Skip to content

Commit 5c5d042

Browse files
siegfriedwebersiegfriedweber
committed
test(backup-restore): Use dedicated admin certificates
1 parent 4b16a8b commit 5c5d042

16 files changed

Lines changed: 308 additions & 50 deletions

‎tests/templates/kuttl/backup-restore/01-rbac.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,13 @@ rules:
1717
- privileged
1818
verbs:
1919
- use
20+
- apiGroups:
21+
- ""
22+
resources:
23+
- secrets
24+
verbs:
25+
# The jobs creating the admin certificates need the permission to insert them into Secrets.
26+
- create
2027
---
2128
kind: RoleBinding
2229
apiVersion: rbac.authorization.k8s.io/v1

‎tests/templates/kuttl/backup-restore/03-create-truststore.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
apiVersion: secrets.stackable.tech/v1alpha1
3+
kind: TrustStore
4+
metadata:
5+
name: truststore-pem
6+
spec:
7+
secretClassName: tls
8+
format: tls-pem
9+
targetKind: ConfigMap

‎tests/templates/kuttl/backup-restore/20-assert.yaml‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,14 @@ apiVersion: kuttl.dev/v1beta1
33
kind: TestAssert
44
timeout: 600
55
---
6-
apiVersion: apps/v1
7-
kind: StatefulSet
6+
apiVersion: batch/v1
7+
kind: Job
88
metadata:
9-
name: opensearch-1-nodes-default
9+
name: create-opensearch-1-admin-certificate
1010
status:
11-
readyReplicas: 1
12-
replicas: 1
11+
succeeded: 1
12+
---
13+
apiVersion: v1
14+
kind: Secret
15+
metadata:
16+
name: opensearch-1-admin-certificate

‎tests/templates/kuttl/backup-restore/20-create-opensearch-1-admin-certificate.yaml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
---
2+
apiVersion: batch/v1
3+
kind: Job
4+
metadata:
5+
name: create-opensearch-1-admin-certificate
6+
spec:
7+
template:
8+
spec:
9+
containers:
10+
- name: create-opensearch-1-admin-certificate
11+
image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable0.0.0-dev
12+
command:
13+
- /stackable/scripts/create-opensearch-1-admin-certificate.sh
14+
volumeMounts:
15+
- name: script
16+
mountPath: /stackable/scripts
17+
- name: tls
18+
mountPath: /stackable/tls
19+
securityContext:
20+
allowPrivilegeEscalation: false
21+
capabilities:
22+
drop:
23+
- ALL
24+
runAsNonRoot: true
25+
resources:
26+
requests:
27+
memory: 128Mi
28+
cpu: 100m
29+
limits:
30+
memory: 128Mi
31+
cpu: 400m
32+
volumes:
33+
- name: script
34+
configMap:
35+
name: create-opensearch-1-admin-certificate-script
36+
defaultMode: 0o770
37+
- name: tls
38+
ephemeral:
39+
volumeClaimTemplate:
40+
metadata:
41+
annotations:
42+
secrets.stackable.tech/class: tls
43+
spec:
44+
storageClassName: secrets.stackable.tech
45+
accessModes:
46+
- ReadWriteOnce
47+
resources:
48+
requests:
49+
storage: "1"
50+
serviceAccountName: test-service-account
51+
securityContext:
52+
fsGroup: 1000
53+
restartPolicy: OnFailure
54+
---
55+
apiVersion: v1
56+
kind: ConfigMap
57+
metadata:
58+
name: create-opensearch-1-admin-certificate-script
59+
data:
60+
create-opensearch-1-admin-certificate.sh: |
61+
#!/usr/bin/env sh
62+
63+
openssl req \
64+
-x509 \
65+
-nodes \
66+
-subj=/CN=opensearch-1-admin-certificate \
67+
-out=tls.crt \
68+
-keyout=tls.key
69+
70+
kubectl create secret generic opensearch-1-admin-certificate \
71+
--from-file=tls.crt \
72+
--from-file=tls.key

‎tests/templates/kuttl/backup-restore/21-assert.yaml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,10 @@ apiVersion: kuttl.dev/v1beta1
33
kind: TestAssert
44
timeout: 600
55
---
6-
apiVersion: batch/v1
7-
kind: Job
6+
apiVersion: apps/v1
7+
kind: StatefulSet
88
metadata:
9-
name: create-testuser
9+
name: opensearch-1-nodes-default
1010
status:
11-
succeeded: 1
11+
readyReplicas: 1
12+
replicas: 1

tests/templates/kuttl/backup-restore/20-install-opensearch-1.yaml.j2 renamed to tests/templates/kuttl/backup-restore/21-install-opensearch-1.yaml.j2

Lines changed: 37 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,7 @@ spec:
3333
# not be created even if enough disk space would be available.
3434
cluster.routing.allocation.disk.threshold_enabled: "false"
3535
plugins.security.allow_default_init_securityindex: "true"
36-
# TODO This is insecure. Use a proper certificate!
37-
plugins.security.authcz.admin_dn: CN=generated certificate for pod
36+
plugins.security.authcz.admin_dn: CN=opensearch-1-admin-certificate
3837
plugins.security.restapi.roles_enabled: all_access
3938
plugins.security.ssl.transport.enabled: "true"
4039
plugins.security.ssl.transport.pemcert_filepath: /stackable/opensearch/config/tls/tls.crt
@@ -99,6 +98,34 @@ spec:
9998
mountPath: /etc/pki/ca-trust/source/anchors/s3-ca.crt
10099
subPath: tls.crt
101100
readOnly: true
101+
- name: init-tls
102+
{% if test_scenario['values']['opensearch'].find(",") > 0 %}
103+
image: "{{ test_scenario['values']['opensearch'].split(',')[1] }}"
104+
{% else %}
105+
image: oci.stackable.tech/sdp/opensearch:{{ test_scenario['values']['opensearch'].split(',')[0] }}-stackable{{ test_scenario['values']['release'] }}
106+
{% endif %}
107+
command:
108+
- /bin/bash
109+
- -euxo
110+
- pipefail
111+
- -c
112+
args:
113+
- |
114+
cp /stackable/opensearch/config/tls/tls.* /stackable/opensearch/config/tls-concatenated
115+
cat \
116+
/stackable/opensearch/config/tls/ca.crt \
117+
/stackable/opensearch/config/tls-admin/tls.crt > \
118+
/stackable/opensearch/config/tls-concatenated/ca.crt
119+
volumeMounts:
120+
- name: tls
121+
mountPath: /stackable/opensearch/config/tls
122+
readOnly: true
123+
- name: admin-certificate
124+
mountPath: /stackable/opensearch/config/tls-admin
125+
readOnly: true
126+
- name: tls-concatenated
127+
mountPath: /stackable/opensearch/config/tls-concatenated
128+
readOnly: false
102129
containers:
103130
- name: opensearch
104131
volumeMounts:
@@ -109,7 +136,7 @@ spec:
109136
mountPath: /etc/pki/java/cacerts
110137
subPath: java/cacerts
111138
readOnly: true
112-
- name: tls
139+
- name: tls-concatenated
113140
mountPath: /stackable/opensearch/config/tls
114141
readOnly: true
115142
- name: keystore
@@ -128,6 +155,10 @@ spec:
128155
secret:
129156
secretName: minio-ca-crt
130157
defaultMode: 0o660
158+
- name: admin-certificate
159+
secret:
160+
secretName: opensearch-1-admin-certificate
161+
defaultMode: 0o660
131162
- name: security-config
132163
secret:
133164
secretName: opensearch-1-security-config
@@ -149,6 +180,9 @@ spec:
149180
resources:
150181
requests:
151182
storage: "1"
183+
- name: tls-concatenated
184+
emptyDir:
185+
sizeLimit: 1Mi
152186
---
153187
apiVersion: v1
154188
kind: Secret

tests/templates/kuttl/backup-restore/21-create-testuser.yaml renamed to tests/templates/kuttl/backup-restore/22-create-testuser.yaml

File renamed without changes.

‎tests/templates/kuttl/backup-restore/23-assert.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
apiVersion: kuttl.dev/v1beta1
3+
kind: TestAssert
4+
timeout: 600
5+
---
6+
apiVersion: batch/v1
7+
kind: Job
8+
metadata:
9+
name: create-data
10+
status:
11+
succeeded: 1

tests/templates/kuttl/backup-restore/22-create-data.yaml renamed to tests/templates/kuttl/backup-restore/23-create-data.yaml

File renamed without changes.

‎tests/templates/kuttl/backup-restore/31-backup-security-indices.yaml.j2‎

Lines changed: 11 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,10 @@ spec:
1919
volumeMounts:
2020
- name: scripts
2121
mountPath: /stackable/scripts
22+
- name: tls
23+
# The Java policy allows reading from /stackable/opensearch/config.
24+
mountPath: /stackable/opensearch/config/tls
25+
readOnly: true
2226
- name: tls-client
2327
# The Java policy allows reading from /stackable/opensearch/config.
2428
mountPath: /stackable/opensearch/config/tls-client
@@ -81,21 +85,13 @@ spec:
8185
configMap:
8286
name: backup-security-indices-scripts
8387
defaultMode: 0o770
84-
# Create a client TLS certificate to run securityadmin.sh
88+
- name: tls
89+
configMap:
90+
name: truststore-pem
8591
- name: tls-client
86-
ephemeral:
87-
volumeClaimTemplate:
88-
metadata:
89-
annotations:
90-
secrets.stackable.tech/class: tls
91-
secrets.stackable.tech/scope: pod
92-
spec:
93-
storageClassName: secrets.stackable.tech
94-
accessModes:
95-
- ReadWriteOnce
96-
resources:
97-
requests:
98-
storage: "1"
92+
secret:
93+
secretName: opensearch-1-admin-certificate
94+
defaultMode: 0o660
9995
- name: s3-ca-crt
10096
secret:
10197
secretName: minio-ca-crt
@@ -117,7 +113,7 @@ data:
117113
#!/usr/bin/env sh
118114

119115
plugins/opensearch-security/tools/securityadmin.sh \
120-
-cacert config/tls-client/ca.crt \
116+
-cacert config/tls/ca.crt \
121117
-cert config/tls-client/tls.crt \
122118
-key config/tls-client/tls.key \
123119
--hostname opensearch-1-nodes-default.$NAMESPACE.svc.cluster.local \

0 commit comments

Comments
 (0)