Skip to content

Commit 15000fd

Browse files
siegfriedwebersiegfriedweber
committed
test(backup-restore): Add the option to disable TLS in S3
1 parent f4c3059 commit 15000fd

8 files changed

Lines changed: 85 additions & 13 deletions

tests/templates/kuttl/backup-restore/11_minio-values.yaml renamed to tests/templates/kuttl/backup-restore/11_minio-values.yaml.j2

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ console:
1616
repository: bitnamilegacy/minio-object-browser
1717

1818
tls:
19-
enabled: true
19+
enabled: {{ test_scenario['values']['s3-use-tls'] }}
2020

2121
persistence:
2222
enabled: false # "false" means, that an emptyDir is used instead of a persistentVolumeClaim

‎tests/templates/kuttl/backup-restore/21-install-opensearch-1.yaml.j2‎

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -45,13 +45,19 @@ spec:
4545
plugins.security.authcz.admin_dn: CN=opensearch-1-admin-certificate
4646
plugins.security.restapi.roles_enabled: all_access
4747
plugins.security.ssl.http.pemtrustedcas_filepath: /stackable/opensearch/config/tls/concatenated/ca.crt
48+
{% if test_scenario['values']['s3-use-tls'] == 'true' %}
4849
s3.client.default.endpoint: https://minio:9000/
4950
s3.client.default.protocol: https
51+
{% else %}
52+
s3.client.default.endpoint: http://minio:9000/
53+
s3.client.default.protocol: http
54+
{% endif %}
5055
s3.client.default.region: unused # but required
5156
s3.client.default.path_style_access: "true"
5257
podOverrides:
5358
spec:
5459
initContainers:
60+
{% if test_scenario['values']['s3-use-tls'] == 'true' %}
5561
- name: init-system-keystore
5662
{% if test_scenario['values']['opensearch'].find(",") > 0 %}
5763
image: "{{ test_scenario['values']['opensearch'].split(',')[1] }}"
@@ -72,6 +78,7 @@ spec:
7278
mountPath: /etc/pki/ca-trust/source/anchors/s3-ca.crt
7379
subPath: tls.crt
7480
readOnly: true
81+
{% endif %}
7582
- name: init-tls
7683
{% if test_scenario['values']['opensearch'].find(",") > 0 %}
7784
image: "{{ test_scenario['values']['opensearch'].split(',')[1] }}"
@@ -106,18 +113,16 @@ spec:
106113
- name: security-config
107114
mountPath: /stackable/opensearch/config/opensearch-security
108115
readOnly: true
116+
{% if test_scenario['values']['s3-use-tls'] == 'true' %}
109117
- name: system-trust-store
110118
mountPath: /etc/pki/java/cacerts
111119
subPath: java/cacerts
112120
readOnly: true
121+
{% endif %}
113122
- name: tls-concatenated
114123
mountPath: /stackable/opensearch/config/tls/concatenated
115124
readOnly: true
116125
volumes:
117-
- name: s3-ca-crt
118-
secret:
119-
secretName: minio-ca-crt
120-
defaultMode: 0o660
121126
- name: admin-certificate
122127
secret:
123128
secretName: opensearch-1-admin-certificate
@@ -126,9 +131,15 @@ spec:
126131
secret:
127132
secretName: opensearch-1-security-config
128133
defaultMode: 0o660
134+
{% if test_scenario['values']['s3-use-tls'] == 'true' %}
135+
- name: s3-ca-crt
136+
secret:
137+
secretName: minio-ca-crt
138+
defaultMode: 0o660
129139
- name: system-trust-store
130140
emptyDir:
131141
sizeLimit: 10Mi
142+
{% endif %}
132143
- name: tls-concatenated
133144
emptyDir:
134145
sizeLimit: 1Mi

‎tests/templates/kuttl/backup-restore/30-create-snapshot.yaml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,10 @@ data:
8888
body={
8989
"type": "s3",
9090
"settings": {
91-
"bucket": "opensearch-data"
91+
"bucket": "opensearch-data",
92+
# The S3CrtClient that was introduced in OpenSearch 3.3.0, does not
93+
# work with a TLS-secured MinIO. Use the old Netty client instead.
94+
"s3_async_client_type": "netty"
9295
}
9396
}
9497
)

‎tests/templates/kuttl/backup-restore/31-backup-security-indices.yaml.j2‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,11 @@ spec:
88
spec:
99
initContainers:
1010
- name: backup-security-indices
11+
{% if test_scenario['values']['opensearch'].find(",") > 0 %}
12+
image: "{{ test_scenario['values']['opensearch'].split(',')[1] }}"
13+
{% else %}
1114
image: oci.stackable.tech/sdp/opensearch:{{ test_scenario['values']['opensearch'].split(',')[0] }}-stackable{{ test_scenario['values']['release'] }}
15+
{% endif %}
1216
command:
1317
- /stackable/scripts/backup-security-indices.sh
1418
env:
@@ -62,8 +66,13 @@ spec:
6266
volumeMounts:
6367
- name: scripts
6468
mountPath: /root/scripts
69+
{% if test_scenario['values']['s3-use-tls'] == 'true' %}
6570
- name: s3-ca-crt
6671
mountPath: /root/.mc/certs/CAs
72+
{% else %}
73+
- name: mc-config
74+
mountPath: /root/.mc
75+
{% endif %}
6776
- name: backup
6877
mountPath: /tmp/backup
6978
securityContext:
@@ -92,10 +101,16 @@ spec:
92101
secret:
93102
secretName: opensearch-1-admin-certificate
94103
defaultMode: 0o660
104+
{% if test_scenario['values']['s3-use-tls'] == 'true' %}
95105
- name: s3-ca-crt
96106
secret:
97107
secretName: minio-ca-crt
98108
defaultMode: 0o660
109+
{% else %}
110+
- name: mc-config
111+
emptyDir:
112+
sizeLimit: 1Mi
113+
{% endif %}
99114
- name: backup
100115
emptyDir:
101116
sizeLimit: 1Mi
@@ -121,6 +136,11 @@ data:
121136
upload-security-indices-backup.sh: |
122137
#!/usr/bin/env sh
123138

124-
mc alias set minio https://minio:9000/ $S3_ACCESS_KEY $S3_SECRET_KEY
139+
{% if test_scenario['values']['s3-use-tls'] == 'true' %}
140+
S3_PROTOCOL=https
141+
{% else %}
142+
S3_PROTOCOL=http
143+
{% endif %}
144+
mc alias set minio $S3_PROTOCOL://minio:9000/ $S3_ACCESS_KEY $S3_SECRET_KEY
125145
mc mb minio/opensearch-security
126146
mc cp /tmp/backup/* minio/opensearch-security/

‎tests/templates/kuttl/backup-restore/51-install-opensearch-2.yaml.j2‎

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -45,13 +45,19 @@ spec:
4545
plugins.security.authcz.admin_dn: CN=opensearch-2-admin-certificate
4646
plugins.security.restapi.roles_enabled: all_access
4747
plugins.security.ssl.http.pemtrustedcas_filepath: /stackable/opensearch/config/tls/concatenated/ca.crt
48+
{% if test_scenario['values']['s3-use-tls'] == 'true' %}
4849
s3.client.default.endpoint: https://minio:9000/
4950
s3.client.default.protocol: https
51+
{% else %}
52+
s3.client.default.endpoint: http://minio:9000/
53+
s3.client.default.protocol: http
54+
{% endif %}
5055
s3.client.default.region: unused # but required
5156
s3.client.default.path_style_access: "true"
5257
podOverrides:
5358
spec:
5459
initContainers:
60+
{% if test_scenario['values']['s3-use-tls'] == 'true' %}
5561
- name: init-system-keystore
5662
{% if test_scenario['values']['opensearch'].find(",") > 0 %}
5763
image: "{{ test_scenario['values']['opensearch'].split(',')[1] }}"
@@ -72,6 +78,7 @@ spec:
7278
mountPath: /etc/pki/ca-trust/source/anchors/s3-ca.crt
7379
subPath: tls.crt
7480
readOnly: true
81+
{% endif %}
7582
- name: init-tls
7683
{% if test_scenario['values']['opensearch'].find(",") > 0 %}
7784
image: "{{ test_scenario['values']['opensearch'].split(',')[1] }}"
@@ -106,18 +113,16 @@ spec:
106113
- name: security-config
107114
mountPath: /stackable/opensearch/config/opensearch-security
108115
readOnly: true
116+
{% if test_scenario['values']['s3-use-tls'] == 'true' %}
109117
- name: system-trust-store
110118
mountPath: /etc/pki/java/cacerts
111119
subPath: java/cacerts
112120
readOnly: true
121+
{% endif %}
113122
- name: tls-concatenated
114123
mountPath: /stackable/opensearch/config/tls/concatenated
115124
readOnly: true
116125
volumes:
117-
- name: s3-ca-crt
118-
secret:
119-
secretName: minio-ca-crt
120-
defaultMode: 0o660
121126
- name: admin-certificate
122127
secret:
123128
secretName: opensearch-2-admin-certificate
@@ -126,9 +131,15 @@ spec:
126131
secret:
127132
secretName: opensearch-2-security-config
128133
defaultMode: 0o660
134+
{% if test_scenario['values']['s3-use-tls'] == 'true' %}
135+
- name: s3-ca-crt
136+
secret:
137+
secretName: minio-ca-crt
138+
defaultMode: 0o660
129139
- name: system-trust-store
130140
emptyDir:
131141
sizeLimit: 10Mi
142+
{% endif %}
132143
- name: tls-concatenated
133144
emptyDir:
134145
sizeLimit: 1Mi

‎tests/templates/kuttl/backup-restore/60-restore-security-indices.yaml.j2‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,13 @@ spec:
2525
volumeMounts:
2626
- name: scripts
2727
mountPath: /root/scripts
28+
{% if test_scenario['values']['s3-use-tls'] == 'true' %}
2829
- name: s3-ca-crt
2930
mountPath: /root/.mc/certs/CAs
31+
{% else %}
32+
- name: mc-config
33+
mountPath: /root/.mc
34+
{% endif %}
3035
- name: backup
3136
mountPath: /tmp/backup
3237
securityContext:
@@ -45,7 +50,11 @@ spec:
4550
cpu: 400m
4651
containers:
4752
- name: restore-security-indices
53+
{% if test_scenario['values']['opensearch'].find(",") > 0 %}
54+
image: "{{ test_scenario['values']['opensearch'].split(',')[1] }}"
55+
{% else %}
4856
image: oci.stackable.tech/sdp/opensearch:{{ test_scenario['values']['opensearch'].split(',')[0] }}-stackable{{ test_scenario['values']['release'] }}
57+
{% endif %}
4958
command:
5059
- /stackable/scripts/restore-security-indices.sh
5160
env:
@@ -92,10 +101,16 @@ spec:
92101
secret:
93102
secretName: opensearch-2-admin-certificate
94103
defaultMode: 0o660
104+
{% if test_scenario['values']['s3-use-tls'] == 'true' %}
95105
- name: s3-ca-crt
96106
secret:
97107
secretName: minio-ca-crt
98108
defaultMode: 0o660
109+
{% else %}
110+
- name: mc-config
111+
emptyDir:
112+
sizeLimit: 1Mi
113+
{% endif %}
99114
- name: backup
100115
emptyDir:
101116
sizeLimit: 1Mi
@@ -112,7 +127,12 @@ data:
112127
download-security-indices-backup.sh: |
113128
#!/usr/bin/env sh
114129

115-
mc alias set minio https://minio:9000/ $S3_ACCESS_KEY $S3_SECRET_KEY
130+
{% if test_scenario['values']['s3-use-tls'] == 'true' %}
131+
S3_PROTOCOL=https
132+
{% else %}
133+
S3_PROTOCOL=http
134+
{% endif %}
135+
mc alias set minio $S3_PROTOCOL://minio:9000/ $S3_ACCESS_KEY $S3_SECRET_KEY
116136
mc cp --recursive minio/opensearch-security/ /tmp/backup
117137
restore-security-indices.sh: |
118138
#!/usr/bin/env sh

‎tests/templates/kuttl/backup-restore/61-restore-snapshot.yaml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,10 @@ data:
8888
body={
8989
"type": "s3",
9090
"settings": {
91-
"bucket": "opensearch-data"
91+
"bucket": "opensearch-data",
92+
# The S3CrtClient that was introduced in OpenSearch 3.3.0, does not
93+
# work with a TLS-secured MinIO. Use the old Netty client instead.
94+
"s3_async_client_type": "netty"
9295
}
9396
}
9497
)

‎tests/test-definition.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ dimensions:
1313
values:
1414
- "true"
1515
- "false"
16+
- name: s3-use-tls
17+
values:
18+
- "true"
1619
# The release must sometimes be known in podOverrides or Helm values
1720
- name: release
1821
values:
@@ -50,6 +53,7 @@ tests:
5053
dimensions:
5154
- opensearch
5255
- release
56+
- s3-use-tls
5357
suites:
5458
- name: nightly
5559
patch:

0 commit comments

Comments
 (0)