From 360d63a7609c566a6b8043a7de70ae35bd1f258a Mon Sep 17 00:00:00 2001 From: rajeevme Date: Sat, 28 Sep 2019 00:05:44 +0530 Subject: [PATCH] [AAI-2617] Search guard is no longer available Change-Id: I5cc786073ac27d3d36d05f0aa89ac5b7f1aadc02 Signed-off-by: rajeevme Change-Id: I6b8ce9867d8b1d8108fcd7002e84f798a5b4e8e2 --- .../aai-elasticsearch/resources/bin/init_sg.sh | 11 - components/aai-elasticsearch/resources/bin/run.sh | 8 - .../resources/bin/wait_until_started.sh | 9 - .../resources/config/elasticsearch.yml | 25 -- .../resources/config/sg/auth/esaai-keystore.jks | Bin 3979 -> 0 bytes .../resources/config/sg/auth/sgadmin-keystore.p12 | Bin 4575 -> 0 bytes .../resources/config/sg/auth/truststore.jks | Bin 930 -> 0 bytes .../resources/config/sg/sg_action_groups.yml | 137 ----------- .../resources/config/sg/sg_config.yml | 123 ---------- .../resources/config/sg/sg_internal_users.yml | 45 ---- .../resources/config/sg/sg_roles.yml | 262 --------------------- .../resources/config/sg/sg_roles_mapping.yml | 38 --- .../aai-elasticsearch/templates/configmap.yaml | 26 -- .../aai-elasticsearch/templates/deployment.yaml | 27 +-- .../aai-elasticsearch/templates/secrets.yaml | 22 -- components/aai-elasticsearch/values.yaml | 2 +- .../resources/config/elastic-search.properties | 2 +- 17 files changed, 4 insertions(+), 733 deletions(-) delete mode 100644 components/aai-elasticsearch/resources/bin/init_sg.sh delete mode 100644 components/aai-elasticsearch/resources/bin/run.sh delete mode 100644 components/aai-elasticsearch/resources/bin/wait_until_started.sh delete mode 100644 components/aai-elasticsearch/resources/config/sg/auth/esaai-keystore.jks delete mode 100644 components/aai-elasticsearch/resources/config/sg/auth/sgadmin-keystore.p12 delete mode 100644 components/aai-elasticsearch/resources/config/sg/auth/truststore.jks delete mode 100644 components/aai-elasticsearch/resources/config/sg/sg_action_groups.yml delete mode 100644 components/aai-elasticsearch/resources/config/sg/sg_config.yml delete mode 100644 components/aai-elasticsearch/resources/config/sg/sg_internal_users.yml delete mode 100644 components/aai-elasticsearch/resources/config/sg/sg_roles.yml delete mode 100644 components/aai-elasticsearch/resources/config/sg/sg_roles_mapping.yml delete mode 100644 components/aai-elasticsearch/templates/secrets.yaml diff --git a/components/aai-elasticsearch/resources/bin/init_sg.sh b/components/aai-elasticsearch/resources/bin/init_sg.sh deleted file mode 100644 index e859365..0000000 --- a/components/aai-elasticsearch/resources/bin/init_sg.sh +++ /dev/null @@ -1,11 +0,0 @@ -#!/bin/sh - -/usr/share/elasticsearch/plugins/search-guard-6/tools/sgadmin.sh \ - -cd /usr/share/elasticsearch/config/sg \ - -ks /usr/share/elasticsearch/config/sg/auth/{{ .Values.config.adminKeyStore }} \ - -ts /usr/share/elasticsearch/config/sg/auth/{{ .Values.config.trustStore }} \ - -kspass {{ .Values.config.adminKeyStorePassword }} \ - -tspass {{ .Values.config.trustStorePassword}} \ - -nhnv \ - -icl \ - -p {{ .Values.service.internalPort2 }} \ No newline at end of file diff --git a/components/aai-elasticsearch/resources/bin/run.sh b/components/aai-elasticsearch/resources/bin/run.sh deleted file mode 100644 index a612c74..0000000 --- a/components/aai-elasticsearch/resources/bin/run.sh +++ /dev/null @@ -1,8 +0,0 @@ -#!/bin/sh - -# Wait for ES to start then initialize SearchGuard -/usr/local/bin/docker-entrypoint.sh eswrapper & -/usr/share/elasticsearch/bin/wait_until_started.sh -/usr/share/elasticsearch/bin/init_sg.sh - -wait \ No newline at end of file diff --git a/components/aai-elasticsearch/resources/bin/wait_until_started.sh b/components/aai-elasticsearch/resources/bin/wait_until_started.sh deleted file mode 100644 index 279253b..0000000 --- a/components/aai-elasticsearch/resources/bin/wait_until_started.sh +++ /dev/null @@ -1,9 +0,0 @@ -#!/bin/sh -RET=1 - -while [[ RET -ne 0 ]]; do - echo "Waiting for Elasticsearch to become ready before running sgadmin..." - curl -XGET -k "https://localhost:{{ .Values.service.internalPort }}/" >/dev/null 2>&1 - RET=$? - sleep 5 -done \ No newline at end of file diff --git a/components/aai-elasticsearch/resources/config/elasticsearch.yml b/components/aai-elasticsearch/resources/config/elasticsearch.yml index 87536e3..ae12344 100644 --- a/components/aai-elasticsearch/resources/config/elasticsearch.yml +++ b/components/aai-elasticsearch/resources/config/elasticsearch.yml @@ -364,31 +364,6 @@ discovery.zen.ping.unicast.hosts: ["0.0.0.0"] #monitor.jvm.gc.old.info: 5s #monitor.jvm.gc.old.debug: 2s -############################################################################################# -### SEARCH GUARD SSL # -### Configuration # -############################################################################################### -######## Start Search Guard Demo Configuration ######## - -searchguard.enterprise_modules_enabled: false - -searchguard.ssl.transport.keystore_filepath: sg/auth/{{ .Values.config.nodeKeyStore }} -searchguard.ssl.transport.keystore_password: {{ .Values.config.nodeKeyStorePassword }} -searchguard.ssl.transport.truststore_filepath: sg/auth/{{ .Values.config.trustStore }} -searchguard.ssl.transport.truststore_password: {{ .Values.config.trustStorePassword }} -searchguard.ssl.transport.enforce_hostname_verification: false - -searchguard.ssl.http.enabled: true -searchguard.ssl.http.keystore_filepath: sg/auth/{{ .Values.config.nodeKeyStore }} -searchguard.ssl.http.keystore_password: {{ .Values.config.nodeKeyStorePassword }} -searchguard.ssl.http.truststore_filepath: sg/auth/{{ .Values.config.trustStore }} -searchguard.ssl.http.truststore_password: {{ .Values.config.trustStorePassword }} - -searchguard.nodes_dn: - - CN=esaai - -searchguard.authcz.admin_dn: - - CN=sgadmin # x-pack security conflicts with searchguard xpack.security.enabled: false diff --git a/components/aai-elasticsearch/resources/config/sg/auth/esaai-keystore.jks b/components/aai-elasticsearch/resources/config/sg/auth/esaai-keystore.jks deleted file mode 100644 index 21ec9bba97307c1879b022d50941919bb2d89e78..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 3979 zcmcK5c{r3^{{Zk=ZJ8NsgtE-YmfVwNQc*~jkZtUvGQ4uE9gkYfSEz_Ji-Fc=PkkzsQUe3!gSX0PY? z%}o$YWM5EZPx&XNdA)Z{(~=qDu8c$AT}y|$Mh;s;U zV6&DhE5L4+1&BYZ;1$YbZ>ml2lt}wM^9;7(^?|!{dZ%@Grvxoj%QMc1KG*Bwn#>e zdE12&?ufxk*yUChLuDVEh9;;jCSjT$pN?>TpfU)Ym8InkrQX&Q2qK30i9G8=c@N@O z+-|M(t?Yob)0%tpu8=a^V&8l?yS`QyDb*vLbmZd|T95K{la-!1d#?@=<_-pFi6l4X zwgrxdCKbxZmncL#X1I;jr0ZUr9dS18p2fCW46nZD(*WHYhe$stPn}6#eO4ze)~Nn0 zTer)~2=V9On-Z0_{vd5#6Wa4`dGyDYgK@3G6YKZZ6_Zf;AN7h?ZM;8w+`cW)1vFob z)BJ3>!=ZO+h3LW1>VJW$D2hJ;k_sFc7W!P;-M_fpFK>Nw*8*!3^HIjsD|F1<#tk89 z7%$yjcHrf6{ns*sU%w_1G&5;)S9NL^mzG~N8b!;9to5zImo<*B2GOY6Jt$?nd0L8t zk;a|;?a2wFjNfgCqR|6%Wz-YCbq;O!Z%#FD4ifL1(jPvwH#}5Y?deQy_fp*6>b;x- z);=n7yhfy`az4pwchzk}x?%UfE?xN}nVgy&Ea9mhkjWJQUf?~4>VI(b)gP4>3J2_v z(}o3I^=*FQgspeAcpSu$Gn$~HvCAID$Uq_j5}nF?<_hoak}0Rn1T}I zH%BE1enx?xd9_b!Y_tlhjLJ)}Zakk9?|90|-P=%lvCHQ^Km4SM+R|J&quV)PhEzJ2 zUUe!^B$j@aE~bB9ZcB%Iy$2lTKE07_kUvPh-;{^)GT)5rllcu3vLdDQ#EuJhuy_^7|7~kPEjy6}4Jn`YQ0%NUF zC4+P?@Os!5ZtYP_Q?x33-i*+OJNaaI5Bz0^>*GiaE^Kp|7nqJ1{4}NSfev7gIf3wt zl_l90{_*vi_T_kz*?=NlbI2s+f-{u!fbUo3xvrfm^K_DKrM=3d7RkOGZQGE28Rw%) z0uL`(@@2PgAJjkYQ@C=8yKkvWOH;ecr;wPp_~B9Ph8c|i?*1)fp)pG4Z+@Ud2+@^Je3C#m7p-xntDF1RKtig~ZDUHEzQ{?C*ro*^HMs|15Xvz_sGzNmW}JTMu- z3c=OdikW946a=?Astl+ydu{+3>I9G>hWStk7yeb6i7vwq5EwLuvMYV-j{-5?zCoDiUP-(a1Urnmw*&#;7uNO*cW}S=g=lGP6c8F=rz6 zZpJvTB;M$9=F8oy@jhnXu4m@REvljD*6$_Ww^))6+o*P~*wf9D%()$$=4BH&AqpuF z{&ah1{VyWujSdXnesW}qc=TnSbB%1O5|Z|mslU?Ke1mv%!sn!!{$sC zl-|D&OVV;eexOl`gCkNyGZojbJ?yb`Gi!%+#yb((%XJ!7Lp)IsC>R7TjJyp*rZBHF zDE=S{4Bmyopb&UIz`hsr!XN+$IJno9gzX3TSlF0X9vsdJ1^>MV`7w-y?T7I>``;K) zKRaMs9!$L9RCxi(?Q{nKME7Q+Va$q0@aa(F=Fb{y=W4zv(HFkHdNYW7Bm@xHdx0Cq z1t7^k>J|r=g~H(Qzm|@79TUkzaiZr^g8O7mO^zGjlP!JnY>KCg^c>-z z4jFA>0_2^(!wR9#O%tKd6IqY;)A5nlXB#joj8^H( z;a>HaD1NDgYMJw9W6n>XARBvhyQq{WGN_g`L-*E0V#=4_PbLMe#~r^QZT*sa3| z4lR+}uDfu-=!LTV&C(@B>L)OcJt23smI_$it)uenF?#8G(Gz2%78>(*vXTUuGm}xX zL27XUNpnwk3+6yTwBkY^e|K!+Kg=<`K^>Up^nRLy{IXnt+OOvL0bb@xGtF^+H)rbQ z<+lg!XBzs?>0h)d?rGb@_d}ba&HoMQ{{-}j-9*;ca}ToQU5C!=K4_03khpy*Zae}$ z$z@7guk;l7yd?TLoOIhnA*t1UpQX0N<#aqXOJ7Yl8xbA&qT4x2YCEAtjjD+0p)~cm zdryOOA&Ks&SwDa;v7Pif ze={qW-CQE#RJ``m9ATv5R$eu4LG6s;51`I~<3IBRvj9AMXn6OyvH>j22L$}n>34|# z*4bYnlCpvkZ7aRY{pV+n)TK1Fbr9U9DFjZ^1*ao@7VF!HI__JdRr z*U7H|L_5WWm?mTMX!fhYq(O>F9ef+T^AB%!Om9|9Z)bjb1OKvI|KHyJmz@8Tv>`2{ z)mt~VYXRX+>yJ+Pp_T6V%haM*gTqJjidBvE9}>C-oSooSV+esTLtaUGJW!I>wVnk$v*NYv{z=GWrj#!Cvyq!pUGFaTj^GH}`MXM9cC-q5v^m#+pTZmdTM5>x>{oUh6duIlil4MG;&d6H#(z-o56Fi z^IjmupUg6C`8L2{l79D$_Lp`SlkUacWmV7sfXi4zub5KR?+{2nbgpi)<@rns5cv%G2cjntrKEPI1F3@sa9peYxn1J+%lTL)+S7B2Qhk(_2ZsE~i`jX8r z>7cr^1B9B(Xd6@@A&{ag&AJxAsJCFJr*T=dI>Ec(EXK*w)3kK8{Bw>rvF1z99o&Qt zo9~7sHE)ZNVvlX{GxB|19T|`&szG!dUtqexD`9fHLk;DWskM08cDIPJZyRl5_zR0}F;EO~=9KjDkm95o6$Da^9EI_w55DDzer&94)!9yfBeROC=V0`B%ZkiQrKeP!^fcDI`zfu6EMKqer&7FJJj!EY?3S|Bzugtxoyd2279BiuEem7oibo>TCx<-L%B6_Y%MIyg z{T|E9EGL}EZgKC2{|G@abABuKWC51S5nAsYH81I0d2MG#k9?zL9_Sr>od@nyKb~~& z=Ae>8Iv|hoA567)%c4D?-3_VI?8ep@1=r-k{6~}{a!J`(#uiAULlC-Y4lm%A8R3>l ze$$vMjq5C`meVZ>^`g9MR{!4aub5z3?oitGr*W2FF2It@k0hGW=6 zEog*3Lk$vCBJgVeY1M8hHztk2vYHV5H=*f78(|Mn)bU*&st9bAr$yOEPs{9pY{4EL zD+HN28t@LPuUQba zUwoM4Ip)G@j5AC@#UO9&oVBbk-z2Jy#+t@wUa5AyjlMN3W!g*o9{EB2mY$&X3@Oui zTADaSE~|RQ0h?`?z6P5C+x^h9zVv5plJyX~H%akm?k;$5fHxo)s6cjFml&}|rM|A?=aVN-}{EHhwKx1`* z^;Grv56e$|TKG<{8a+?_pwexdvqhZ-ZA4n-jXI$-Eosu9m0zQ{(7(l*gg0D1y=&E3 zbq!pWCcL~=cl8QNY&Oay!KU`|iW@B%F1DNW?1-te1t>}K4~WeGhT!d@ghn~rmL~{3e|3dzmP6e(klJ}#4q3VrIKyNs{l~p zmehU)Lw+Imb4pGwvL;NYat+2u=uFD>H_voQQ3R3OYJ+D8~}6ZPm`d94r^m|jg-;5ZFPG!vsGCVk)4V+U4`_4vY#HlJPzUO)*+j5%AZ%_hr^)%MkGEtKP5dm;5EPn zAO-LM*a0j7)&OUK1Hc6a`A><0pBxC*b8xm{3?qO^oDw{*{v?64pf$`+gqhVxZf5P(g?Vc0kBz31_Z#BHHYG-) zv}H-WGjAiJT8}kpFgXUzn#&CyR{crJKWhIuq4 z89LJXq9kKDgS|;2RmAH#g%gjUKbhd+B_$EMCcbIKOuzF3h0~~H4mb&mvsq+9@P{)< zu5LwfO+Fbp{d^a$K=HD)p37Ruc9C~Gz>d5aJ}EW4#o+i4-|U|gbrnW>tGFnRIZ>hm zGF@C5xao<2Ph$un_ki|_Q?}mdJ?dLp>iIW~74ZjAX0 zYjROilTtC3X7e8e8HR}AI+d1siP5}#U<5@>^NzPBFb&gkv~l=+N9i@&X++kIK_;#x=O6iIY~g zNzcQVteInn8C@49bXn~kEk8Nk*9DgRct*>$0tc^BAFi<` z=_F5<&Q#~xSre}te<8|&s>K~2*V??XO&%lf5=lg4Z!{;;d$b?PEAWBVWU{W}RffT@ zb;3I;5?^+_tn0{CV%u{&M_?tCP!F?tuNQFU>sDiYZBx9XJ*}*S@h$(kw6v??lGO#CEp9zrtj_Z_2Krb7mI2c-lSPZJo366Px!V7bY zckdm(n+gm7L@B zehSu#w{@G=gmmG8e^a=Fm9wQvY>Mz4y@sa)UB;Z0KIRUpCcP}TPf8FEKXfgqlul3k*5vFmB=HJOuz4p-)a|@T}r-P1uycgB{$sXrzEayXpY2&Bz&lcR+0Jl zBibG=Oo^-2xNdV?oP6>uzK{1-QOXy>OE4<&UN_$#@QU>pK1d}R>G-ysIr&-`h)i3R zPgtjFa86qP`NvKDt&k%PO*>%5JzchI(>QY3jOntg>77{`{DDAzDaLeR_62U}Cw&^< zVy)zUGKSG~nRn?<_iQEo>bX-B5^siOs!o1ptUA)W)DW!)EE7bxpO(&q9)*Ar!_e`5 z5s5naOm3JVZHy#{<1Hx{MUp%9^!#O=){2z>mVV08H(;{@s%&cU(az`Xk4GvhrO}mP zsjv2XqJ3@z@DVSIfmSUUNvA?zs6x5+c;4)TH*I3D3kyny#DW zenaW3WGzSW5fAxM9>o>J^u~>|Ha}s}!IpJ$hlg)S z{XM~iBXo88b2X&2F@$?6BTaG^{Dw^C6o1S;b&^0`Hq zYb_#0gfDzQc!bd2uA~e#Z&bbBG00vj1sqN7vt2EzgF4}VOf9MxwpRsmFVXMIH1lPw zE$A4gGgh1%Ts&ON$tkyTNY)Lo@CaDZf-st7NEu+1Z$12Ong^il4AOO(`93nNS(n7# z$EI0I*QslIE^n6|(B{DA4>d{FZ(hvG7m!7)?~fE~3W2U4nRJc3E~P_mjJangVYRKd0-IhqIz5AVN0PRi5klQUrZywd>3 z0gUF1h_~vdjjtc-qgzK;+VrGV8(T7d!nX^nw@s?**~+F_NVO+2KMm~^#QZ$Fg#_WI z+um9TNQ=4UrlIJk=69_7$*9%>dGAwx*?qi5v{{DL5}*&?lu|oKzx({fa?}KcsRBLo zN3qt|B+7bCqaRJdDB#fPPHy?tHanWbUR*9D^Gh1M@!R;j{E3=DRVxi0g6HE)?u9TK z9=_x0+L06v$Gy_-2KtJ3^Cf}%wNU|rX~a6Ox}S+t4n;07n1c;rw8@Dj+2ev zMNvQc1U}qHIKf?R6(=jHTNrsGCnZ1Iv2?O3-NKN(+RV2CuI58e9SEuXgHUkGjb8d8)clnFQD^ z7P_u;p+QLWRPwTgU%!!g`OLiiM{cH+NRh(S8dlzUPqWSHA6BF&(6u|Qu)EzST`=fN zv~}_gjXm%=^U{Q15(Nw;o+01;T{uevYIN)G$+klF7=Mr3?;0qVF+btlgl>a-MTOs;6uzdAOS~Gnrw8k<-1#w)bqGWr-vy@meOz5#lEp zj2Q+Qx7x2_>nEXV*zEG=)Jb{$6SlJjQJeC^72Md;wx5WwMbG`ZdNvpX9p*6stX?KK zDh~H4{nqd0>~eQc%0Dbny!nYm8ia{uYtrgtF>wK06A)vK5EFOC=^I+%1g~L50Vyt! z4Xlf?RY*WrE*b=u48#Za=j7vrI}j*^k^18zM?7>cF}k)P&h5NDER?(}F?C)Npew=% zpQiO10mNf0pkCU*%tmX+e%H8x@z+v2WoTLGfPi`n1`o zdhGGhjnj!i=to~GCQaWnjEF-09(1)NbZRvnZ8u=jFbE7E2b=2&7UnZ-0Fbi9FS88r+8ul1d@8f; zb)GkeU;e+_EUj`{G@kPB}Babb0t|i%s4rR zKYPat<9U3>y}fsKfBtY*DVD!+3th<^Co#UN`D2vz=ZW>QFkJO9Z! zWm0?BF8@B$psT#wLxcTm+1(vsoL8m_gdI#}J;BNrFiGRt^69n<+)|?2Lf&0S%#>0K z`Cm10?_Y)7HlyF7cNY|Aq}*lNGt;M~L!^AV_*Lnq&crR01)8GZMrOPMp5D)nEO5Wqt&cBh@Yz-%F6RkF7x#|u8__k-F diff --git a/components/aai-elasticsearch/resources/config/sg/sg_action_groups.yml b/components/aai-elasticsearch/resources/config/sg/sg_action_groups.yml deleted file mode 100644 index be5901a..0000000 --- a/components/aai-elasticsearch/resources/config/sg/sg_action_groups.yml +++ /dev/null @@ -1,137 +0,0 @@ -UNLIMITED: - readonly: true - permissions: - - "*" - -###### INDEX LEVEL ###### - -INDICES_ALL: - readonly: true - permissions: - - "indices:*" - -# for backward compatibility -ALL: - readonly: true - permissions: - - INDICES_ALL - -MANAGE: - readonly: true - permissions: - - "indices:monitor/*" - - "indices:admin/*" - -CREATE_INDEX: - readonly: true - permissions: - - "indices:admin/create" - - "indices:admin/mapping/put" - -MANAGE_ALIASES: - readonly: true - permissions: - - "indices:admin/aliases*" - -# for backward compatibility -MONITOR: - readonly: true - permissions: - - INDICES_MONITOR - -INDICES_MONITOR: - readonly: true - permissions: - - "indices:monitor/*" - -DATA_ACCESS: - readonly: true - permissions: - - "indices:data/*" - - CRUD - -WRITE: - readonly: true - permissions: - - "indices:data/write*" - - "indices:admin/mapping/put" - -READ: - readonly: true - permissions: - - "indices:data/read*" - - "indices:admin/mappings/fields/get*" - -DELETE: - readonly: true - permissions: - - "indices:data/write/delete*" - -CRUD: - readonly: true - permissions: - - READ - - WRITE - -SEARCH: - readonly: true - permissions: - - "indices:data/read/search*" - - "indices:data/read/msearch*" - - SUGGEST - -SUGGEST: - readonly: true - permissions: - - "indices:data/read/suggest*" - -INDEX: - readonly: true - permissions: - - "indices:data/write/index*" - - "indices:data/write/update*" - - "indices:admin/mapping/put" - - "indices:data/write/bulk*" - -GET: - readonly: true - permissions: - - "indices:data/read/get*" - - "indices:data/read/mget*" - -###### CLUSTER LEVEL ###### - -CLUSTER_ALL: - readonly: true - permissions: - - "cluster:*" - -CLUSTER_MONITOR: - readonly: true - permissions: - - "cluster:monitor/*" - -CLUSTER_COMPOSITE_OPS_RO: - readonly: true - permissions: - - "indices:data/read/mget" - - "indices:data/read/msearch" - - "indices:data/read/mtv" - - "indices:data/read/coordinate-msearch*" - - "indices:admin/aliases/exists*" - - "indices:admin/aliases/get*" - - "indices:data/read/scroll" - -CLUSTER_COMPOSITE_OPS: - readonly: true - permissions: - - "indices:data/write/bulk" - - "indices:admin/aliases*" - - "indices:data/write/reindex" - - CLUSTER_COMPOSITE_OPS_RO - -MANAGE_SNAPSHOTS: - readonly: true - permissions: - - "cluster:admin/snapshot/*" - - "cluster:admin/repository/*" \ No newline at end of file diff --git a/components/aai-elasticsearch/resources/config/sg/sg_config.yml b/components/aai-elasticsearch/resources/config/sg/sg_config.yml deleted file mode 100644 index d0050e0..0000000 --- a/components/aai-elasticsearch/resources/config/sg/sg_config.yml +++ /dev/null @@ -1,123 +0,0 @@ -# This is the main Search Guard configuration file where authentication -# and authorization is defined. -# -# You need to configure at least one authentication domain in the authc of this file. -# An authentication domain is responsible for extracting the user credentials from -# the request and for validating them against an authentication backend like Active Directory for example. -# -# If more than one authentication domain is configured the first one which succeeds wins. -# If all authentication domains fail then the request is unauthenticated. -# In this case an exception is thrown and/or the HTTP status is set to 401. -# -# After authentication authorization (authz) will be applied. There can be zero or more authorizers which collect -# the roles from a given backend for the authenticated user. -# -# Both, authc and auth can be enabled/disabled separately for REST and TRANSPORT layer. Default is true for both. -# http_enabled: true -# transport_enabled: true -# -# 5.x Migration: "enabled: true/false" will also be respected currently but only to provide backward compatibility. -# -# For HTTP it is possible to allow anonymous authentication. If that is the case then the HTTP authenticators try to -# find user credentials in the HTTP request. If credentials are found then the user gets regularly authenticated. -# If none can be found the user will be authenticated as an "anonymous" user. This user has always the username "sg_anonymous" -# and one role named "sg_anonymous_backendrole". -# If you enable anonymous authentication all HTTP authenticators will not challenge. -# -# -# Note: If you define more than one HTTP authenticators make sure to put non-challenging authenticators like "proxy" or "clientcert" -# first and the challenging one last. -# Because it's not possible to challenge a client with two different authentication methods (for example -# Kerberos and Basic) only one can have the challenge flag set to true. You can cope with this situation -# by using pre-authentication, e.g. sending a HTTP Basic authentication header in the request. -# -# Default value of the challenge flag is true. -# -# -# HTTP -# basic (challenging) -# proxy (not challenging, needs xff) -# clientcert (not challenging, needs https) -# host (not challenging) #DEPRECATED, will be removed in a future version. -# host based authentication is configurable in sg_roles_mapping - -# Authc -# internal -# noop - -# Authz -# noop - -# Some SearchGuard functionality is licensed under Apache-2.0, while other functionality is non-free; -# see https://github.com/floragunncom/search-guard. The functionality enabled in this configuration -# file only include those that are licensed under Apache-2.0. Please use care and review SearchGuard's -# license details before enabling any additional features here. - -searchguard: - dynamic: - # Set filtered_alias_mode to 'disallow' to forbid more than 2 filtered aliases per index - # Set filtered_alias_mode to 'warn' to allow more than 2 filtered aliases per index but warns about it (default) - # Set filtered_alias_mode to 'nowarn' to allow more than 2 filtered aliases per index silently - #filtered_alias_mode: warn - http: - anonymous_auth_enabled: false - xff: - enabled: false - internalProxies: '192\.168\.0\.10|192\.168\.0\.11' # regex pattern - #internalProxies: '.*' # trust all internal proxies, regex pattern - remoteIpHeader: 'x-forwarded-for' - proxiesHeader: 'x-forwarded-by' - #trustedProxies: '.*' # trust all external proxies, regex pattern - ###### see https://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html for regex help - ###### more information about XFF https://en.wikipedia.org/wiki/X-Forwarded-For - ###### and here https://tools.ietf.org/html/rfc7239 - ###### and https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Remote_IP_Valve - authc: - basic_internal_auth_domain: - http_enabled: true - transport_enabled: true - order: 2 - http_authenticator: - type: basic - challenge: true - authentication_backend: - type: intern - proxy_auth_domain: - http_enabled: false - transport_enabled: false - order: 3 - http_authenticator: - type: proxy - challenge: false - config: - user_header: "x-proxy-user" - roles_header: "x-proxy-roles" - authentication_backend: - type: noop - jwt_auth_domain: - http_enabled: false - transport_enabled: false - order: 0 - http_authenticator: - type: jwt - challenge: false - config: - signing_key: "base64 encoded HMAC key or public RSA/ECDSA pem key" - jwt_header: "Authorization" - jwt_url_parameter: null - roles_key: null - subject_key: null - authentication_backend: - type: noop - clientcert_auth_domain: - http_enabled: true - transport_enabled: true - order: 1 - http_authenticator: - type: clientcert - config: - username_attribute: cn #optional, if omitted DN becomes username - challenge: false - authentication_backend: - type: noop - authz: \ No newline at end of file diff --git a/components/aai-elasticsearch/resources/config/sg/sg_internal_users.yml b/components/aai-elasticsearch/resources/config/sg/sg_internal_users.yml deleted file mode 100644 index 942a716..0000000 --- a/components/aai-elasticsearch/resources/config/sg/sg_internal_users.yml +++ /dev/null @@ -1,45 +0,0 @@ -# This is the internal user database -# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh - -#password is: admin -admin: - readonly: true - hash: $2a$12$VcCDgh2NDk07JGN0rjGbM.Ad41qVR/YFJcgHp0UGns5JDymv..TOG - roles: - - admin - attributes: - #no dots allowed in attribute names - attribute1: value1 - attribute2: value2 - attribute3: value3 - -#password is: logstash -logstash: - hash: $2a$12$u1ShR4l4uBS3Uv59Pa2y5.1uQuZBrZtmNfqB3iM/.jL0XoV9sghS2 - roles: - - logstash - -#password is: kibanaserver -kibanaserver: - readonly: true - hash: $2a$12$4AcgAt3xwOWadA5s5blL6ev39OXDNhmOesEoo33eZtrq2N0YrU3H. - -#password is: kibanaro -kibanaro: - hash: $2a$12$JJSXNfTowz7Uu5ttXfeYpeYE0arACvcwlPBStB1F.MI7f0U9Z4DGC - roles: - - kibanauser - - readall - -#password is: readall -readall: - hash: $2a$12$ae4ycwzwvLtZxwZ82RmiEunBbIPiAmGZduBAjKN0TXdwQFtCwARz2 - #password is: readall - roles: - - readall - -#password is: snapshotrestore -snapshotrestore: - hash: $2y$12$DpwmetHKwgYnorbgdvORCenv4NAK8cPUg8AI6pxLCuWf/ALc0.v7W - roles: - - snapshotrestore \ No newline at end of file diff --git a/components/aai-elasticsearch/resources/config/sg/sg_roles.yml b/components/aai-elasticsearch/resources/config/sg/sg_roles.yml deleted file mode 100644 index c918e85..0000000 --- a/components/aai-elasticsearch/resources/config/sg/sg_roles.yml +++ /dev/null @@ -1,262 +0,0 @@ -# Allows everything, but no changes to searchguard configuration index -sg_all_access: - readonly: true - cluster: - - UNLIMITED - indices: - '*': - '*': - - UNLIMITED - tenants: - admin_tenant: RW - -# Read all, but no write permissions -sg_readall: - readonly: true - cluster: - - CLUSTER_COMPOSITE_OPS_RO - indices: - '*': - '*': - - READ - -# Read all and monitor, but no write permissions -sg_readall_and_monitor: - cluster: - - CLUSTER_MONITOR - - CLUSTER_COMPOSITE_OPS_RO - indices: - '*': - '*': - - READ - -# For users which use kibana, access to indices must be granted separately -sg_kibana_user: - readonly: true - cluster: - - INDICES_MONITOR - - CLUSTER_COMPOSITE_OPS - indices: - '?kibana': - '*': - - MANAGE - - INDEX - - READ - - DELETE - '?kibana-6': - '*': - - MANAGE - - INDEX - - READ - - DELETE - '?kibana_*': - '*': - - MANAGE - - INDEX - - READ - - DELETE - '?tasks': - '*': - - INDICES_ALL - '?management-beats': - '*': - - INDICES_ALL - '*': - '*': - - indices:data/read/field_caps* - - indices:data/read/xpack/rollup* - - indices:admin/mappings/get* - - indices:admin/get - -# For the kibana server -sg_kibana_server: - readonly: true - cluster: - - CLUSTER_MONITOR - - CLUSTER_COMPOSITE_OPS - - cluster:admin/xpack/monitoring* - - indices:admin/template* - - indices:data/read/scroll* - indices: - '?kibana': - '*': - - INDICES_ALL - '?kibana-6': - '*': - - INDICES_ALL - '?kibana_*': - '*': - - INDICES_ALL - '?reporting*': - '*': - - INDICES_ALL - '?monitoring*': - '*': - - INDICES_ALL - '?tasks': - '*': - - INDICES_ALL - '?management-beats*': - '*': - - INDICES_ALL - '*': - '*': - - "indices:admin/aliases*" - -# For logstash and beats -sg_logstash: - cluster: - - CLUSTER_MONITOR - - CLUSTER_COMPOSITE_OPS - - indices:admin/template/get - - indices:admin/template/put - indices: - 'logstash-*': - '*': - - CRUD - - CREATE_INDEX - '*beat*': - '*': - - CRUD - - CREATE_INDEX - -# Allows adding and modifying repositories and creating and restoring snapshots -sg_manage_snapshots: - cluster: - - MANAGE_SNAPSHOTS - indices: - '*': - '*': - - "indices:data/write/index" - - "indices:admin/create" - -# Allows each user to access own named index -sg_own_index: - cluster: - - CLUSTER_COMPOSITE_OPS - indices: - '${user_name}': - '*': - - INDICES_ALL - -### X-Pack COMPATIBILITY -sg_xp_monitoring: - readonly: true - cluster: - - cluster:monitor/xpack/info - - cluster:monitor/main - - cluster:admin/xpack/monitoring/bulk - indices: - '?monitor*': - '*': - - INDICES_ALL - -sg_xp_alerting: - readonly: true - cluster: - - indices:data/read/scroll - - cluster:admin/xpack/watcher* - - cluster:monitor/xpack/watcher* - indices: - '?watches*': - '*': - - INDICES_ALL - '?watcher-history-*': - '*': - - INDICES_ALL - '?triggered_watches': - '*': - - INDICES_ALL - '*': - '*': - - READ - - indices:admin/aliases/get - -sg_xp_machine_learning: - readonly: true - cluster: - - cluster:admin/persistent* - - cluster:internal/xpack/ml* - - indices:data/read/scroll* - - cluster:admin/xpack/ml* - - cluster:monitor/xpack/ml* - indices: - '*': - '*': - - READ - - indices:admin/get* - '?ml-*': - '*': - - "*" - -### LEGACY ROLES, FOR COMPATIBILITY ONLY -### WILL BE REMOVED IN SG7, DO NOT USE ANYMORE - -sg_readonly_and_monitor: - cluster: - - CLUSTER_MONITOR - - CLUSTER_COMPOSITE_OPS_RO - indices: - '*': - '*': - - READ - -# Make xpack monitoring work -sg_monitor: - cluster: - - cluster:admin/xpack/monitoring/* - - cluster:admin/ingest/pipeline/put - - cluster:admin/ingest/pipeline/get - - indices:admin/template/get - - indices:admin/template/put - - CLUSTER_MONITOR - - CLUSTER_COMPOSITE_OPS - indices: - '?monitor*': - '*': - - INDICES_ALL - '?marvel*': - '*': - - INDICES_ALL - '?kibana*': - '*': - - READ - '*': - '*': - - indices:data/read/field_caps - -# Make xpack alerting work -sg_alerting: - cluster: - - indices:data/read/scroll - - cluster:admin/xpack/watcher/watch/put - - cluster:admin/xpack/watcher* - - CLUSTER_MONITOR - - CLUSTER_COMPOSITE_OPS - indices: - '?kibana*': - '*': - - READ - '?watches*': - '*': - - INDICES_ALL - '?watcher-history-*': - '*': - - INDICES_ALL - '?triggered_watches': - '*': - - INDICES_ALL - '*': - '*': - - READ - - -sg_role_test: - cluster: - - indices:admin/template/get - - indices:admin/template/put - - CLUSTER_COMPOSITE_OPS - indices: - '*': - '*': - - UNLIMITED diff --git a/components/aai-elasticsearch/resources/config/sg/sg_roles_mapping.yml b/components/aai-elasticsearch/resources/config/sg/sg_roles_mapping.yml deleted file mode 100644 index 970e027..0000000 --- a/components/aai-elasticsearch/resources/config/sg/sg_roles_mapping.yml +++ /dev/null @@ -1,38 +0,0 @@ -# In this file users, backendroles and hosts can be mapped to Search Guard roles. -# Permissions for Search Guard roles are configured in sg_roles.yml - -sg_all_access: - readonly: true - backendroles: - - admin - -sg_logstash: - backendroles: - - logstash - -sg_kibana_server: - readonly: true - users: - - kibanaserver - -sg_kibana_user: - backendroles: - - kibanauser - -sg_readall: - readonly: true - backendroles: - - readall - -sg_manage_snapshots: - readonly: true - backendroles: - - snapshotrestore - -sg_own_index: - users: - - '*' - -sg_role_test: - users: - - test diff --git a/components/aai-elasticsearch/templates/configmap.yaml b/components/aai-elasticsearch/templates/configmap.yaml index 4be124f..5067c83 100644 --- a/components/aai-elasticsearch/templates/configmap.yaml +++ b/components/aai-elasticsearch/templates/configmap.yaml @@ -24,29 +24,3 @@ metadata: heritage: {{ .Release.Service }} data: {{ tpl (.Files.Glob "resources/config/*").AsConfig . | indent 2 }} ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ include "common.fullname" . }}-sg-scripts - namespace: {{ include "common.namespace" . }} - labels: - app: {{ include "common.name" . }} - chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -data: -{{ tpl (.Files.Glob "resources/bin/*").AsConfig . | indent 2 }} ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ include "common.fullname" . }}-sg-config - namespace: {{ include "common.namespace" . }} - labels: - app: {{ include "common.name" . }} - chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -data: -{{ tpl (.Files.Glob "resources/config/sg/*").AsConfig . | indent 2 }} diff --git a/components/aai-elasticsearch/templates/deployment.yaml b/components/aai-elasticsearch/templates/deployment.yaml index 785693a..0c54738 100644 --- a/components/aai-elasticsearch/templates/deployment.yaml +++ b/components/aai-elasticsearch/templates/deployment.yaml @@ -60,8 +60,8 @@ spec: - name: elasticsearch-data mountPath: /logroot/ containers: - - name: {{ include "common.name" . }} - image: "{{ include "common.repository" . }}/{{ .Values.image }}" + - name: {{ include "common.name" . }} + image: "{{ .Values.global.loggingRepository }}/{{ .Values.image }}" imagePullPolicy: {{ .Values.pullPolicy | default .Values.global.pullPolicy }} ports: - containerPort: {{ .Values.service.internalPort }} @@ -93,19 +93,6 @@ spec: - name: elasticsearch-config subPath: log4j2.properties mountPath: /usr/share/elasticsearch/config/log4j2.properties - - name: searchguard-scripts - subPath: run.sh - mountPath: /usr/share/elasticsearch/bin/run.sh - - name: searchguard-scripts - subPath: wait_until_started.sh - mountPath: /usr/share/elasticsearch/bin/wait_until_started.sh - - name: searchguard-scripts - subPath: init_sg.sh - mountPath: /usr/share/elasticsearch/bin/init_sg.sh - - name: searchguard-config - mountPath: /usr/share/elasticsearch/config/sg - - name: searchguard-auth-config - mountPath: /usr/share/elasticsearch/config/sg/auth - name: elasticsearch-data mountPath: /usr/share/elasticsearch/data resources: @@ -126,16 +113,6 @@ spec: - name: elasticsearch-config configMap: name: {{ include "common.fullname" . }}-es-config - - name: searchguard-scripts - configMap: - name: {{ include "common.fullname" . }}-sg-scripts - defaultMode: 0754 - - name: searchguard-config - configMap: - name: {{ include "common.fullname" . }}-sg-config - - name: searchguard-auth-config - secret: - secretName: {{ include "common.fullname" . }}-sg-auth - name: elasticsearch-data hostPath: path: {{ .Values.persistence.mountPath }}/{{ .Release.Name }}/{{ .Values.persistence.mountSubPath }} diff --git a/components/aai-elasticsearch/templates/secrets.yaml b/components/aai-elasticsearch/templates/secrets.yaml deleted file mode 100644 index 34b272f..0000000 --- a/components/aai-elasticsearch/templates/secrets.yaml +++ /dev/null @@ -1,22 +0,0 @@ -# Copyright © 2018 Amdocs, Bell Canada, AT&T -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: Secret -metadata: - name: {{ include "common.fullname" . }}-sg-auth - namespace: {{ include "common.namespace" . }} -type: Opaque -data: -{{ tpl (.Files.Glob "resources/config/sg/auth/*").AsSecrets . | indent 2 }} \ No newline at end of file diff --git a/components/aai-elasticsearch/values.yaml b/components/aai-elasticsearch/values.yaml index 2cd835f..dff0703 100644 --- a/components/aai-elasticsearch/values.yaml +++ b/components/aai-elasticsearch/values.yaml @@ -19,7 +19,7 @@ global: # global defaults nodePortPrefix: 302 # application image -image: onap/elasticsearch-sg:1.5.1 +image: elasticsearch/elasticsearch:6.1.2 pullPolicy: Always restartPolicy: Always diff --git a/components/aai-search-data/resources/config/elastic-search.properties b/components/aai-search-data/resources/config/elastic-search.properties index 6232c14..65de20d 100644 --- a/components/aai-search-data/resources/config/elastic-search.properties +++ b/components/aai-search-data/resources/config/elastic-search.properties @@ -17,7 +17,7 @@ es.cluster-name=ES_AAI es.ip-address=aai-elasticsearch.{{.Release.Namespace}} es.http-port={{ .Values.config.elasticsearchHttpPort }} -es.uri-scheme=https +es.uri-scheme=http es.auth-user=admin es.auth-password=OBF:1u2a1toa1w8v1tok1u30 es.trust-store=auth/tomcat_keystore -- 2.16.6