Skip to content

Conversation

@cwperks
Copy link
Member

@cwperks cwperks commented Jul 28, 2025

Description

This PR updates the demo installer to always install the demo certs into the config/ folder even if the following settings are already present in opensearch.yml

/**
  * plugins.security.ssl.transport.pemcert_filepath: esnode.pem
  * plugins.security.ssl.transport.pemkey_filepath: esnode-key.pem
  * plugins.security.ssl.transport.pemtrustedcas_filepath: root-ca.pem
  * plugins.security.ssl.http.pemcert_filepath: esnode.pem
  * plugins.security.ssl.http.pemkey_filepath: esnode-key.pem
  * plugins.security.ssl.http.pemtrustedcas_filepath: root-ca.pem
  */

By ensuring that the files are always copied, it resolves an issue seen in the helm-charts repo where the values are already present in opensearch.yml but the certs are not written to the config/ folder in the event that the opensearch process dies on one of the pods and is replaced. The reason for that is that it goes through the installation script and aborts saying that security is already configured.

Issues Resolved

Resolves: #5044

Helm Charts: opensearch-project/helm-charts#680

Check List

  • New functionality includes testing
  • New functionality has been documented
  • New Roles/Permissions have a corresponding security dashboards plugin PR
  • API changes companion pull request created
  • Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

cwperks added 2 commits July 25, 2025 22:54
Signed-off-by: Craig Perkins <cwperx@amazon.com>
Signed-off-by: Craig Perkins <cwperx@amazon.com>
Signed-off-by: Craig Perkins <cwperx@amazon.com>
@codecov
Copy link

codecov bot commented Jul 28, 2025

Codecov Report

❌ Patch coverage is 51.51515% with 16 lines in your changes missing coverage. Please review.
✅ Project coverage is 72.74%. Comparing base (5dc83be) to head (25493d5).
⚠️ Report is 18 commits behind head on main.

Files with missing lines Patch % Lines
...y/tools/democonfig/SecuritySettingsConfigurer.java 55.17% 5 Missing and 8 partials ⚠️
...ecurity/tools/democonfig/CertificateGenerator.java 25.00% 2 Missing and 1 partial ⚠️
Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##             main    #5517      +/-   ##
==========================================
- Coverage   72.78%   72.74%   -0.04%     
==========================================
  Files         398      398              
  Lines       24641    24674      +33     
  Branches     3747     3757      +10     
==========================================
+ Hits        17934    17950      +16     
- Misses       4878     4887       +9     
- Partials     1829     1837       +8     
Files with missing lines Coverage Δ
...pensearch/security/tools/democonfig/Installer.java 72.88% <ø> (ø)
...ecurity/tools/democonfig/CertificateGenerator.java 76.47% <25.00%> (-15.84%) ⬇️
...y/tools/democonfig/SecuritySettingsConfigurer.java 72.04% <55.17%> (-3.12%) ⬇️

... and 7 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@willyborankin willyborankin merged commit 1c2792a into opensearch-project:main Aug 4, 2025
68 of 70 checks passed
@cwperks cwperks added the backport 2.19 backport to 2.19 branch label Aug 4, 2025
@opensearch-trigger-bot
Copy link
Contributor

The backport to 2.19 failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repository
cd $(git rev-parse --show-toplevel)
# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/security/backport-2.19 2.19
# Navigate to the new working tree
pushd ../.worktrees/security/backport-2.19
# Create a new branch
git switch --create backport/backport-5517-to-2.19
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 1c2792aea651dfa79e0e2986b11a3d27a222b25f
# Push it to GitHub
git push --set-upstream origin backport/backport-5517-to-2.19
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/security/backport-2.19

Then, create a pull request where the base branch is 2.19 and the compare/head branch is backport/backport-5517-to-2.19.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport 2.19 backport to 2.19 branch backport-failed

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] OpenSearch security plugin unable to load after a pod is killed due to opensearch.yaml configuration.

3 participants