Merge pull request #1500 from pavolloffay/jaeger-poc

Add SearchGuard conf for Jaeger to ES image

elasticsearch/init/0001-jaeger

@@ -0,0 +1,29 @@
+#!/bin/bash
+#
+# Copyright 2018 Red Hat, Inc. and/or its affiliates
+# and other contributors as indicated by the @author tags.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+script=$(basename $0)
+
+source "logging"
+info "Starting init script: ${script}"
+
+if [ -n "${NAMESPACE:-}" ] ; then
+ sed -i -e 's/namespace:.*/namespace: '"$NAMESPACE"'/' ${HOME}/sgconfig/sg_config.yml
+else
+  error "NAMESPACE variable is not set. Failed to substitute it in Jaeger SearchGuard config"
+fi
+
+info "Completed init script: ${script}"

elasticsearch/sgconfig/sg_config.yml

@@ -20,6 +20,11 @@ searchguard:
                prometheus:
                  verb: get
                  resource: /metrics
+               jaeger:
+                 verb: get
+                 resource: jaeger
+                 namespace: set-in-run-script
+                 resourceAPIGroup: elasticsearch.jaegertracing.io
       authentication_domain_basic_internal:
         enabled: true
         order: 1

elasticsearch/sgconfig/sg_roles.yml

@@ -49,6 +49,41 @@ sg_role_admin:
   cluster:
     - CLUSTER_ALL
 
+sg_role_jaeger:
+  cluster:
+    - indices:data/write/bulk
+    - SEARCH
+    - CLUSTER_MONITOR
+  indices:
+    '*jaeger-span-*':
+      '*':
+        - CRUD
+        - CREATE_INDEX
+        - READ
+        - SEARCH
+        - MANAGE
+    '*jaeger-service-*':
+      '*':
+        - CRUD
+        - CREATE_INDEX
+        - READ
+        - SEARCH
+        - MANAGE
+    '*jaeger-span-archive':
+      '*':
+        - CRUD
+        - CREATE_INDEX
+        - READ
+        - SEARCH
+        - MANAGE
+    '*jaeger-span-archive-*':
+      '*':
+        - CRUD
+        - CREATE_INDEX
+        - READ
+        - SEARCH
+        - MANAGE
+
 sg_project_operations:
   indices:
     '?operations?*':

elasticsearch/sgconfig/sg_roles_mapping.yml

@@ -20,3 +20,7 @@ sg_role_admin:
 sg_role_prometheus:
   backendroles:
     - 'prometheus'
+
+sg_role_jaeger:
+  backendroles:
+    - 'jaeger'