mirror of
https://github.com/bitnami/charts.git
synced 2026-08-10 14:15:55 +08:00
[bitnami/opensearch] bugfix: snapshots init-job to consider security settings (#31809)
This commit is contained in:
Juan Ariza Toledano
@@ -1,8 +1,12 @@
|
||||
# Changelog
|
||||
|
||||
## 1.5.3 (2025-01-28)
|
||||
## 1.5.4 (2025-02-06)
|
||||
|
||||
* [bitnami/opensearch] Release 1.5.3 ([#31638](https://github.com/bitnami/charts/pull/31638))
|
||||
* [bitnami/opensearch] bugfix: snapshots init-job to consider security settings ([#31809](https://github.com/bitnami/charts/pull/31809))
|
||||
|
||||
## <small>1.5.3 (2025-01-28)</small>
|
||||
|
||||
* [bitnami/opensearch] Release 1.5.3 (#31638) ([d5a7ed3](https://github.com/bitnami/charts/commit/d5a7ed377bda0f7899e2d6335ad1860b50687360)), closes [#31638](https://github.com/bitnami/charts/issues/31638)
|
||||
|
||||
## <small>1.5.2 (2025-01-25)</small>
|
||||
|
||||
|
||||
@@ -30,4 +30,4 @@ maintainers:
|
||||
name: opensearch
|
||||
sources:
|
||||
- https://github.com/bitnami/charts/tree/main/bitnami/opensearch
|
||||
version: 1.5.3
|
||||
version: 1.5.4
|
||||
|
||||
@@ -1027,7 +1027,7 @@ You can enable this initContainer by setting `volumePermissions.enabled` to `tru
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------- |
|
||||
| `snapshots.enabled` | Enable automatic setup of repositories and snapshot policies | `false` |
|
||||
| `snapshots.command` | Override default container command (useful when using custom images) | `["/usr/bin/curl"]` |
|
||||
| `snapshots.command` | Override default container command (useful when using custom images) | `[]` |
|
||||
| `snapshots.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` |
|
||||
| `snapshots.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `nil` |
|
||||
| `snapshots.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` |
|
||||
|
||||
@@ -113,14 +113,16 @@ In order to replicate the container startup scripts execute this command:
|
||||
|
||||
kubectl port-forward --namespace {{ include "common.names.namespace" . }} svc/{{ template "opensearch.service.name" . }} {{ include "opensearch.service.ports.restAPI" . }}:9200 &
|
||||
curl http://127.0.0.1:9200/
|
||||
{{- end }}
|
||||
|
||||
{{- include "common.warnings.rollingTag" .Values.image }}
|
||||
{{- include "common.warnings.rollingTag" .Values.volumePermissions.image }}
|
||||
{{- include "common.warnings.rollingTag" .Values.sysctlImage }}
|
||||
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{ include "opensearch.validateValues" . }}
|
||||
{{- include "common.warnings.resources" (dict "sections" (list "coordinating" "dashboards" "data" "ingest" "master" "sysctlImage" "volumePermissions") "context" $) }}
|
||||
{{- include "common.warnings.rollingTag" .Values.image }}
|
||||
{{- include "common.warnings.rollingTag" .Values.sysctlImage }}
|
||||
{{- include "common.warnings.rollingTag" .Values.dashboards.image }}
|
||||
{{- include "common.warnings.rollingTag" .Values.volumePermissions.image }}
|
||||
{{- include "common.warnings.rollingTag" .Values.snapshots.image }}
|
||||
{{- include "common.warnings.resources" (dict "sections" (list "coordinating" "dashboards" "data" "ingest" "master" "sysctlImage" "volumePermissions" "snapshots") "context" $) }}
|
||||
{{- include "common.warnings.modifiedImages" (dict "images" (list .Values.image .Values.volumePermissions.image .Values.sysctlImage .Values.dashboards.image .Values.snapshots.image) "context" $) }}
|
||||
{{- include "common.errors.insecureImages" (dict "images" (list .Values.image .Values.volumePermissions.image .Values.sysctlImage .Values.dashboards.image .Values.snapshots.image) "context" $) }}
|
||||
|
||||
@@ -12,13 +12,6 @@ Return the proper OS image name
|
||||
{{ include "common.images.image" (dict "imageRoot" .Values.image "global" .Values.global) }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Docker Image Registry Secret Names
|
||||
*/}}
|
||||
{{- define "opensearch.imagePullSecrets" -}}
|
||||
{{ include "common.images.renderPullSecrets" (dict "images" (list .Values.image .Values.sysctlImage .Values.volumePermissions.image) "context" $) }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper sysctl image name
|
||||
*/}}
|
||||
@@ -26,6 +19,34 @@ Return the proper sysctl image name
|
||||
{{ include "common.images.image" (dict "imageRoot" .Values.sysctlImage "global" .Values.global) }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper image name (for the init container volume-permissions image)
|
||||
*/}}
|
||||
{{- define "opensearch.volumePermissions.image" -}}
|
||||
{{ include "common.images.image" (dict "imageRoot" .Values.volumePermissions.image "global" .Values.global) }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper OpenSearch Dashboards image name
|
||||
*/}}
|
||||
{{- define "opensearch.dashboards.image" -}}
|
||||
{{ include "common.images.image" (dict "imageRoot" .Values.dashboards.image "global" .Values.global) }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper OpenSearch Snapshots image name
|
||||
*/}}
|
||||
{{- define "opensearch.snapshots.image" -}}
|
||||
{{ include "common.images.image" (dict "imageRoot" .Values.snapshots.image "global" .Values.global) }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Docker Image Registry Secret Names
|
||||
*/}}
|
||||
{{- define "opensearch.imagePullSecrets" -}}
|
||||
{{ include "common.images.renderPullSecrets" (dict "images" (list .Values.image .Values.sysctlImage .Values.volumePermissions.image .Values.dashboards.image .Values.snapshots.image) "context" $) }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper sysctl image name
|
||||
*/}}
|
||||
@@ -135,15 +156,7 @@ Set Elasticsearch PVC.
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper image name (for the init container volume-permissions image)
|
||||
*/}}
|
||||
{{- define "opensearch.volumePermissions.image" -}}
|
||||
{{ include "common.images.image" (dict "imageRoot" .Values.volumePermissions.image "global" .Values.global) }}
|
||||
{{- end -}}
|
||||
|
||||
|
||||
{{/*
|
||||
Name for the Opensearch service
|
||||
Name for the OpenSearch service
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
*/}}
|
||||
{{- define "opensearch.service.name" -}}
|
||||
@@ -151,7 +164,7 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Port number for the Opensearch service REST API port
|
||||
Port number for the OpenSearch service REST API port
|
||||
*/}}
|
||||
{{- define "opensearch.service.ports.restAPI" -}}
|
||||
{{- printf "%d" (int .Values.service.ports.restAPI) -}}
|
||||
@@ -505,7 +518,7 @@ Return true if an authentication credentials secret object should be created
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Opensearch authentication credentials secret name
|
||||
Return the OpenSearch authentication credentials secret name
|
||||
*/}}
|
||||
{{- define "opensearch.secretName" -}}
|
||||
{{- if .Values.security.existingSecret -}}
|
||||
@@ -525,7 +538,7 @@ Return true if a TLS password secret object should be created
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Opensearch TLS password secret name
|
||||
Return the OpenSearch TLS password secret name
|
||||
*/}}
|
||||
{{- define "opensearch.tlsPasswordsSecret" -}}
|
||||
{{- if .Values.security.tls.passwordsSecret -}}
|
||||
@@ -658,47 +671,47 @@ Returns true if at least 1 existing secret was provided
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Opensearch - Existing secret not provided for master nodes */}}
|
||||
{{/* Validate values of OpenSearch - Existing secret not provided for master nodes */}}
|
||||
{{- define "opensearch.validateValues.security.missingTlsSecrets.master" -}}
|
||||
{{- $masterSecret := (and (include "opensearch.master.enabled" .) (not .Values.security.tls.master.existingSecret)) -}}
|
||||
{{- if and .Values.security.enabled (include "opensearch.security.tlsSecretsProvided" .) $masterSecret -}}
|
||||
opensearch: security.tls.master.existingSecret
|
||||
Missing secret containing the TLS certificates for the Opensearch master nodes.
|
||||
Missing secret containing the TLS certificates for the OpenSearch master nodes.
|
||||
Provide the certificates using --set .security.tls.master.existingSecret="my-secret".
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Opensearch - Existing secret not provided for coordinating-only nodes */}}
|
||||
{{/* Validate values of OpenSearch - Existing secret not provided for coordinating-only nodes */}}
|
||||
{{- define "opensearch.validateValues.security.missingTlsSecrets.coordinating" -}}
|
||||
{{- $coordinatingSecret := (and (include "opensearch.coordinating.enabled" .) (not .Values.security.tls.coordinating.existingSecret)) -}}
|
||||
{{- if and .Values.security.enabled (include "opensearch.security.tlsSecretsProvided" .) $coordinatingSecret -}}
|
||||
opensearch: security.tls.coordinating.existingSecret
|
||||
Missing secret containing the TLS certificates for the Opensearch coordinating-only nodes.
|
||||
Missing secret containing the TLS certificates for the OpenSearch coordinating-only nodes.
|
||||
Provide the certificates using --set .security.tls.coordinating.existingSecret="my-secret".
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Opensearch - Existing secret not provided for data nodes */}}
|
||||
{{/* Validate values of OpenSearch - Existing secret not provided for data nodes */}}
|
||||
{{- define "opensearch.validateValues.security.missingTlsSecrets.data" -}}
|
||||
{{- $dataSecret := (and (include "opensearch.data.enabled" .) (not .Values.security.tls.data.existingSecret)) -}}
|
||||
{{- if and .Values.security.enabled (include "opensearch.security.tlsSecretsProvided" .) $dataSecret -}}
|
||||
opensearch: security.tls.data.existingSecret
|
||||
Missing secret containing the TLS certificates for the Opensearch data nodes.
|
||||
Missing secret containing the TLS certificates for the OpenSearch data nodes.
|
||||
Provide the certificates using --set .security.tls.data.existingSecret="my-secret".
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Opensearch - Existing secret not provided for ingest nodes */}}
|
||||
{{/* Validate values of OpenSearch - Existing secret not provided for ingest nodes */}}
|
||||
{{- define "opensearch.validateValues.security.missingTlsSecrets.ingest" -}}
|
||||
{{- $ingestSecret := (and (include "opensearch.ingest.enabled" .) (not .Values.security.tls.ingest.existingSecret)) -}}
|
||||
{{- if and .Values.security.enabled (include "opensearch.security.tlsSecretsProvided" .) $ingestSecret -}}
|
||||
opensearch: security.tls.ingest.existingSecret
|
||||
Missing secret containing the TLS certificates for the Opensearch ingest nodes.
|
||||
Missing secret containing the TLS certificates for the OpenSearch ingest nodes.
|
||||
Provide the certificates using --set .security.tls.ingest.existingSecret="my-secret".
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Opensearch - TLS enabled but no certificates provided */}}
|
||||
{{/* Validate values of OpenSearch - TLS enabled but no certificates provided */}}
|
||||
{{- define "opensearch.validateValues.security.tls" -}}
|
||||
{{- if and .Values.security.enabled (not .Values.security.tls.autoGenerated) (not (include "opensearch.security.tlsSecretsProvided" .)) -}}
|
||||
opensearch: security.tls
|
||||
@@ -712,11 +725,11 @@ opensearch: security.tls
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate at least Opensearch one master node is configured */}}
|
||||
{{/* Validate at least OpenSearch one master node is configured */}}
|
||||
{{- define "opensearch.validateValues.master.replicas" -}}
|
||||
{{- if not (include "opensearch.master.enabled" .) -}}
|
||||
opensearch: master.replicas
|
||||
Opensearch needs at least one master-eligible node to form a cluster.
|
||||
OpenSearch needs at least one master-eligible node to form a cluster.
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
@@ -787,15 +800,7 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Opensearch Dashboards image name
|
||||
*/}}
|
||||
{{- define "opensearch.dashboards.image" -}}
|
||||
{{ include "common.images.image" (dict "imageRoot" .Values.dashboards.image "global" .Values.global) }}
|
||||
{{- end -}}
|
||||
|
||||
|
||||
{{/*
|
||||
Set Opensearch URL.
|
||||
Set OpenSearch URL.
|
||||
*/}}
|
||||
{{- define "opensearch.url" -}}
|
||||
{{- $protocol := ternary "https" "http" .Values.security.tls.restEncryption -}}
|
||||
@@ -856,10 +861,3 @@ Create name for snapshot API policy data ConfigMap
|
||||
{{- define "opensearch.snapshots.policyDataConfigMap" -}}
|
||||
{{- printf "%s-policy-data" (include "opensearch.snapshots.fullname" $) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Opensearch Snapshots image name
|
||||
*/}}
|
||||
{{- define "opensearch.snapshots.image" -}}
|
||||
{{ include "common.images.image" (dict "imageRoot" .Values.snapshots.image "global" .Values.global) }}
|
||||
{{- end -}}
|
||||
|
||||
@@ -258,9 +258,14 @@ spec:
|
||||
- name: custom-init-scripts-secret
|
||||
mountPath: /docker-entrypoint-initdb.d/init-scripts-secret
|
||||
{{- end }}
|
||||
{{- if .Values.snapshots.persistence.enabled }}
|
||||
- name: snapshots
|
||||
mountPath: {{ include "opensearch.snapshots.mountPath" . }}
|
||||
{{- if .Values.snapshots.enabled }}
|
||||
- mountPath: {{ include "opensearch.snapshots.mountPath" . }}
|
||||
{{- if .Values.snapshots.persistence.enabled }}
|
||||
name: snapshots
|
||||
{{- else }}
|
||||
name: empty-dir
|
||||
subPath: app-snapshots-dir
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.coordinating.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.coordinating.extraVolumeMounts "context" $) | nindent 12 }}
|
||||
@@ -312,7 +317,7 @@ spec:
|
||||
secretName: {{ template "opensearch.initScriptsSecret" . }}
|
||||
defaultMode: 0755
|
||||
{{- end }}
|
||||
{{- if .Values.snapshots.persistence.enabled }}
|
||||
{{- if and .Values.snapshots.enabled .Values.snapshots.persistence.enabled }}
|
||||
- name: snapshots
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ include "opensearch.snapshots.fullname" . }}
|
||||
|
||||
@@ -284,9 +284,14 @@ spec:
|
||||
- name: custom-init-scripts-secret
|
||||
mountPath: /docker-entrypoint-initdb.d/init-scripts-secret
|
||||
{{- end }}
|
||||
{{- if .Values.snapshots.persistence.enabled }}
|
||||
- name: snapshots
|
||||
mountPath: {{ include "opensearch.snapshots.mountPath" . }}
|
||||
{{- if .Values.snapshots.enabled }}
|
||||
- mountPath: {{ include "opensearch.snapshots.mountPath" . }}
|
||||
{{- if .Values.snapshots.persistence.enabled }}
|
||||
name: snapshots
|
||||
{{- else }}
|
||||
name: empty-dir
|
||||
subPath: app-snapshots-dir
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.data.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.data.extraVolumeMounts "context" $) | nindent 12 }}
|
||||
@@ -336,7 +341,7 @@ spec:
|
||||
secretName: {{ template "opensearch.initScriptsSecret" . }}
|
||||
defaultMode: 0755
|
||||
{{- end }}
|
||||
{{- if .Values.snapshots.persistence.enabled }}
|
||||
{{- if and .Values.snapshots.enabled .Values.snapshots.persistence.enabled }}
|
||||
- name: snapshots
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ include "opensearch.snapshots.fullname" . }}
|
||||
|
||||
@@ -258,9 +258,14 @@ spec:
|
||||
- name: custom-init-scripts-secret
|
||||
mountPath: /docker-entrypoint-initdb.d/init-scripts-secret
|
||||
{{- end }}
|
||||
{{- if .Values.snapshots.persistence.enabled }}
|
||||
- name: snapshots
|
||||
mountPath: {{ include "opensearch.snapshots.mountPath" . }}
|
||||
{{- if .Values.snapshots.enabled }}
|
||||
- mountPath: {{ include "opensearch.snapshots.mountPath" . }}
|
||||
{{- if .Values.snapshots.persistence.enabled }}
|
||||
name: snapshots
|
||||
{{- else }}
|
||||
name: empty-dir
|
||||
subPath: app-snapshots-dir
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.ingest.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.ingest.extraVolumeMounts "context" $) | nindent 12 }}
|
||||
@@ -312,7 +317,7 @@ spec:
|
||||
secretName: {{ template "opensearch.initScriptsSecret" . }}
|
||||
defaultMode: 0755
|
||||
{{- end }}
|
||||
{{- if .Values.snapshots.persistence.enabled }}
|
||||
{{- if and .Values.snapshots.enabled .Values.snapshots.persistence.enabled }}
|
||||
- name: snapshots
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ include "opensearch.snapshots.fullname" . }}
|
||||
|
||||
@@ -296,9 +296,14 @@ spec:
|
||||
- name: custom-init-scripts-secret
|
||||
mountPath: /docker-entrypoint-initdb.d/init-scripts-secret
|
||||
{{- end }}
|
||||
{{- if .Values.snapshots.persistence.enabled }}
|
||||
- name: snapshots
|
||||
mountPath: {{ include "opensearch.snapshots.mountPath" . }}
|
||||
{{- if .Values.snapshots.enabled }}
|
||||
- mountPath: {{ include "opensearch.snapshots.mountPath" . }}
|
||||
{{- if .Values.snapshots.persistence.enabled }}
|
||||
name: snapshots
|
||||
{{- else }}
|
||||
name: empty-dir
|
||||
subPath: app-snapshots-dir
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.master.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.master.extraVolumeMounts "context" $) | nindent 12 }}
|
||||
@@ -348,7 +353,7 @@ spec:
|
||||
secretName: {{ template "opensearch.initScriptsSecret" . }}
|
||||
defaultMode: 0755
|
||||
{{- end }}
|
||||
{{- if .Values.snapshots.persistence.enabled }}
|
||||
{{- if and .Values.snapshots.enabled .Values.snapshots.persistence.enabled }}
|
||||
- name: snapshots
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ include "opensearch.snapshots.fullname" . }}
|
||||
|
||||
@@ -3,62 +3,142 @@ Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if $.Values.snapshots.enabled -}}
|
||||
{{- $host := (include "opensearch.service.name" $) -}}
|
||||
{{- $port := (include "opensearch.service.ports.restAPI" $) -}}
|
||||
{{- if .Values.snapshots.enabled }}
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
annotations:
|
||||
helm.sh/hook: post-install
|
||||
{{- if .Values.commonAnnotations }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: snapshots
|
||||
name: {{ include "opensearch.snapshots.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" . ) | nindent 4 }}
|
||||
app.kubernetes.io/component: snapshots
|
||||
{{- $defaultAnnotations := dict "helm.sh/hook" "post-install" "helm.sh/hook-delete-policy" "hook-succeeded" }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonAnnotations $defaultAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" . ) | nindent 4 }}
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
{{- include "opensearch.imagePullSecrets" . | nindent 6 }}
|
||||
automountServiceAccountToken: false
|
||||
initContainers:
|
||||
- name: wait-for-opensearch
|
||||
image: {{ template "opensearch.snapshots.image" . }}
|
||||
imagePullPolicy: {{ .Values.snapshots.image.pullPolicy }}
|
||||
{{- if .Values.snapshots.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.snapshots.containerSecurityContext "context" .) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.snapshots.resources }}
|
||||
resources: {{- toYaml .Values.snapshots.resources | nindent 12 }}
|
||||
{{- else if ne .Values.snapshots.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.snapshots.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
command:
|
||||
- bash
|
||||
args:
|
||||
- -ec
|
||||
- |
|
||||
retry_while() {
|
||||
local -r cmd="${1:?cmd is missing}"
|
||||
local -r retries="${2:-12}"
|
||||
local -r sleep_time="${3:-5}"
|
||||
local return_value=1
|
||||
|
||||
read -r -a command <<< "$cmd"
|
||||
for ((i = 1 ; i <= retries ; i+=1 )); do
|
||||
"${command[@]}" && return_value=0 && break
|
||||
sleep "$sleep_time"
|
||||
done
|
||||
return $return_value
|
||||
}
|
||||
|
||||
check_opensearch() {
|
||||
if wait-for-port --timeout=5 --host="$OPENSEARCH_HOST" --state=inuse $OPENSEARCH_PORT_NUMBER; then
|
||||
return 0
|
||||
else
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
echo "Checking connection to OpenSearch"
|
||||
if retry_while "check_opensearch"; then
|
||||
echo "Connected to OpenSearch"
|
||||
exit 0
|
||||
else
|
||||
echo "Error connecting to OpenSearch"
|
||||
exit 1
|
||||
fi
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: {{ ternary "true" "false" (or .Values.snapshots.image.debug .Values.diagnosticMode.enabled) | quote }}
|
||||
- name: OPENSEARCH_HOST
|
||||
value: {{ include "opensearch.service.name" . | quote }}
|
||||
- name: OPENSEARCH_PORT_NUMBER
|
||||
value: {{ include "opensearch.service.ports.restAPI" . | quote }}
|
||||
containers:
|
||||
- args:
|
||||
- --silent
|
||||
- --show-error
|
||||
- "file:///dev/null" # Starting with curl 8, a URL is required before the first `--next`
|
||||
{{- range $name, $_ := $.Values.snapshots.repositories }}
|
||||
# Starting with curl 8, a URL is required before the first `--next`
|
||||
- "file:///dev/null"
|
||||
{{- range $name, $_ := .Values.snapshots.repositories }}
|
||||
# Register snapshot repository:
|
||||
- --next
|
||||
- -w
|
||||
- '\n'
|
||||
- -XPUT
|
||||
{{- if $.Values.security.enabled }}
|
||||
- -u
|
||||
- admin:$(OPENSEARCH_PASSWORD)
|
||||
{{- if $.Values.security.tls.restEncryption }}
|
||||
- --cacert
|
||||
- /certs/ca.crt
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- -H
|
||||
- "Content-Type: application/json"
|
||||
- -d
|
||||
- "@/run/repo-data/{{ $name }}"
|
||||
- http://{{ $host }}:{{ $port }}/_snapshot/{{ $name }}
|
||||
- "$(OPENSEARCH_ORIGIN)/_snapshot/{{ $name }}"
|
||||
{{- end }}
|
||||
{{- range $name, $_ := $.Values.snapshots.policies }}
|
||||
{{- range $name, $_ := .Values.snapshots.policies }}
|
||||
# Register snapshot policy:
|
||||
- --next
|
||||
- -w
|
||||
- '\n'
|
||||
{{- if $.Values.security.enabled }}
|
||||
- -u
|
||||
- admin:$(OPENSEARCH_PASSWORD)
|
||||
{{- if $.Values.security.tls.restEncryption }}
|
||||
- --cacert
|
||||
- /certs/ca.crt
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- -H
|
||||
- "Content-Type: application/json"
|
||||
- -d
|
||||
- "@/run/policy-data/{{ $name }}"
|
||||
- http://{{ $host }}:{{ $port }}/_plugins/_sm/policies/{{ $name }}
|
||||
- "$(OPENSEARCH_ORIGIN)/_plugins/_sm/policies/{{ $name }}"
|
||||
{{- end }}
|
||||
command:
|
||||
{{- if .Values.snapshots.command }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.snapshots.command "context" .) | nindent 12 }}
|
||||
{{- else }}
|
||||
- /usr/bin/curl
|
||||
{{- end }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.snapshots.command "context" $) | nindent 12 }}
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: {{ ternary "true" "false" (or .Values.snapshots.image.debug .Values.diagnosticMode.enabled) | quote }}
|
||||
- name: OPENSEARCH_ORIGIN
|
||||
value: {{ printf "%s://%s:%d" (ternary "https" "http" (and .Values.security.enabled .Values.security.tls.restEncryption)) (include "opensearch.service.name" .) (include "opensearch.service.ports.restAPI" . | int) | quote }}
|
||||
- name: OPENSEARCH_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "opensearch.secretName" . }}
|
||||
key: opensearch-password
|
||||
image: {{ template "opensearch.snapshots.image" . }}
|
||||
imagePullPolicy: {{ .Values.snapshots.image.pullPolicy }}
|
||||
name: {{ include "opensearch.snapshots.fullname" . }}
|
||||
name: shell
|
||||
{{- if .Values.snapshots.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.snapshots.containerSecurityContext "context" $) | nindent 12 }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.snapshots.containerSecurityContext "context" .) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.snapshots.resources }}
|
||||
resources: {{- toYaml .Values.snapshots.resources | nindent 12 }}
|
||||
@@ -70,15 +150,14 @@ spec:
|
||||
mountPath: /run/repo-data/
|
||||
- name: policy-data
|
||||
mountPath: /run/policy-data/
|
||||
{{- with .Values.snapshots.image.pullSecrets }}
|
||||
imagePullPolicy:
|
||||
{{- range . }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.security.enabled }}
|
||||
- name: opensearch-certificates
|
||||
mountPath: /certs
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
restartPolicy: Never
|
||||
{{- if .Values.dashboards.podSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.dashboards.podSecurityContext "context" $) | nindent 8 }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.dashboards.podSecurityContext "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: policy-data
|
||||
@@ -87,4 +166,13 @@ spec:
|
||||
- name: repo-data
|
||||
configMap:
|
||||
name: {{ include "opensearch.snapshots.repoDataConfigMap" . }}
|
||||
{{- if and .Values.security.enabled .Values.security.tls.restEncryption }}
|
||||
- name: opensearch-certificates
|
||||
projected:
|
||||
defaultMode: 256
|
||||
sources:
|
||||
- secret:
|
||||
name: {{ include "opensearch.node.tlsSecretName" (dict "nodeRole" "master" "context" $) }}
|
||||
items: {{- include "opensearch.node.tlsSecretItems" (dict "nodeRole" "master" "context" $) | nindent 20 }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
@@ -34,6 +34,7 @@ global:
|
||||
## @param global.compatibility.openshift.adaptSecurityContext Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation)
|
||||
##
|
||||
adaptSecurityContext: auto
|
||||
|
||||
## @section Common parameters
|
||||
|
||||
## @param kubeVersion Override Kubernetes version
|
||||
@@ -74,6 +75,7 @@ diagnosticMode:
|
||||
##
|
||||
args:
|
||||
- infinity
|
||||
|
||||
## @section OpenSearch cluster Parameters
|
||||
|
||||
## @param clusterName OpenSearch cluster name
|
||||
@@ -345,8 +347,8 @@ security:
|
||||
## @param security.tls.adminDN A comma separated list of DN for admins
|
||||
##
|
||||
adminDN: ""
|
||||
|
||||
## @section Traffic Exposure Parameters
|
||||
##
|
||||
|
||||
## OpenSearch service parameters
|
||||
##
|
||||
@@ -509,7 +511,9 @@ ingress:
|
||||
## name: http
|
||||
##
|
||||
extraRules: []
|
||||
|
||||
## @section Master-eligible nodes parameters
|
||||
|
||||
master:
|
||||
## @param master.masterOnly Deploy the OpenSearch master-eligible nodes as master-only nodes. Recommended for high-demand deployments.
|
||||
## If you are
|
||||
@@ -1035,7 +1039,9 @@ master:
|
||||
selector: {}
|
||||
namespace: monitoring
|
||||
additionalLabels: {}
|
||||
|
||||
## @section Data-only nodes parameters
|
||||
|
||||
data:
|
||||
## @param data.replicaCount Number of data-only replicas to deploy
|
||||
##
|
||||
@@ -1554,7 +1560,9 @@ data:
|
||||
selector: {}
|
||||
namespace: monitoring
|
||||
additionalLabels: {}
|
||||
|
||||
## @section Coordinating-only nodes parameters
|
||||
|
||||
coordinating:
|
||||
## @param coordinating.replicaCount Number of coordinating-only replicas to deploy
|
||||
##
|
||||
@@ -2035,7 +2043,9 @@ coordinating:
|
||||
selector: {}
|
||||
namespace: monitoring
|
||||
additionalLabels: {}
|
||||
|
||||
## @section Ingest-only nodes parameters
|
||||
|
||||
ingest:
|
||||
## @param ingest.enabled Enable ingest nodes
|
||||
##
|
||||
@@ -2684,6 +2694,7 @@ ingest:
|
||||
selector: {}
|
||||
namespace: monitoring
|
||||
additionalLabels: {}
|
||||
|
||||
## @section Init Container Parameters
|
||||
|
||||
## 'volumePermissions' init container parameters
|
||||
@@ -2786,7 +2797,9 @@ sysctlImage:
|
||||
## memory: 1024Mi
|
||||
##
|
||||
resources: {}
|
||||
|
||||
## @section OpenSearch Dashboards Parameters
|
||||
|
||||
dashboards:
|
||||
## @param dashboards.enabled Enables OpenSearch Dashboards deployment
|
||||
##
|
||||
@@ -3412,14 +3425,14 @@ dashboards:
|
||||
dataSource: {}
|
||||
|
||||
## @section OpenSearch Snapshots Parameters
|
||||
|
||||
snapshots:
|
||||
## @param snapshots.enabled Enable automatic setup of repositories and snapshot policies
|
||||
##
|
||||
enabled: false
|
||||
## @param snapshots.command Override default container command (useful when using custom images)
|
||||
##
|
||||
command:
|
||||
- /usr/bin/curl
|
||||
command: []
|
||||
## Configure Container Security Context
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
|
||||
## @param snapshots.containerSecurityContext.enabled Enabled containers' Security Context
|
||||
|
||||
Reference in New Issue
Block a user