Rename clusterConfig.security.config to clusterConfig.security.settings; Fix admin DN; Fix integration tests

Author: siegfriedweber

deploy/helm/opensearch-operator/crds/crds.yaml

@@ -32,7 +32,9 @@ spec:
                   default:
                     keystore: []
                     security:
-                      config:
+                      enabled: true
+                      managingRoleGroup: security-config
+                      settings:
                         actionGroups:
                           content:
                             value:
@@ -105,8 +107,6 @@ spec:
                                 config_version: 2
                                 type: tenants
                           managedBy: API
-                      enabled: true
-                      managingRoleGroup: security-config
                     tls:
                       internalSecretClass: tls
                       serverSecretClass: tls
@@ -148,7 +148,9 @@ spec:
                       type: array
                     security:
                       default:
-                        config:
+                        enabled: true
+                        managingRoleGroup: security-config
+                        settings:
                           actionGroups:
                             content:
                               value:
@@ -221,11 +223,17 @@ spec:
                                   config_version: 2
                                   type: tenants
                             managedBy: API
-                        enabled: true
-                        managingRoleGroup: security-config
                       description: TODO Add description
                       properties:
-                        config:
+                        enabled:
+                          default: true
+                          type: boolean
+                        managingRoleGroup:
+                          default: security-config
+                          maxLength: 16
+                          minLength: 1
+                          type: string
+                        settings:
                           default:
                             actionGroups:
                               content:
@@ -976,14 +984,6 @@ spec:
                                 - managedBy
                               type: object
                           type: object
-                        enabled:
-                          default: true
-                          type: boolean
-                        managingRoleGroup:
-                          default: security-config
-                          maxLength: 16
-                          minLength: 1
-                          type: string
                       type: object
                     tls:
                       default:

rust/operator-binary/src/controller/build/node_config.rs

@@ -251,21 +251,9 @@ impl NodeConfig {
         config
     }
 
-    pub fn admin_dn(&self) -> Option<String> {
-        let security = self.cluster.security.as_ref()?;
-
-        security
-            .managing_role_group
-            .as_ref()
-            .map(|managing_role_group| {
-                format!(
-                    "CN={container}.{pod}-0.{namespace}.{cluster_domain_name}",
-                    container = "update-security-config",
-                    pod = managing_role_group,
-                    namespace = self.cluster.namespace,
-                    cluster_domain_name = self.cluster_domain_name
-                )
-            })
+    pub fn admin_dn(&self) -> String {
+        // The common name field is limited to 64 characters, see RFC 5280.
+        format!("CN=update-security-config.{}", self.cluster.uid)
     }
 
     pub fn tls_config(&self) -> serde_json::Map<String, Value> {

rust/operator-binary/src/controller/build/role_group_builder.rs

@@ -629,10 +629,11 @@ cp --archive config/opensearch.keystore {OPENSEARCH_INITIALIZED_KEYSTORE_DIRECTO
             return None;
         }
 
-        let admin_dn = self.node_config.admin_dn().expect("");
-
         let env_vars = EnvVarSet::new()
-            .with_value(&EnvVarName::from_str_unsafe("ADMIN_DN"), admin_dn)
+            .with_value(
+                &EnvVarName::from_str_unsafe("ADMIN_DN"),
+                self.node_config.admin_dn(),
+            )
             .with_field_path(
                 &EnvVarName::from_str_unsafe("POD_NAME"),
                 FieldPathEnvVar::Name,

rust/operator-binary/src/controller/preprocess.rs

@@ -26,7 +26,7 @@ type Result<T, E = Error> = std::result::Result<T, E>;
 pub fn preprocess(mut cluster: v1alpha1::OpenSearchCluster) -> Result<v1alpha1::OpenSearchCluster> {
     let security = &cluster.spec.cluster_config.security;
     if security.enabled
-        && !security.config.is_only_managed_by_api()
+        && !security.settings.is_only_managed_by_api()
         && !cluster
             .spec
             .nodes

rust/operator-binary/src/controller/validate.rs

@@ -283,7 +283,12 @@ fn validate_security_config(
     spec: &v1alpha1::OpenSearchClusterSpec,
 ) -> Result<Option<ValidatedSecurity>> {
     let security = if spec.cluster_config.security.enabled {
-        let managing_role_group = if !spec.cluster_config.security.config.is_only_managed_by_api() {
+        let managing_role_group = if !spec
+            .cluster_config
+            .security
+            .settings
+            .is_only_managed_by_api()
+        {
             let managing_role_group = spec.cluster_config.security.managing_role_group.clone();
 
             ensure!(
@@ -308,7 +313,7 @@ fn validate_security_config(
 
         Some(ValidatedSecurity {
             managing_role_group,
-            config: spec.cluster_config.security.config.clone(),
+            config: spec.cluster_config.security.settings.clone(),
             tls: spec.cluster_config.tls.clone(),
         })
     } else {
@@ -891,7 +896,7 @@ mod tests {
                     .spec
                     .cluster_config
                     .security
-                    .config
+                    .settings
                     .config
                     .managed_by = v1alpha1::SecurityConfigFileTypeManagedBy::Operator;
                 cluster.spec.cluster_config.tls.server_secret_class = None;
@@ -946,7 +951,7 @@ mod tests {
                     security: v1alpha1::Security {
                         enabled: true,
                         managing_role_group: RoleGroupName::from_str_unsafe("default"),
-                        config: v1alpha1::SecurityConfig {
+                        settings: v1alpha1::SecurityConfig {
                             config: v1alpha1::SecurityConfigFileType {
                                 managed_by: v1alpha1::SecurityConfigFileTypeManagedBy::Operator,
                                 content: v1alpha1::SecurityConfigFileTypeContent::ValueFrom(

rust/operator-binary/src/crd/mod.rs

@@ -140,7 +140,7 @@ pub mod versioned {
         pub managing_role_group: RoleGroupName,
 
         #[serde(default)]
-        pub config: SecurityConfig,
+        pub settings: SecurityConfig,
     }
 
     #[derive(Clone, Debug, Deserialize, Eq, JsonSchema, PartialEq, Serialize)]
@@ -511,7 +511,7 @@ impl Default for v1alpha1::Security {
         Self {
             enabled: security_config_enabled_default(),
             managing_role_group: security_config_managing_role_group(),
-            config: v1alpha1::SecurityConfig::default(),
+            settings: v1alpha1::SecurityConfig::default(),
         }
     }
 }

tests/templates/kuttl/backup-restore/21-install-opensearch-1.yaml.j2

@@ -21,7 +21,7 @@ spec:
           name: s3-credentials
           key: SECRET_KEY
     security:
-      config:
+      settings:
         config:
           managedBy: API
           content:

tests/templates/kuttl/backup-restore/51-install-opensearch-2.yaml.j2

@@ -21,7 +21,7 @@ spec:
           name: s3-credentials
           key: SECRET_KEY
     security:
-      config:
+      settings:
         config:
           managedBy: API
           content:

tests/templates/kuttl/ldap/21-install-opensearch.yaml.j2

@@ -12,7 +12,7 @@ spec:
     pullPolicy: IfNotPresent
   clusterConfig:
     security:
-      config:
+      settings:
         config:
           managedBy: operator
           content:

tests/templates/kuttl/metrics/20-install-opensearch.yaml.j2

@@ -12,7 +12,7 @@ spec:
     pullPolicy: IfNotPresent
   clusterConfig:
     security:
-      config:
+      settings:
         config:
           managedBy: API
           content: