diff --git a/bitnami/opensearch/3/debian-12/Dockerfile b/bitnami/opensearch/3/debian-12/Dockerfile index 87a0c79fba03..7ead0b83c7b7 100644 --- a/bitnami/opensearch/3/debian-12/Dockerfile +++ b/bitnami/opensearch/3/debian-12/Dockerfile @@ -9,13 +9,13 @@ ARG OPENSEARCH_PLUGINS ARG TARGETARCH LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bookworm" \ - org.opencontainers.image.created="2026-06-11T03:55:14Z" \ + org.opencontainers.image.created="2026-06-15T20:26:19Z" \ org.opencontainers.image.description="Application packaged by Broadcom, Inc." \ org.opencontainers.image.documentation="https://github.com/bitnami/containers/tree/main/bitnami/opensearch/README.md" \ org.opencontainers.image.source="https://github.com/bitnami/containers/tree/main/bitnami/opensearch" \ org.opencontainers.image.title="opensearch" \ org.opencontainers.image.vendor="Broadcom, Inc." \ - org.opencontainers.image.version="3.6.0" + org.opencontainers.image.version="3.7.0" ENV HOME="/" \ OS_ARCH="${TARGETARCH:-amd64}" \ @@ -33,7 +33,7 @@ RUN --mount=type=secret,id=downloads_url,env=SECRET_DOWNLOADS_URL \ COMPONENTS=( \ "yq-4.53.3-1-linux-${OS_ARCH}-debian-12" \ "jre-21.0.11-11-1-linux-${OS_ARCH}-debian-12" \ - "opensearch-3.6.0-0-linux-${OS_ARCH}-debian-12" \ + "opensearch-3.7.0-0-linux-${OS_ARCH}-debian-12" \ ) ; \ for COMPONENT in "${COMPONENTS[@]}"; do \ if [ ! -f "${COMPONENT}.tar.gz" ]; then \ @@ -52,9 +52,9 @@ RUN find / -perm /6000 -type f -exec chmod a-s {} \; || true COPY rootfs / RUN /opt/bitnami/scripts/opensearch/postunpack.sh RUN /opt/bitnami/scripts/java/postunpack.sh -ENV APP_VERSION="3.6.0" \ +ENV APP_VERSION="3.7.0" \ BITNAMI_APP_NAME="opensearch" \ - IMAGE_REVISION="7" \ + IMAGE_REVISION="0" \ JAVA_HOME="/opt/bitnami/java" \ LD_LIBRARY_PATH="/opt/bitnami/opensearch/plugins/opensearch-knn/lib" \ OPENSEARCH_JAVA_HOME="/opt/bitnami/java" diff --git a/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/opensearch-3.6.0-0-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/opensearch-3.6.0-0-linux-amd64-debian-12.tar.gz.sha256 deleted file mode 100644 index 63981a0e4175..000000000000 --- a/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/opensearch-3.6.0-0-linux-amd64-debian-12.tar.gz.sha256 +++ /dev/null @@ -1 +0,0 @@ -ce2396d7413e5284206c7e2fe252a6730405ffe4756bd83c46d418d53d1176ad opensearch-3.6.0-0-linux-amd64-debian-12.tar.gz diff --git a/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/opensearch-3.6.0-0-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/opensearch-3.6.0-0-linux-arm64-debian-12.tar.gz.sha256 deleted file mode 100644 index 22e65195046e..000000000000 --- a/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/opensearch-3.6.0-0-linux-arm64-debian-12.tar.gz.sha256 +++ /dev/null @@ -1 +0,0 @@ -c1f7cd521f2be1d9be4fd736dc66e59d06f3c686b28d228bc40cc303065ceb1c opensearch-3.6.0-0-linux-arm64-debian-12.tar.gz diff --git a/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/opensearch-3.7.0-0-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/opensearch-3.7.0-0-linux-amd64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..a8e82aa490f5 --- /dev/null +++ b/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/opensearch-3.7.0-0-linux-amd64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +fc1302cd5ad383c8ab357c1181ce6f74d587f845af6824458cb3f797b166cee9 opensearch-3.7.0-0-linux-amd64-debian-12.tar.gz diff --git a/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/opensearch-3.7.0-0-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/opensearch-3.7.0-0-linux-arm64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..17163fac718b --- /dev/null +++ b/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/opensearch-3.7.0-0-linux-arm64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +5da3610c89fa41f34ebc0eb1359acbf4628424c2b8c4b74d2eee2782815d35a8 opensearch-3.7.0-0-linux-arm64-debian-12.tar.gz diff --git a/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/scripts/libpersistence.sh b/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/scripts/libpersistence.sh index 18445e7d27fa..833ee5ab1d65 100644 --- a/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/scripts/libpersistence.sh +++ b/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/scripts/libpersistence.sh @@ -39,7 +39,7 @@ persist_app() { fi pushd "$install_dir" >/dev/null || exit local file_to_persist_relative file_to_persist_destination file_to_persist_destination_folder - local -r tmp_file="/tmp/perms.acl" + local -r acl_file="$(mktemp "${TMPDIR:-/tmp}"/acl.XXXXXXXXXX)" for file_to_persist in "${files_to_persist[@]}"; do if [[ ! -f "$file_to_persist" && ! -d "$file_to_persist" ]]; then error "Cannot persist '${file_to_persist}' because it does not exist" @@ -50,22 +50,22 @@ persist_app() { file_to_persist_destination_folder="$(dirname "$file_to_persist_destination")" # Get original permissions for existing files, which will be applied later # Exclude the root directory with 'sed', to avoid issues when copying the entirety of it to a volume - getfacl -R "$file_to_persist_relative" | sed -E '/# file: (\..+|[^.])/,$!d' > "$tmp_file" + getfacl -R "$file_to_persist_relative" | sed -E '/# file: (\..+|[^.])/,$!d' > "$acl_file" # Copy directories to the volume ensure_dir_exists "$file_to_persist_destination_folder" cp -Lr --preserve=links "$file_to_persist_relative" "$file_to_persist_destination_folder" # Restore permissions pushd "$persist_dir" >/dev/null || exit if am_i_root; then - setfacl --restore="$tmp_file" + setfacl --restore="$acl_file" else # When running as non-root, don't change ownership - setfacl --restore=<(grep -E -v '^# (owner|group):' "$tmp_file") + setfacl --restore=<(grep -E -v '^# (owner|group):' "$acl_file") fi popd >/dev/null || exit done popd >/dev/null || exit - rm -f "$tmp_file" + rm -f "$acl_file" # Install the persisted files into the installation directory, via symlinks restore_persisted_app "$@" } diff --git a/bitnami/opensearch/3/debian-12/rootfs/opt/bitnami/scripts/libopensearch.sh b/bitnami/opensearch/3/debian-12/rootfs/opt/bitnami/scripts/libopensearch.sh index 1aabadc3b3f8..d5fcdf17a03d 100644 --- a/bitnami/opensearch/3/debian-12/rootfs/opt/bitnami/scripts/libopensearch.sh +++ b/bitnami/opensearch/3/debian-12/rootfs/opt/bitnami/scripts/libopensearch.sh @@ -756,6 +756,48 @@ elasticsearch_initialize() { replace_in_file "${DB_CONF_DIR}/jvm.options" "(^.*logs[/]gc.log.*$)" "# \1" fi elasticsearch_set_heap_size + # Write BC FIPS JVM options only when FIPS mode is enabled AND Java is in restricted mode. + # Restricted mode is signalled by JAVA_TOOL_OPTIONS containing "java.security.restricted", + # which the chart sets via common.fips.config when fips.java=restricted. + # Relaxed mode (fips.java=relaxed) uses the non-FIPS BouncyCastle provider and does not + # need the BC FIPS module path. + if is_boolean_yes "${ELASTICSEARCH_ENABLE_FIPS_MODE:-false}" && \ + [[ "${JAVA_TOOL_OPTIONS:-}" == *"java.security.restricted"* ]]; then + info "Writing BC FIPS JVM options to ${DB_CONF_DIR}/jvm.options.d/bc-fips.options..." + # BC FIPS JARs are placed into ${BITNAMI_ROOT_DIR}/elasticsearch/lib/ at container start by the + # prepare-bcfips-lib initContainer (see charts-private extra-init-vals7.yaml). This makes + # them named modules (org.bouncycastle.fips.core etc.) in the ES server layer, which is + # required for the es.entitlements.policy.server patch to work. + # The patch grants manage_threads to org.bouncycastle.fips.core so DisposalDaemon can + # call Thread.setDaemon() without triggering NotEntitledException. + # --module-path is NOT written here; BC FIPS is already in lib/ (server layer) via the + # initContainer, and JAVA_TOOL_OPTIONS provides it for CLI tools and the boot layer. + # The version is detected at runtime from the installed JAR filename so the patch + # never goes stale on upgrades. We avoid calling elasticsearch_get_version() here + # because at this point the BC FIPS JARs are already in lib/ (server layer via the + # prepare-bcfips-lib initContainer), and running the elasticsearch binary without + # the entitlement patch would trigger DisposalDaemon. → NotEntitledException + # before the version string is ever printed (chicken-and-egg problem). + local es_version + es_version="$(ls "${DB_BASE_DIR}/lib/elasticsearch-"*.jar 2>/dev/null | grep -oP '\d+\.\d+\.\d+' | head -1)" + if [[ -z "$es_version" ]]; then + warn "Could not detect Elasticsearch version from lib/; skipping entitlement patch" + return + fi + local bc_fips_entitlement_patch + bc_fips_entitlement_patch="$(printf 'versions:\n - %s\npolicy:\n org.bouncycastle.fips.core:\n - manage_threads\n' "${es_version}" | base64 -w 0)" + + cat > "${DB_CONF_DIR}/jvm.options.d/bc-fips.options" <