Add SearchGuard conf for Jaeger to ES image

[pavolloffay]

https://jira.coreos.com/browse/LOG-327

Signed-off-by: Pavol Loffay [email protected]

[openshift-ci-robot]

Hi @pavolloffay. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[pavolloffay]

cc @ewolinetz

[ewolinetz]

/ok-to-test

[ewolinetz]

lgtm @jcantrill can you confirm this is all thats required on our side?

edit: asked for a change to restrict the index pattern

[jcantrill]

/lgtm

[ewolinetz]

/hold

[objectiser]

@ewolinetz Just wanted to check the implications for multitenancy, to protect one tenants data from another.

One approach is that the index prefix is specific to the tenant - as we would need to make sure the index patterns in SG supports that. However this assumes the Jaeger server is configured by something that controls the valid index prefix. Which maybe fine when used with Istio (service mesh), but not sure if Jaeger is configured for standalone usage outside of Istio.

Are there any other ways that searchguard would need to be configured to ensure that the data from one tenant is protected from another? For example, if each tenant used a different client certificate, but possibly the same index prefix, would it be possible to still restrict access to the information generated by the separate tenants?

[jcantrill]

Are there any other ways that searchguard would need to be configured to ensure that the data from one tenant is protected from another? For example, if each tenant used a different client certificate, but possibly the same index prefix, would it be possible to still restrict access to the information generated by the separate tenants?

No, because access is restricted based on the index and not something like the document type or field. Searchguard is capable of document and field level security but those are enterprise licensed features. Client certificates do not make a difference because SG resolves permissions to the index and the matches that to a user or group. Even if you declared separate roles and rolemappings the permissions will resolve to the same set of indices.

[ewolinetz]

/lgtm

[ewolinetz]

/retest

[ewolinetz]

/retest

[ewolinetz]

can you squash your commits?

[pavolloffay]

@ewolinetz done

[ewolinetz]

/lgtm

[jcantrill]

/hold cancel

[jcantrill]

/retest

[openshift-ci-robot]

@pavolloffay: The following tests failed, say /retest to rerun them all:

Test name	Commit	Details	Rerun command
ci/prow/rhel-images	21b704c	link	/test rhel-images
ci/prow/full-integ-aws	21b704c	link	/test full-integ-aws
ci/prow/e2e-aws	21b704c	link	/test e2e-aws

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.