mount tls volume in default directory of official image

Author: labrenbe

rust/operator-binary/src/controller/build/node_config.rs

@@ -183,15 +183,15 @@ impl NodeConfig {
         );
         config.insert(
             CONFIG_OPTION_PLUGINS_SECURITY_SSL_HTTP_PEMCERT_FILEPATH.to_owned(),
-            json!("/stackable/tls/tls.crt".to_string()),
+            json!("${OPENSEARCH_HOME}/config/tls/tls.crt".to_string()),
         );
         config.insert(
             CONFIG_OPTION_PLUGINS_SECURITY_SSL_HTTP_PEMKEY_FILEPATH.to_owned(),
-            json!("/stackable/tls/tls.key".to_string()),
+            json!("${OPENSEARCH_HOME}/config/tls/tls.key".to_string()),
         );
         config.insert(
             CONFIG_OPTION_PLUGINS_SECURITY_SSL_HTTP_PEMTRUSTEDCAS_FILEPATH.to_owned(),
-            json!("/stackable/tls/ca.crt".to_string()),
+            json!("${OPENSEARCH_HOME}/config/tls/ca.crt".to_string()),
         );
         // TLS config for TRANSPORT port
         config.insert(
@@ -200,15 +200,15 @@ impl NodeConfig {
         );
         config.insert(
             CONFIG_OPTION_PLUGINS_SECURITY_SSL_TRANSPORT_PEMCERT_FILEPATH.to_owned(),
-            json!("/stackable/tls/tls.crt".to_string()),
+            json!("${OPENSEARCH_HOME}/config/tls/tls.crt".to_string()),
         );
         config.insert(
             CONFIG_OPTION_PLUGINS_SECURITY_SSL_TRANSPORT_PEMKEY_FILEPATH.to_owned(),
-            json!("/stackable/tls/tls.key".to_string()),
+            json!("${OPENSEARCH_HOME}/config/tls/tls.key".to_string()),
         );
         config.insert(
             CONFIG_OPTION_PLUGINS_SECURITY_SSL_TRANSPORT_PEMTRUSTEDCAS_FILEPATH.to_owned(),
-            json!("/stackable/tls/ca.crt".to_string()),
+            json!("${OPENSEARCH_HOME}/config/tls/ca.crt".to_string()),
         );
 
         config

rust/operator-binary/src/controller/build/role_group_builder.rs

@@ -71,8 +71,8 @@ constant!(DATA_VOLUME_NAME: VolumeName = "data");
 
 constant!(LISTENER_VOLUME_NAME: PersistentVolumeClaimName = "listener");
 const LISTENER_VOLUME_DIR: &str = "/stackable/listener";
+
 constant!(TLS_VOLUME_NAME: VolumeName = "tls");
-const TLS_VOLUME_DIR: &str = "/stackable/tls";
 
 constant!(LOG_VOLUME_NAME: VolumeName = "log");
 const LOG_VOLUME_DIR: &str = "/stackable/log";
@@ -461,7 +461,7 @@ impl<'a> RoleGroupBuilder<'a> {
 
         if self.cluster.cluster_config.tls.secret_class.is_some() {
             volume_mounts.push(VolumeMount {
-                mount_path: TLS_VOLUME_DIR.to_owned(),
+                mount_path: format!("{opensearch_home}/config/tls"),
                 name: TLS_VOLUME_NAME.to_string(),
                 ..VolumeMount::default()
             })

tests/templates/kuttl/smoke/10-assert.yaml.j2

@@ -169,7 +169,7 @@ spec:
           name: listener
         - mountPath: /stackable/log
           name: log
-        - mountPath: /stackable/tls
+        - mountPath: {{ test_scenario['values']['opensearch_home'] }}/config/tls
           name: tls
         - mountPath: {{ test_scenario['values']['opensearch_home'] }}/config/opensearch-security
           name: security-config
@@ -480,7 +480,7 @@ spec:
           name: listener
         - mountPath: /stackable/log
           name: log
-        - mountPath: /stackable/tls
+        - mountPath: {{ test_scenario['values']['opensearch_home'] }}/config/tls
           name: tls
         - mountPath: {{ test_scenario['values']['opensearch_home'] }}/config/opensearch-security
           name: security-config
@@ -654,13 +654,13 @@ data:
     plugins.security.allow_default_init_securityindex: "true"
     plugins.security.nodes_dn: ["CN=generated certificate for pod"]
     plugins.security.ssl.http.enabled: "true"
-    plugins.security.ssl.http.pemcert_filepath: "/stackable/tls/tls.crt"
-    plugins.security.ssl.http.pemkey_filepath: "/stackable/tls/tls.key"
-    plugins.security.ssl.http.pemtrustedcas_filepath: "/stackable/tls/ca.crt"
+    plugins.security.ssl.http.pemcert_filepath: "${OPENSEARCH_HOME}/config/tls/tls.crt"
+    plugins.security.ssl.http.pemkey_filepath: "${OPENSEARCH_HOME}/config/tls/tls.key"
+    plugins.security.ssl.http.pemtrustedcas_filepath: "${OPENSEARCH_HOME}/config/tls/ca.crt"
     plugins.security.ssl.transport.enabled: "true"
-    plugins.security.ssl.transport.pemcert_filepath: "/stackable/tls/tls.crt"
-    plugins.security.ssl.transport.pemkey_filepath: "/stackable/tls/tls.key"
-    plugins.security.ssl.transport.pemtrustedcas_filepath: "/stackable/tls/ca.crt"
+    plugins.security.ssl.transport.pemcert_filepath: "${OPENSEARCH_HOME}/config/tls/tls.crt"
+    plugins.security.ssl.transport.pemkey_filepath: "${OPENSEARCH_HOME}/config/tls/tls.key"
+    plugins.security.ssl.transport.pemtrustedcas_filepath: "${OPENSEARCH_HOME}/config/tls/ca.crt"
 ---
 apiVersion: v1
 kind: ConfigMap
@@ -689,13 +689,13 @@ data:
     plugins.security.allow_default_init_securityindex: "true"
     plugins.security.nodes_dn: ["CN=generated certificate for pod"]
     plugins.security.ssl.http.enabled: "true"
-    plugins.security.ssl.http.pemcert_filepath: "/stackable/tls/tls.crt"
-    plugins.security.ssl.http.pemkey_filepath: "/stackable/tls/tls.key"
-    plugins.security.ssl.http.pemtrustedcas_filepath: "/stackable/tls/ca.crt"
+    plugins.security.ssl.http.pemcert_filepath: "${OPENSEARCH_HOME}/config/tls/tls.crt"
+    plugins.security.ssl.http.pemkey_filepath: "${OPENSEARCH_HOME}/config/tls/tls.key"
+    plugins.security.ssl.http.pemtrustedcas_filepath: "${OPENSEARCH_HOME}/config/tls/ca.crt"
     plugins.security.ssl.transport.enabled: "true"
-    plugins.security.ssl.transport.pemcert_filepath: "/stackable/tls/tls.crt"
-    plugins.security.ssl.transport.pemkey_filepath: "/stackable/tls/tls.key"
-    plugins.security.ssl.transport.pemtrustedcas_filepath: "/stackable/tls/ca.crt"
+    plugins.security.ssl.transport.pemcert_filepath: "${OPENSEARCH_HOME}/config/tls/tls.crt"
+    plugins.security.ssl.transport.pemkey_filepath: "${OPENSEARCH_HOME}/config/tls/tls.key"
+    plugins.security.ssl.transport.pemtrustedcas_filepath: "${OPENSEARCH_HOME}/config/tls/ca.crt"
 ---
 apiVersion: v1
 kind: Service