address feedback on PR

Author: labrenbe

deploy/helm/opensearch-operator/crds/crds.yaml

@@ -31,17 +31,17 @@ spec:
                 clusterConfig:
                   default:
                     tls:
-                      restSecretClass: tls
+                      httpSecretClass: tls
                       transportSecretClass: tls
                   description: Configuration that applies to all roles and role groups
                   properties:
                     tls:
                       default:
-                        restSecretClass: tls
+                        httpSecretClass: tls
                         transportSecretClass: tls
                       description: TLS configuration options for the REST API and internal communication (transport).
                       properties:
-                        restSecretClass:
+                        httpSecretClass:
                           default: tls
                           description: |-
                             Only affects client connections to the REST API.

docs/modules/opensearch/pages/usage-guide/security.adoc

@@ -0,0 +1,55 @@
+= Security
+:description: Configure TLS encryption, authentication, and Open Policy Agent (OPA) authorization for Kafka with the Stackable Operator.
+
+== TLS
+
+The internal and client communication at the REST API can be encrypted with TLS. This requires the xref:secret-operator:index.adoc[Secret Operator] to be running in the Kubernetes cluster providing certificates.
+The used certificates can be changed in a cluster-wide config. TLS encryption on the REST API may be disabled, while it is always enabled for the internal communication between nodes using the `transport` port.
+
+[source,yaml]
+----
+---
+apiVersion: opensearch.stackable.tech/v1alpha1
+kind: OpenSearchCluster
+metadata:
+  name: opensearch
+spec:
+  image:
+    productVersion: 3.1.0
+  clusterConfig:
+    tls:
+      httpSecretClass: tls # <1>
+      transportSecretClass: opensearch-transport-tls # <2>
+  nodes:
+    config:
+      requestedSecretLifetime: 7d # <3>
+    roleGroups:
+      default:
+        replicas: 3
+----
+<1> The `spec.clusterConfig.tls.httpSecretClass` refers to the client-to-server encryption at the REST API. Defaults to the `tls` SecretClass and can be disabled by setting `httpSecretClass` to `null`.
+<2> The `spec.clusterConfig.tls.transportSecretClass` refers to the internal encryption between OpenSearch nodes using mTLS (transport). Defaults to the `tls` SecretClass` and can't be disabled.
+<3> The lifetime for autoTls certificates generated by the secret operator.
+    Only a lifetime up to the `maxCertificateLifetime` setting in the SecretClass is applied.
+
+The `tls` secret is deployed from the xref:secret-operator:index.adoc[Secret Operator] and looks like this:
+
+[source,yaml]
+----
+---
+apiVersion: secrets.stackable.tech/v1alpha1
+kind: SecretClass
+metadata:
+  name: tls
+spec:
+  backend:
+    autoTls:
+      ca:
+        secret:
+          name: secret-provisioner-tls-ca
+          namespace: default
+        autoGenerate: true
+      maxCertificateLifetime: 15d
+----
+
+You can create your own secrets and reference them e.g. in the `spec.clusterConfig.tls.httpSecretClass` or `spec.clusterConfig.tls.transportSecretClass` to use different certificates.

rust/operator-binary/src/controller.rs

@@ -30,7 +30,7 @@ use validate::validate;
 use crate::{
     crd::{
         NodeRoles,
-        v1alpha1::{self, OpenSearchClusterConfig},
+        v1alpha1::{self, OpenSearchTls},
     },
     framework::{
         ClusterName, ControllerName, HasName, HasUid, ListenerClassName, NameIsValidLabelValue,
@@ -165,9 +165,9 @@ pub struct ValidatedCluster {
     pub name: ClusterName,
     pub namespace: NamespaceName,
     pub uid: Uid,
-    pub cluster_config: OpenSearchClusterConfig,
     pub role_config: GenericRoleConfig,
     pub role_group_configs: BTreeMap<RoleGroupName, OpenSearchRoleGroupConfig>,
+    pub tls_config: OpenSearchTls,
 }
 
 impl ValidatedCluster {
@@ -178,9 +178,9 @@ impl ValidatedCluster {
         name: ClusterName,
         namespace: NamespaceName,
         uid: impl Into<Uid>,
-        cluster_config: OpenSearchClusterConfig,
         role_config: GenericRoleConfig,
         role_group_configs: BTreeMap<RoleGroupName, OpenSearchRoleGroupConfig>,
+        tls_config: OpenSearchTls,
     ) -> Self {
         let uid = uid.into();
         ValidatedCluster {
@@ -195,9 +195,9 @@ impl ValidatedCluster {
             name,
             namespace,
             uid,
-            cluster_config,
             role_config,
             role_group_configs,
+            tls_config,
         }
     }
 
@@ -386,7 +386,7 @@ mod tests {
         controller::{OpenSearchNodeResources, ValidatedOpenSearchConfig},
         crd::{
             NodeRoles,
-            v1alpha1::{self, OpenSearchClusterConfig},
+            v1alpha1::{self, OpenSearchTls},
         },
         framework::{
             ClusterName, ListenerClassName, NamespaceName, OperatorName, ProductVersion,
@@ -469,7 +469,6 @@ mod tests {
             ClusterName::from_str_unsafe("my-opensearch"),
             NamespaceName::from_str_unsafe("default"),
             uuid!("e6ac237d-a6d4-43a1-8135-f36506110912"),
-            OpenSearchClusterConfig::default(),
             GenericRoleConfig::default(),
             [
                 (
@@ -504,6 +503,7 @@ mod tests {
                 ),
             ]
             .into(),
+            OpenSearchTls::default(),
         )
     }
 
@@ -523,7 +523,7 @@ mod tests {
                     vector_container: None,
                 },
                 node_roles: NodeRoles(node_roles.to_vec()),
-                requested_secret_lifetime: Duration::from_str("15d")
+                requested_secret_lifetime: Duration::from_str("1d")
                     .expect("should be a valid duration"),
                 resources: OpenSearchNodeResources::default(),
                 termination_grace_period_seconds: 120,

rust/operator-binary/src/controller/build.rs

@@ -80,7 +80,7 @@ mod tests {
         },
         crd::{
             NodeRoles,
-            v1alpha1::{self, OpenSearchClusterConfig},
+            v1alpha1::{self, OpenSearchTls},
         },
         framework::{
             ClusterName, ControllerName, ListenerClassName, NamespaceName, OperatorName,
@@ -172,7 +172,6 @@ mod tests {
             ClusterName::from_str_unsafe("my-opensearch"),
             NamespaceName::from_str_unsafe("default"),
             uuid!("e6ac237d-a6d4-43a1-8135-f36506110912"),
-            OpenSearchClusterConfig::default(),
             GenericRoleConfig::default(),
             [
                 (
@@ -196,6 +195,7 @@ mod tests {
                 ),
             ]
             .into(),
+            OpenSearchTls::default(),
         )
     }
 
@@ -215,7 +215,7 @@ mod tests {
                     vector_container: None,
                 },
                 node_roles: NodeRoles(node_roles.to_vec()),
-                requested_secret_lifetime: Duration::from_str("15d")
+                requested_secret_lifetime: Duration::from_str("1d")
                     .expect("should be a valid duration"),
                 resources: OpenSearchNodeResources::default(),
                 termination_grace_period_seconds: 120,

rust/operator-binary/src/controller/build/node_config.rs

@@ -93,6 +93,8 @@ pub const CONFIG_OPTION_PLUGINS_SECURITY_SSL_TRANSPORT_PEMKEY_FILEPATH: &str =
 pub const CONFIG_OPTION_PLUGINS_SECURITY_SSL_TRANSPORT_PEMTRUSTEDCAS_FILEPATH: &str =
     "plugins.security.ssl.transport.pemtrustedcas_filepath";
 
+const DEFAULT_OPENSEARCH_HOME: &str = "/stackable/opensearch";
+
 /// Configuration of an OpenSearch node based on the cluster and role-group configuration
 pub struct NodeConfig {
     cluster: ValidatedCluster,
@@ -173,6 +175,7 @@ impl NodeConfig {
 
     pub fn tls_config(&self) -> serde_json::Map<String, Value> {
         let mut config = serde_json::Map::new();
+        let opensearch_path_conf = self.opensearch_path_conf();
 
         // TLS config for TRANSPORT port which is always enabled.
         config.insert(
@@ -181,34 +184,34 @@ impl NodeConfig {
         );
         config.insert(
             CONFIG_OPTION_PLUGINS_SECURITY_SSL_TRANSPORT_PEMCERT_FILEPATH.to_owned(),
-            json!("${OPENSEARCH_PATH_CONF}/tls/transport/tls.crt".to_string()),
+            json!(format!("{opensearch_path_conf}/tls/transport/tls.crt")),
         );
         config.insert(
             CONFIG_OPTION_PLUGINS_SECURITY_SSL_TRANSPORT_PEMKEY_FILEPATH.to_owned(),
-            json!("${OPENSEARCH_PATH_CONF}/tls/transport/tls.key".to_string()),
+            json!(format!("{opensearch_path_conf}/tls/transport/tls.key")),
         );
         config.insert(
             CONFIG_OPTION_PLUGINS_SECURITY_SSL_TRANSPORT_PEMTRUSTEDCAS_FILEPATH.to_owned(),
-            json!("${OPENSEARCH_PATH_CONF}/tls/transport/ca.crt".to_string()),
+            json!(format!("{opensearch_path_conf}/tls/transport/ca.crt")),
         );
 
         // TLS config for HTTP port which is optional.
-        if self.cluster.cluster_config.tls.rest_secret_class.is_some() {
+        if self.cluster.tls_config.http_secret_class.is_some() {
             config.insert(
                 CONFIG_OPTION_PLUGINS_SECURITY_SSL_HTTP_ENABLED.to_owned(),
                 json!("true".to_string()),
             );
             config.insert(
                 CONFIG_OPTION_PLUGINS_SECURITY_SSL_HTTP_PEMCERT_FILEPATH.to_owned(),
-                json!("${OPENSEARCH_PATH_CONF}/tls/rest/tls.crt".to_string()),
+                json!(format!("{opensearch_path_conf}/tls/http/tls.crt")),
             );
             config.insert(
                 CONFIG_OPTION_PLUGINS_SECURITY_SSL_HTTP_PEMKEY_FILEPATH.to_owned(),
-                json!("${OPENSEARCH_PATH_CONF}/tls/rest/tls.key".to_string()),
+                json!(format!("{opensearch_path_conf}/tls/http/tls.key")),
             );
             config.insert(
                 CONFIG_OPTION_PLUGINS_SECURITY_SSL_HTTP_PEMTRUSTEDCAS_FILEPATH.to_owned(),
-                json!("${OPENSEARCH_PATH_CONF}/tls/rest/ca.crt".to_string()),
+                json!(format!("{opensearch_path_conf}/tls/http/ca.crt")),
             );
         } else {
             config.insert(
@@ -353,6 +356,23 @@ impl NodeConfig {
             String::new()
         }
     }
+
+    /// Return content of the `OPENSEARCH_HOME` environment variable from envOverrides or default to `DEFAULT_OPENSEARCH_HOME`
+    pub fn opensearch_home(&self) -> String {
+        self.environment_variables()
+            .get(&EnvVarName::from_str_unsafe("OPENSEARCH_HOME"))
+            .and_then(|env_var| env_var.value.clone())
+            .unwrap_or(DEFAULT_OPENSEARCH_HOME.to_owned())
+    }
+
+    /// Return content of the `OPENSEARCH_PATH_CONF` environment variable from envOverrides or default to `OPENSEARCH_HOME/config`
+    pub fn opensearch_path_conf(&self) -> String {
+        let opensearch_home = self.opensearch_home();
+        self.environment_variables()
+            .get(&EnvVarName::from_str_unsafe("OPENSEARCH_PATH_CONF"))
+            .and_then(|env_var| env_var.value.clone())
+            .unwrap_or(format!("{opensearch_home}/config"))
+    }
 }
 
 #[cfg(test)]
@@ -376,7 +396,7 @@ mod tests {
     use super::*;
     use crate::{
         controller::{ValidatedLogging, ValidatedOpenSearchConfig},
-        crd::{NodeRoles, v1alpha1::OpenSearchClusterConfig},
+        crd::{NodeRoles, v1alpha1::OpenSearchTls},
         framework::{
             ClusterName, ListenerClassName, NamespaceName, ProductVersion, RoleGroupName,
             product_logging::framework::ValidatedContainerLogConfigChoice,
@@ -421,7 +441,7 @@ mod tests {
                     v1alpha1::NodeRole::Ingest,
                     v1alpha1::NodeRole::RemoteClusterClient,
                 ]),
-                requested_secret_lifetime: Duration::from_str("15d")
+                requested_secret_lifetime: Duration::from_str("1d")
                     .expect("should be a valid duration"),
                 resources: Resources::default(),
                 termination_grace_period_seconds: 30,
@@ -459,13 +479,13 @@ mod tests {
             ClusterName::from_str_unsafe("my-opensearch-cluster"),
             NamespaceName::from_str_unsafe("default"),
             uuid!("0b1e30e6-326e-4c1a-868d-ad6598b49e8b"),
-            OpenSearchClusterConfig::default(),
             GenericRoleConfig::default(),
             [(
                 RoleGroupName::from_str_unsafe("default"),
                 role_group_config.clone(),
             )]
             .into(),
+            OpenSearchTls::default(),
         );
 
         NodeConfig::new(
@@ -488,7 +508,15 @@ mod tests {
                 "discovery.type: \"zen\"\n",
                 "network.host: \"0.0.0.0\"\n",
                 "plugins.security.nodes_dn: [\"CN=generated certificate for pod\"]\n",
-                "test: \"value\""
+                "plugins.security.ssl.http.enabled: \"true\"\n",
+                "plugins.security.ssl.http.pemcert_filepath: \"/stackable/opensearch/config/tls/http/tls.crt\"\n",
+                "plugins.security.ssl.http.pemkey_filepath: \"/stackable/opensearch/config/tls/http/tls.key\"\n",
+                "plugins.security.ssl.http.pemtrustedcas_filepath: \"/stackable/opensearch/config/tls/http/ca.crt\"\n",
+                "plugins.security.ssl.transport.enabled: \"true\"\n",
+                "plugins.security.ssl.transport.pemcert_filepath: \"/stackable/opensearch/config/tls/transport/tls.crt\"\n",
+                "plugins.security.ssl.transport.pemkey_filepath: \"/stackable/opensearch/config/tls/transport/tls.key\"\n",
+                "plugins.security.ssl.transport.pemtrustedcas_filepath: \"/stackable/opensearch/config/tls/transport/ca.crt\"\n",
+                "test: \"value\"",
             )
             .to_owned(),
             node_config.opensearch_config_file_content()
@@ -509,7 +537,7 @@ mod tests {
             ..TestConfig::default()
         });
 
-        assert!(!node_config_tls_undefined.tls_on_http_port_enabled());
+        assert!(node_config_tls_undefined.tls_on_http_port_enabled());
         assert!(node_config_tls_enabled.tls_on_http_port_enabled());
         assert!(!node_config_tls_disabled.tls_on_http_port_enabled());
     }

rust/operator-binary/src/controller/build/role_builder.rs

@@ -242,7 +242,7 @@ mod tests {
         },
         crd::{
             NodeRoles,
-            v1alpha1::{self, OpenSearchClusterConfig},
+            v1alpha1::{self, OpenSearchTls},
         },
         framework::{
             ClusterName, ControllerName, ListenerClassName, NamespaceName, OperatorName,
@@ -280,7 +280,7 @@ mod tests {
                     v1alpha1::NodeRole::Ingest,
                     v1alpha1::NodeRole::RemoteClusterClient,
                 ]),
-                requested_secret_lifetime: Duration::from_str("15d")
+                requested_secret_lifetime: Duration::from_str("1d")
                     .expect("should be a valid duration"),
                 resources: Resources::default(),
                 termination_grace_period_seconds: 30,
@@ -305,13 +305,13 @@ mod tests {
             ClusterName::from_str_unsafe("my-opensearch-cluster"),
             NamespaceName::from_str_unsafe("default"),
             uuid!("0b1e30e6-326e-4c1a-868d-ad6598b49e8b"),
-            OpenSearchClusterConfig::default(),
             GenericRoleConfig::default(),
             [(
                 RoleGroupName::from_str_unsafe("default"),
                 role_group_config.clone(),
             )]
             .into(),
+            OpenSearchTls::default(),
         );
 
         RoleBuilder::new(cluster, context_names)