From a1dd587d6a5204030bc266d371e6ec9fa7c95d7b Mon Sep 17 00:00:00 2001 From: Edwin Lawrance Date: Tue, 5 Mar 2019 10:30:33 +0000 Subject: [PATCH] Add Searchguard OOM config to ElasticSearch Change-Id: I3c4d0c82882b2f064a6ad3610c0f699d8af50632 Issue-ID: AAI-2203 Signed-off-by: Edwin Lawrance --- .../aai-elasticsearch/resources/bin/init_sg.sh | 11 + .../charts/aai-elasticsearch/resources/bin/run.sh | 8 + .../resources/bin/wait_until_started.sh | 9 + .../resources/config/elasticsearch.yml | 96 ++------ .../resources/config/sg/auth/esaai-keystore.jks | Bin 0 -> 3979 bytes .../resources/config/sg/auth/sgadmin-keystore.p12 | Bin 0 -> 4575 bytes .../resources/config/sg/auth/truststore.jks | Bin 0 -> 930 bytes .../resources/config/sg/sg_action_groups.yml | 137 +++++++++++ .../resources/config/sg/sg_config.yml | 221 +++++++++++++++++ .../resources/config/sg/sg_internal_users.yml | 45 ++++ .../resources/config/sg/sg_roles.yml | 262 +++++++++++++++++++++ .../resources/config/sg/sg_roles_mapping.yml | 38 +++ .../aai-elasticsearch/templates/configmap.yaml | 33 ++- .../aai-elasticsearch/templates/deployment.yaml | 37 ++- .../aai-elasticsearch/templates/secrets.yaml | 22 ++ .../aai-elasticsearch/templates/service.yaml | 21 +- .../aai/charts/aai-elasticsearch/values.yaml | 13 +- 17 files changed, 859 insertions(+), 94 deletions(-) create mode 100644 kubernetes/aai/charts/aai-elasticsearch/resources/bin/init_sg.sh create mode 100644 kubernetes/aai/charts/aai-elasticsearch/resources/bin/run.sh create mode 100644 kubernetes/aai/charts/aai-elasticsearch/resources/bin/wait_until_started.sh create mode 100644 kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/auth/esaai-keystore.jks create mode 100644 kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/auth/sgadmin-keystore.p12 create mode 100644 kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/auth/truststore.jks create mode 100644 kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_action_groups.yml create mode 100644 kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_config.yml create mode 100644 kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_internal_users.yml create mode 100644 kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_roles.yml create mode 100644 kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_roles_mapping.yml create mode 100644 kubernetes/aai/charts/aai-elasticsearch/templates/secrets.yaml diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/bin/init_sg.sh b/kubernetes/aai/charts/aai-elasticsearch/resources/bin/init_sg.sh new file mode 100644 index 0000000000..e85936570e --- /dev/null +++ b/kubernetes/aai/charts/aai-elasticsearch/resources/bin/init_sg.sh @@ -0,0 +1,11 @@ +#!/bin/sh + +/usr/share/elasticsearch/plugins/search-guard-6/tools/sgadmin.sh \ + -cd /usr/share/elasticsearch/config/sg \ + -ks /usr/share/elasticsearch/config/sg/auth/{{ .Values.config.adminKeyStore }} \ + -ts /usr/share/elasticsearch/config/sg/auth/{{ .Values.config.trustStore }} \ + -kspass {{ .Values.config.adminKeyStorePassword }} \ + -tspass {{ .Values.config.trustStorePassword}} \ + -nhnv \ + -icl \ + -p {{ .Values.service.internalPort2 }} \ No newline at end of file diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/bin/run.sh b/kubernetes/aai/charts/aai-elasticsearch/resources/bin/run.sh new file mode 100644 index 0000000000..a612c74a1c --- /dev/null +++ b/kubernetes/aai/charts/aai-elasticsearch/resources/bin/run.sh @@ -0,0 +1,8 @@ +#!/bin/sh + +# Wait for ES to start then initialize SearchGuard +/usr/local/bin/docker-entrypoint.sh eswrapper & +/usr/share/elasticsearch/bin/wait_until_started.sh +/usr/share/elasticsearch/bin/init_sg.sh + +wait \ No newline at end of file diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/bin/wait_until_started.sh b/kubernetes/aai/charts/aai-elasticsearch/resources/bin/wait_until_started.sh new file mode 100644 index 0000000000..279253b43d --- /dev/null +++ b/kubernetes/aai/charts/aai-elasticsearch/resources/bin/wait_until_started.sh @@ -0,0 +1,9 @@ +#!/bin/sh +RET=1 + +while [[ RET -ne 0 ]]; do + echo "Waiting for Elasticsearch to become ready before running sgadmin..." + curl -XGET -k "https://localhost:{{ .Values.service.internalPort }}/" >/dev/null 2>&1 + RET=$? + sleep 5 +done \ No newline at end of file diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/config/elasticsearch.yml b/kubernetes/aai/charts/aai-elasticsearch/resources/config/elasticsearch.yml index 24b3c5aefc..87536e3faa 100644 --- a/kubernetes/aai/charts/aai-elasticsearch/resources/config/elasticsearch.yml +++ b/kubernetes/aai/charts/aai-elasticsearch/resources/config/elasticsearch.yml @@ -192,7 +192,7 @@ network.bind_host: 0.0.0.0 # Set a custom port for the node to node communication (9300 by default): -transport.tcp.port: {{ .Values.config.tcpPort }} +transport.tcp.port: {{ .Values.service.internalPort2 }} # Enable compression for all communication between nodes (disabled by default): transport.tcp.compress: false @@ -368,77 +368,29 @@ discovery.zen.ping.unicast.hosts: ["0.0.0.0"] ### SEARCH GUARD SSL # ### Configuration # ############################################################################################### -## Uncomment all lines below prefixed with #X# (globally remove #X#) for searchguard -## -############################################################################################### -### Transport layer SSL # -### # -############################################################################################### -### Enable or disable node-to-node ssl encryption (default: true) -#X#searchguard.ssl.transport.enable_openssl_if_available: true -#X#searchguard.ssl.transport.enabled: true -### JKS or PKCS12 (default: JKS) -#X#searchguard.ssl.transport.keystore_type: JKS -### Relative path to the keystore file (mandatory, this stores the server certificates), must be placed under the config/ dir -#X#searchguard.ssl.transport.keystore_filepath: /some/path -### Alias name (default: first alias which could be found) -###searchguard.ssl.transport.keystore_alias: localhost -### Keystore password (default: changeit) -#X#searchguard.ssl.transport.keystore_password: changeit -## -### JKS or PKCS12 (default: JKS) -#X#searchguard.ssl.transport.truststore_type: JKS -### Relative path to the truststore file (mandatory, this stores the client/root certificates), must be placed under the config/ dir -#X#searchguard.ssl.transport.truststore_filepath: truststore.jks -### Alias name (default: first alias which could be found) -###searchguard.ssl.transport.truststore_alias: my_alias -### Truststore password (default: changeit) -#X#searchguard.ssl.transport.truststore_password: changeit -### Enforce hostname verification (default: true) -###searchguard.ssl.transport.enforce_hostname_verification: true -### If hostname verification specify if hostname should be resolved (default: true) -###searchguard.ssl.transport.resolve_hostname: true -### Use native Open SSL instead of JDK SSL if available (default: true) -###searchguard.ssl.transport.enable_openssl_if_available: false -## -############################################################################################### -### HTTP/REST layer SSL # -### # -############################################################################################### -### Enable or disable rest layer security - https, (default: false) -#X#searchguard.ssl.http.enable_openssl_if_available: true -#X#searchguard.ssl.http.enabled: true -### JKS or PKCS12 (default: JKS) -#X#searchguard.ssl.http.keystore_type: JKS -### Relative path to the keystore file (this stores the server certificates), must be placed under the config/ dir -#X#searchguard.ssl.http.keystore_filepath: /keystore/path -### Alias name (default: first alias which could be found) -###searchguard.ssl.http.keystore_alias: my_alias -### Keystore password (default: changeit) -#X#searchguard.ssl.http.keystore_password: changeit -### Do the clients (typically the browser or the proxy) have to authenticate themself to the http server, default is OPTIONAL -### To enforce authentication use REQUIRE, to completely disable client certificates use NONE -###searchguard.ssl.http.clientauth_mode: REQUIRE -### JKS or PKCS12 (default: JKS) -#X#searchguard.ssl.http.truststore_type: JKS -### Relative path to the truststore file (this stores the client certificates), must be placed under the config/ dir -#X#searchguard.ssl.http.truststore_filepath: truststore.jks -### Alias name (default: first alias which could be found) -###searchguard.ssl.http.truststore_alias: my_alias -### Truststore password (default: changeit) -#X#searchguard.ssl.http.truststore_password: changeit -### Use native Open SSL instead of JDK SSL if available (default: true) -###searchguard.ssl.http.enable_openssl_if_available: false - -##################################################### -##### Security manager - Searchguard Configuration -##################################################### -#X#security.manager.enabled: false -#X#searchguard.authcz.admin_dn: - -##################################################### -##### X-Pack Configuration -##################################################### +######## Start Search Guard Demo Configuration ######## + +searchguard.enterprise_modules_enabled: false + +searchguard.ssl.transport.keystore_filepath: sg/auth/{{ .Values.config.nodeKeyStore }} +searchguard.ssl.transport.keystore_password: {{ .Values.config.nodeKeyStorePassword }} +searchguard.ssl.transport.truststore_filepath: sg/auth/{{ .Values.config.trustStore }} +searchguard.ssl.transport.truststore_password: {{ .Values.config.trustStorePassword }} +searchguard.ssl.transport.enforce_hostname_verification: false + +searchguard.ssl.http.enabled: true +searchguard.ssl.http.keystore_filepath: sg/auth/{{ .Values.config.nodeKeyStore }} +searchguard.ssl.http.keystore_password: {{ .Values.config.nodeKeyStorePassword }} +searchguard.ssl.http.truststore_filepath: sg/auth/{{ .Values.config.trustStore }} +searchguard.ssl.http.truststore_password: {{ .Values.config.trustStorePassword }} + +searchguard.nodes_dn: + - CN=esaai + +searchguard.authcz.admin_dn: + - CN=sgadmin + +# x-pack security conflicts with searchguard xpack.security.enabled: false xpack.ml.enabled: false xpack.monitoring.enabled: false diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/auth/esaai-keystore.jks b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/auth/esaai-keystore.jks new file mode 100644 index 0000000000000000000000000000000000000000..21ec9bba97307c1879b022d50941919bb2d89e78 GIT binary patch literal 3979 zcmcK5c{r3^{{Zk=ZJ8NsgtE-YmfVwNQc*~jkZtUvGQ4uE9gkYfSEz_Ji-Fc=PkkzsQUe3!gSX0PY? z%}o$YWM5EZPx&XNdA)Z{(~=qDu8c$AT}y|$Mh;s;U zV6&DhE5L4+1&BYZ;1$YbZ>ml2lt}wM^9;7(^?|!{dZ%@Grvxoj%QMc1KG*Bwn#>e zdE12&?ufxk*yUChLuDVEh9;;jCSjT$pN?>TpfU)Ym8InkrQX&Q2qK30i9G8=c@N@O z+-|M(t?Yob)0%tpu8=a^V&8l?yS`QyDb*vLbmZd|T95K{la-!1d#?@=<_-pFi6l4X zwgrxdCKbxZmncL#X1I;jr0ZUr9dS18p2fCW46nZD(*WHYhe$stPn}6#eO4ze)~Nn0 zTer)~2=V9On-Z0_{vd5#6Wa4`dGyDYgK@3G6YKZZ6_Zf;AN7h?ZM;8w+`cW)1vFob z)BJ3>!=ZO+h3LW1>VJW$D2hJ;k_sFc7W!P;-M_fpFK>Nw*8*!3^HIjsD|F1<#tk89 z7%$yjcHrf6{ns*sU%w_1G&5;)S9NL^mzG~N8b!;9to5zImo<*B2GOY6Jt$?nd0L8t zk;a|;?a2wFjNfgCqR|6%Wz-YCbq;O!Z%#FD4ifL1(jPvwH#}5Y?deQy_fp*6>b;x- z);=n7yhfy`az4pwchzk}x?%UfE?xN}nVgy&Ea9mhkjWJQUf?~4>VI(b)gP4>3J2_v z(}o3I^=*FQgspeAcpSu$Gn$~HvCAID$Uq_j5}nF?<_hoak}0Rn1T}I zH%BE1enx?xd9_b!Y_tlhjLJ)}Zakk9?|90|-P=%lvCHQ^Km4SM+R|J&quV)PhEzJ2 zUUe!^B$j@aE~bB9ZcB%Iy$2lTKE07_kUvPh-;{^)GT)5rllcu3vLdDQ#EuJhuy_^7|7~kPEjy6}4Jn`YQ0%NUF zC4+P?@Os!5ZtYP_Q?x33-i*+OJNaaI5Bz0^>*GiaE^Kp|7nqJ1{4}NSfev7gIf3wt zl_l90{_*vi_T_kz*?=NlbI2s+f-{u!fbUo3xvrfm^K_DKrM=3d7RkOGZQGE28Rw%) z0uL`(@@2PgAJjkYQ@C=8yKkvWOH;ecr;wPp_~B9Ph8c|i?*1)fp)pG4Z+@Ud2+@^Je3C#m7p-xntDF1RKtig~ZDUHEzQ{?C*ro*^HMs|15Xvz_sGzNmW}JTMu- z3c=OdikW946a=?Astl+ydu{+3>I9G>hWStk7yeb6i7vwq5EwLuvMYV-j{-5?zCoDiUP-(a1Urnmw*&#;7uNO*cW}S=g=lGP6c8F=rz6 zZpJvTB;M$9=F8oy@jhnXu4m@REvljD*6$_Ww^))6+o*P~*wf9D%()$$=4BH&AqpuF z{&ah1{VyWujSdXnesW}qc=TnSbB%1O5|Z|mslU?Ke1mv%!sn!!{$sC zl-|D&OVV;eexOl`gCkNyGZojbJ?yb`Gi!%+#yb((%XJ!7Lp)IsC>R7TjJyp*rZBHF zDE=S{4Bmyopb&UIz`hsr!XN+$IJno9gzX3TSlF0X9vsdJ1^>MV`7w-y?T7I>``;K) zKRaMs9!$L9RCxi(?Q{nKME7Q+Va$q0@aa(F=Fb{y=W4zv(HFkHdNYW7Bm@xHdx0Cq z1t7^k>J|r=g~H(Qzm|@79TUkzaiZr^g8O7mO^zGjlP!JnY>KCg^c>-z z4jFA>0_2^(!wR9#O%tKd6IqY;)A5nlXB#joj8^H( z;a>HaD1NDgYMJw9W6n>XARBvhyQq{WGN_g`L-*E0V#=4_PbLMe#~r^QZT*sa3| z4lR+}uDfu-=!LTV&C(@B>L)OcJt23smI_$it)uenF?#8G(Gz2%78>(*vXTUuGm}xX zL27XUNpnwk3+6yTwBkY^e|K!+Kg=<`K^>Up^nRLy{IXnt+OOvL0bb@xGtF^+H)rbQ z<+lg!XBzs?>0h)d?rGb@_d}ba&HoMQ{{-}j-9*;ca}ToQU5C!=K4_03khpy*Zae}$ z$z@7guk;l7yd?TLoOIhnA*t1UpQX0N<#aqXOJ7Yl8xbA&qT4x2YCEAtjjD+0p)~cm zdryOOA&Ks&SwDa;v7Pif ze={qW-CQE#RJ``m9ATv5R$eu4LG6s;51`I~<3IBRvj9AMXn6OyvH>j22L$}n>34|# z*4bYnlCpvkZ7aRY{pV+n)TK1Fbr9U9DFjZ^1*ao@7VF!HI__JdRr z*U7H|L_5WWm?mTMX!fhYq(O>F9ef+T^AB%!Om9|9Z)bjb1OKvI|KHyJmz@8Tv>`2{ z)mt~VYXRX+>yJ+Pp_T6V%haM*gTqJjidBvE9}>C-oSooSV+esTLtaUGJW!I>wVnk$v*NYv{z=GWrj#!Cvyq!pUGFaTj^GH}`MXM9cC-q5v^m#+pTZmdTM5>x>{oUh6duIlil4MG;&d6H#(z-o56Fi z^IjmupUg6C`8L2{l79D$_Lp`SlkUacWmV7sfXi4zub5KR?+{2nbgpi)<@rns5cv%G2cjntrKEPI1F3@sa9peYxn1J+%lTL)+S7B2Qhk(_2ZsE~i`jX8r z>7cr^1B9B(Xd6@@A&{ag&AJxAsJCFJr*T=dI>Ec(EXK*w)3kK8{Bw>rvF1z99o&Qt zo9~7sHE)ZNVvlX{GxB|19T|`&szG!dUtqexD`9fHLk;DWskM08cDIPJZyRl5_zR0}F;EO~=9KjDkm95o6$Da^9EI_w55DDzer&94)!9yfBeROC=V0`B%ZkiQrKeP!^fcDI`zfu6EMKqer&7FJJj!EY?3S|Bzugtxoyd2279BiuEem7oibo>TCx<-L%B6_Y%MIyg z{T|E9EGL}EZgKC2{|G@abABuKWC51S5nAsYH81I0d2MG#k9?zL9_Sr>od@nyKb~~& z=Ae>8Iv|hoA567)%c4D?-3_VI?8ep@1=r-k{6~}{a!J`(#uiAULlC-Y4lm%A8R3>l ze$$vMjq5C`meVZ>^`g9MR{!4aub5z3?oitGr*W2FF2It@k0hGW=6 zEog*3Lk$vCBJgVeY1M8hHztk2vYHV5H=*f78(|Mn)bU*&st9bAr$yOEPs{9pY{4EL zD+HN28t@LPuUQba zUwoM4Ip)G@j5AC@#UO9&oVBbk-z2Jy#+t@wUa5AyjlMN3W!g*o9{EB2mY$&X3@Oui zTADaSE~|RQ0h?`?z6P5C+x^h9zVv5plJyX~H%akm?k;$5fHxo)s6cjFml&}|rM|A?=aVN-}{EHhwKx1`* z^;Grv56e$|TKG<{8a+?_pwexdvqhZ-ZA4n-jXI$-Eosu9m0zQ{(7(l*gg0D1y=&E3 zbq!pWCcL~=cl8QNY&Oay!KU`|iW@B%F1DNW?1-te1t>}K4~WeGhT!d@ghn~rmL~{3e|3dzmP6e(klJ}#4q3VrIKyNs{l~p zmehU)Lw+Imb4pGwvL;NYat+2u=uFD>H_voQQ3R3OYJ+D8~}6ZPm`d94r^m|jg-;5ZFPG!vsGCVk)4V+U4`_4vY#HlJPzUO)*+j5%AZ%_hr^)%MkGEtKP5dm;5EPn zAO-LM*a0j7)&OUK1Hc6a`A><0pBxC*b8xm{3?qO^oDw{*{v?64pf$`+gqhVxZf5P(g?Vc0kBz31_Z#BHHYG-) zv}H-WGjAiJT8}kpFgXUzn#&CyR{crJKWhIuq4 z89LJXq9kKDgS|;2RmAH#g%gjUKbhd+B_$EMCcbIKOuzF3h0~~H4mb&mvsq+9@P{)< zu5LwfO+Fbp{d^a$K=HD)p37Ruc9C~Gz>d5aJ}EW4#o+i4-|U|gbrnW>tGFnRIZ>hm zGF@C5xao<2Ph$un_ki|_Q?}mdJ?dLp>iIW~74ZjAX0 zYjROilTtC3X7e8e8HR}AI+d1siP5}#U<5@>^NzPBFb&gkv~l=+N9i@&X++kIK_;#x=O6iIY~g zNzcQVteInn8C@49bXn~kEk8Nk*9DgRct*>$0tc^BAFi<` z=_F5<&Q#~xSre}te<8|&s>K~2*V??XO&%lf5=lg4Z!{;;d$b?PEAWBVWU{W}RffT@ zb;3I;5?^+_tn0{CV%u{&M_?tCP!F?tuNQFU>sDiYZBx9XJ*}*S@h$(kw6v??lGO#CEp9zrtj_Z_2Krb7mI2c-lSPZJo366Px!V7bY zckdm(n+gm7L@B zehSu#w{@G=gmmG8e^a=Fm9wQvY>Mz4y@sa)UB;Z0KIRUpCcP}TPf8FEKXfgqlul3k*5vFmB=HJOuz4p-)a|@T}r-P1uycgB{$sXrzEayXpY2&Bz&lcR+0Jl zBibG=Oo^-2xNdV?oP6>uzK{1-QOXy>OE4<&UN_$#@QU>pK1d}R>G-ysIr&-`h)i3R zPgtjFa86qP`NvKDt&k%PO*>%5JzchI(>QY3jOntg>77{`{DDAzDaLeR_62U}Cw&^< zVy)zUGKSG~nRn?<_iQEo>bX-B5^siOs!o1ptUA)W)DW!)EE7bxpO(&q9)*Ar!_e`5 z5s5naOm3JVZHy#{<1Hx{MUp%9^!#O=){2z>mVV08H(;{@s%&cU(az`Xk4GvhrO}mP zsjv2XqJ3@z@DVSIfmSUUNvA?zs6x5+c;4)TH*I3D3kyny#DW zenaW3WGzSW5fAxM9>o>J^u~>|Ha}s}!IpJ$hlg)S z{XM~iBXo88b2X&2F@$?6BTaG^{Dw^C6o1S;b&^0`Hq zYb_#0gfDzQc!bd2uA~e#Z&bbBG00vj1sqN7vt2EzgF4}VOf9MxwpRsmFVXMIH1lPw zE$A4gGgh1%Ts&ON$tkyTNY)Lo@CaDZf-st7NEu+1Z$12Ong^il4AOO(`93nNS(n7# z$EI0I*QslIE^n6|(B{DA4>d{FZ(hvG7m!7)?~fE~3W2U4nRJc3E~P_mjJangVYRKd0-IhqIz5AVN0PRi5klQUrZywd>3 z0gUF1h_~vdjjtc-qgzK;+VrGV8(T7d!nX^nw@s?**~+F_NVO+2KMm~^#QZ$Fg#_WI z+um9TNQ=4UrlIJk=69_7$*9%>dGAwx*?qi5v{{DL5}*&?lu|oKzx({fa?}KcsRBLo zN3qt|B+7bCqaRJdDB#fPPHy?tHanWbUR*9D^Gh1M@!R;j{E3=DRVxi0g6HE)?u9TK z9=_x0+L06v$Gy_-2KtJ3^Cf}%wNU|rX~a6Ox}S+t4n;07n1c;rw8@Dj+2ev zMNvQc1U}qHIKf?R6(=jHTNrsGCnZ1Iv2?O3-NKN(+RV2CuI58e9SEuXgHUkGjb8d8)clnFQD^ z7P_u;p+QLWRPwTgU%!!g`OLiiM{cH+NRh(S8dlzUPqWSHA6BF&(6u|Qu)EzST`=fN zv~}_gjXm%=^U{Q15(Nw;o+01;T{uevYIN)G$+klF7=Mr3?;0qVF+btlgl>a-MTOs;6uzdAOS~Gnrw8k<-1#w)bqGWr-vy@meOz5#lEp zj2Q+Qx7x2_>nEXV*zEG=)Jb{$6SlJjQJeC^72Md;wx5WwMbG`ZdNvpX9p*6stX?KK zDh~H4{nqd0>~eQc%0Dbny!nYm8ia{uYtrgtF>wK06A)vK5EFOC=^I+%1g~L50Vyt! z4Xlf?RY*WrE*b=u48#Za=j7vrI}j*^k^18zM?7>cF}k)P&h5NDER?(}F?C)Npew=% zpQiO10mNf0pkCU*%tmX+e%H8x@z+v2WoTLGfPi`n1`o zdhGGhjnj!i=to~GCQaWnjEF-09(1)NbZRvnZ8u=jFbE7E2b=2&7UnZ-0Fbi9FS88r+8ul1d@8f; zb)GkeU;e+_EUj`{G@kPB}Babb0t|i%s4rR zKYPat<9U3>y}fsKfBtY*DVD!+3th<^Co#UN`D2vz=ZW>QFkJO9Z! zWm0?BF8@B$psT#wLxcTm+1(vsoL8m_gdI#}J;BNrFiGRt^69n<+)|?2Lf&0S%#>0K z`Cm10?_Y)7HlyF7cNY|Aq}*lNGt;M~L!^AV_*Lnq&crR01)8GZMrOPMp5D)nEO5Wqt&cBh@Yz-%F6RkF7x#|u8__k-F literal 0 HcmV?d00001 diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_action_groups.yml b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_action_groups.yml new file mode 100644 index 0000000000..be5901a559 --- /dev/null +++ b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_action_groups.yml @@ -0,0 +1,137 @@ +UNLIMITED: + readonly: true + permissions: + - "*" + +###### INDEX LEVEL ###### + +INDICES_ALL: + readonly: true + permissions: + - "indices:*" + +# for backward compatibility +ALL: + readonly: true + permissions: + - INDICES_ALL + +MANAGE: + readonly: true + permissions: + - "indices:monitor/*" + - "indices:admin/*" + +CREATE_INDEX: + readonly: true + permissions: + - "indices:admin/create" + - "indices:admin/mapping/put" + +MANAGE_ALIASES: + readonly: true + permissions: + - "indices:admin/aliases*" + +# for backward compatibility +MONITOR: + readonly: true + permissions: + - INDICES_MONITOR + +INDICES_MONITOR: + readonly: true + permissions: + - "indices:monitor/*" + +DATA_ACCESS: + readonly: true + permissions: + - "indices:data/*" + - CRUD + +WRITE: + readonly: true + permissions: + - "indices:data/write*" + - "indices:admin/mapping/put" + +READ: + readonly: true + permissions: + - "indices:data/read*" + - "indices:admin/mappings/fields/get*" + +DELETE: + readonly: true + permissions: + - "indices:data/write/delete*" + +CRUD: + readonly: true + permissions: + - READ + - WRITE + +SEARCH: + readonly: true + permissions: + - "indices:data/read/search*" + - "indices:data/read/msearch*" + - SUGGEST + +SUGGEST: + readonly: true + permissions: + - "indices:data/read/suggest*" + +INDEX: + readonly: true + permissions: + - "indices:data/write/index*" + - "indices:data/write/update*" + - "indices:admin/mapping/put" + - "indices:data/write/bulk*" + +GET: + readonly: true + permissions: + - "indices:data/read/get*" + - "indices:data/read/mget*" + +###### CLUSTER LEVEL ###### + +CLUSTER_ALL: + readonly: true + permissions: + - "cluster:*" + +CLUSTER_MONITOR: + readonly: true + permissions: + - "cluster:monitor/*" + +CLUSTER_COMPOSITE_OPS_RO: + readonly: true + permissions: + - "indices:data/read/mget" + - "indices:data/read/msearch" + - "indices:data/read/mtv" + - "indices:data/read/coordinate-msearch*" + - "indices:admin/aliases/exists*" + - "indices:admin/aliases/get*" + - "indices:data/read/scroll" + +CLUSTER_COMPOSITE_OPS: + readonly: true + permissions: + - "indices:data/write/bulk" + - "indices:admin/aliases*" + - "indices:data/write/reindex" + - CLUSTER_COMPOSITE_OPS_RO + +MANAGE_SNAPSHOTS: + readonly: true + permissions: + - "cluster:admin/snapshot/*" + - "cluster:admin/repository/*" \ No newline at end of file diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_config.yml b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_config.yml new file mode 100644 index 0000000000..3fefe1690d --- /dev/null +++ b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_config.yml @@ -0,0 +1,221 @@ +# This is the main Search Guard configuration file where authentication +# and authorization is defined. +# +# You need to configure at least one authentication domain in the authc of this file. +# An authentication domain is responsible for extracting the user credentials from +# the request and for validating them against an authentication backend like Active Directory for example. +# +# If more than one authentication domain is configured the first one which succeeds wins. +# If all authentication domains fail then the request is unauthenticated. +# In this case an exception is thrown and/or the HTTP status is set to 401. +# +# After authentication authorization (authz) will be applied. There can be zero or more authorizers which collect +# the roles from a given backend for the authenticated user. +# +# Both, authc and auth can be enabled/disabled separately for REST and TRANSPORT layer. Default is true for both. +# http_enabled: true +# transport_enabled: true +# +# 5.x Migration: "enabled: true/false" will also be respected currently but only to provide backward compatibility. +# +# For HTTP it is possible to allow anonymous authentication. If that is the case then the HTTP authenticators try to +# find user credentials in the HTTP request. If credentials are found then the user gets regularly authenticated. +# If none can be found the user will be authenticated as an "anonymous" user. This user has always the username "sg_anonymous" +# and one role named "sg_anonymous_backendrole". +# If you enable anonymous authentication all HTTP authenticators will not challenge. +# +# +# Note: If you define more than one HTTP authenticators make sure to put non-challenging authenticators like "proxy" or "clientcert" +# first and the challenging one last. +# Because it's not possible to challenge a client with two different authentication methods (for example +# Kerberos and Basic) only one can have the challenge flag set to true. You can cope with this situation +# by using pre-authentication, e.g. sending a HTTP Basic authentication header in the request. +# +# Default value of the challenge flag is true. +# +# +# HTTP +# basic (challenging) +# proxy (not challenging, needs xff) +# kerberos (challenging) NOT FREE FOR COMMERCIAL +# clientcert (not challenging, needs https) +# jwt (not challenging) NOT FREE FOR COMMERCIAL +# host (not challenging) #DEPRECATED, will be removed in a future version. +# host based authentication is configurable in sg_roles_mapping + +# Authc +# internal +# noop +# ldap NOT FREE FOR COMMERCIAL USE + +# Authz +# ldap NOT FREE FOR COMMERCIAL USE +# noop + +searchguard: + dynamic: + # Set filtered_alias_mode to 'disallow' to forbid more than 2 filtered aliases per index + # Set filtered_alias_mode to 'warn' to allow more than 2 filtered aliases per index but warns about it (default) + # Set filtered_alias_mode to 'nowarn' to allow more than 2 filtered aliases per index silently + #filtered_alias_mode: warn + #kibana: + # Kibana multitenancy - NOT FREE FOR COMMERCIAL USE + # see https://github.com/floragunncom/search-guard-docs/blob/master/multitenancy.md + # To make this work you need to install https://github.com/floragunncom/search-guard-module-kibana-multitenancy/wiki + #multitenancy_enabled: true + #server_username: kibanaserver + #index: '.kibana' + #do_not_fail_on_forbidden: false + http: + anonymous_auth_enabled: false + xff: + enabled: false + internalProxies: '192\.168\.0\.10|192\.168\.0\.11' # regex pattern + #internalProxies: '.*' # trust all internal proxies, regex pattern + remoteIpHeader: 'x-forwarded-for' + proxiesHeader: 'x-forwarded-by' + #trustedProxies: '.*' # trust all external proxies, regex pattern + ###### see https://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html for regex help + ###### more information about XFF https://en.wikipedia.org/wiki/X-Forwarded-For + ###### and here https://tools.ietf.org/html/rfc7239 + ###### and https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Remote_IP_Valve + authc: + kerberos_auth_domain: + http_enabled: false + transport_enabled: false + order: 6 + http_authenticator: + type: kerberos # NOT FREE FOR COMMERCIAL USE + challenge: true + config: + # If true a lot of kerberos/security related debugging output will be logged to standard out + krb_debug: false + # If true then the realm will be stripped from the user name + strip_realm_from_principal: true + authentication_backend: + type: noop + basic_internal_auth_domain: + http_enabled: true + transport_enabled: true + order: 2 + http_authenticator: + type: basic + challenge: true + authentication_backend: + type: intern + proxy_auth_domain: + http_enabled: false + transport_enabled: false + order: 3 + http_authenticator: + type: proxy + challenge: false + config: + user_header: "x-proxy-user" + roles_header: "x-proxy-roles" + authentication_backend: + type: noop + jwt_auth_domain: + http_enabled: false + transport_enabled: false + order: 0 + http_authenticator: + type: jwt + challenge: false + config: + signing_key: "base64 encoded HMAC key or public RSA/ECDSA pem key" + jwt_header: "Authorization" + jwt_url_parameter: null + roles_key: null + subject_key: null + authentication_backend: + type: noop + clientcert_auth_domain: + http_enabled: true + transport_enabled: true + order: 1 + http_authenticator: + type: clientcert + config: + username_attribute: cn #optional, if omitted DN becomes username + challenge: false + authentication_backend: + type: noop + ldap: + http_enabled: false + transport_enabled: false + order: 5 + http_authenticator: + type: basic + challenge: false + authentication_backend: + # LDAP authentication backend (authenticate users against a LDAP or Active Directory) + type: ldap # NOT FREE FOR COMMERCIAL USE + config: + # enable ldaps + enable_ssl: false + # enable start tls, enable_ssl should be false + enable_start_tls: false + # send client certificate + enable_ssl_client_auth: false + # verify ldap hostname + verify_hostnames: true + hosts: + - localhost:8389 + bind_dn: null + password: null + userbase: 'ou=people,dc=example,dc=com' + # Filter to search for users (currently in the whole subtree beneath userbase) + # {0} is substituted with the username + usersearch: '(sAMAccountName={0})' + # Use this attribute from the user as username (if not set then DN is used) + username_attribute: null + authz: + roles_from_myldap: + http_enabled: false + transport_enabled: false + authorization_backend: + # LDAP authorization backend (gather roles from a LDAP or Active Directory, you have to configure the above LDAP authentication backend settings too) + type: ldap # NOT FREE FOR COMMERCIAL USE + config: + # enable ldaps + enable_ssl: false + # enable start tls, enable_ssl should be false + enable_start_tls: false + # send client certificate + enable_ssl_client_auth: false + # verify ldap hostname + verify_hostnames: true + hosts: + - localhost:8389 + bind_dn: null + password: null + rolebase: 'ou=groups,dc=example,dc=com' + # Filter to search for roles (currently in the whole subtree beneath rolebase) + # {0} is substituted with the DN of the user + # {1} is substituted with the username + # {2} is substituted with an attribute value from user's directory entry, of the authenticated user. Use userroleattribute to specify the name of the attribute + rolesearch: '(member={0})' + # Specify the name of the attribute which value should be substituted with {2} above + userroleattribute: null + # Roles as an attribute of the user entry + userrolename: disabled + #userrolename: memberOf + # The attribute in a role entry containing the name of that role, Default is "name". + # Can also be "dn" to use the full DN as rolename. + rolename: cn + # Resolve nested roles transitive (roles which are members of other roles and so on ...) + resolve_nested_roles: true + userbase: 'ou=people,dc=example,dc=com' + # Filter to search for users (currently in the whole subtree beneath userbase) + # {0} is substituted with the username + usersearch: '(uid={0})' + # Skip users matching a user name, a wildcard or a regex pattern + #skip_users: + # - 'cn=Michael Jackson,ou*people,o=TEST' + # - '/\S*/' + roles_from_another_ldap: + enabled: false + authorization_backend: + type: ldap # NOT FREE FOR COMMERCIAL USE + #config goes here ... diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_internal_users.yml b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_internal_users.yml new file mode 100644 index 0000000000..942a7164aa --- /dev/null +++ b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_internal_users.yml @@ -0,0 +1,45 @@ +# This is the internal user database +# The hash value is a bcrypt hash and can be generated with plugin/tools/hash.sh + +#password is: admin +admin: + readonly: true + hash: $2a$12$VcCDgh2NDk07JGN0rjGbM.Ad41qVR/YFJcgHp0UGns5JDymv..TOG + roles: + - admin + attributes: + #no dots allowed in attribute names + attribute1: value1 + attribute2: value2 + attribute3: value3 + +#password is: logstash +logstash: + hash: $2a$12$u1ShR4l4uBS3Uv59Pa2y5.1uQuZBrZtmNfqB3iM/.jL0XoV9sghS2 + roles: + - logstash + +#password is: kibanaserver +kibanaserver: + readonly: true + hash: $2a$12$4AcgAt3xwOWadA5s5blL6ev39OXDNhmOesEoo33eZtrq2N0YrU3H. + +#password is: kibanaro +kibanaro: + hash: $2a$12$JJSXNfTowz7Uu5ttXfeYpeYE0arACvcwlPBStB1F.MI7f0U9Z4DGC + roles: + - kibanauser + - readall + +#password is: readall +readall: + hash: $2a$12$ae4ycwzwvLtZxwZ82RmiEunBbIPiAmGZduBAjKN0TXdwQFtCwARz2 + #password is: readall + roles: + - readall + +#password is: snapshotrestore +snapshotrestore: + hash: $2y$12$DpwmetHKwgYnorbgdvORCenv4NAK8cPUg8AI6pxLCuWf/ALc0.v7W + roles: + - snapshotrestore \ No newline at end of file diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_roles.yml b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_roles.yml new file mode 100644 index 0000000000..c918e851f1 --- /dev/null +++ b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_roles.yml @@ -0,0 +1,262 @@ +# Allows everything, but no changes to searchguard configuration index +sg_all_access: + readonly: true + cluster: + - UNLIMITED + indices: + '*': + '*': + - UNLIMITED + tenants: + admin_tenant: RW + +# Read all, but no write permissions +sg_readall: + readonly: true + cluster: + - CLUSTER_COMPOSITE_OPS_RO + indices: + '*': + '*': + - READ + +# Read all and monitor, but no write permissions +sg_readall_and_monitor: + cluster: + - CLUSTER_MONITOR + - CLUSTER_COMPOSITE_OPS_RO + indices: + '*': + '*': + - READ + +# For users which use kibana, access to indices must be granted separately +sg_kibana_user: + readonly: true + cluster: + - INDICES_MONITOR + - CLUSTER_COMPOSITE_OPS + indices: + '?kibana': + '*': + - MANAGE + - INDEX + - READ + - DELETE + '?kibana-6': + '*': + - MANAGE + - INDEX + - READ + - DELETE + '?kibana_*': + '*': + - MANAGE + - INDEX + - READ + - DELETE + '?tasks': + '*': + - INDICES_ALL + '?management-beats': + '*': + - INDICES_ALL + '*': + '*': + - indices:data/read/field_caps* + - indices:data/read/xpack/rollup* + - indices:admin/mappings/get* + - indices:admin/get + +# For the kibana server +sg_kibana_server: + readonly: true + cluster: + - CLUSTER_MONITOR + - CLUSTER_COMPOSITE_OPS + - cluster:admin/xpack/monitoring* + - indices:admin/template* + - indices:data/read/scroll* + indices: + '?kibana': + '*': + - INDICES_ALL + '?kibana-6': + '*': + - INDICES_ALL + '?kibana_*': + '*': + - INDICES_ALL + '?reporting*': + '*': + - INDICES_ALL + '?monitoring*': + '*': + - INDICES_ALL + '?tasks': + '*': + - INDICES_ALL + '?management-beats*': + '*': + - INDICES_ALL + '*': + '*': + - "indices:admin/aliases*" + +# For logstash and beats +sg_logstash: + cluster: + - CLUSTER_MONITOR + - CLUSTER_COMPOSITE_OPS + - indices:admin/template/get + - indices:admin/template/put + indices: + 'logstash-*': + '*': + - CRUD + - CREATE_INDEX + '*beat*': + '*': + - CRUD + - CREATE_INDEX + +# Allows adding and modifying repositories and creating and restoring snapshots +sg_manage_snapshots: + cluster: + - MANAGE_SNAPSHOTS + indices: + '*': + '*': + - "indices:data/write/index" + - "indices:admin/create" + +# Allows each user to access own named index +sg_own_index: + cluster: + - CLUSTER_COMPOSITE_OPS + indices: + '${user_name}': + '*': + - INDICES_ALL + +### X-Pack COMPATIBILITY +sg_xp_monitoring: + readonly: true + cluster: + - cluster:monitor/xpack/info + - cluster:monitor/main + - cluster:admin/xpack/monitoring/bulk + indices: + '?monitor*': + '*': + - INDICES_ALL + +sg_xp_alerting: + readonly: true + cluster: + - indices:data/read/scroll + - cluster:admin/xpack/watcher* + - cluster:monitor/xpack/watcher* + indices: + '?watches*': + '*': + - INDICES_ALL + '?watcher-history-*': + '*': + - INDICES_ALL + '?triggered_watches': + '*': + - INDICES_ALL + '*': + '*': + - READ + - indices:admin/aliases/get + +sg_xp_machine_learning: + readonly: true + cluster: + - cluster:admin/persistent* + - cluster:internal/xpack/ml* + - indices:data/read/scroll* + - cluster:admin/xpack/ml* + - cluster:monitor/xpack/ml* + indices: + '*': + '*': + - READ + - indices:admin/get* + '?ml-*': + '*': + - "*" + +### LEGACY ROLES, FOR COMPATIBILITY ONLY +### WILL BE REMOVED IN SG7, DO NOT USE ANYMORE + +sg_readonly_and_monitor: + cluster: + - CLUSTER_MONITOR + - CLUSTER_COMPOSITE_OPS_RO + indices: + '*': + '*': + - READ + +# Make xpack monitoring work +sg_monitor: + cluster: + - cluster:admin/xpack/monitoring/* + - cluster:admin/ingest/pipeline/put + - cluster:admin/ingest/pipeline/get + - indices:admin/template/get + - indices:admin/template/put + - CLUSTER_MONITOR + - CLUSTER_COMPOSITE_OPS + indices: + '?monitor*': + '*': + - INDICES_ALL + '?marvel*': + '*': + - INDICES_ALL + '?kibana*': + '*': + - READ + '*': + '*': + - indices:data/read/field_caps + +# Make xpack alerting work +sg_alerting: + cluster: + - indices:data/read/scroll + - cluster:admin/xpack/watcher/watch/put + - cluster:admin/xpack/watcher* + - CLUSTER_MONITOR + - CLUSTER_COMPOSITE_OPS + indices: + '?kibana*': + '*': + - READ + '?watches*': + '*': + - INDICES_ALL + '?watcher-history-*': + '*': + - INDICES_ALL + '?triggered_watches': + '*': + - INDICES_ALL + '*': + '*': + - READ + + +sg_role_test: + cluster: + - indices:admin/template/get + - indices:admin/template/put + - CLUSTER_COMPOSITE_OPS + indices: + '*': + '*': + - UNLIMITED diff --git a/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_roles_mapping.yml b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_roles_mapping.yml new file mode 100644 index 0000000000..970e02763b --- /dev/null +++ b/kubernetes/aai/charts/aai-elasticsearch/resources/config/sg/sg_roles_mapping.yml @@ -0,0 +1,38 @@ +# In this file users, backendroles and hosts can be mapped to Search Guard roles. +# Permissions for Search Guard roles are configured in sg_roles.yml + +sg_all_access: + readonly: true + backendroles: + - admin + +sg_logstash: + backendroles: + - logstash + +sg_kibana_server: + readonly: true + users: + - kibanaserver + +sg_kibana_user: + backendroles: + - kibanauser + +sg_readall: + readonly: true + backendroles: + - readall + +sg_manage_snapshots: + readonly: true + backendroles: + - snapshotrestore + +sg_own_index: + users: + - '*' + +sg_role_test: + users: + - test diff --git a/kubernetes/aai/charts/aai-elasticsearch/templates/configmap.yaml b/kubernetes/aai/charts/aai-elasticsearch/templates/configmap.yaml index c60b8f2da8..4be124fc0f 100644 --- a/kubernetes/aai/charts/aai-elasticsearch/templates/configmap.yaml +++ b/kubernetes/aai/charts/aai-elasticsearch/templates/configmap.yaml @@ -1,5 +1,4 @@ -# Copyright © 2017 Amdocs, Bell Canada -# Modifications Copyright © 2018 AT&T +# Copyright © 2018 Amdocs, Bell Canada, AT&T # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -13,11 +12,10 @@ # See the License for the specific language governing permissions and # limitations under the License. -#{{ if not .Values.disableAaiElasticsearch }} apiVersion: v1 kind: ConfigMap metadata: - name: {{ include "common.fullname" . }} + name: {{ include "common.fullname" . }}-es-config namespace: {{ include "common.namespace" . }} labels: app: {{ include "common.name" . }} @@ -26,4 +24,29 @@ metadata: heritage: {{ .Release.Service }} data: {{ tpl (.Files.Glob "resources/config/*").AsConfig . | indent 2 }} -#{{ end }} +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "common.fullname" . }}-sg-scripts + namespace: {{ include "common.namespace" . }} + labels: + app: {{ include "common.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +data: +{{ tpl (.Files.Glob "resources/bin/*").AsConfig . | indent 2 }} +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "common.fullname" . }}-sg-config + namespace: {{ include "common.namespace" . }} + labels: + app: {{ include "common.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +data: +{{ tpl (.Files.Glob "resources/config/sg/*").AsConfig . | indent 2 }} diff --git a/kubernetes/aai/charts/aai-elasticsearch/templates/deployment.yaml b/kubernetes/aai/charts/aai-elasticsearch/templates/deployment.yaml index 14b896e272..785693a9ba 100644 --- a/kubernetes/aai/charts/aai-elasticsearch/templates/deployment.yaml +++ b/kubernetes/aai/charts/aai-elasticsearch/templates/deployment.yaml @@ -34,6 +34,7 @@ spec: release: {{ .Release.Name }} name: {{ include "common.name" . }} spec: + hostname: {{ include "common.name" . }} initContainers: - command: - /bin/sh @@ -53,18 +54,18 @@ spec: securityContext: privileged: true image: {{ .Values.global.dockerhubRepository | default .Values.dockerhubRepository }}/{{ .Values.global.busyboxImage | default .Values.busyboxImage }} - imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} + imagePullPolicy: {{ .Values.pullPolicy | default .Values.global.pullPolicy }} name: init-sysctl volumeMounts: - name: elasticsearch-data mountPath: /logroot/ - hostname: {{ include "common.name" . }} containers: - name: {{ include "common.name" . }} - image: {{ .Values.global.loggingRepository | default .Values.loggingRepository }}/{{ .Values.image }} - imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }} + image: "{{ include "common.repository" . }}/{{ .Values.image }}" + imagePullPolicy: {{ .Values.pullPolicy | default .Values.global.pullPolicy }} ports: - containerPort: {{ .Values.service.internalPort }} + - containerPort: {{ .Values.service.internalPort2 }} # disable liveness probe when breakpoints set in debugger # so K8s doesn't restart unresponsive container {{- if eq .Values.liveness.enabled true }} @@ -92,10 +93,23 @@ spec: - name: elasticsearch-config subPath: log4j2.properties mountPath: /usr/share/elasticsearch/config/log4j2.properties + - name: searchguard-scripts + subPath: run.sh + mountPath: /usr/share/elasticsearch/bin/run.sh + - name: searchguard-scripts + subPath: wait_until_started.sh + mountPath: /usr/share/elasticsearch/bin/wait_until_started.sh + - name: searchguard-scripts + subPath: init_sg.sh + mountPath: /usr/share/elasticsearch/bin/init_sg.sh + - name: searchguard-config + mountPath: /usr/share/elasticsearch/config/sg + - name: searchguard-auth-config + mountPath: /usr/share/elasticsearch/config/sg/auth - name: elasticsearch-data mountPath: /usr/share/elasticsearch/data resources: -{{ include "common.resources" . }} +{{ include "common.resources" . | indent 12 }} {{- if .Values.nodeSelector }} nodeSelector: {{ toYaml .Values.nodeSelector | indent 8 }} @@ -111,9 +125,20 @@ spec: path: /etc/localtime - name: elasticsearch-config configMap: - name: {{ include "common.fullname" . }} + name: {{ include "common.fullname" . }}-es-config + - name: searchguard-scripts + configMap: + name: {{ include "common.fullname" . }}-sg-scripts + defaultMode: 0754 + - name: searchguard-config + configMap: + name: {{ include "common.fullname" . }}-sg-config + - name: searchguard-auth-config + secret: + secretName: {{ include "common.fullname" . }}-sg-auth - name: elasticsearch-data hostPath: path: {{ .Values.persistence.mountPath }}/{{ .Release.Name }}/{{ .Values.persistence.mountSubPath }} + restartPolicy: {{ .Values.restartPolicy }} imagePullSecrets: - name: "{{ include "common.namespace" . }}-docker-registry-key" diff --git a/kubernetes/aai/charts/aai-elasticsearch/templates/secrets.yaml b/kubernetes/aai/charts/aai-elasticsearch/templates/secrets.yaml new file mode 100644 index 0000000000..34b272f086 --- /dev/null +++ b/kubernetes/aai/charts/aai-elasticsearch/templates/secrets.yaml @@ -0,0 +1,22 @@ +# Copyright © 2018 Amdocs, Bell Canada, AT&T +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "common.fullname" . }}-sg-auth + namespace: {{ include "common.namespace" . }} +type: Opaque +data: +{{ tpl (.Files.Glob "resources/config/sg/auth/*").AsSecrets . | indent 2 }} \ No newline at end of file diff --git a/kubernetes/aai/charts/aai-elasticsearch/templates/service.yaml b/kubernetes/aai/charts/aai-elasticsearch/templates/service.yaml index b1de5a73cb..d1199125d2 100644 --- a/kubernetes/aai/charts/aai-elasticsearch/templates/service.yaml +++ b/kubernetes/aai/charts/aai-elasticsearch/templates/service.yaml @@ -25,14 +25,19 @@ metadata: spec: type: {{ .Values.service.type }} ports: - {{if eq .Values.service.type "NodePort" -}} - - port: {{ .Values.service.internalPort }} - nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort }} - name: {{ .Values.service.portName }} - {{- else -}} - - port: {{ .Values.service.internalPort }} - name: {{ .Values.service.portName }} - {{- end}} + {{if eq .Values.service.type "NodePort" -}} + - port: {{ .Values.service.internalPort }} + nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort }} + name: {{ .Values.service.portName }} + - port: {{ .Values.service.internalPort2 }} + nodePort: {{ .Values.global.nodePortPrefix | default .Values.nodePortPrefix }}{{ .Values.service.nodePort2 }} + name: {{ .Values.service.portName2 }} + {{- else -}} + - port: {{ .Values.service.internalPort }} + name: {{ .Values.service.portName }} + - port: {{ .Values.service.internalPort2 }} + name: {{ .Values.service.portName2 }} + {{- end}} selector: app: {{ include "common.name" . }} release: {{ .Release.Name }} diff --git a/kubernetes/aai/charts/aai-elasticsearch/values.yaml b/kubernetes/aai/charts/aai-elasticsearch/values.yaml index 5ce8f8016b..ea82c99f8b 100644 --- a/kubernetes/aai/charts/aai-elasticsearch/values.yaml +++ b/kubernetes/aai/charts/aai-elasticsearch/values.yaml @@ -19,16 +19,21 @@ global: # global defaults nodePortPrefix: 302 # application image -loggingRepository: docker.elastic.co -image: elasticsearch/elasticsearch:6.1.2 +image: onap/elasticsearch-sg:1.4-STAGING-latest pullPolicy: Always +restartPolicy: Always flavor: small # application configuration config: tcpPort: 8443 - + nodeKeyStore: esaai-keystore.jks + nodeKeyStorePassword: b87b46d3da7d3d4aadfe + adminKeyStore: sgadmin-keystore.p12 + adminKeyStorePassword: 341274302a70ad691e12 + trustStore: truststore.jks + trustStorePassword: b200926e9da205487f63 # default number of instances replicaCount: 1 @@ -54,6 +59,8 @@ service: name: aai-elasticsearch portName: aai-elasticsearch internalPort: 9200 + portName2: aai-elasticsearch-tcp + internalPort2: 8443 ingress: enabled: false -- 2.16.6