Skip to content

Commit efbaffc

Browse files
siegfriedwebersiegfriedweber
committed
Publish fully qualified domain names so that the SANs in the TLS certificates are matched
1 parent 0eb73cc commit efbaffc

14 files changed

Lines changed: 138 additions & 18 deletions

‎rust/operator-binary/src/controller.rs‎

Lines changed: 18 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,10 @@ use dereference::dereference;
1111
use snafu::{ResultExt, Snafu};
1212
use stackable_operator::{
1313
cluster_resources::ClusterResourceApplyStrategy,
14-
commons::{affinity::StackableAffinity, product_image_selection::ResolvedProductImage},
14+
commons::{
15+
affinity::StackableAffinity, networking::DomainName,
16+
product_image_selection::ResolvedProductImage,
17+
},
1518
crd::listener,
1619
k8s_openapi::api::{
1720
apps::v1::StatefulSet,
@@ -58,6 +61,7 @@ pub struct ContextNames {
5861
pub product_name: ProductName,
5962
pub operator_name: OperatorName,
6063
pub controller_name: ControllerName,
64+
pub cluster_domain_name: DomainName,
6165
}
6266

6367
/// The controller context
@@ -68,19 +72,22 @@ pub struct Context {
6872

6973
impl Context {
7074
pub fn new(client: stackable_operator::client::Client, operator_name: OperatorName) -> Self {
75+
let cluster_domain_name = client.kubernetes_cluster_info.cluster_domain.clone();
76+
7177
Context {
7278
client,
73-
names: Self::context_names(operator_name),
79+
names: Self::context_names(operator_name, cluster_domain_name),
7480
}
7581
}
7682

77-
fn context_names(operator_name: OperatorName) -> ContextNames {
83+
fn context_names(operator_name: OperatorName, cluster_domain_name: DomainName) -> ContextNames {
7884
ContextNames {
7985
product_name: ProductName::from_str("opensearch")
8086
.expect("should be a valid product name"),
8187
operator_name,
8288
controller_name: ControllerName::from_str("opensearchcluster")
8389
.expect("should be a valid controller name"),
90+
cluster_domain_name,
8491
}
8592
}
8693

@@ -402,7 +409,10 @@ mod tests {
402409
};
403410

404411
use stackable_operator::{
405-
commons::{affinity::StackableAffinity, product_image_selection::ResolvedProductImage},
412+
commons::{
413+
affinity::StackableAffinity, networking::DomainName,
414+
product_image_selection::ResolvedProductImage,
415+
},
406416
k8s_openapi::api::core::v1::PodTemplateSpec,
407417
kvp::LabelValue,
408418
product_logging::spec::AutomaticContainerLogConfig,
@@ -428,7 +438,10 @@ mod tests {
428438
#[test]
429439
fn test_context_names() {
430440
// Test that the function does not panic
431-
Context::context_names(OperatorName::from_str_unsafe("my-operator"));
441+
Context::context_names(
442+
OperatorName::from_str_unsafe("my-operator"),
443+
DomainName::from_str("cluster.local").expect("should be a valid domain name"),
444+
);
432445
}
433446

434447
#[test]

‎rust/operator-binary/src/controller/build.rs‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,10 @@ mod tests {
6565
};
6666

6767
use stackable_operator::{
68-
commons::{affinity::StackableAffinity, product_image_selection::ResolvedProductImage},
68+
commons::{
69+
affinity::StackableAffinity, networking::DomainName,
70+
product_image_selection::ResolvedProductImage,
71+
},
6972
k8s_openapi::api::core::v1::PodTemplateSpec,
7073
kube::Resource,
7174
kvp::LabelValue,
@@ -164,6 +167,8 @@ mod tests {
164167
product_name: ProductName::from_str_unsafe("opensearch"),
165168
operator_name: OperatorName::from_str_unsafe("opensearch.stackable.tech"),
166169
controller_name: ControllerName::from_str_unsafe("opensearchcluster"),
170+
cluster_domain_name: DomainName::from_str("cluster.local")
171+
.expect("should be a valid domain name"),
167172
}
168173
}
169174

‎rust/operator-binary/src/controller/build/node_config.rs‎

Lines changed: 54 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,9 @@
33
use std::str::FromStr;
44

55
use serde_json::{Value, json};
6-
use stackable_operator::builder::pod::container::FieldPathEnvVar;
6+
use stackable_operator::{
7+
builder::pod::container::FieldPathEnvVar, commons::networking::DomainName,
8+
};
79

810
use super::ValidatedCluster;
911
use crate::{
@@ -32,6 +34,11 @@ pub const CONFIG_OPTION_DISCOVERY_SEED_HOSTS: &str = "discovery.seed_hosts";
3234
/// Type: string
3335
pub const CONFIG_OPTION_DISCOVERY_TYPE: &str = "discovery.type";
3436

37+
/// Specifies an address or addresses that an OpenSearch node publishes to other nodes for HTTP
38+
/// communication.
39+
/// Type: (comma-separated) list of strings
40+
pub const CONFIG_OPTION_HTTP_PUBLISH_HOST: &str = "http.publish_host";
41+
3542
/// A list of cluster-manager-eligible nodes used to bootstrap the cluster.
3643
/// Type: (comma-separated) list of strings
3744
pub const CONFIG_OPTION_INITIAL_CLUSTER_MANAGER_NODES: &str =
@@ -41,6 +48,11 @@ pub const CONFIG_OPTION_INITIAL_CLUSTER_MANAGER_NODES: &str =
4148
/// Type: string
4249
pub const CONFIG_OPTION_NETWORK_HOST: &str = "network.host";
4350

51+
/// Specifies an address or addresses that an OpenSearch node publishes to other nodes in the
52+
/// cluster so that they can connect to it.
53+
/// Type: (comma-separated) list of strings
54+
pub const CONFIG_OPTION_NETWORK_PUBLISH_HOST: &str = "network.publish_host";
55+
4456
/// The custom node attribute "role-group"
4557
/// Type: string
4658
pub const CONFIG_OPTION_NODE_ATTR_ROLE_GROUP: &str = "node.attr.role-group";
@@ -97,6 +109,11 @@ pub const CONFIG_OPTION_PLUGINS_SECURITY_SSL_TRANSPORT_PEMKEY_FILEPATH: &str =
97109
pub const CONFIG_OPTION_PLUGINS_SECURITY_SSL_TRANSPORT_PEMTRUSTEDCAS_FILEPATH: &str =
98110
"plugins.security.ssl.transport.pemtrustedcas_filepath";
99111

112+
/// Specifies an address or addresses that an OpenSearch node publishes to other nodes for
113+
/// transport communication.
114+
/// Type: (comma-separated) list of strings
115+
pub const CONFIG_OPTION_TRANSPORT_PUBLISH_HOST: &str = "transport.publish_host";
116+
100117
const DEFAULT_OPENSEARCH_HOME: &str = "/stackable/opensearch";
101118

102119
/// Configuration of an OpenSearch node based on the cluster and role-group configuration
@@ -105,6 +122,8 @@ pub struct NodeConfig {
105122
role_group_name: RoleGroupName,
106123
role_group_config: OpenSearchRoleGroupConfig,
107124
pub seed_nodes_service_name: ServiceName,
125+
cluster_domain_name: DomainName,
126+
headless_service_name: ServiceName,
108127
}
109128

110129
// Most functions are public because their configuration values could also be used in environment
@@ -115,12 +134,16 @@ impl NodeConfig {
115134
role_group_name: RoleGroupName,
116135
role_group_config: OpenSearchRoleGroupConfig,
117136
seed_nodes_service_name: ServiceName,
137+
cluster_domain_name: DomainName,
138+
headless_service_name: ServiceName,
118139
) -> Self {
119140
Self {
120141
cluster,
121142
role_group_name,
122143
role_group_config,
123144
seed_nodes_service_name,
145+
cluster_domain_name,
146+
headless_service_name,
124147
}
125148
}
126149

@@ -258,16 +281,42 @@ impl NodeConfig {
258281
/// The environment variables should only contain node-specific configuration options.
259282
/// Cluster-wide options should be added to the configuration file.
260283
pub fn environment_variables(&self) -> EnvVarSet {
284+
let fqdn = format!(
285+
"$(_POD_NAME).{}.{}.svc.{}",
286+
self.headless_service_name, self.cluster.namespace, self.cluster_domain_name
287+
);
288+
261289
let mut env_vars = EnvVarSet::new()
262290
// Set the OpenSearch node name to the Pod name.
263291
// The node name is used e.g. for INITIAL_CLUSTER_MANAGER_NODES.
292+
.with_field_path(
293+
// Prefix with an underscore, so that it occurs before the other environment
294+
// variables which depend on it.
295+
&EnvVarName::from_str_unsafe("_POD_NAME"),
296+
FieldPathEnvVar::Name,
297+
)
264298
.with_field_path(
265299
&EnvVarName::from_str_unsafe(CONFIG_OPTION_NODE_NAME),
266300
FieldPathEnvVar::Name,
267301
)
302+
.with_value(
303+
&EnvVarName::from_str_unsafe(CONFIG_OPTION_NETWORK_PUBLISH_HOST),
304+
&fqdn,
305+
)
306+
.with_value(
307+
&EnvVarName::from_str_unsafe(CONFIG_OPTION_TRANSPORT_PUBLISH_HOST),
308+
&fqdn,
309+
)
310+
.with_value(
311+
&EnvVarName::from_str_unsafe(CONFIG_OPTION_HTTP_PUBLISH_HOST),
312+
&fqdn,
313+
)
268314
.with_value(
269315
&EnvVarName::from_str_unsafe(CONFIG_OPTION_DISCOVERY_SEED_HOSTS),
270-
&self.seed_nodes_service_name,
316+
format!(
317+
"{}.{}.svc.{}",
318+
self.seed_nodes_service_name, self.cluster.namespace, self.cluster_domain_name
319+
),
271320
)
272321
.with_value(
273322
&EnvVarName::from_str_unsafe(CONFIG_OPTION_NODE_ROLES),
@@ -547,7 +596,9 @@ mod tests {
547596
cluster,
548597
role_group_name,
549598
role_group_config,
550-
ServiceName::from_str_unsafe("my-opensearch-cluster-discovery"),
599+
ServiceName::from_str_unsafe("my-opensearch-seed-nodes"),
600+
DomainName::from_str("cluster.local").expect("should be a valid domain name"),
601+
ServiceName::from_str_unsafe("my-opensearch-cluster-default-headless"),
551602
)
552603
}
553604

‎rust/operator-binary/src/controller/build/role_builder.rs‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -315,6 +315,7 @@ mod tests {
315315
use stackable_operator::{
316316
commons::{
317317
affinity::StackableAffinity,
318+
networking::DomainName,
318319
product_image_selection::{ProductImage, ResolvedProductImage},
319320
resources::Resources,
320321
},
@@ -358,6 +359,8 @@ mod tests {
358359
product_name: ProductName::from_str_unsafe("opensearch"),
359360
operator_name: OperatorName::from_str_unsafe("opensearch.stackable.tech"),
360361
controller_name: ControllerName::from_str_unsafe("opensearchcluster"),
362+
cluster_domain_name: DomainName::from_str("cluster.local")
363+
.expect("should be a valid domain name"),
361364
}
362365
}
363366

‎rust/operator-binary/src/controller/build/role_group_builder.rs‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -123,6 +123,11 @@ impl<'a> RoleGroupBuilder<'a> {
123123
seed_nodes_service_name: ServiceName,
124124
discovery_service_listener_name: ListenerName,
125125
) -> RoleGroupBuilder<'a> {
126+
let resource_names = ResourceNames {
127+
cluster_name: cluster.name.clone(),
128+
role_name: ValidatedCluster::role_name(),
129+
role_group_name: role_group_name.clone(),
130+
};
126131
RoleGroupBuilder {
127132
service_account_name,
128133
cluster: cluster.clone(),
@@ -131,6 +136,8 @@ impl<'a> RoleGroupBuilder<'a> {
131136
role_group_name.clone(),
132137
role_group_config.clone(),
133138
seed_nodes_service_name,
139+
context_names.cluster_domain_name.clone(),
140+
resource_names.headless_service_name(),
134141
),
135142
role_group_name: role_group_name.clone(),
136143
role_group_config,
@@ -856,8 +863,8 @@ mod tests {
856863
use serde_json::json;
857864
use stackable_operator::{
858865
commons::{
859-
affinity::StackableAffinity, product_image_selection::ResolvedProductImage,
860-
resources::Resources,
866+
affinity::StackableAffinity, networking::DomainName,
867+
product_image_selection::ResolvedProductImage, resources::Resources,
861868
},
862869
k8s_openapi::api::core::v1::PodTemplateSpec,
863870
kvp::LabelValue,
@@ -917,6 +924,8 @@ mod tests {
917924
product_name: ProductName::from_str_unsafe("opensearch"),
918925
operator_name: OperatorName::from_str_unsafe("opensearch.stackable.tech"),
919926
controller_name: ControllerName::from_str_unsafe("opensearchcluster"),
927+
cluster_domain_name: DomainName::from_str("cluster.local")
928+
.expect("should be a valid domain name"),
920929
}
921930
}
922931

‎rust/operator-binary/src/controller/validate.rs‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -331,6 +331,7 @@ mod tests {
331331
commons::{
332332
affinity::StackableAffinity,
333333
cluster_operation::ClusterOperation,
334+
networking::DomainName,
334335
product_image_selection::ResolvedProductImage,
335336
resources::{CpuLimits, MemoryLimits, PvcConfig, Resources},
336337
},
@@ -745,6 +746,8 @@ mod tests {
745746
product_name: ProductName::from_str_unsafe("opensearch"),
746747
operator_name: OperatorName::from_str_unsafe("opensearch.stackable.tech"),
747748
controller_name: ControllerName::from_str_unsafe("opensearchcluster"),
749+
cluster_domain_name: DomainName::from_str("cluster.local")
750+
.expect("should be a valid domain name"),
748751
}
749752
}
750753

‎tests/templates/kuttl/backup-restore/30-create-snapshot.yaml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,10 @@ data:
8686
body={
8787
"type": "s3",
8888
"settings": {
89-
"bucket": "opensearch-data"
89+
"bucket": "opensearch-data",
90+
# The S3CrtClient that was introduced in OpenSearch 3.3.0, does not
91+
# work with a TLS-secured MinIO. Use the old Netty client instead.
92+
"s3_async_client_type": "netty"
9093
}
9194
}
9295
)

‎tests/templates/kuttl/backup-restore/31-backup-security-indices.yaml.j2‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -125,7 +125,7 @@ data:
125125
backup-security-indices.sh: |
126126
#!/usr/bin/env sh
127127

128-
bash plugins/opensearch-security/tools/securityadmin.sh \
128+
plugins/opensearch-security/tools/securityadmin.sh \
129129
-cacert config/tls/ca.crt \
130130
-cert config/tls-client/tls.crt \
131131
-key config/tls-client/tls.key \

‎tests/templates/kuttl/backup-restore/60-restore-security-indices.yaml.j2‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ data:
135135
restore-security-indices.sh: |
136136
#!/usr/bin/env sh
137137

138-
bash plugins/opensearch-security/tools/securityadmin.sh \
138+
plugins/opensearch-security/tools/securityadmin.sh \
139139
-cacert config/tls/ca.crt \
140140
-cert config/tls-client/tls.crt \
141141
-key config/tls-client/tls.key \

‎tests/templates/kuttl/backup-restore/61-restore-snapshot.yaml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,10 @@ data:
8686
body={
8787
"type": "s3",
8888
"settings": {
89-
"bucket": "opensearch-data"
89+
"bucket": "opensearch-data",
90+
# The S3CrtClient that was introduced in OpenSearch 3.3.0, does not
91+
# work with a TLS-secured MinIO. Use the old Netty client instead.
92+
"s3_async_client_type": "netty"
9093
}
9194
}
9295
)

0 commit comments

Comments
 (0)