Skip to content

Commit 6a5b464

Browse files
stephen-crawfordstephen-crawford
authored
Allow test clusters to run with TLS (#8900)
* Basic idea Signed-off-by: Stephen Crawford <[email protected]> * Make configurable Signed-off-by: Stephen Crawford <[email protected]> * Update change log Signed-off-by: Stephen Crawford <[email protected]> * Have to ask around Signed-off-by: Stephen Crawford <[email protected]> * add http protocol configuration Signed-off-by: Stephen Crawford <[email protected]> * Fix failure Signed-off-by: Stephen Crawford <[email protected]> * Update settings Signed-off-by: Stephen Crawford <[email protected]> * Fix config Signed-off-by: Stephen Crawford <[email protected]> * retry integ Signed-off-by: Stephen Crawford <[email protected]> * retry integ Signed-off-by: Stephen Crawford <[email protected]> * Fix failure to find Signed-off-by: Stephen Crawford <[email protected]> * spotless Signed-off-by: Stephen Crawford <[email protected]> * fix assigment Signed-off-by: Stephen Crawford <[email protected]> * fix npe Signed-off-by: Stephen Crawford <[email protected]> * set default Signed-off-by: Stephen Crawford <[email protected]> * set default Signed-off-by: Stephen Crawford <[email protected]> * Spotless Signed-off-by: Stephen Crawford <[email protected]> * prevent empty string Signed-off-by: Stephen Crawford <[email protected]> * Swap optional use Signed-off-by: Stephen Crawford <[email protected]> * Swap back run setup Signed-off-by: Stephen Crawford <[email protected]> * try stream fix Signed-off-by: Stephen Crawford <[email protected]> * store Signed-off-by: Stephen Crawford <[email protected]> * remove config mentioons Signed-off-by: Stephen Crawford <[email protected]> * fix failure Signed-off-by: Stephen Crawford <[email protected]> * spotless Signed-off-by: Stephen Crawford <[email protected]> * Readd setting to config Signed-off-by: Stephen Crawford <[email protected]> * readd overridable Signed-off-by: Stephen Crawford <[email protected]> * Spotless Signed-off-by: Stephen Crawford <[email protected]> * Add setting to env Signed-off-by: Stephen Crawford <[email protected]> * spotless Signed-off-by: Stephen Crawford <[email protected]> * trigger retry Signed-off-by: Stephen Crawford <[email protected]> * Buildable Signed-off-by: Stephen Crawford <[email protected]> * update cert passing Signed-off-by: Stephen Crawford <[email protected]> * remove log Signed-off-by: Stephen Crawford <[email protected]> * buildable no logs Signed-off-by: Stephen Crawford <[email protected]> * Spotless Signed-off-by: Stephen Crawford <[email protected]> * remove uneeded configs Signed-off-by: Stephen Crawford <[email protected]> * Pass old creds Signed-off-by: Stephen Crawford <[email protected]> * fix bad logs Signed-off-by: Stephen Crawford <[email protected]> * spotless Signed-off-by: Stephen Crawford <[email protected]> * Reta's requests Signed-off-by: Stephen Crawford <[email protected]> * Swap to boolean Signed-off-by: Stephen Crawford <[email protected]> * trigger retry Signed-off-by: Stephen Crawford <[email protected]> * Make bool Signed-off-by: Stephen Crawford <[email protected]> * fix npe Signed-off-by: Stephen Crawford <[email protected]> * spotless Signed-off-by: Stephen Crawford <[email protected]> * failed with string logic Signed-off-by: Stephen Crawford <[email protected]> --------- Signed-off-by: Stephen Crawford <[email protected]> Signed-off-by: Stephen Crawford <[email protected]>
1 parent 5cc7313 commit 6a5b464

File tree

5 files changed

+75
-8
lines changed

5 files changed

+75
-8
lines changed

‎CHANGELOG.md

+1
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
128128
- Change InternalSignificantTerms to sum shard-level superset counts only in final reduce ([#8735](https://github.com/opensearch-project/OpenSearch/pull/8735))
129129
- Exclude 'benchmarks' from codecov report ([#8805](https://github.com/opensearch-project/OpenSearch/pull/8805))
130130
- Create separate SourceLookup instance per segment slice in SignificantTextAggregatorFactory ([#8807](https://github.com/opensearch-project/OpenSearch/pull/8807))
131+
- Allow test clusters to run with TLS ([#8900](https://github.com/opensearch-project/OpenSearch/pull/8900))
131132
- Replace the deprecated IndexReader APIs with new storedFields() & termVectors() ([#7792](https://github.com/opensearch-project/OpenSearch/pull/7792))
132133
- [Remote Store] Add support to restore only unassigned shards of an index ([#8792](https://github.com/opensearch-project/OpenSearch/pull/8792))
133134
- Add safeguard limits for file cache during node level allocation ([#8208](https://github.com/opensearch-project/OpenSearch/pull/8208))

‎buildSrc/src/main/java/org/opensearch/gradle/http/WaitForHttpResource.java

+18
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,24 @@ public WaitForHttpResource(String protocol, String host, int numberOfNodes) thro
8383
this(new URL(protocol + "://" + host + "/_cluster/health?wait_for_nodes=>=" + numberOfNodes + "&wait_for_status=yellow"));
8484
}
8585

86+
public WaitForHttpResource(String protocol, String host, String username, String password, int numberOfNodes)
87+
throws MalformedURLException {
88+
this(
89+
new URL(
90+
protocol
91+
+ "://"
92+
+ username
93+
+ ":"
94+
+ password
95+
+ "@"
96+
+ host
97+
+ "/_cluster/health?wait_for_nodes=>="
98+
+ numberOfNodes
99+
+ "&wait_for_status=yellow"
100+
)
101+
);
102+
}
103+
86104
public WaitForHttpResource(URL url) {
87105
this.url = url;
88106
}

‎buildSrc/src/main/java/org/opensearch/gradle/testclusters/OpenSearchCluster.java

+25-8
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,6 @@ public class OpenSearchCluster implements TestClusterConfiguration, Named {
8181
private final FileSystemOperations fileSystemOperations;
8282
private final ArchiveOperations archiveOperations;
8383
private int nodeIndex = 0;
84-
8584
private int zoneCount = 1;
8685

8786
public OpenSearchCluster(
@@ -100,7 +99,6 @@ public OpenSearchCluster(
10099
this.archiveOperations = archiveOperations;
101100
this.workingDirBase = workingDirBase;
102101
this.nodes = project.container(OpenSearchNode.class);
103-
104102
// Always add the first node
105103
String zone = hasZoneProperty() ? "zone-1" : "";
106104
addNode(clusterName + "-0", zone);
@@ -265,6 +263,11 @@ public void keystorePassword(String password) {
265263
nodes.all(each -> each.keystorePassword(password));
266264
}
267265

266+
@Override
267+
public void setSecure(boolean secure) {
268+
nodes.all(each -> each.setSecure(secure));
269+
}
270+
268271
@Override
269272
public void cliSetup(String binTool, CharSequence... args) {
270273
nodes.all(each -> each.cliSetup(binTool, args));
@@ -367,6 +370,7 @@ private void commonNodeConfig() {
367370
} else {
368371
nodeNames = nodes.stream().map(OpenSearchNode::getName).map(this::safeName).collect(Collectors.joining(","));
369372
}
373+
370374
OpenSearchNode firstNode = null;
371375
for (OpenSearchNode node : nodes) {
372376
// Can only configure master nodes if we have node names defined
@@ -554,12 +558,25 @@ public OpenSearchNode singleNode() {
554558
private void addWaitForClusterHealth() {
555559
waitConditions.put("cluster health yellow", (node) -> {
556560
try {
557-
WaitForHttpResource wait = new WaitForHttpResource("http", getFirstNode().getHttpSocketURI(), nodes.size());
558-
559-
List<Map<String, String>> credentials = getFirstNode().getCredentials();
560-
if (getFirstNode().getCredentials().isEmpty() == false) {
561-
wait.setUsername(credentials.get(0).get("useradd"));
562-
wait.setPassword(credentials.get(0).get("-p"));
561+
WaitForHttpResource wait;
562+
if (!getFirstNode().isSecure()) {
563+
wait = new WaitForHttpResource("http", getFirstNode().getHttpSocketURI(), nodes.size());
564+
List<Map<String, String>> credentials = getFirstNode().getCredentials();
565+
if (getFirstNode().getCredentials().isEmpty() == false) {
566+
wait.setUsername(credentials.get(0).get("useradd"));
567+
wait.setPassword(credentials.get(0).get("-p"));
568+
}
569+
} else {
570+
wait = new WaitForHttpResource(
571+
"https",
572+
getFirstNode().getHttpSocketURI(),
573+
getFirstNode().getCredentials().get(0).get("username"),
574+
getFirstNode().getCredentials().get(0).get("password"),
575+
nodes.size()
576+
);
577+
wait.setUsername(getFirstNode().getCredentials().get(0).get("username"));
578+
wait.setPassword(getFirstNode().getCredentials().get(0).get("password"));
579+
wait.setCertificateAuthorities(getFirstNode().getExtraConfigFilesMap().get("root-ca.pem"));
563580
}
564581
return wait.wait(500);
565582
} catch (IOException e) {

‎buildSrc/src/main/java/org/opensearch/gradle/testclusters/OpenSearchNode.java

+29
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,7 @@ public class OpenSearchNode implements TestClusterConfiguration {
160160
private final Path httpPortsFile;
161161
private final Path tmpDir;
162162

163+
private boolean secure = false;
163164
private int currentDistro = 0;
164165
private TestDistribution testDistribution;
165166
private final List<OpenSearchDistribution> distributions = new ArrayList<>();
@@ -209,6 +210,7 @@ public class OpenSearchNode implements TestClusterConfiguration {
209210
setTestDistribution(TestDistribution.INTEG_TEST);
210211
setVersion(VersionProperties.getOpenSearch());
211212
this.zone = zone;
213+
this.credentials.add(new HashMap<>());
212214
}
213215

214216
@Input
@@ -217,6 +219,11 @@ public String getName() {
217219
return nameCustomization.apply(name);
218220
}
219221

222+
@Internal
223+
public boolean isSecure() {
224+
return secure;
225+
}
226+
220227
@Internal
221228
public Version getVersion() {
222229
return Version.fromString(distributions.get(currentDistro).getVersion());
@@ -452,6 +459,11 @@ public void setPreserveDataDir(boolean preserveDataDir) {
452459
this.preserveDataDir = preserveDataDir;
453460
}
454461

462+
@Override
463+
public void setSecure(boolean secure) {
464+
this.secure = secure;
465+
}
466+
455467
@Override
456468
public void freeze() {
457469
requireNonNull(testDistribution, "null testDistribution passed when configuring test cluster `" + this + "`");
@@ -471,6 +483,18 @@ public Stream<String> logLines() throws IOException {
471483
@Override
472484
public synchronized void start() {
473485
LOGGER.info("Starting `{}`", this);
486+
if (System.getProperty("tests.opensearch.secure") != null
487+
&& System.getProperty("tests.opensearch.secure").equalsIgnoreCase("true")) {
488+
secure = true;
489+
}
490+
if (System.getProperty("tests.opensearch.username") != null) {
491+
this.credentials.get(0).put("username", System.getProperty("tests.opensearch.username"));
492+
LOGGER.info("Overwriting username to: " + this.getCredentials().get(0).get("username"));
493+
}
494+
if (System.getProperty("tests.opensearch.password") != null) {
495+
this.credentials.get(0).put("password", System.getProperty("tests.opensearch.password"));
496+
LOGGER.info("Overwriting password to: " + this.getCredentials().get(0).get("password"));
497+
}
474498
if (Files.exists(getExtractedDistributionDir()) == false) {
475499
throw new TestClustersException("Can not start " + this + ", missing: " + getExtractedDistributionDir());
476500
}
@@ -1349,6 +1373,11 @@ public List<?> getExtraConfigFiles() {
13491373
return extraConfigFiles.getNormalizedCollection();
13501374
}
13511375

1376+
@Internal
1377+
public Map<String, File> getExtraConfigFilesMap() {
1378+
return extraConfigFiles;
1379+
}
1380+
13521381
@Override
13531382
@Internal
13541383
public boolean isProcessAlive() {

‎buildSrc/src/main/java/org/opensearch/gradle/testclusters/TestClusterConfiguration.java

+2
Original file line numberDiff line numberDiff line change
@@ -108,6 +108,8 @@ public interface TestClusterConfiguration {
108108

109109
void setPreserveDataDir(boolean preserveDataDir);
110110

111+
void setSecure(boolean secure);
112+
111113
void freeze();
112114

113115
void start();

0 commit comments

Comments
 (0)