feat: TLS support #55

labrenbe · 2025-10-27T14:18:39Z

Description

Add TLS secret operator Volumes & VolumeMounts
Add spec.clusterConfig.tls.secretClass to CRD

Part of #61

Definition of Done Checklist

Not all of these items are applicable to all PRs, the author should update this template to only leave the boxes in that are relevant
Please make sure all these things are done and tick the boxes

Author

Changes are OpenShift compatible
CRD changes approved
- requestedSecretLifetime was already decided in decision: Make autoTls certificate lifetime configurable issues#673.
- SecretClass
CRD documentation for all fields, following the style guide.
Helm chart can be installed and deployed operator works
Integration tests passed (for non trivial changes)
Changes need to be "offline" compatible
Links to generated (nightly) docs added
Release note snippet added

Reviewer

Code contains useful comments
(Integration-)Test cases added
Documentation added or updated. Follows the style guide.
Changelog updated
Cargo.toml only contains references to git tags (not specific commits or branches)

Acceptance

Feature Tracker has been updated
Proper release label has been added
Links to generated (nightly) docs added
Release note snippet added
Add type/deprecation label & add to the deprecation schedule
Add type/experimental label & add to the experimental features tracker

…n-job

siegfriedweber · 2025-10-30T12:35:14Z

rust/operator-binary/src/crd/mod.rs

+    pub struct OpenSearchTls {
+        /// Affects client connections and internal transport connections.
+        /// This setting controls:
+        /// - If TLS encryption is used at all


If secret_class is not set, then TLS is not just disabled but the cluster does not start anymore:

org.opensearch.bootstrap.StartupException: java.lang.IllegalStateException: failed to load plugin class [org.opensearch.security.OpenSearchSecurityPlugin] at org.opensearch.bootstrap.OpenSearch.init(OpenSearch.java:172) ~[opensearch-3.1.0.jar:3.1.0] at org.opensearch.bootstrap.OpenSearch.execute(OpenSearch.java:159) ~[opensearch-3.1.0.jar:3.1.0] at org.opensearch.common.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:110) ~[opensearch-3.1.0.jar:3.1.0] at org.opensearch.cli.Command.mainWithoutErrorHandling(Command.java:138) ~[opensearch-cli-3.1.0.jar:3.1.0] at org.opensearch.cli.Command.main(Command.java:101) ~[opensearch-cli-3.1.0.jar:3.1.0] at org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:125) ~[opensearch-3.1.0.jar:3.1.0] at org.opensearch.bootstrap.OpenSearch.main(OpenSearch.java:91) ~[opensearch-3.1.0.jar:3.1.0] Caused by: java.lang.IllegalStateException: failed to load plugin class [org.opensearch.security.OpenSearchSecurityPlugin] at org.opensearch.plugins.PluginsService.loadPlugin(PluginsService.java:881) ~[opensearch-3.1.0.jar:3.1.0] at org.opensearch.plugins.PluginsService.loadBundle(PluginsService.java:820) ~[opensearch-3.1.0.jar:3.1.0] at org.opensearch.plugins.PluginsService.loadBundles(PluginsService.java:615) ~[opensearch-3.1.0.jar:3.1.0] at org.opensearch.plugins.PluginsService.<init>(PluginsService.java:229) ~[opensearch-3.1.0.jar:3.1.0] at org.opensearch.node.Node.<init>(Node.java:536) ~[opensearch-3.1.0.jar:3.1.0] at org.opensearch.node.Node.<init>(Node.java:464) ~[opensearch-3.1.0.jar:3.1.0] at org.opensearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:249) ~[opensearch-3.1.0.jar:3.1.0] at org.opensearch.bootstrap.Bootstrap.setup(Bootstrap.java:249) ~[opensearch-3.1.0.jar:3.1.0] at org.opensearch.bootstrap.Bootstrap.init(Bootstrap.java:411) ~[opensearch-3.1.0.jar:3.1.0] at org.opensearch.bootstrap.OpenSearch.init(OpenSearch.java:168) ~[opensearch-3.1.0.jar:3.1.0] ... 6 more Caused by: java.lang.reflect.InvocationTargetException at java.base/jdk.internal.reflect.DirectConstructorHandleAccessor.newInstance(DirectConstructorHandleAccessor.java:74) ~[?:?] at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:502) ~[?:?] at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:486) ~[?:?] at org.opensearch.plugins.PluginsService.loadPlugin(PluginsService.java:872) ~[opensearch-3.1.0.jar:3.1.0] at org.opensearch.plugins.PluginsService.loadBundle(PluginsService.java:820) ~[opensearch-3.1.0.jar:3.1.0] at org.opensearch.plugins.PluginsService.loadBundles(PluginsService.java:615) ~[opensearch-3.1.0.jar:3.1.0] at org.opensearch.plugins.PluginsService.<init>(PluginsService.java:229) ~[opensearch-3.1.0.jar:3.1.0] at org.opensearch.node.Node.<init>(Node.java:536) ~[opensearch-3.1.0.jar:3.1.0] at org.opensearch.node.Node.<init>(Node.java:464) ~[opensearch-3.1.0.jar:3.1.0] at org.opensearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:249) ~[opensearch-3.1.0.jar:3.1.0] at org.opensearch.bootstrap.Bootstrap.setup(Bootstrap.java:249) ~[opensearch-3.1.0.jar:3.1.0] at org.opensearch.bootstrap.Bootstrap.init(Bootstrap.java:411) ~[opensearch-3.1.0.jar:3.1.0] at org.opensearch.bootstrap.OpenSearch.init(OpenSearch.java:168) ~[opensearch-3.1.0.jar:3.1.0] ... 6 more Caused by: org.opensearch.OpenSearchException: No SSL configuration found at org.opensearch.security.ssl.SslSettingsManager.loadConfigurations(SslSettingsManager.java:128) ~[?:?] at org.opensearch.security.ssl.SslSettingsManager.buildSslContexts(SslSettingsManager.java:96) ~[?:?] at org.opensearch.security.ssl.SslSettingsManager.<init>(SslSettingsManager.java:83) ~[?:?] at org.opensearch.security.ssl.OpenSearchSecuritySSLPlugin.<init>(OpenSearchSecuritySSLPlugin.java:248) ~[?:?] at org.opensearch.security.OpenSearchSecurityPlugin.<init>(OpenSearchSecurityPlugin.java:347) ~[?:?] at java.base/jdk.internal.reflect.DirectConstructorHandleAccessor.newInstance(DirectConstructorHandleAccessor.java:62) ~[?:?] at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:502) ~[?:?] at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:486) ~[?:?] at org.opensearch.plugins.PluginsService.loadPlugin(PluginsService.java:872) ~[opensearch-3.1.0.jar:3.1.0] at org.opensearch.plugins.PluginsService.loadBundle(PluginsService.java:820) ~[opensearch-3.1.0.jar:3.1.0] at org.opensearch.plugins.PluginsService.loadBundles(PluginsService.java:615) ~[opensearch-3.1.0.jar:3.1.0] at org.opensearch.plugins.PluginsService.<init>(PluginsService.java:229) ~[opensearch-3.1.0.jar:3.1.0] at org.opensearch.node.Node.<init>(Node.java:536) ~[opensearch-3.1.0.jar:3.1.0] at org.opensearch.node.Node.<init>(Node.java:464) ~[opensearch-3.1.0.jar:3.1.0] at org.opensearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:249) ~[opensearch-3.1.0.jar:3.1.0] at org.opensearch.bootstrap.Bootstrap.setup(Bootstrap.java:249) ~[opensearch-3.1.0.jar:3.1.0] at org.opensearch.bootstrap.Bootstrap.init(Bootstrap.java:411) ~[opensearch-3.1.0.jar:3.1.0] at org.opensearch.bootstrap.OpenSearch.init(OpenSearch.java:168) ~[opensearch-3.1.0.jar:3.1.0] ... 6 more

If the security plugin is enabled, then

TLS is optional for the REST layer and mandatory for the transport layer.

https://docs.opensearch.org/3.1/security/configuration/tls/

I would not allow to disable the security plugin, especially if it was enabled before, because then the security index becomes unprotected and confidential data could be leaked.

If it should be possible to disable TLS for the REST layer, then separate SecretClasses are required for the REST and transport layer.

siegfriedweber · 2025-10-30T12:40:47Z

rust/operator-binary/src/crd/mod.rs

    #[derive(Clone, Debug, Default, Deserialize, Eq, JsonSchema, PartialEq, Serialize)]
    #[serde(rename_all = "camelCase")]
    pub struct OpenSearchClusterConfig {
+        pub tls: OpenSearchTls,


The other operators set a comment and default to the SecretClass tls, e.g. https://github.com/stackabletech/kafka-operator/blob/25.7.0/rust/operator-binary/src/crd/mod.rs#L158-L162.

siegfriedweber · 2025-10-30T13:40:57Z

rust/operator-binary/src/crd/mod.rs

                v1alpha1::NodeRole::RemoteClusterClient,
            ])),
+            requested_secret_lifetime: Some(
+                Duration::from_str("15d").expect("should be a valid duration"),


This should default to 1 day like mentioned in the comment.

siegfriedweber · 2025-10-30T13:54:24Z

rust/operator-binary/src/framework.rs

+/// Maximum length of annotation values
+pub const MAX_ANNOTATION_LENGTH: usize = 253;


Annotation values are not restricted by their length.

siegfriedweber · 2025-10-30T14:12:46Z

rust/operator-binary/src/framework.rs

 }
-
+attributed_string_type! {
+    TlsSecretClassName,


I would use the type SecretClassName instead of TlsSecretClassName. TLS is only the backend used by the SecretClass, but also k8sSearch could be used to reference TLS certificates. We can only check that a given string is a valid name for a SecretClass. We cannot check if the SecretClass actually will exist and what its backend will be. We should not define too specific types if we cannot validate them.

siegfriedweber · 2025-10-30T16:29:22Z

rust/operator-binary/src/controller/build/role_group_builder.rs

            ClusterName::from_str_unsafe("my-opensearch-cluster"),
            NamespaceName::from_str_unsafe("default"),
            uuid!("0b1e30e6-326e-4c1a-868d-ad6598b49e8b"),
+            OpenSearchClusterConfig::default(),


By using the default here, which means no TLS, there exists not a single unit test which tests this feature.

siegfriedweber · 2025-10-30T16:31:53Z

rust/operator-binary/src/controller/validate.rs

+    #[snafu(display("failed to set tls secret class"))]
+    ParseTlsSecretClassName { source: crate::framework::Error },


siegfriedweber · 2025-10-31T08:24:12Z

rust/operator-binary/src/controller.rs

    pub name: ClusterName,
    pub namespace: NamespaceName,
    pub uid: Uid,
+    pub cluster_config: OpenSearchClusterConfig,


If OpenSearchClusterConfig is extended in the future, then it will probably contain unvalidated entries. If the whole structure is added now to ValidatedCluster, then it will have to be removed again and all the TLS related code has to be refactored.

Additionally, OpenSearchClusterConfig contains vector_aggregator_config_map_name which is already contained in role_group_configs.logging.vector_container.vector_aggregator_config_map_name.

I would directly add the OpenSearchTls structure here.

siegfriedweber · 2025-10-31T08:28:06Z

tests/templates/kuttl/logging/20-install-opensearch.yaml.j2

              - name: tls
                mountPath: /stackable/opensearch/config/tls
                readOnly: true


not required

siegfriedweber · 2025-10-31T08:28:18Z

tests/templates/kuttl/logging/20-install-opensearch.yaml.j2

          - name: tls
            ephemeral:
              volumeClaimTemplate:
                metadata:
                  annotations:
                    secrets.stackable.tech/class: tls
                spec:
                  storageClassName: secrets.stackable.tech
                  accessModes:
                    - ReadWriteOnce
                  resources:
                    requests:
                      storage: "1"


not required

siegfriedweber

The documentation is missing.
A changelog entry is missing.
If it should be possible to disable TLS on the HTTP port, then an integration test is required for this case.

labrenbe added 9 commits August 14, 2025 18:15

wip: add run-securityadmin job

d45f8fb

configure tls on run-securityadmin

c489b44

add tls secret class to crd

ffa0585

Merge remote-tracking branch 'origin/main' into feat/run-securityadmi…

aaa560f

…n-job

add tls volume to sts

4d7496c

add tls config to opensearch.yml

7f805b8

disable security demo install

c6db525

Merge remote-tracking branch 'origin/main' into feat/run-securityadmi…

1c3e672

…n-job

wip amend integration tests

bbbdbb6

labrenbe self-assigned this Oct 27, 2025

labrenbe added this to Stackable Engineering Oct 27, 2025

labrenbe moved this to Ready for Development in Stackable Engineering Oct 27, 2025

labrenbe moved this from Ready for Development to Development: In Progress in Stackable Engineering Oct 27, 2025

Merge remote-tracking branch 'origin/main' into feat/tls-support

1aeb4db

This was referenced Oct 28, 2025

feat: Add TLS support #25

Closed

OpenSearch operator MVP #1

Open

labrenbe added 5 commits October 28, 2025 12:10

fix smoke test

ab42f5a

restore properties file

97681a3

mount tls volume in default directory of official image

815d243

use tls feature in all integration tests

95986a5

use OPENSEARCH_PATH_CONF for tls config

910a58d

labrenbe requested a review from siegfriedweber October 28, 2025 15:26

labrenbe moved this from Development: In Progress to Development: Waiting for Review in Stackable Engineering Oct 28, 2025

labrenbe marked this pull request as ready for review October 28, 2025 15:26

labrenbe added 2 commits October 28, 2025 16:32

Merge remote-tracking branch 'origin/main' into feat/tls-support

9252b06

fix incorrectly resolved merge conflict

beb2aff

siegfriedweber moved this from Development: Waiting for Review to Development: In Review in Stackable Engineering Oct 29, 2025

siegfriedweber mentioned this pull request Oct 30, 2025

Integrate TLS support #61

Open

2 tasks

siegfriedweber requested changes Oct 31, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

feat: TLS support #55

feat: TLS support #55

Uh oh!

labrenbe commented Oct 27, 2025 •

edited by siegfriedweber

Loading

Uh oh!

siegfriedweber Oct 30, 2025

Uh oh!

siegfriedweber Oct 30, 2025

Uh oh!

siegfriedweber Oct 30, 2025

Uh oh!

siegfriedweber Oct 30, 2025

Uh oh!

siegfriedweber Oct 30, 2025

Uh oh!

siegfriedweber Oct 30, 2025

Uh oh!

siegfriedweber Oct 30, 2025

Uh oh!

siegfriedweber Oct 31, 2025

Uh oh!

siegfriedweber Oct 31, 2025

Uh oh!

siegfriedweber Oct 31, 2025

Uh oh!

siegfriedweber left a comment •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		/// Maximum length of annotation values
		pub const MAX_ANNOTATION_LENGTH: usize = 253;

		#[snafu(display("failed to set tls secret class"))]
		ParseTlsSecretClassName { source: crate::framework::Error },

Uh oh!

feat: TLS support #55

Are you sure you want to change the base?

feat: TLS support #55

Uh oh!

Conversation

labrenbe commented Oct 27, 2025 • edited by siegfriedweber Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Definition of Done Checklist

Author

Reviewer

Acceptance

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

siegfriedweber left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

labrenbe commented Oct 27, 2025 •

edited by siegfriedweber

Loading

siegfriedweber left a comment •

edited

Loading