Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update log4j #2806

Merged
merged 20 commits into from
Dec 30, 2021
Merged

Update log4j #2806

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
36ef78e
Update log4j
rafzei Dec 20, 2021
4d6b4c1
Add log4j patch to upgrade
rafzei Dec 21, 2021
3a3ced9
Changelog update
rafzei Dec 21, 2021
c37fec4
Update ansible/playbooks/roles/opendistro_for_elasticsearch/tasks/log…
seriva Dec 29, 2021
816d1c4
Update ansible/playbooks/roles/opendistro_for_elasticsearch/tasks/log…
seriva Dec 29, 2021
394d890
Update ansible/playbooks/roles/opendistro_for_elasticsearch/tasks/log…
seriva Dec 29, 2021
4830d13
Update ansible/playbooks/roles/opendistro_for_elasticsearch/tasks/log…
seriva Dec 29, 2021
31c6dae
Update ansible/playbooks/roles/upgrade/tasks/opendistro_for_elasticse…
seriva Dec 29, 2021
64f5a63
Update ansible/playbooks/roles/upgrade/tasks/opendistro_for_elasticse…
seriva Dec 29, 2021
b6c3046
Update ansible/playbooks/roles/opendistro_for_elasticsearch/tasks/log…
seriva Dec 29, 2021
a2cb336
Update ansible/playbooks/roles/opendistro_for_elasticsearch/tasks/con…
seriva Dec 29, 2021
614c8fc
Merge branch 'develop' into 2788-odfe
seriva Dec 29, 2021
13d90d3
Update ansible/playbooks/roles/opendistro_for_elasticsearch/tasks/log…
seriva Dec 29, 2021
ad7206a
Rename log4j-patch.yml to patch-log4j.yml
seriva Dec 29, 2021
fe5d508
Update requirements.x86_64.txt
seriva Dec 29, 2021
d9c157a
Update requirements.x86_64.txt
seriva Dec 29, 2021
e166c05
Update requirements.x86_64.txt
seriva Dec 29, 2021
822b46a
Update requirements.aarch64.txt
seriva Dec 29, 2021
a0b5626
Update main.yml
seriva Dec 29, 2021
e16e3f0
Update patch-log4j.yml
seriva Dec 29, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions ansible/playbooks/roles/opendistro_for_elasticsearch/defaults/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,3 +60,4 @@ certificates:
ports:
http: 9200 # defaults to range but we want static port
transport: 9300 # defaults to range but we want static port
log4j_file_name: apache-log4j-2.17.0-bin.tar.gz
3 changes: 3 additions & 0 deletions ansible/playbooks/roles/opendistro_for_elasticsearch/meta/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
---
dependencies:
- role: preflight_facts
14 changes: 9 additions & 5 deletions ansible/playbooks/roles/opendistro_for_elasticsearch/tasks/configure-es.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,20 +102,24 @@
# For apply mode, demo certificate files are removed based only on their names. For upgrade mode,
# public key fingerprints are checked to protect against unintentional deletion (what takes additional time).

# Remove demo certificate files
- include_tasks:
- name: Remove demo certificate files
include_tasks:
file: "{{ is_upgrade_run | ternary('remove-known-demo-certs.yml', 'remove-demo-certs.yml') }}"
when: not certificates.files.demo.opendistro_security.allow_unsafe_democertificates

- name: Include log4j patch
include_tasks: log4j-patch.yml
seriva marked this conversation as resolved.
Show resolved Hide resolved

- name: Restart elasticsearch service
systemd:
name: elasticsearch
state: restarted
register: restart_elasticsearch
when: change_config.changed
or change_jvm_config.changed
or install_elasticsearch_package.changed
or (install_opendistro_packages is defined and install_opendistro_packages.changed)
or log4j_patch.changed
or change_jvm_config.changed
or install_elasticsearch_package.changed
or (install_opendistro_packages is defined and install_opendistro_packages.changed)

- name: Enable and start elasticsearch service
systemd:
Expand Down
68 changes: 68 additions & 0 deletions ansible/playbooks/roles/opendistro_for_elasticsearch/tasks/log4j-patch.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,68 @@

seriva marked this conversation as resolved.
Show resolved Hide resolved
- name: Log4j patch
seriva marked this conversation as resolved.
Show resolved Hide resolved
block:
- name: "opendistro_for_elasticsearch : Log4j patch - get archive"
seriva marked this conversation as resolved.
Show resolved Hide resolved
include_role:
name: download
tasks_from: download_file
vars:
file_name: "{{ log4j_file_name }}"

- name: Log4j patch - extract archive
seriva marked this conversation as resolved.
Show resolved Hide resolved
unarchive:
dest: /tmp/
src: "{{ download_directory }}/{{ log4j_file_name }}"
remote_src: true
list_files: true
register: unarchive_list_files

- name: Log4j patch - Copy new jars
seriva marked this conversation as resolved.
Show resolved Hide resolved
register: log4j_patch
copy:
src: "{{ item.src }}"
dest: "{{ item.dest }}"
owner: elasticsearch
group: root
mode: u=rw,g=r,o=
remote_src: true
loop:
- { src: "{{ download_directory }}/{{ log4j_api }}", dest: /usr/share/elasticsearch/lib/ }
- { src: "{{ download_directory }}/{{ log4j_api }}", dest: /usr/share/elasticsearch/performance-analyzer-rca/lib/ }
- { src: "{{ download_directory }}/{{ log4j_api }}", dest: /usr/share/elasticsearch/plugins/opendistro-performance-analyzer/performance-analyzer-rca/lib/ }
- { src: "{{ download_directory }}/{{ log4j_core }}", dest: /usr/share/elasticsearch/lib/ }
- { src: "{{ download_directory }}/{{ log4j_core }}", dest: /usr/share/elasticsearch/performance-analyzer-rca/lib/ }
- { src: "{{ download_directory }}/{{ log4j_core }}", dest: /usr/share/elasticsearch/plugins/opendistro-performance-analyzer/performance-analyzer-rca/lib/ }
- { src: "{{ download_directory }}/{{ log4j_slfj_impl }}", dest: /usr/share/elasticsearch/plugins/opendistro_security/ }
vars:
log4j_core: "{{ unarchive_list_files.files | select('contains', 'log4j-api-2.17.0.jar') | first }}"
log4j_api: "{{ unarchive_list_files.files | select('contains', 'log4j-core-2.17.0.jar') | first }}"
log4j_slfj_impl: "{{ unarchive_list_files.files | select('contains', 'log4j-slf4j-impl-2.17.0.jar') | first }}"

- name: Log4j patch - cleanup
block:
- name: Log4j patch - remove old jars
seriva marked this conversation as resolved.
Show resolved Hide resolved
file:
state: absent
path: "{{ item }}"
loop:
- /usr/share/elasticsearch/plugins/opendistro-performance-analyzer/performance-analyzer-rca/lib/log4j-api-2.13.0.jar
- /usr/share/elasticsearch/plugins/opendistro-performance-analyzer/performance-analyzer-rca/lib/log4j-core-2.13.0.jar
- /usr/share/elasticsearch/performance-analyzer-rca/lib/log4j-api-2.13.0.jar
- /usr/share/elasticsearch/performance-analyzer-rca/lib/log4j-core-2.13.0.jar
- /usr/share/elasticsearch/lib/log4j-api-2.11.1.jar
- /usr/share/elasticsearch/lib/log4j-core-2.11.1.jar
- /usr/share/elasticsearch/plugins/opendistro_security/log4j-slf4j-impl-2.11.1.jar
rafzei marked this conversation as resolved.
Show resolved Hide resolved

- name: Log4j patch - Delete temporary dir
seriva marked this conversation as resolved.
Show resolved Hide resolved
file:
dest: "{{ download_directory }}/{{ _archive_root_dir }}"
state: absent
vars:
_archive_root_dir: >-
{{ unarchive_list_files.files | first | dirname }}

- name: Restart opendistro-performance-analyzer service
systemd:
name: opendistro-performance-analyzer
state: restarted
when: log4j_patch.changed
1 change: 1 addition & 0 deletions .../playbooks/roles/repository/files/download-requirements/centos-7/requirements.aarch64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -165,6 +165,7 @@ https://archive.apache.org/dist/ignite/2.9.1/apache-ignite-2.9.1-bin.zip
https://releases.hashicorp.com/vault/1.7.0/vault_1.7.0_linux_arm64.zip
https://get.helm.sh/helm-v3.2.0-linux-arm64.tar.gz
https://github.com/hashicorp/vault-helm/archive/v0.11.0.tar.gz
https://dlcdn.apache.org/logging/log4j/2.17.0/apache-log4j-2.17.0-bin.tar.gz
# --- Helm charts ---
https://charts.bitnami.com/bitnami/node-exporter-1.1.2.tgz
https://helm.elastic.co/helm/filebeat/filebeat-7.9.2.tgz
Expand Down
1 change: 1 addition & 0 deletions ...e/playbooks/roles/repository/files/download-requirements/centos-7/requirements.x86_64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,6 +166,7 @@ https://archive.apache.org/dist/ignite/2.9.1/apache-ignite-2.9.1-bin.zip
https://releases.hashicorp.com/vault/1.7.0/vault_1.7.0_linux_amd64.zip
https://get.helm.sh/helm-v3.2.0-linux-amd64.tar.gz
https://github.com/hashicorp/vault-helm/archive/v0.11.0.tar.gz
https://dlcdn.apache.org/logging/log4j/2.17.0/apache-log4j-2.17.0-bin.tar.gz
# --- Helm charts ---
https://helm.elastic.co/helm/filebeat/filebeat-7.9.2.tgz
https://charts.bitnami.com/bitnami/node-exporter-1.1.2.tgz
Expand Down
1 change: 1 addition & 0 deletions ...e/playbooks/roles/repository/files/download-requirements/redhat-7/requirements.x86_64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,6 +162,7 @@ https://archive.apache.org/dist/ignite/2.9.1/apache-ignite-2.9.1-bin.zip
https://releases.hashicorp.com/vault/1.7.0/vault_1.7.0_linux_amd64.zip
https://get.helm.sh/helm-v3.2.0-linux-amd64.tar.gz
https://github.com/hashicorp/vault-helm/archive/v0.11.0.tar.gz
https://dlcdn.apache.org/logging/log4j/2.17.0/apache-log4j-2.17.0-bin.tar.gz
# --- Helm charts ---
https://helm.elastic.co/helm/filebeat/filebeat-7.9.2.tgz
https://charts.bitnami.com/bitnami/node-exporter-1.1.2.tgz
Expand Down
1 change: 1 addition & 0 deletions ...aybooks/roles/repository/files/download-requirements/ubuntu-18.04/requirements.x86_64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -225,6 +225,7 @@ https://archive.apache.org/dist/ignite/2.9.1/apache-ignite-2.9.1-bin.zip
https://releases.hashicorp.com/vault/1.7.0/vault_1.7.0_linux_amd64.zip
https://get.helm.sh/helm-v3.2.0-linux-amd64.tar.gz
https://github.com/hashicorp/vault-helm/archive/v0.11.0.tar.gz
https://dlcdn.apache.org/logging/log4j/2.17.0/apache-log4j-2.17.0-bin.tar.gz
# --- Helm charts ---
https://charts.bitnami.com/bitnami/node-exporter-1.1.2.tgz
https://helm.elastic.co/helm/filebeat/filebeat-7.9.2.tgz
Expand Down
13 changes: 13 additions & 0 deletions ansible/playbooks/roles/upgrade/tasks/opendistro_for_elasticsearch-01.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,19 @@
file: roles/opendistro_for_elasticsearch/defaults/main.yml
name: odfe_defaults

- name: ODFE | Log4j patch
seriva marked this conversation as resolved.
Show resolved Hide resolved
include_role:
name: opendistro_for_elasticsearch
tasks_from: log4j-patch
seriva marked this conversation as resolved.
Show resolved Hide resolved
when: odfe_defaults.log4j_file_name is defined

- name: Restart elasticsearch service
systemd:
name: elasticsearch
state: restarted
register: restart_elasticsearch
when: odfe_defaults.log4j_file_name is defined and log4j_patch.changed

- name: ODFE | Print elasticsearch-oss versions
debug:
msg:
Expand Down
2 changes: 2 additions & 0 deletions docs/changelogs/CHANGELOG-1.3.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,8 @@
- [#2748](https://github.com/epiphany-platform/epiphany/issues/2748) - Upgrade Kafka exporter to the version 1.4.2
- [#2750](https://github.com/epiphany-platform/epiphany/issues/2750) - Upgrade JMX exporter to the newest version
- [#2699](https://github.com/epiphany-platform/epiphany/issues/2699) - Upgrade Grafana to 8.3.2
- [#2788](https://github.com/epiphany-platform/epiphany/issues/2788) - Upgrade Log4j in Open Distro for Elasticsearch


### Removed

Expand Down