From 21b704c530e6ab87157baa8d65e2f4923b5c89a8 Mon Sep 17 00:00:00 2001
From: Pavol Loffay <ploffay@redhat.com>
Date: Tue, 29 Jan 2019 10:32:37 +0100
Subject: [PATCH] Add SearchGuard rules for jaeger

Signed-off-by: Pavol Loffay <ploffay@redhat.com>
---
 elasticsearch/init/0001-jaeger              | 29 +++++++++++++++++
 elasticsearch/sgconfig/sg_config.yml        |  5 +++
 elasticsearch/sgconfig/sg_roles.yml         | 35 +++++++++++++++++++++
 elasticsearch/sgconfig/sg_roles_mapping.yml |  4 +++
 4 files changed, 73 insertions(+)
 create mode 100755 elasticsearch/init/0001-jaeger

diff --git a/elasticsearch/init/0001-jaeger b/elasticsearch/init/0001-jaeger
new file mode 100755
index 000000000..35bcc0f2e
--- /dev/null
+++ b/elasticsearch/init/0001-jaeger
@@ -0,0 +1,29 @@
+#!/bin/bash
+#
+# Copyright 2018 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+script=$(basename $0)
+
+source "logging"
+info "Starting init script: ${script}"
+
+if [ -n "${NAMESPACE:-}" ] ; then
+ sed -i -e 's/namespace:.*/namespace: '"$NAMESPACE"'/' ${HOME}/sgconfig/sg_config.yml
+else
+  error "NAMESPACE variable is not set. Failed to substitute it in Jaeger SearchGuard config"
+fi
+
+info "Completed init script: ${script}"
diff --git a/elasticsearch/sgconfig/sg_config.yml b/elasticsearch/sgconfig/sg_config.yml
index c47b812ef..44615e437 100644
--- a/elasticsearch/sgconfig/sg_config.yml
+++ b/elasticsearch/sgconfig/sg_config.yml
@@ -20,6 +20,11 @@ searchguard:
                prometheus:
                  verb: get
                  resource: /metrics
+               jaeger:
+                 verb: get
+                 resource: jaeger
+                 namespace: set-in-run-script
+                 resourceAPIGroup: elasticsearch.jaegertracing.io
       authentication_domain_basic_internal:
         enabled: true
         order: 1
diff --git a/elasticsearch/sgconfig/sg_roles.yml b/elasticsearch/sgconfig/sg_roles.yml
index d3582026c..95e39215f 100644
--- a/elasticsearch/sgconfig/sg_roles.yml
+++ b/elasticsearch/sgconfig/sg_roles.yml
@@ -49,6 +49,41 @@ sg_role_admin:
   cluster:
     - CLUSTER_ALL
 
+sg_role_jaeger:
+  cluster:
+    - indices:data/write/bulk
+    - SEARCH
+    - CLUSTER_MONITOR
+  indices:
+    '*jaeger-span-*':
+      '*':
+        - CRUD
+        - CREATE_INDEX
+        - READ
+        - SEARCH
+        - MANAGE
+    '*jaeger-service-*':
+      '*':
+        - CRUD
+        - CREATE_INDEX
+        - READ
+        - SEARCH
+        - MANAGE
+    '*jaeger-span-archive':
+      '*':
+        - CRUD
+        - CREATE_INDEX
+        - READ
+        - SEARCH
+        - MANAGE
+    '*jaeger-span-archive-*':
+      '*':
+        - CRUD
+        - CREATE_INDEX
+        - READ
+        - SEARCH
+        - MANAGE
+
 sg_project_operations:
   indices:
     '?operations?*':
diff --git a/elasticsearch/sgconfig/sg_roles_mapping.yml b/elasticsearch/sgconfig/sg_roles_mapping.yml
index 38b3f5081..d6b841ee6 100644
--- a/elasticsearch/sgconfig/sg_roles_mapping.yml
+++ b/elasticsearch/sgconfig/sg_roles_mapping.yml
@@ -20,3 +20,7 @@ sg_role_admin:
 sg_role_prometheus:
   backendroles:
     - 'prometheus'
+
+sg_role_jaeger:
+  backendroles:
+    - 'jaeger'