address more feedback on PR

labrenbe · labrenbe · commit ce4e355ab506 · 2025-12-10T16:33:16.000+01:00
diff --git a/rust/operator-binary/src/controller/build.rs b/rust/operator-binary/src/controller/build.rs
@@ -78,10 +78,7 @@ mod tests {
             ContextNames, OpenSearchNodeResources, OpenSearchRoleGroupConfig, ValidatedCluster,
             ValidatedContainerLogConfigChoice, ValidatedLogging, ValidatedOpenSearchConfig,
         },
-        crd::{
-            NodeRoles,
-            v1alpha1::{self, OpenSearchTls},
-        },
+        crd::{NodeRoles, v1alpha1},
         framework::{
             builder::pod::container::EnvVarSet,
             role_utils::GenericProductSpecificCommonConfig,
@@ -201,7 +198,7 @@ mod tests {
                 ),
             ]
             .into(),
-            OpenSearchTls::default(),
+            v1alpha1::OpenSearchTls::default(),
         )
     }
 
diff --git a/rust/operator-binary/src/controller/build/role_group_builder.rs b/rust/operator-binary/src/controller/build/role_group_builder.rs
@@ -725,10 +725,7 @@ mod tests {
             ContextNames, OpenSearchRoleGroupConfig, ValidatedCluster,
             ValidatedContainerLogConfigChoice, ValidatedLogging, ValidatedOpenSearchConfig,
         },
-        crd::{
-            NodeRoles,
-            v1alpha1::{self, OpenSearchTls},
-        },
+        crd::{NodeRoles, v1alpha1},
         framework::{
             builder::pod::container::EnvVarSet,
             product_logging::framework::VectorContainerLogConfig,
@@ -822,7 +819,7 @@ mod tests {
                 role_group_config.clone(),
             )]
             .into(),
-            OpenSearchTls::default(),
+            v1alpha1::OpenSearchTls::default(),
         )
     }
 
diff --git a/rust/operator-binary/src/controller/validate.rs b/rust/operator-binary/src/controller/validate.rs
@@ -287,10 +287,7 @@ mod tests {
     use crate::{
         built_info,
         controller::{ContextNames, ValidatedCluster, ValidatedLogging, ValidatedOpenSearchConfig},
-        crd::{
-            NodeRoles,
-            v1alpha1::{self, OpenSearchTls},
-        },
+        crd::{NodeRoles, v1alpha1},
         framework::{
             builder::pod::container::{EnvVarName, EnvVarSet},
             product_logging::framework::{
@@ -514,7 +511,7 @@ mod tests {
                     }
                 )]
                 .into(),
-                OpenSearchTls {
+                v1alpha1::OpenSearchTls {
                     server_secret_class: Some(SecretClassName::from_str_unsafe("tls")),
                     internal_secret_class: SecretClassName::from_str_unsafe("tls")
                 },
@@ -695,7 +692,7 @@ mod tests {
                 image: serde_json::from_str(r#"{"productVersion": "3.1.0"}"#)
                     .expect("should be a valid ProductImage structure"),
                 cluster_config: v1alpha1::OpenSearchClusterConfig {
-                    tls: OpenSearchTls::default(),
+                    tls: v1alpha1::OpenSearchTls::default(),
                     vector_aggregator_config_map_name: Some(ConfigMapName::from_str_unsafe(
                         "vector-aggregator",
                     )),
diff --git a/tests/templates/kuttl/backup-restore/21-install-opensearch-1.yaml.j2 b/tests/templates/kuttl/backup-restore/21-install-opensearch-1.yaml.j2
@@ -35,14 +35,7 @@ spec:
         plugins.security.allow_default_init_securityindex: "true"
         plugins.security.authcz.admin_dn: CN=opensearch-1-admin-certificate
         plugins.security.restapi.roles_enabled: all_access
-        plugins.security.ssl.transport.enabled: "true"
-        plugins.security.ssl.transport.pemcert_filepath: /stackable/opensearch/config/tls/tls.crt
-        plugins.security.ssl.transport.pemkey_filepath: /stackable/opensearch/config/tls/tls.key
-        plugins.security.ssl.transport.pemtrustedcas_filepath: /stackable/opensearch/config/tls/ca.crt
-        plugins.security.ssl.http.enabled: "true"
-        plugins.security.ssl.http.pemcert_filepath: /stackable/opensearch/config/tls/tls.crt
-        plugins.security.ssl.http.pemkey_filepath: /stackable/opensearch/config/tls/tls.key
-        plugins.security.ssl.http.pemtrustedcas_filepath: /stackable/opensearch/config/tls/ca.crt
+        plugins.security.ssl.http.pemtrustedcas_filepath: /stackable/opensearch/config/tls/concatenated/ca.crt
         s3.client.default.endpoint: https://minio:9000/
         s3.client.default.protocol: https
         s3.client.default.region: unused # but required
@@ -117,7 +110,7 @@ spec:
                     /stackable/opensearch/config/tls-admin/tls.crt > \
                     /stackable/opensearch/config/tls-concatenated/ca.crt
             volumeMounts:
-              - name: tls
+              - name: tls-server
                 mountPath: /stackable/opensearch/config/tls
                 readOnly: true
               - name: admin-certificate
@@ -136,6 +129,9 @@ spec:
                 mountPath: /etc/pki/java/cacerts
                 subPath: java/cacerts
                 readOnly: true
+              - name: tls-concatenated
+                mountPath: /stackable/opensearch/config/tls/concatenated
+                readOnly: true
               - name: keystore
                 mountPath: /stackable/opensearch/config/opensearch.keystore
                 subPath: opensearch.keystore
@@ -163,6 +159,9 @@ spec:
           - name: system-trust-store
             emptyDir:
               sizeLimit: 10Mi
+          - name: tls-concatenated
+            emptyDir:
+              sizeLimit: 1Mi
 ---
 apiVersion: v1
 kind: Secret
diff --git a/tests/templates/kuttl/backup-restore/22-create-testuser.yaml b/tests/templates/kuttl/backup-restore/22-create-testuser.yaml
@@ -72,7 +72,7 @@ data:
     client = OpenSearch(
       http_auth=('admin', 'AJVFsGJBbpT6mChn'),
       hosts=[{
-        'host': f'opensearch-1-nodes-default.{namespace}.svc.cluster.local',
+        'host': f'opensearch-1.{namespace}.svc.cluster.local',
         'port': 9200
       }],
       http_compress=True,
diff --git a/tests/templates/kuttl/backup-restore/23-create-data.yaml b/tests/templates/kuttl/backup-restore/23-create-data.yaml
@@ -72,7 +72,7 @@ data:
     client = OpenSearch(
       http_auth=('testuser', 'L9hUHtLVVEsrcLzZ'),
       hosts=[{
-        'host': f'opensearch-1-nodes-default.{namespace}.svc.cluster.local',
+        'host': f'opensearch-1.{namespace}.svc.cluster.local',
         'port': 9200
       }],
       http_compress=True,
diff --git a/tests/templates/kuttl/backup-restore/30-create-snapshot.yaml b/tests/templates/kuttl/backup-restore/30-create-snapshot.yaml
@@ -70,7 +70,7 @@ data:
 
     client = OpenSearch(
       hosts=[{
-        'host': f'opensearch-1-nodes-default.{namespace}.svc.cluster.local',
+        'host': f'opensearch-1.{namespace}.svc.cluster.local',
         'port': 9200
       }],
       http_auth=('admin', 'AJVFsGJBbpT6mChn'),
diff --git a/tests/templates/kuttl/backup-restore/31-backup-security-indices.yaml.j2 b/tests/templates/kuttl/backup-restore/31-backup-security-indices.yaml.j2
@@ -116,7 +116,7 @@ data:
         -cacert config/tls/ca.crt \
         -cert config/tls-client/tls.crt \
         -key config/tls-client/tls.key \
-        --hostname opensearch-1-nodes-default.$NAMESPACE.svc.cluster.local \
+        --hostname opensearch-1.$NAMESPACE.svc.cluster.local \
         -backup /tmp/backup
   upload-security-indices-backup.sh: |
     #!/usr/bin/env sh
diff --git a/tests/templates/kuttl/backup-restore/51-install-opensearch-2.yaml.j2 b/tests/templates/kuttl/backup-restore/51-install-opensearch-2.yaml.j2
@@ -35,14 +35,7 @@ spec:
         plugins.security.allow_default_init_securityindex: "true"
         plugins.security.authcz.admin_dn: CN=opensearch-2-admin-certificate
         plugins.security.restapi.roles_enabled: all_access
-        plugins.security.ssl.transport.enabled: "true"
-        plugins.security.ssl.transport.pemcert_filepath: /stackable/opensearch/config/tls/tls.crt
-        plugins.security.ssl.transport.pemkey_filepath: /stackable/opensearch/config/tls/tls.key
-        plugins.security.ssl.transport.pemtrustedcas_filepath: /stackable/opensearch/config/tls/ca.crt
-        plugins.security.ssl.http.enabled: "true"
-        plugins.security.ssl.http.pemcert_filepath: /stackable/opensearch/config/tls/tls.crt
-        plugins.security.ssl.http.pemkey_filepath: /stackable/opensearch/config/tls/tls.key
-        plugins.security.ssl.http.pemtrustedcas_filepath: /stackable/opensearch/config/tls/ca.crt
+        plugins.security.ssl.http.pemtrustedcas_filepath: /stackable/opensearch/config/tls/concatenated/ca.crt
         s3.client.default.endpoint: https://minio:9000/
         s3.client.default.protocol: https
         s3.client.default.region: unused # but required
@@ -117,7 +110,7 @@ spec:
                     /stackable/opensearch/config/tls-admin/tls.crt > \
                     /stackable/opensearch/config/tls-concatenated/ca.crt
             volumeMounts:
-              - name: tls
+              - name: tls-server
                 mountPath: /stackable/opensearch/config/tls
                 readOnly: true
               - name: admin-certificate
@@ -137,7 +130,7 @@ spec:
                 subPath: java/cacerts
                 readOnly: true
               - name: tls-concatenated
-                mountPath: /stackable/opensearch/config/tls
+                mountPath: /stackable/opensearch/config/tls/concatenated
                 readOnly: true
               - name: keystore
                 mountPath: /stackable/opensearch/config/opensearch.keystore
@@ -166,20 +159,6 @@ spec:
           - name: system-trust-store
             emptyDir:
               sizeLimit: 10Mi
-          - name: tls
-            ephemeral:
-              volumeClaimTemplate:
-                metadata:
-                  annotations:
-                    secrets.stackable.tech/scope: node,pod,service=opensearch-2,service=opensearch-2-nodes-default,service=opensearch-2-nodes-default-headless,listener-volume=listener
-                    secrets.stackable.tech/class: tls
-                spec:
-                  storageClassName: secrets.stackable.tech
-                  accessModes:
-                    - ReadWriteOnce
-                  resources:
-                    requests:
-                      storage: "1"
           - name: tls-concatenated
             emptyDir:
               sizeLimit: 1Mi
diff --git a/tests/templates/kuttl/backup-restore/60-restore-security-indices.yaml.j2 b/tests/templates/kuttl/backup-restore/60-restore-security-indices.yaml.j2
@@ -121,5 +121,5 @@ data:
         -cacert config/tls/ca.crt \
         -cert config/tls-client/tls.crt \
         -key config/tls-client/tls.key \
-        --hostname opensearch-2-nodes-default.$NAMESPACE.svc.cluster.local \
+        --hostname opensearch-2.$NAMESPACE.svc.cluster.local \
         --configdir /tmp/backup
diff --git a/tests/templates/kuttl/backup-restore/61-restore-snapshot.yaml b/tests/templates/kuttl/backup-restore/61-restore-snapshot.yaml
@@ -70,7 +70,7 @@ data:
 
     client = OpenSearch(
       hosts=[{
-        'host': f'opensearch-2-nodes-default.{namespace}.svc.cluster.local',
+        'host': f'opensearch-2.{namespace}.svc.cluster.local',
         'port': 9200
       }],
       http_auth=('admin', 'AJVFsGJBbpT6mChn'),
diff --git a/tests/templates/kuttl/backup-restore/70-test-opensearch-2.yaml b/tests/templates/kuttl/backup-restore/70-test-opensearch-2.yaml
@@ -72,7 +72,7 @@ data:
     client = OpenSearch(
       http_auth=('testuser', 'L9hUHtLVVEsrcLzZ'),
       hosts=[{
-        'host': f'opensearch-2-nodes-default.{namespace}.svc.cluster.local',
+        'host': f'opensearch-2.{namespace}.svc.cluster.local',
         'port': 9200
       }],
       http_compress=True,
diff --git a/tests/templates/kuttl/external-access/opensearch.yaml.j2 b/tests/templates/kuttl/external-access/opensearch.yaml.j2
@@ -11,6 +11,7 @@ spec:
     productVersion: "{{ test_scenario['values']['opensearch'].split(',')[0] }}"
     pullPolicy: IfNotPresent
 {% if lookup('env', 'VECTOR_AGGREGATOR') %}
+  clusterConfig:
     vectorAggregatorConfigMapName: vector-aggregator-discovery
 {% endif %}
   nodes:
diff --git a/tests/templates/kuttl/opensearch-dashboards/20_opensearch-dashboards-values.yaml.j2 b/tests/templates/kuttl/opensearch-dashboards/20_opensearch-dashboards-values.yaml.j2
@@ -23,19 +23,12 @@ config:
         key: /stackable/opensearch-dashboards/config/tls/tls.key
     opensearch:
       username: kibanaserver
-      requestHeadersWhitelist:
-        - authorization
-        - securitytenant
 {% if test_scenario['values']['server-use-tls'] == 'true' %}
       ssl:
         verificationMode: full
         certificateAuthorities: [/stackable/opensearch-dashboards/config/tls/ca.crt]
 {% endif %}
     opensearch_security:
-      multitenancy:
-        enabled: true
-        tenants.preferred: [Private, Global]
-      readonly_mode.roles: [kibana_read_only]
       cookie:
         secure: true
 extraVolumes:

Original file line number	Diff line number	Diff line change
`@@ -78,10 +78,7 @@ mod tests {`
`78`	`78`	`ContextNames, OpenSearchNodeResources, OpenSearchRoleGroupConfig, ValidatedCluster,`
`79`	`79`	`ValidatedContainerLogConfigChoice, ValidatedLogging, ValidatedOpenSearchConfig,`
`80`	`80`	`},`
`81`		`- crd::{`
`82`		`- NodeRoles,`
`83`		`- v1alpha1::{self, OpenSearchTls},`
`84`		`- },`
	`81`	`+ crd::{NodeRoles, v1alpha1},`
`85`	`82`	`framework::{`
`86`	`83`	`builder::pod::container::EnvVarSet,`
`87`	`84`	`role_utils::GenericProductSpecificCommonConfig,`
`@@ -201,7 +198,7 @@ mod tests {`
`201`	`198`	`),`
`202`	`199`	`]`
`203`	`200`	`.into(),`
`204`		`- OpenSearchTls::default(),`
	`201`	`+ v1alpha1::OpenSearchTls::default(),`
`205`	`202`	`)`
`206`	`203`	`}`
`207`	`204`