Skip to content

Commit 3b1db97

Browse files
siegfriedwebersiegfriedweber
committed
fix: Fix format of plugins.security.nodes_dn; Fix the unit tests
1 parent 1026ef5 commit 3b1db97

2 files changed

Lines changed: 43 additions & 34 deletions

File tree

‎rust/operator-binary/src/controller/build/node_config.rs‎

Lines changed: 37 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -198,44 +198,12 @@ impl NodeConfig {
198198
/// The file should only contain cluster-wide configuration options. Node-specific options
199199
/// should be defined as environment variables.
200200
pub fn static_opensearch_config(&self) -> serde_json::Value {
201-
let nodes_dn = self
202-
.cluster
203-
.role_group_configs
204-
.keys()
205-
.map(|role_group_name| {
206-
let resource_names = ResourceNames {
207-
cluster_name: self.cluster.name.clone(),
208-
role_name: ValidatedCluster::role_name(),
209-
role_group_name: role_group_name.clone(),
210-
};
211-
212-
self.cluster_domain_name
213-
.split('.')
214-
.rev()
215-
.chain([
216-
"svc",
217-
self.cluster.namespace.as_ref(),
218-
resource_names.headless_service_name().as_ref(),
219-
&format!(
220-
"{stateful_set_name}-*",
221-
stateful_set_name = resource_names.stateful_set_name()
222-
),
223-
])
224-
.map(|component| format!("DC={component}"))
225-
.collect::<Vec<_>>()
226-
.join(",")
227-
})
228-
.collect::<Vec<_>>();
229-
230201
let mut config = json!({
231202
CONFIG_OPTION_CLUSTER_NAME: self.cluster.name,
232203
// Bind to all interfaces because the IP address is not known in advance.
233204
CONFIG_OPTION_NETWORK_HOST: "0.0.0.0",
234205
CONFIG_OPTION_DISCOVERY_TYPE: self.discovery_type(),
235-
// Accept certificates generated by the secret-operator
236-
CONFIG_OPTION_PLUGINS_SECURITY_NODES_DN: [
237-
json!(nodes_dn),
238-
],
206+
CONFIG_OPTION_PLUGINS_SECURITY_NODES_DN: json!(self.nodes_dn()),
239207
CONFIG_OPTION_NODE_ATTR_ROLE_GROUP: self.role_group_name,
240208
CONFIG_OPTION_PATH_LOGS: format!(
241209
"{STACKABLE_LOG_DIR}/{container}",
@@ -265,6 +233,41 @@ impl NodeConfig {
265233
config
266234
}
267235

236+
/// Returns the list of distinguished names (DNs) that denote the other nodes in the cluster.
237+
///
238+
/// The list looks similar to:
239+
/// - DC=local,DC=cluster,DC=svc,DC=my-namespace,DC=opensearch-nodes-cluster-manager-headless,DC=opensearch-nodes-cluster-manager-*
240+
/// - DC=local,DC=cluster,DC=svc,DC=my-namespace,DC=opensearch-nodes-data-headless,DC=opensearch-nodes-data-*
241+
fn nodes_dn(&self) -> Vec<String> {
242+
self.cluster
243+
.role_group_configs
244+
.keys()
245+
.map(|role_group_name| {
246+
let resource_names = ResourceNames {
247+
cluster_name: self.cluster.name.clone(),
248+
role_name: ValidatedCluster::role_name(),
249+
role_group_name: role_group_name.clone(),
250+
};
251+
252+
self.cluster_domain_name
253+
.split('.')
254+
.rev()
255+
.chain([
256+
"svc",
257+
self.cluster.namespace.as_ref(),
258+
resource_names.headless_service_name().as_ref(),
259+
&format!(
260+
"{stateful_set_name}-*",
261+
stateful_set_name = resource_names.stateful_set_name()
262+
),
263+
])
264+
.map(|component| format!("DC={component}"))
265+
.collect::<Vec<_>>()
266+
.join(",")
267+
})
268+
.collect()
269+
}
270+
268271
/// Distinguished name (DN) of the super admin certificate
269272
pub fn super_admin_dn(&self) -> String {
270273
// The common name field is limited to 64 characters, see RFC 5280.
@@ -687,7 +690,7 @@ mod tests {
687690
"path.logs: /stackable/log/opensearch\n",
688691
"plugins.security.authcz.admin_dn: CN=update-security-config.0b1e30e6-326e-4c1a-868d-ad6598b49e8b\n",
689692
"plugins.security.nodes_dn:\n",
690-
"- CN=generated certificate for pod\n",
693+
"- DC=local,DC=cluster,DC=svc,DC=default,DC=my-opensearch-cluster-nodes-default-headless,DC=my-opensearch-cluster-nodes-default-*\n",
691694
"plugins.security.ssl.http.enabled: true\n",
692695
"plugins.security.ssl.http.pemcert_filepath: /stackable/opensearch/config/tls/server/tls.crt\n",
693696
"plugins.security.ssl.http.pemkey_filepath: /stackable/opensearch/config/tls/server/tls.key\n",

‎rust/operator-binary/src/controller/build/role_group_builder.rs‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2550,6 +2550,7 @@ mod tests {
25502550
"metadata": {
25512551
"annotations": {
25522552
"secrets.stackable.tech/backend.autotls.cert.lifetime": "1d",
2553+
"secrets.stackable.tech/backend.autotls.cert.domain-components-in-subject-dn": "true",
25532554
"secrets.stackable.tech/class": "tls",
25542555
"secrets.stackable.tech/format": "tls-pem",
25552556
"secrets.stackable.tech/provision-parts": "public-private",
@@ -2577,6 +2578,7 @@ mod tests {
25772578
"metadata": {
25782579
"annotations": {
25792580
"secrets.stackable.tech/backend.autotls.cert.lifetime": "1d",
2581+
"secrets.stackable.tech/backend.autotls.cert.domain-components-in-subject-dn": "true",
25802582
"secrets.stackable.tech/class": "tls",
25812583
"secrets.stackable.tech/format": "tls-pem",
25822584
"secrets.stackable.tech/provision-parts": "public-private",
@@ -2762,6 +2764,7 @@ mod tests {
27622764
"metadata": {
27632765
"annotations": {
27642766
"secrets.stackable.tech/backend.autotls.cert.lifetime": "1d",
2767+
"secrets.stackable.tech/backend.autotls.cert.domain-components-in-subject-dn": "true",
27652768
"secrets.stackable.tech/class": "tls",
27662769
"secrets.stackable.tech/format": "tls-pem",
27672770
"secrets.stackable.tech/provision-parts": "public-private",
@@ -2789,6 +2792,7 @@ mod tests {
27892792
"metadata": {
27902793
"annotations": {
27912794
"secrets.stackable.tech/backend.autotls.cert.lifetime": "1d",
2795+
"secrets.stackable.tech/backend.autotls.cert.domain-components-in-subject-dn": "true",
27922796
"secrets.stackable.tech/class": "tls",
27932797
"secrets.stackable.tech/format": "tls-pem",
27942798
"secrets.stackable.tech/provision-parts": "public-private",
@@ -2986,6 +2990,7 @@ mod tests {
29862990
"metadata": {
29872991
"annotations": {
29882992
"secrets.stackable.tech/backend.autotls.cert.lifetime": "1d",
2993+
"secrets.stackable.tech/backend.autotls.cert.domain-components-in-subject-dn": "true",
29892994
"secrets.stackable.tech/class": "tls",
29902995
"secrets.stackable.tech/format": "tls-pem",
29912996
"secrets.stackable.tech/provision-parts": "public-private",
@@ -3013,6 +3018,7 @@ mod tests {
30133018
"metadata": {
30143019
"annotations": {
30153020
"secrets.stackable.tech/backend.autotls.cert.lifetime": "1d",
3021+
"secrets.stackable.tech/backend.autotls.cert.domain-components-in-subject-dn": "true",
30163022
"secrets.stackable.tech/class": "tls",
30173023
"secrets.stackable.tech/format": "tls-pem",
30183024
"secrets.stackable.tech/provision-parts": "public-private",

0 commit comments

Comments
 (0)