Merge remote-tracking branch 'origin/main' into feat/tls-support

Author: labrenbe

tests/templates/kuttl/ldap/21-install-opensearch.yaml.j2

@@ -22,6 +22,16 @@ spec:
     config:
       logging:
         enableVectorAgent: {{ lookup('env', 'VECTOR_AGGREGATOR') | length > 0 }}
+        containers:
+          opensearch:
+            console:
+              level: DEBUG
+            file:
+              level: DEBUG
+            loggers:
+              # Successful authorizations are logged at the DEBUG level.
+              org.opensearch.security:
+                level: DEBUG
     roleGroups:
       default:
         replicas: 3

tests/templates/kuttl/snapshot-s3/11_minio-values.yaml.j2

@@ -15,6 +15,9 @@ console:
   image:
     repository: bitnamilegacy/minio-object-browser
 
+tls:
+  enabled: true
+
 persistence:
   enabled: false # "false" means, that an emptyDir is used instead of a persistentVolumeClaim
   size: 64Mi

tests/templates/kuttl/snapshot-s3/20-install-opensearch.yaml.j2

@@ -37,8 +37,8 @@ spec:
         # not be created even if enough disk space would be available.
         cluster.routing.allocation.disk.threshold_enabled: "false"
         plugins.security.allow_default_init_securityindex: "true"
-        s3.client.default.endpoint: http://minio:9000/
-        s3.client.default.protocol: http
+        s3.client.default.endpoint: https://minio:9000/
+        s3.client.default.protocol: https
         s3.client.default.region: unused # but required
         s3.client.default.path_style_access: "true"
     podOverrides:
@@ -68,12 +68,31 @@ spec:
               - name: keystore-secrets
                 mountPath: /stackable/opensearch/keystore-secrets
                 readOnly: true
+          - name: init-system-keystore
+            image: oci.stackable.tech/sdp/opensearch:3.1.0-stackable0.0.0-dev
+            command:
+              - update-ca-trust
+            args:
+              - extract
+              - --output
+              - /stackable/ca-trust
+            volumeMounts:
+              - name: system-trust-store
+                mountPath: /stackable/ca-trust
+                readOnly: false
+              - name: s3-ca-crt
+                mountPath: /etc/pki/ca-trust/source/anchors/s3-ca.crt
+                subPath: tls.crt
+                readOnly: true
         containers:
           - name: opensearch
             volumeMounts:
               - name: security-config
                 mountPath: /stackable/opensearch/config/opensearch-security
                 readOnly: true
+              - name: tls
+                mountPath: /stackable/opensearch/config/tls
+                readOnly: true
               - name: keystore
                 mountPath: /stackable/opensearch/config/opensearch.keystore
                 subPath: opensearch.keystore
@@ -86,10 +105,28 @@ spec:
             secret:
               secretName: s3-credentials
               defaultMode: 0o660
+          - name: s3-ca-crt
+            secret:
+              secretName: minio-ca-crt
+              defaultMode: 0o660
           - name: security-config
             secret:
               secretName: opensearch-security-config
               defaultMode: 0o660
+          - name: tls
+            ephemeral:
+              volumeClaimTemplate:
+                metadata:
+                  annotations:
+                    secrets.stackable.tech/scope: node,pod,service=opensearch,service=opensearch-nodes-default-headless
+                    secrets.stackable.tech/class: tls
+                spec:
+                  storageClassName: secrets.stackable.tech
+                  accessModes:
+                    - ReadWriteOnce
+                  resources:
+                    requests:
+                      storage: "1"
 ---
 apiVersion: v1
 kind: Secret