fix: Log file rollover

CHANGELOG.md

@@ -30,6 +30,10 @@ All notable changes to this project will be documented in this file.
 
 - Bump testing-tools to `0.3.0-stackable0.0.0-dev` ([#91]).
 
+### Fixed
+
+- Log file rollover fixed ([#107]).
+
 [#55]: https://github.com/stackabletech/opensearch-operator/pull/55
 [#63]: https://github.com/stackabletech/opensearch-operator/pull/63
 [#76]: https://github.com/stackabletech/opensearch-operator/pull/76
@@ -38,6 +42,7 @@ All notable changes to this project will be documented in this file.
 [#94]: https://github.com/stackabletech/opensearch-operator/pull/94
 [#97]: https://github.com/stackabletech/opensearch-operator/pull/97
 [#100]: https://github.com/stackabletech/opensearch-operator/pull/100
+[#107]: https://github.com/stackabletech/opensearch-operator/pull/107
 
 ## [25.11.0] - 2025-11-07
 

rust/operator-binary/src/controller/build/node_config.rs

@@ -13,6 +13,7 @@ use crate::{
     crd::v1alpha1,
     framework::{
         builder::pod::container::{EnvVarName, EnvVarSet},
+        product_logging::framework::STACKABLE_LOG_DIR,
         role_group_utils,
         types::{kubernetes::ServiceName, operator::RoleGroupName},
     },
@@ -65,6 +66,13 @@ pub const CONFIG_OPTION_NODE_NAME: &str = "node.name";
 /// Type: (comma-separated) list of strings
 pub const CONFIG_OPTION_NODE_ROLES: &str = "node.roles";
 
+/// Defines the path for the logs
+/// OpenSearch grants the required access rights, see
+/// https://github.com/opensearch-project/OpenSearch/blob/3.4.0/server/src/main/java/org/opensearch/bootstrap/Security.java#L369
+/// The permissions "write" and "delete" are required for the log file rollover.
+/// Type: string
+pub const CONFIG_OPTION_PATH_LOGS: &str = "path.logs";
+
 /// Specifies a list of distinguished names (DNs) that denote the other nodes in the cluster.
 /// Type: (comma-separated) list of strings
 pub const CONFIG_OPTION_PLUGINS_SECURITY_NODES_DN: &str = "plugins.security.nodes_dn";
@@ -203,6 +211,13 @@ impl NodeConfig {
             CONFIG_OPTION_NODE_ATTR_ROLE_GROUP.to_owned(),
             json!(self.role_group_name),
         );
+        config.insert(
+            CONFIG_OPTION_PATH_LOGS.to_owned(),
+            json!(format!(
+                "{STACKABLE_LOG_DIR}/{container}",
+                container = v1alpha1::Container::OpenSearch.to_container_name()
+            )),
+        );
 
         config
     }

tests/templates/kuttl/logging/20-install-opensearch.yaml.j2

@@ -13,6 +13,34 @@ data:
     appender.FILE.layout.type = OpenSearchJsonLayout
     appender.FILE.layout.type_name = server
 ---
+# Expose the API of the Vector agent
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: vector-api-config
+data:
+  vector-api-config.yaml: |
+    api:
+      address: 0.0.0.0:8686
+      enabled: true
+---
+# Expose the API of the Vector agent of the pod opensearch-nodes-automatic-0
+apiVersion: v1
+kind: Service
+metadata:
+  name: opensearch-nodes-automatic-vector
+spec:
+  ports:
+    - name: vector
+      port: 8686
+      protocol: TCP
+  selector:
+    app.kubernetes.io/component: nodes
+    app.kubernetes.io/instance: opensearch
+    app.kubernetes.io/name: opensearch
+    app.kubernetes.io/role-group: automatic
+  type: ClusterIP
+---
 apiVersion: opensearch.stackable.tech/v1alpha1
 kind: OpenSearchCluster
 metadata:
@@ -37,10 +65,10 @@ spec:
                 console:
                   level: INFO
                 file:
-                  level: INFO
+                  level: TRACE
                 loggers:
                   ROOT:
-                    level: INFO
+                    level: TRACE
               vector:
                 console:
                   level: INFO
@@ -78,10 +106,26 @@ spec:
               - name: security-config
                 mountPath: /stackable/opensearch/config/opensearch-security
                 readOnly: true
+          - name: vector
+            env:
+              - name: VECTOR_CONFIG_YAML
+                value: /stackable/config/vector.yaml,/stackable/config/vector-api-config.yaml
+            ports:
+              - name: vector
+                containerPort: 8686
+                protocol: TCP
+            volumeMounts:
+              - name: vector-api-config
+                mountPath: /stackable/config/vector-api-config.yaml
+                readOnly: true
+                subPath: vector-api-config.yaml
         volumes:
           - name: security-config
             secret:
               secretName: opensearch-security-config
+          - name: vector-api-config
+            configMap:
+              name: vector-api-config
 ---
 apiVersion: v1
 kind: Secret

tests/templates/kuttl/logging/30-test-opensearch.yaml

@@ -37,6 +37,7 @@ spec:
       securityContext:
         fsGroup: 1000
       restartPolicy: OnFailure
+    backoffLimit: 10
 ---
 apiVersion: v1
 kind: ConfigMap
@@ -88,6 +89,50 @@ data:
                        f'No events were sent in "{componentId}".'
 
 
+    def check_log_file_rollover():
+        response = requests.post(
+            'http://opensearch-nodes-automatic-vector:8686/graphql',
+            json={
+                'query': """
+                    {
+                        sources {
+                            nodes {
+                                componentId
+                                metrics {
+                                    receivedBytesTotal {
+                                        receivedBytesTotal
+                                    }
+                                }
+                            }
+                        }
+                    }
+                """
+            }
+        )
+
+        assert response.status_code == 200, \
+            'Cannot access the API of the vector agent.'
+
+        result = response.json()
+
+        sources = result['data']['sources']['nodes']
+        for source in sources:
+            receivedBytes = source['metrics']['receivedBytesTotal']
+            componentId = source['componentId']
+
+            if componentId == 'files_opensearch_server':
+                assert receivedBytes is not None
+                receivedBytes = receivedBytes['receivedBytesTotal']
+                MAX_LOG_FILE_SIZE = 5_500_000
+                expectedBytes = 2 * MAX_LOG_FILE_SIZE
+                assert receivedBytes >= expectedBytes, \
+                       'Log file rollover did not yet happen twice ' \
+                       f'({receivedBytes:,.0f} Bytes of {expectedBytes:,d} Bytes received). ' \
+                       'The first rollover requires write permission to rename the log file, ' \
+                       'the second rollover additionally requires delete permission to remove the old log file.'
+
+
     if __name__ == '__main__':
         check_sent_events()
+        check_log_file_rollover()
         print('Test successful!')