310758d37c9e675a6549f68eb88af3458010023f"; - sha256 = "0xw8nz7im6b2k9p87gggcqjn6lpl9y1cv1zh58fx9bjblm9vcr5p"; + rev = "a609ce81f038b79c7cf2da19118bddc813a5c82e"; + sha256 = "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33"; }; procMacro = true; libName = "stackable_versioned_macros"; @@ -10513,13 +10513,13 @@ rec { }; "stackable-webhook" = rec { crateName = "stackable-webhook"; - version = "0.9.1"; + version = "0.9.2"; edition = "2024"; workspace_member = null; src = pkgs.fetchgit { url = "https://github.com/stackabletech/operator-rs.git"; - rev = "310758d37c9e675a6549f68eb88af3458010023f"; - sha256 = "0xw8nz7im6b2k9p87gggcqjn6lpl9y1cv1zh58fx9bjblm9vcr5p"; + rev = "a609ce81f038b79c7cf2da19118bddc813a5c82e"; + sha256 = "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33"; }; libName = "stackable_webhook"; authors = [ diff --git a/Cargo.toml b/Cargo.toml index 7e1271c9..22838bcf 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -10,7 +10,7 @@ edition = "2024" repository = "https://github.com/stackabletech/opensearch-operator" [workspace.dependencies] -stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "stackable-operator-0.113.0", features = ["webhook"] } +stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "stackable-operator-0.113.1", features = ["webhook"] } built = { version = "0.8", features = ["chrono", "git2"] } clap = "4.6" @@ -29,3 +29,4 @@ uuid = "1.23" [patch."https://github.com/stackabletech/operator-rs"] # stackable-operator = { git = "https://github.com/stackabletech//operator-rs.git", branch = "main" } +# stackable-operator = { path = "../operator-rs/crates/stackable-operator" } diff --git a/crate-hashes.json b/crate-hashes.json index 27f00e58..f660b5eb 100644 --- a/crate-hashes.json +++ b/crate-hashes.json @@ -1,12 +1,12 @@ { - "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.0#k8s-version@0.1.3": "0xw8nz7im6b2k9p87gggcqjn6lpl9y1cv1zh58fx9bjblm9vcr5p", - "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.0#stackable-certs@0.4.0": "0xw8nz7im6b2k9p87gggcqjn6lpl9y1cv1zh58fx9bjblm9vcr5p", - "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.0#stackable-operator-derive@0.3.1": "0xw8nz7im6b2k9p87gggcqjn6lpl9y1cv1zh58fx9bjblm9vcr5p", - "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.0#stackable-operator@0.113.0": "0xw8nz7im6b2k9p87gggcqjn6lpl9y1cv1zh58fx9bjblm9vcr5p", - "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.0#stackable-shared@0.1.1": "0xw8nz7im6b2k9p87gggcqjn6lpl9y1cv1zh58fx9bjblm9vcr5p", - "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.0#stackable-telemetry@0.6.4": "0xw8nz7im6b2k9p87gggcqjn6lpl9y1cv1zh58fx9bjblm9vcr5p", - "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.0#stackable-versioned-macros@0.11.0": "0xw8nz7im6b2k9p87gggcqjn6lpl9y1cv1zh58fx9bjblm9vcr5p", - "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.0#stackable-versioned@0.11.0": "0xw8nz7im6b2k9p87gggcqjn6lpl9y1cv1zh58fx9bjblm9vcr5p", - "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.0#stackable-webhook@0.9.1": "0xw8nz7im6b2k9p87gggcqjn6lpl9y1cv1zh58fx9bjblm9vcr5p", + "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#k8s-version@0.1.3": "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33", + "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#stackable-certs@0.4.1": "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33", + "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#stackable-operator-derive@0.3.1": "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33", + "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#stackable-operator@0.113.1": "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33", + "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#stackable-shared@0.1.2": "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33", + "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#stackable-telemetry@0.6.5": "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33", + "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#stackable-versioned-macros@0.11.1": "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33", + "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#stackable-versioned@0.11.1": "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33", + "git+https://github.com/stackabletech/operator-rs.git?tag=stackable-operator-0.113.1#stackable-webhook@0.9.2": "1qq2z64gzx4sd1csh35cxcfshvhgrm0c9b13rq0sqv0046lmhh33", "git+https://github.com/stackabletech/product-config.git?tag=0.8.0#product-config@0.8.0": "1dz70kapm2wdqcr7ndyjji0lhsl98bsq95gnb2lw487wf6yr7987" } \ No newline at end of file diff --git a/rust/operator-binary/src/controller/build/node_config.rs b/rust/operator-binary/src/controller/build/node_config.rs index 5242f6d7..9c535896 100644 --- a/rust/operator-binary/src/controller/build/node_config.rs +++ b/rust/operator-binary/src/controller/build/node_config.rs @@ -1,6 +1,6 @@ //! Configuration of an OpenSearch node -use std::str::FromStr; +use std::{iter, str::FromStr}; use serde_json::json; use stackable_operator::{ @@ -12,7 +12,7 @@ use stackable_operator::{ builder::pod::container::{EnvVarName, EnvVarSet}, config_overrides::JsonConfigOverrides, product_logging::framework::STACKABLE_LOG_DIR, - role_group_utils, + role_group_utils::{self, ResourceNames}, types::{kubernetes::ServiceName, operator::RoleGroupName}, }, }; @@ -218,10 +218,7 @@ impl NodeConfig { // Bind to all interfaces because the IP address is not known in advance. CONFIG_OPTION_NETWORK_HOST: "0.0.0.0", CONFIG_OPTION_DISCOVERY_TYPE: self.discovery_type(), - // Accept certificates generated by the secret-operator - CONFIG_OPTION_PLUGINS_SECURITY_NODES_DN: [ - "CN=generated certificate for pod" - ], + CONFIG_OPTION_PLUGINS_SECURITY_NODES_DN: json!(self.nodes_dn()), CONFIG_OPTION_NODE_ATTR_ROLE_GROUP: self.role_group_name, CONFIG_OPTION_PATH_LOGS: format!( "{STACKABLE_LOG_DIR}/{container}", @@ -251,6 +248,50 @@ impl NodeConfig { config } + /// Returns the list of distinguished names (DNs) that denote the other nodes in the cluster. + /// + /// The list looks similar to: + /// - DC=local,DC=cluster,DC=svc,DC=my-namespace,DC=opensearch-nodes-cluster-manager-headless,DC=opensearch-nodes-cluster-manager-* + /// - DC=local,DC=cluster,DC=svc,DC=my-namespace,DC=opensearch-nodes-data-headless,DC=opensearch-nodes-data-* + /// - CN=generated certificate for pod + /// + /// The entry "CN=generated certificate for pod" is still added to make the transition from + /// SDP 26.3 to 26.7 possible. + fn nodes_dn(&self) -> Vec { + self.cluster + .role_group_configs + .keys() + .map(|role_group_name| { + let resource_names = ResourceNames { + cluster_name: self.cluster.name.clone(), + role_name: ValidatedCluster::role_name(), + role_group_name: role_group_name.clone(), + }; + + self.cluster_domain_name + .split('.') + .rev() + .chain([ + "svc", + self.cluster.namespace.as_ref(), + resource_names.headless_service_name().as_ref(), + &format!( + "{stateful_set_name}-*", + stateful_set_name = resource_names.stateful_set_name() + ), + ]) + .map(|component| format!("DC={component}")) + .collect::>() + .join(",") + }) + // TODO Remove "CN=generated certificate for pod" after the release of SDP 26.7 and + // adapt the comment of the function and the tests. + // + // tracked in https://github.com/stackabletech/opensearch-operator/issues/145 + .chain(iter::once("CN=generated certificate for pod".to_owned())) + .collect() + } + /// Distinguished name (DN) of the super admin certificate pub fn super_admin_dn(&self) -> String { // The common name field is limited to 64 characters, see RFC 5280. @@ -673,6 +714,7 @@ mod tests { "path.logs: /stackable/log/opensearch\n", "plugins.security.authcz.admin_dn: CN=update-security-config.0b1e30e6-326e-4c1a-868d-ad6598b49e8b\n", "plugins.security.nodes_dn:\n", + "- DC=local,DC=cluster,DC=svc,DC=default,DC=my-opensearch-cluster-nodes-default-headless,DC=my-opensearch-cluster-nodes-default-*\n", "- CN=generated certificate for pod\n", "plugins.security.ssl.http.enabled: true\n", "plugins.security.ssl.http.pemcert_filepath: /stackable/opensearch/config/tls/server/tls.crt\n", diff --git a/rust/operator-binary/src/controller/build/role_group_builder.rs b/rust/operator-binary/src/controller/build/role_group_builder.rs index 79b3294a..6d7b3ac7 100644 --- a/rust/operator-binary/src/controller/build/role_group_builder.rs +++ b/rust/operator-binary/src/controller/build/role_group_builder.rs @@ -1083,7 +1083,8 @@ impl<'a> RoleGroupBuilder<'a> { .with_pod_scope() .with_listener_volume_scope(ROLE_GROUP_LISTENER_VOLUME_NAME.to_string()) .with_format(SecretFormat::TlsPem) - .with_auto_tls_cert_lifetime(self.role_group_config.config.requested_secret_lifetime); + .with_auto_tls_cert_lifetime(self.role_group_config.config.requested_secret_lifetime) + .with_auto_tls_cert_domain_components_in_subject_dn(true); if self .role_group_config @@ -1122,7 +1123,8 @@ impl<'a> RoleGroupBuilder<'a> { .with_pod_scope() .with_listener_volume_scope(ROLE_GROUP_LISTENER_VOLUME_NAME.to_string()) .with_format(SecretFormat::TlsPem) - .with_auto_tls_cert_lifetime(self.role_group_config.config.requested_secret_lifetime); + .with_auto_tls_cert_lifetime(self.role_group_config.config.requested_secret_lifetime) + .with_auto_tls_cert_domain_components_in_subject_dn(true); if self.role_group_config.config.discovery_service_exposed { volume_source_builder @@ -2530,6 +2532,7 @@ mod tests { "metadata": { "annotations": { "secrets.stackable.tech/backend.autotls.cert.lifetime": "1d", + "secrets.stackable.tech/backend.autotls.cert.domain-components-in-subject-dn": "true", "secrets.stackable.tech/class": "tls", "secrets.stackable.tech/format": "tls-pem", "secrets.stackable.tech/provision-parts": "public-private", @@ -2557,6 +2560,7 @@ mod tests { "metadata": { "annotations": { "secrets.stackable.tech/backend.autotls.cert.lifetime": "1d", + "secrets.stackable.tech/backend.autotls.cert.domain-components-in-subject-dn": "true", "secrets.stackable.tech/class": "tls", "secrets.stackable.tech/format": "tls-pem", "secrets.stackable.tech/provision-parts": "public-private", @@ -2742,6 +2746,7 @@ mod tests { "metadata": { "annotations": { "secrets.stackable.tech/backend.autotls.cert.lifetime": "1d", + "secrets.stackable.tech/backend.autotls.cert.domain-components-in-subject-dn": "true", "secrets.stackable.tech/class": "tls", "secrets.stackable.tech/format": "tls-pem", "secrets.stackable.tech/provision-parts": "public-private", @@ -2769,6 +2774,7 @@ mod tests { "metadata": { "annotations": { "secrets.stackable.tech/backend.autotls.cert.lifetime": "1d", + "secrets.stackable.tech/backend.autotls.cert.domain-components-in-subject-dn": "true", "secrets.stackable.tech/class": "tls", "secrets.stackable.tech/format": "tls-pem", "secrets.stackable.tech/provision-parts": "public-private", @@ -2966,6 +2972,7 @@ mod tests { "metadata": { "annotations": { "secrets.stackable.tech/backend.autotls.cert.lifetime": "1d", + "secrets.stackable.tech/backend.autotls.cert.domain-components-in-subject-dn": "true", "secrets.stackable.tech/class": "tls", "secrets.stackable.tech/format": "tls-pem", "secrets.stackable.tech/provision-parts": "public-private", @@ -2993,6 +3000,7 @@ mod tests { "metadata": { "annotations": { "secrets.stackable.tech/backend.autotls.cert.lifetime": "1d", + "secrets.stackable.tech/backend.autotls.cert.domain-components-in-subject-dn": "true", "secrets.stackable.tech/class": "tls", "secrets.stackable.tech/format": "tls-pem", "secrets.stackable.tech/provision-parts": "public-private", diff --git a/tests/templates/kuttl/smoke/10-assert.yaml.j2 b/tests/templates/kuttl/smoke/10-assert.yaml.j2 index 74bbb0d3..cd7e78b8 100644 --- a/tests/templates/kuttl/smoke/10-assert.yaml.j2 +++ b/tests/templates/kuttl/smoke/10-assert.yaml.j2 @@ -1048,29 +1048,36 @@ metadata: kind: OpenSearchCluster name: opensearch data: - opensearch.yml: | - cluster.name: opensearch - cluster.routing.allocation.disk.threshold_enabled: false - discovery.type: zen - network.host: 0.0.0.0 - node.attr.role-group: cluster-manager - node.store.allow_mmap: false - path.logs: /stackable/log/opensearch - plugins.security.allow_default_init_securityindex: true - plugins.security.nodes_dn: - - CN=generated certificate for pod -{% if test_scenario['values']['server-use-tls'] == 'true' %} - plugins.security.ssl.http.enabled: true - plugins.security.ssl.http.pemcert_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/server/tls.crt - plugins.security.ssl.http.pemkey_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/server/tls.key - plugins.security.ssl.http.pemtrustedcas_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/server/ca.crt -{% else %} - plugins.security.ssl.http.enabled: false -{% endif %} - plugins.security.ssl.transport.enabled: true - plugins.security.ssl.transport.pemcert_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/internal/tls.crt - plugins.security.ssl.transport.pemkey_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/internal/tls.key - plugins.security.ssl.transport.pemtrustedcas_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/internal/ca.crt +{% raw %} + log4j2.properties: | + rootLogger.level = INFO + rootLogger.appenderRef.CONSOLE.ref = CONSOLE + rootLogger.appenderRef.FILE.ref = FILE + appender.CONSOLE.type = Console + appender.CONSOLE.name = CONSOLE + appender.CONSOLE.target = SYSTEM_ERR + appender.CONSOLE.layout.type = PatternLayout + appender.CONSOLE.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n + appender.CONSOLE.filter.threshold.type = ThresholdFilter + appender.CONSOLE.filter.threshold.level = INFO + appender.FILE.type = RollingFile + appender.FILE.name = FILE + appender.FILE.fileName = /stackable/log/opensearch/opensearch_server.json + appender.FILE.filePattern = /stackable/log/opensearch/opensearch_server.json.%i + appender.FILE.layout.type = OpenSearchJsonLayout + appender.FILE.layout.type_name = server + appender.FILE.policies.type = Policies + appender.FILE.policies.size.type = SizeBasedTriggeringPolicy + appender.FILE.policies.size.size = 5MB + appender.FILE.strategy.type = DefaultRolloverStrategy + appender.FILE.strategy.max = 1 + appender.FILE.filter.threshold.type = ThresholdFilter + appender.FILE.filter.threshold.level = INFO +{% endraw %} + # opensearch.yml: | + # The property "plugins.security.nodes_dn" in opensearch.yml contains the namespace and cluster + # domain. Since these cannot be substituted here, opensearch.yml is omitted in this assertion. + # This is okay, because the configuration file is already covered by the unit tests. --- apiVersion: v1 kind: ConfigMap @@ -1090,29 +1097,36 @@ metadata: kind: OpenSearchCluster name: opensearch data: - opensearch.yml: | - cluster.name: opensearch - cluster.routing.allocation.disk.threshold_enabled: false - discovery.type: zen - network.host: 0.0.0.0 - node.attr.role-group: data - node.store.allow_mmap: false - path.logs: /stackable/log/opensearch - plugins.security.allow_default_init_securityindex: true - plugins.security.nodes_dn: - - CN=generated certificate for pod -{% if test_scenario['values']['server-use-tls'] == 'true' %} - plugins.security.ssl.http.enabled: true - plugins.security.ssl.http.pemcert_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/server/tls.crt - plugins.security.ssl.http.pemkey_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/server/tls.key - plugins.security.ssl.http.pemtrustedcas_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/server/ca.crt -{% else %} - plugins.security.ssl.http.enabled: false -{% endif %} - plugins.security.ssl.transport.enabled: true - plugins.security.ssl.transport.pemcert_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/internal/tls.crt - plugins.security.ssl.transport.pemkey_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/internal/tls.key - plugins.security.ssl.transport.pemtrustedcas_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/internal/ca.crt +{% raw %} + log4j2.properties: |2 + rootLogger.level = INFO + rootLogger.appenderRef.CONSOLE.ref = CONSOLE + rootLogger.appenderRef.FILE.ref = FILE + appender.CONSOLE.type = Console + appender.CONSOLE.name = CONSOLE + appender.CONSOLE.target = SYSTEM_ERR + appender.CONSOLE.layout.type = PatternLayout + appender.CONSOLE.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node_name]%marker %m%n + appender.CONSOLE.filter.threshold.type = ThresholdFilter + appender.CONSOLE.filter.threshold.level = INFO + appender.FILE.type = RollingFile + appender.FILE.name = FILE + appender.FILE.fileName = /stackable/log/opensearch/opensearch_server.json + appender.FILE.filePattern = /stackable/log/opensearch/opensearch_server.json.%i + appender.FILE.layout.type = OpenSearchJsonLayout + appender.FILE.layout.type_name = server + appender.FILE.policies.type = Policies + appender.FILE.policies.size.type = SizeBasedTriggeringPolicy + appender.FILE.policies.size.size = 5MB + appender.FILE.strategy.type = DefaultRolloverStrategy + appender.FILE.strategy.max = 1 + appender.FILE.filter.threshold.type = ThresholdFilter + appender.FILE.filter.threshold.level = INFO +{% endraw %} + # opensearch.yml: | + # The property "plugins.security.nodes_dn" in opensearch.yml contains the namespace and cluster + # domain. Since these cannot be substituted here, opensearch.yml is omitted in this assertion. + # This is okay, because the configuration file is already covered by the unit tests. --- apiVersion: v1 kind: Service