rename CRD fields based on decision

Author: labrenbe

deploy/helm/opensearch-operator/crds/crds.yaml

@@ -31,36 +31,36 @@ spec:
                 clusterConfig:
                   default:
                     tls:
-                      httpSecretClass: tls
-                      transportSecretClass: tls
+                      internalSecretClass: tls
+                      serverSecretClass: tls
                   description: Configuration that applies to all roles and role groups
                   properties:
                     tls:
                       default:
-                        httpSecretClass: tls
-                        transportSecretClass: tls
-                      description: TLS configuration options for the REST API and internal communication (transport).
+                        internalSecretClass: tls
+                        serverSecretClass: tls
+                      description: TLS configuration options for the server (REST API) and internal communication (transport).
                       properties:
-                        httpSecretClass:
+                        internalSecretClass:
                           default: tls
                           description: |-
-                            Only affects client connections to the REST API.
+                            Only affects internal communication (transport). Used for mutual verification between OpenSearch nodes.
                             This setting controls:
-                            - If TLS encryption is used at all
-                            - Which cert the servers should use to authenticate themselves against the client
+                            - Which cert the servers should use to authenticate themselves against other servers
+                            - Which ca.crt to use when validating the other server
                           maxLength: 253
                           minLength: 1
-                          nullable: true
                           type: string
-                        transportSecretClass:
+                        serverSecretClass:
                           default: tls
                           description: |-
-                            Only affects internal communication (transport). Used for mutual verification between OpenSearch nodes.
+                            Only affects client connections to the REST API.
                             This setting controls:
-                            - Which cert the servers should use to authenticate themselves against other servers
-                            - Which ca.crt to use when validating the other server
+                            - If TLS encryption is used at all
+                            - Which cert the servers should use to authenticate themselves against the client
                           maxLength: 253
                           minLength: 1
+                          nullable: true
                           type: string
                       type: object
                     vectorAggregatorConfigMapName:

docs/modules/opensearch/examples/getting_started/opensearch.yaml

@@ -14,14 +14,6 @@ spec:
       opensearch.yml:
         plugins.security.allow_default_init_securityindex: "true"
         plugins.security.restapi.roles_enabled: all_access
-        plugins.security.ssl.transport.enabled: "true"
-        plugins.security.ssl.transport.pemcert_filepath: /stackable/opensearch/config/tls/tls.crt
-        plugins.security.ssl.transport.pemkey_filepath: /stackable/opensearch/config/tls/tls.key
-        plugins.security.ssl.transport.pemtrustedcas_filepath: /stackable/opensearch/config/tls/ca.crt
-        plugins.security.ssl.http.enabled: "true"
-        plugins.security.ssl.http.pemcert_filepath: /stackable/opensearch/config/tls/tls.crt
-        plugins.security.ssl.http.pemkey_filepath: /stackable/opensearch/config/tls/tls.key
-        plugins.security.ssl.http.pemtrustedcas_filepath: /stackable/opensearch/config/tls/ca.crt
     podOverrides:
       spec:
         containers:
@@ -30,25 +22,8 @@ spec:
               - name: security-config
                 mountPath: /stackable/opensearch/config/opensearch-security
                 readOnly: true
-              - name: tls
-                mountPath: /stackable/opensearch/config/tls
-                readOnly: true
         volumes:
           - name: security-config
             secret:
               secretName: opensearch-security-config
               defaultMode: 0o660
-          - name: tls
-            ephemeral:
-              volumeClaimTemplate:
-                metadata:
-                  annotations:
-                    secrets.stackable.tech/class: tls
-                    secrets.stackable.tech/scope: node,pod,service=simple-opensearch,service=simple-opensearch-nodes-default,service=simple-opensearch-nodes-default-headless
-                spec:
-                  storageClassName: secrets.stackable.tech
-                  accessModes:
-                    - ReadWriteOnce
-                  resources:
-                    requests:
-                      storage: "1"

docs/modules/opensearch/pages/usage-guide/security.adoc

@@ -18,17 +18,17 @@ spec:
     productVersion: 3.1.0
   clusterConfig:
     tls:
-      httpSecretClass: tls # <1>
-      transportSecretClass: opensearch-transport-tls # <2>
+      serverSecretClass: tls # <1>
+      internalSecretClass: opensearch-internal-tls # <2>
   nodes:
     config:
       requestedSecretLifetime: 7d # <3>
     roleGroups:
       default:
         replicas: 3
 ----
-<1> The `spec.clusterConfig.tls.httpSecretClass` refers to the client-to-server encryption at the REST API. Defaults to the `tls` SecretClass and can be disabled by setting `httpSecretClass` to `null`.
-<2> The `spec.clusterConfig.tls.transportSecretClass` refers to the internal encryption between OpenSearch nodes using mTLS (transport). Defaults to the `tls` SecretClass` and can't be disabled.
+<1> The `spec.clusterConfig.tls.serverSecretClass` refers to the client-to-server encryption at the REST API. Defaults to the `tls` SecretClass and can be disabled by setting `serverSecretClass` to `null`.
+<2> The `spec.clusterConfig.tls.internalSecretClass` refers to the internal encryption between OpenSearch nodes using mTLS (transport). Defaults to the `tls` SecretClass` and can't be disabled.
 <3> The lifetime for autoTls certificates generated by the secret operator.
     Only a lifetime up to the `maxCertificateLifetime` setting in the SecretClass is applied.
 
@@ -52,4 +52,4 @@ spec:
       maxCertificateLifetime: 15d
 ----
 
-You can create your own secrets and reference them e.g. in the `spec.clusterConfig.tls.httpSecretClass` or `spec.clusterConfig.tls.transportSecretClass` to use different certificates.
+You can create your own secrets and reference them e.g. in the `spec.clusterConfig.tls.serverSecretClass` or `spec.clusterConfig.tls.internalSecretClass` to use different certificates.

rust/operator-binary/src/controller/build/node_config.rs

@@ -195,34 +195,34 @@ impl NodeConfig {
         );
         config.insert(
             CONFIG_OPTION_PLUGINS_SECURITY_SSL_TRANSPORT_PEMCERT_FILEPATH.to_owned(),
-            json!(format!("{opensearch_path_conf}/tls/transport/tls.crt")),
+            json!(format!("{opensearch_path_conf}/tls/internal/tls.crt")),
         );
         config.insert(
             CONFIG_OPTION_PLUGINS_SECURITY_SSL_TRANSPORT_PEMKEY_FILEPATH.to_owned(),
-            json!(format!("{opensearch_path_conf}/tls/transport/tls.key")),
+            json!(format!("{opensearch_path_conf}/tls/internal/tls.key")),
         );
         config.insert(
             CONFIG_OPTION_PLUGINS_SECURITY_SSL_TRANSPORT_PEMTRUSTEDCAS_FILEPATH.to_owned(),
-            json!(format!("{opensearch_path_conf}/tls/transport/ca.crt")),
+            json!(format!("{opensearch_path_conf}/tls/internal/ca.crt")),
         );
 
-        // TLS config for HTTP port which is optional.
-        if self.cluster.tls_config.http_secret_class.is_some() {
+        // TLS config for HTTP port (REST API) (optional).
+        if self.cluster.tls_config.server_secret_class.is_some() {
             config.insert(
                 CONFIG_OPTION_PLUGINS_SECURITY_SSL_HTTP_ENABLED.to_owned(),
                 json!("true".to_string()),
             );
             config.insert(
                 CONFIG_OPTION_PLUGINS_SECURITY_SSL_HTTP_PEMCERT_FILEPATH.to_owned(),
-                json!(format!("{opensearch_path_conf}/tls/http/tls.crt")),
+                json!(format!("{opensearch_path_conf}/tls/server/tls.crt")),
             );
             config.insert(
                 CONFIG_OPTION_PLUGINS_SECURITY_SSL_HTTP_PEMKEY_FILEPATH.to_owned(),
-                json!(format!("{opensearch_path_conf}/tls/http/tls.key")),
+                json!(format!("{opensearch_path_conf}/tls/server/tls.key")),
             );
             config.insert(
                 CONFIG_OPTION_PLUGINS_SECURITY_SSL_HTTP_PEMTRUSTEDCAS_FILEPATH.to_owned(),
-                json!(format!("{opensearch_path_conf}/tls/http/ca.crt")),
+                json!(format!("{opensearch_path_conf}/tls/server/ca.crt")),
             );
         } else {
             config.insert(
@@ -524,13 +524,13 @@ mod tests {
                 "node.attr.role-group: \"data\"\n",
                 "plugins.security.nodes_dn: [\"CN=generated certificate for pod\"]\n",
                 "plugins.security.ssl.http.enabled: \"true\"\n",
-                "plugins.security.ssl.http.pemcert_filepath: \"/stackable/opensearch/config/tls/http/tls.crt\"\n",
-                "plugins.security.ssl.http.pemkey_filepath: \"/stackable/opensearch/config/tls/http/tls.key\"\n",
-                "plugins.security.ssl.http.pemtrustedcas_filepath: \"/stackable/opensearch/config/tls/http/ca.crt\"\n",
+                "plugins.security.ssl.http.pemcert_filepath: \"/stackable/opensearch/config/tls/server/tls.crt\"\n",
+                "plugins.security.ssl.http.pemkey_filepath: \"/stackable/opensearch/config/tls/server/tls.key\"\n",
+                "plugins.security.ssl.http.pemtrustedcas_filepath: \"/stackable/opensearch/config/tls/server/ca.crt\"\n",
                 "plugins.security.ssl.transport.enabled: \"true\"\n",
-                "plugins.security.ssl.transport.pemcert_filepath: \"/stackable/opensearch/config/tls/transport/tls.crt\"\n",
-                "plugins.security.ssl.transport.pemkey_filepath: \"/stackable/opensearch/config/tls/transport/tls.key\"\n",
-                "plugins.security.ssl.transport.pemtrustedcas_filepath: \"/stackable/opensearch/config/tls/transport/ca.crt\"\n",
+                "plugins.security.ssl.transport.pemcert_filepath: \"/stackable/opensearch/config/tls/internal/tls.crt\"\n",
+                "plugins.security.ssl.transport.pemkey_filepath: \"/stackable/opensearch/config/tls/internal/tls.key\"\n",
+                "plugins.security.ssl.transport.pemtrustedcas_filepath: \"/stackable/opensearch/config/tls/internal/ca.crt\"\n",
                 "test: \"value\"",
             )
             .to_owned(),

rust/operator-binary/src/controller/build/role_group_builder.rs

@@ -76,8 +76,8 @@ constant!(DATA_VOLUME_NAME: VolumeName = "data");
 constant!(LISTENER_VOLUME_NAME: PersistentVolumeClaimName = "listener");
 const LISTENER_VOLUME_DIR: &str = "/stackable/listener";
 
-constant!(TLS_HTTP_VOLUME_NAME: VolumeName = "tls-http");
-constant!(TLS_TRANSPORT_VOLUME_NAME: VolumeName = "tls-transport");
+constant!(TLS_SERVER_VOLUME_NAME: VolumeName = "tls-server");
+constant!(TLS_INTERNAL_VOLUME_NAME: VolumeName = "tls-internal");
 
 constant!(LOG_VOLUME_NAME: VolumeName = "log");
 const LOG_VOLUME_DIR: &str = "/stackable/log";
@@ -295,18 +295,18 @@ impl<'a> RoleGroupBuilder<'a> {
                 ..Volume::default()
             },
             self.build_tls_volume(
-                &TLS_TRANSPORT_VOLUME_NAME.to_string(),
-                &self.cluster.tls_config.transport_secret_class,
+                &TLS_INTERNAL_VOLUME_NAME.to_string(),
+                &self.cluster.tls_config.internal_secret_class,
                 vec![],
                 SecretFormat::TlsPem,
                 &self.role_group_config.config.requested_secret_lifetime,
                 Some(&LISTENER_VOLUME_NAME.to_string()),
             ),
         ];
 
-        if let Some(tls_http_secret_class_name) = &self.cluster.tls_config.http_secret_class {
+        if let Some(tls_http_secret_class_name) = &self.cluster.tls_config.server_secret_class {
             volumes.push(self.build_tls_volume(
-                &TLS_HTTP_VOLUME_NAME.to_string(),
+                &TLS_SERVER_VOLUME_NAME.to_string(),
                 tls_http_secret_class_name,
                 service_scopes,
                 SecretFormat::TlsPem,
@@ -456,16 +456,16 @@ impl<'a> RoleGroupBuilder<'a> {
                 ..VolumeMount::default()
             },
             VolumeMount {
-                mount_path: format!("{opensearch_path_conf}/tls/transport"),
-                name: TLS_TRANSPORT_VOLUME_NAME.to_string(),
+                mount_path: format!("{opensearch_path_conf}/tls/internal"),
+                name: TLS_INTERNAL_VOLUME_NAME.to_string(),
                 ..VolumeMount::default()
             },
         ];
 
-        if self.cluster.tls_config.http_secret_class.is_some() {
+        if self.cluster.tls_config.server_secret_class.is_some() {
             volume_mounts.push(VolumeMount {
-                mount_path: format!("{opensearch_path_conf}/tls/http"),
-                name: TLS_HTTP_VOLUME_NAME.to_string(),
+                mount_path: format!("{opensearch_path_conf}/tls/server"),
+                name: TLS_SERVER_VOLUME_NAME.to_string(),
                 ..VolumeMount::default()
             })
         }
@@ -1088,12 +1088,12 @@ mod tests {
                                             "name": "log"
                                         },
                                                                                 {
-                                            "mountPath": "/stackable/opensearch/config/tls/transport",
-                                            "name": "tls-transport"
+                                            "mountPath": "/stackable/opensearch/config/tls/internal",
+                                            "name": "tls-internal"
                                         },
                                         {
-                                            "mountPath": "/stackable/opensearch/config/tls/http",
-                                            "name": "tls-http",
+                                            "mountPath": "/stackable/opensearch/config/tls/server",
+                                            "name": "tls-server",
                                         }
                                     ]
                                 },
@@ -1245,7 +1245,7 @@ mod tests {
                                             }
                                         }
                                     },
-                                "name": "tls-transport"
+                                "name": "tls-internal"
                                 },
                                 {
                                     "ephemeral": {
@@ -1271,7 +1271,7 @@ mod tests {
                                                 }
                                             }
                                         },
-                                    "name": "tls-http"
+                                    "name": "tls-server"
                                 },
                             ]
                         }

rust/operator-binary/src/controller/validate.rs

@@ -497,8 +497,8 @@ mod tests {
                 )]
                 .into(),
                 OpenSearchTls {
-                    http_secret_class: Some(SecretClassName::from_str_unsafe("tls")),
-                    transport_secret_class: SecretClassName::from_str_unsafe("tls")
+                    server_secret_class: Some(SecretClassName::from_str_unsafe("tls")),
+                    internal_secret_class: SecretClassName::from_str_unsafe("tls")
                 },
             )),
             result.ok()

rust/operator-binary/src/crd/mod.rs

@@ -81,7 +81,7 @@ pub mod versioned {
     #[derive(Clone, Debug, Default, Deserialize, Eq, JsonSchema, PartialEq, Serialize)]
     #[serde(rename_all = "camelCase")]
     pub struct OpenSearchClusterConfig {
-        /// TLS configuration options for the REST API and internal communication (transport).
+        /// TLS configuration options for the server (REST API) and internal communication (transport).
         #[serde(default)]
         pub tls: OpenSearchTls,
         /// Name of the Vector aggregator [discovery ConfigMap](DOCS_BASE_URL_PLACEHOLDER/concepts/service_discovery).
@@ -100,16 +100,16 @@ pub mod versioned {
         /// - If TLS encryption is used at all
         /// - Which cert the servers should use to authenticate themselves against the client
         #[serde(
-            default = "http_secret_class_default",
+            default = "server_secret_class_default",
             skip_serializing_if = "Option::is_none"
         )]
-        pub http_secret_class: Option<SecretClassName>,
+        pub server_secret_class: Option<SecretClassName>,
         /// Only affects internal communication (transport). Used for mutual verification between OpenSearch nodes.
         /// This setting controls:
         /// - Which cert the servers should use to authenticate themselves against other servers
         /// - Which ca.crt to use when validating the other server
-        #[serde(default = "transport_secret_class_default")]
-        pub transport_secret_class: SecretClassName,
+        #[serde(default = "internal_secret_class_default")]
+        pub internal_secret_class: SecretClassName,
     }
 
     // The possible node roles are by default the built-in roles and the search role, see
@@ -336,17 +336,17 @@ impl v1alpha1::OpenSearchConfig {
 impl Default for v1alpha1::OpenSearchTls {
     fn default() -> Self {
         v1alpha1::OpenSearchTls {
-            http_secret_class: http_secret_class_default(),
-            transport_secret_class: transport_secret_class_default(),
+            server_secret_class: server_secret_class_default(),
+            internal_secret_class: internal_secret_class_default(),
         }
     }
 }
 
-fn http_secret_class_default() -> Option<SecretClassName> {
+fn server_secret_class_default() -> Option<SecretClassName> {
     Some(TLS_DEFAULT_SECRET_CLASS.to_owned())
 }
 
-fn transport_secret_class_default() -> SecretClassName {
+fn internal_secret_class_default() -> SecretClassName {
     TLS_DEFAULT_SECRET_CLASS.to_owned()
 }
 

tests/templates/kuttl/ldap/20_opensearch-security-config.yaml.j2

@@ -58,7 +58,7 @@ stringData:
                 enable_ssl: true
                 hosts:
                   - openldap.$NAMESPACE.svc.cluster.local:1636
-                pemtrustedcas_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/transport/ca.crt
+                pemtrustedcas_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/internal/ca.crt
                 userbase: ou=users,dc=stackable,dc=tech
                 username_attribute: uid
                 usersearch: (cn={0})
@@ -73,7 +73,7 @@ stringData:
                 enable_ssl: true
                 hosts:
                   - openldap.$NAMESPACE.svc.cluster.local:1636
-                pemtrustedcas_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/transport/ca.crt
+                pemtrustedcas_filepath: {{ test_scenario['values']['opensearch_home'] }}/config/tls/internal/ca.crt
                 userbase: ou=users,dc=stackable,dc=tech
                 username_attribute: uid
                 usersearch: (cn={0})

tests/templates/kuttl/metrics/20-install-opensearch.yaml.j2

@@ -11,9 +11,9 @@ spec:
     productVersion: "{{ test_scenario['values']['opensearch'].split(',')[0] }}"
     pullPolicy: IfNotPresent
   clusterConfig:
-{% if test_scenario['values']['http-use-tls'] == 'false' %}
+{% if test_scenario['values']['server-use-tls'] == 'false' %}
     tls:
-      httpSecretClass: null
+      serverSecretClass: null
 {% endif %}
 {% if lookup('env', 'VECTOR_AGGREGATOR') %}
     vectorAggregatorConfigMapName: vector-aggregator-discovery

tests/templates/kuttl/opensearch-dashboards/10-install-opensearch.yaml.j2

@@ -11,9 +11,9 @@ spec:
     productVersion: "{{ test_scenario['values']['opensearch'].split(',')[0] }}"
     pullPolicy: IfNotPresent
   clusterConfig:
-{% if test_scenario['values']['http-use-tls'] == 'false' %}
+{% if test_scenario['values']['server-use-tls'] == 'false' %}
     tls:
-      httpSecretClass: null
+      serverSecretClass: null
 {% endif %}
 {% if lookup('env', 'VECTOR_AGGREGATOR') %}
     vectorAggregatorConfigMapName: vector-aggregator-discovery