-
Notifications
You must be signed in to change notification settings - Fork 107
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* makefile: add cluster.get-cert to copy the admin cert out of the container Signed-off-by: Jakob Hahn <[email protected]> * github/workflows: use cluster-get-cert as it is needed for security tests Signed-off-by: Jakob Hahn <[email protected]> * opensearch: add ToPointer function so it can be reused by plugins Signed-off-by: Jakob Hahn <[email protected]> * golangci-lint: update config to expluce plugin security from dupl checks Signed-off-by: Jakob Hahn <[email protected]> * plugins/security: add base Signed-off-by: Jakob Hahn <[email protected]> * plugins/security: add account functions Signed-off-by: Jakob Hahn <[email protected]> * plugins/security: add tenants functions Signed-off-by: Jakob Hahn <[email protected]> * plugins/security: add ssl functions Signed-off-by: Jakob Hahn <[email protected]> * plugins/security: add securityconfig functions Signed-off-by: Jakob Hahn <[email protected]> * plugins/security: add rolesmapping functions Signed-off-by: Jakob Hahn <[email protected]> * plugins/security: add roles functions Signed-off-by: Jakob Hahn <[email protected]> * plugins/security: add nodesdn functions Signed-off-by: Jakob Hahn <[email protected]> * plugins/security: add internalusers functions Signed-off-by: Jakob Hahn <[email protected]> * plugins/security: add health functions Signed-off-by: Jakob Hahn <[email protected]> * plugins/security: add flushcache functions Signed-off-by: Jakob Hahn <[email protected]> * plugins/security: add audit functions Signed-off-by: Jakob Hahn <[email protected]> * plugins/security: add actiongroups functions Signed-off-by: Jakob Hahn <[email protected]> * add changelog Signed-off-by: Jakob Hahn <[email protected]> * ci/opensearch: adjust healthcheck to use admin cert instread of user Signed-off-by: Jakob Hahn <[email protected]> * ci/opensearch: set opensearch security settings for testing Signed-off-by: Jakob Hahn <[email protected]> * github/workflows: get integration coverage from secure test Signed-off-by: Jakob Hahn <[email protected]> --------- Signed-off-by: Jakob Hahn <[email protected]>
- Loading branch information
Showing
71 changed files
with
4,908 additions
and
18 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,25 +1,27 @@ | ||
| ARG OPENSEARCH_VERSION | ||
| FROM opensearchproject/opensearch:${OPENSEARCH_VERSION} | ||
|
|
||
| ARG OPENSEARCH_VERSION | ||
| ARG opensearch_path=/usr/share/opensearch | ||
| ARG SECURE_INTEGRATION | ||
| ENV SECURE_INTEGRATION=$SECURE_INTEGRATION | ||
| ARG OPENSEARCH_INITIAL_ADMIN_PASSWORD | ||
|
|
||
| # Starting in 2.12.0 security demo requires an initial admin password, which is set as myStrongPassword123! | ||
| # Some opensearch secuirty settings are only present since 2.8.0 and causes older versions to brake if the setting is present | ||
| # https://apple.stackexchange.com/a/123408/11374 | ||
| RUN if [ "$SECURE_INTEGRATION" != "true" ] ; then \ | ||
| $opensearch_path/bin/opensearch-plugin remove opensearch-security; \ | ||
| else \ | ||
| $opensearch_path/opensearch-onetime-setup.sh; \ | ||
| echo "plugins.security.nodes_dn_dynamic_config_enabled: true" | tee -a $opensearch_path/config/opensearch.yml > /dev/null; \ | ||
| echo "plugins.security.unsupported.restapi.allow_securityconfig_modification: true" | tee -a $opensearch_path/config/opensearch.yml > /dev/null; \ | ||
| echo "plugins.security.ssl_cert_reload_enabled: true" | tee -a $opensearch_path/config/opensearch.yml > /dev/null; \ | ||
| function version { echo "$@" | awk -F. '{ printf("%d%03d%03d%03d\n", $1,$2,$3,$4); }'; }; \ | ||
| if [ $(version $OPENSEARCH_VERSION) -ge $(version "2.12.0") ] || [ $OPENSEARCH_VERSION == "latest" ]; then \ | ||
| echo user admin:myStrongPassword123! > curl.conf ; \ | ||
| else \ | ||
| echo user admin:admin > curl.conf ; \ | ||
| fi\ | ||
| if [ $(version $OPENSEARCH_VERSION) -ge $(version "2.8.0") ] || [ $OPENSEARCH_VERSION == "latest" ]; then \ | ||
| echo "plugins.security.restapi.admin.enabled: true" | tee -a $opensearch_path/config/opensearch.yml > /dev/null; \ | ||
| fi \ | ||
| fi | ||
|
|
||
| HEALTHCHECK --start-period=20s --interval=30s \ | ||
| CMD curl -sf -retry 5 --max-time 5 --retry-delay 5 --retry-max-time 30 \ | ||
| $(if $SECURE_INTEGRATION; then echo "-K curl.conf -k https://"; fi)"localhost:9200" \ | ||
| $(if $SECURE_INTEGRATION; then echo "--cert config/kirk.pem --key config/kirk-key.pem -k https://"; fi)"localhost:9200" \ | ||
| || bash -c 'kill -s 15 -1 && (sleep 10; kill -s 9 -1)' |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,80 @@ | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
| // | ||
| // The OpenSearch Contributors require contributions made to | ||
| // this file be licensed under the Apache-2.0 license or a | ||
| // compatible open source license. | ||
|
|
||
| package security | ||
|
|
||
| import ( | ||
| "context" | ||
| "fmt" | ||
|
|
||
| "github.com/opensearch-project/opensearch-go/v3" | ||
| ) | ||
|
|
||
| // Config represents the client configuration | ||
| type Config struct { | ||
| Client opensearch.Config | ||
| } | ||
|
|
||
| // Client represents the security Client summarizing all API calls | ||
| type Client struct { | ||
| Client *opensearch.Client | ||
| Account accountClient | ||
| ActionGroups actiongroupsClient | ||
| Audit auditClient | ||
| InternalUsers internalusersClient | ||
| NodesDN nodesdnClient | ||
| Roles rolesClient | ||
| RolesMapping rolesmappingClient | ||
| SecurityConfig securityconfigClient | ||
| SSL sslClient | ||
| Tenants tenantsClient | ||
| } | ||
|
|
||
| // clientInit inits the Client with all sub clients | ||
| func clientInit(rootClient *opensearch.Client) *Client { | ||
| client := &Client{ | ||
| Client: rootClient, | ||
| } | ||
| client.Account = accountClient{apiClient: client} | ||
| client.ActionGroups = actiongroupsClient{apiClient: client} | ||
| client.Audit = auditClient{apiClient: client} | ||
| client.InternalUsers = internalusersClient{apiClient: client} | ||
| client.NodesDN = nodesdnClient{apiClient: client} | ||
| client.Roles = rolesClient{apiClient: client} | ||
| client.RolesMapping = rolesmappingClient{apiClient: client} | ||
| client.SecurityConfig = securityconfigClient{apiClient: client} | ||
| client.SSL = sslClient{apiClient: client} | ||
| client.Tenants = tenantsClient{apiClient: client} | ||
| return client | ||
| } | ||
|
|
||
| // NewClient returns a security client | ||
| func NewClient(config Config) (*Client, error) { | ||
| rootClient, err := opensearch.NewClient(config.Client) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| return clientInit(rootClient), nil | ||
| } | ||
|
|
||
| // do calls the opensearch.Client.Do() and checks the response for errors | ||
| func (c *Client) do(ctx context.Context, req opensearch.Request, dataPointer any) (*opensearch.Response, error) { | ||
| resp, err := c.Client.Do(ctx, req, dataPointer) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| if resp.IsError() { | ||
| if dataPointer != nil { | ||
| return resp, opensearch.ParseError(resp) | ||
| } else { | ||
| return resp, fmt.Errorf("status: %s", resp.Status()) | ||
| } | ||
| } | ||
|
|
||
| return resp, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,48 @@ | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
| // | ||
| // The OpenSearch Contributors require contributions made to | ||
| // this file be licensed under the Apache-2.0 license or a | ||
| // compatible open source license. | ||
|
|
||
| package security | ||
|
|
||
| import ( | ||
| "net/http" | ||
|
|
||
| "github.com/opensearch-project/opensearch-go/v3" | ||
| ) | ||
|
|
||
| // AccountGetReq represents possible options for the account get request | ||
| type AccountGetReq struct { | ||
| Header http.Header | ||
| } | ||
|
|
||
| // GetRequest returns the *http.Request that gets executed by the client | ||
| func (r AccountGetReq) GetRequest() (*http.Request, error) { | ||
| return opensearch.BuildRequest( | ||
| "GET", | ||
| "/_plugins/_security/api/account", | ||
| nil, | ||
| make(map[string]string), | ||
| r.Header, | ||
| ) | ||
| } | ||
|
|
||
| // AccountGetResp represents the returned struct of the account get response | ||
| type AccountGetResp struct { | ||
| UserName string `json:"user_name"` | ||
| IsReserved bool `json:"is_reserved"` | ||
| IsHidden bool `json:"is_hidden"` | ||
| IsInternaluser bool `json:"is_internal_user"` | ||
| BackendRoles []string `json:"backend_roles"` | ||
| CustomAttributes []string `json:"custom_attribute_names"` | ||
| UserRequestedTenant *string `json:"user_requested_tenant"` | ||
| Tennants map[string]bool `json:"tenants"` | ||
| Roles []string `json:"roles"` | ||
| response *opensearch.Response | ||
| } | ||
|
|
||
| // Inspect returns the Inspect type containing the raw *opensearch.Reponse | ||
| func (r AccountGetResp) Inspect() Inspect { | ||
| return Inspect{Response: r.response} | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,56 @@ | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
| // | ||
| // The OpenSearch Contributors require contributions made to | ||
| // this file be licensed under the Apache-2.0 license or a | ||
| // compatible open source license. | ||
|
|
||
| package security | ||
|
|
||
| import ( | ||
| "bytes" | ||
| "encoding/json" | ||
| "net/http" | ||
|
|
||
| "github.com/opensearch-project/opensearch-go/v3" | ||
| ) | ||
|
|
||
| // AccountPutReq represents possible options for the account put request | ||
| type AccountPutReq struct { | ||
| Body AccountPutBody | ||
|
|
||
| Header http.Header | ||
| } | ||
|
|
||
| // GetRequest returns the *http.Request that gets executed by the client | ||
| func (r AccountPutReq) GetRequest() (*http.Request, error) { | ||
| body, err := json.Marshal(r.Body) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| return opensearch.BuildRequest( | ||
| "PUT", | ||
| "/_plugins/_security/api/account", | ||
| bytes.NewReader(body), | ||
| make(map[string]string), | ||
| r.Header, | ||
| ) | ||
| } | ||
|
|
||
| // AccountPutBody reperensts the request body for AccountPutReq | ||
| type AccountPutBody struct { | ||
| CurrentPassword string `json:"current_password"` | ||
| Password string `json:"password"` | ||
| } | ||
|
|
||
| // AccountPutResp represents the returned struct of the account put response | ||
| type AccountPutResp struct { | ||
| Message string `json:"message"` | ||
| Status string `json:"status"` | ||
| response *opensearch.Response | ||
| } | ||
|
|
||
| // Inspect returns the Inspect type containing the raw *opensearch.Reponse | ||
| func (r AccountPutResp) Inspect() Inspect { | ||
| return Inspect{Response: r.response} | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
| // | ||
| // The OpenSearch Contributors require contributions made to | ||
| // this file be licensed under the Apache-2.0 license or a | ||
| // compatible open source license. | ||
|
|
||
| package security | ||
|
|
||
| import ( | ||
| "context" | ||
| ) | ||
|
|
||
| type accountClient struct { | ||
| apiClient *Client | ||
| } | ||
|
|
||
| // Get executes a get account request with the optional AccountGetReq | ||
| func (c accountClient) Get(ctx context.Context, req *AccountGetReq) (AccountGetResp, error) { | ||
| if req == nil { | ||
| req = &AccountGetReq{} | ||
| } | ||
|
|
||
| var ( | ||
| data AccountGetResp | ||
| err error | ||
| ) | ||
| if data.response, err = c.apiClient.do(ctx, req, &data); err != nil { | ||
| return data, err | ||
| } | ||
|
|
||
| return data, nil | ||
| } | ||
|
|
||
| // Put executes a put account request with the required AccountPutReq | ||
| func (c accountClient) Put(ctx context.Context, req AccountPutReq) (AccountPutResp, error) { | ||
| var ( | ||
| data AccountPutResp | ||
| err error | ||
| ) | ||
| if data.response, err = c.apiClient.do(ctx, req, &data); err != nil { | ||
| return data, err | ||
| } | ||
|
|
||
| return data, nil | ||
| } |
Oops, something went wrong.