diff --git a/bitnami/elasticsearch/8/debian-11/Dockerfile b/bitnami/elasticsearch/8/debian-11/Dockerfile index 9d34c5762105..722de711234b 100644 --- a/bitnami/elasticsearch/8/debian-11/Dockerfile +++ b/bitnami/elasticsearch/8/debian-11/Dockerfile @@ -8,10 +8,10 @@ ARG JAVA_EXTRA_SECURITY_DIR="/bitnami/java/extra-security" ARG TARGETARCH LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bullseye" \ - org.opencontainers.image.created="2023-07-11T09:08:28Z" \ + org.opencontainers.image.created="2023-07-14T10:02:34Z" \ org.opencontainers.image.description="Application packaged by VMware, Inc" \ org.opencontainers.image.licenses="Apache-2.0" \ - org.opencontainers.image.ref.name="8.8.2-debian-11-r4" \ + org.opencontainers.image.ref.name="8.8.2-debian-11-r5" \ org.opencontainers.image.title="elasticsearch" \ org.opencontainers.image.vendor="VMware, Inc." \ org.opencontainers.image.version="8.8.2" @@ -28,7 +28,7 @@ SHELL ["/bin/bash", "-o", "pipefail", "-c"] RUN install_packages ca-certificates curl libasound2-dev libc6 libfreetype6 libfreetype6-dev libgcc1 procps zlib1g RUN mkdir -p /tmp/bitnami/pkg/cache/ && cd /tmp/bitnami/pkg/cache/ && \ COMPONENTS=( \ - "yq-4.34.1-6-linux-${OS_ARCH}-debian-11" \ + "yq-4.34.2-0-linux-${OS_ARCH}-debian-11" \ "java-17.0.7-7-2-linux-${OS_ARCH}-debian-11" \ "elasticsearch-8.8.2-0-linux-${OS_ARCH}-debian-11" \ ) && \ diff --git a/bitnami/elasticsearch/8/debian-11/prebuildfs/opt/bitnami/.bitnami_components.json b/bitnami/elasticsearch/8/debian-11/prebuildfs/opt/bitnami/.bitnami_components.json index 341d5e4d9a1a..1c5c1e11e42e 100644 --- a/bitnami/elasticsearch/8/debian-11/prebuildfs/opt/bitnami/.bitnami_components.json +++ b/bitnami/elasticsearch/8/debian-11/prebuildfs/opt/bitnami/.bitnami_components.json @@ -15,6 +15,6 @@ "arch": "amd64", "distro": "debian-11", "type": "NAMI", - "version": "4.34.1-6" + "version": "4.34.2-0" } } \ No newline at end of file diff --git a/bitnami/elasticsearch/8/debian-11/rootfs/opt/bitnami/scripts/elasticsearch-env.sh b/bitnami/elasticsearch/8/debian-11/rootfs/opt/bitnami/scripts/elasticsearch-env.sh index 5c35bcfcfe81..07d6f54ec130 100644 --- a/bitnami/elasticsearch/8/debian-11/rootfs/opt/bitnami/scripts/elasticsearch-env.sh +++ b/bitnami/elasticsearch/8/debian-11/rootfs/opt/bitnami/scripts/elasticsearch-env.sh @@ -37,21 +37,17 @@ elasticsearch_env_vars=( ELASTICSEARCH_MAX_TIMEOUT ELASTICSEARCH_LOCK_ALL_MEMORY ELASTICSEARCH_DISABLE_JVM_HEAP_DUMP - ELASTICSEARCH_ACTION_DESTRUCTIVE_REQUIRES_NAME ELASTICSEARCH_DISABLE_GC_LOGS ELASTICSEARCH_IS_DEDICATED_NODE ELASTICSEARCH_MINIMUM_MASTER_NODES ELASTICSEARCH_NODE_NAME ELASTICSEARCH_FS_SNAPSHOT_REPO_PATH ELASTICSEARCH_NODE_ROLES - ELASTICSEARCH_NODE_TYPE ELASTICSEARCH_PLUGINS - ELASTICSEARCH_KEYS ELASTICSEARCH_TRANSPORT_PORT_NUMBER ELASTICSEARCH_HTTP_PORT_NUMBER - ELASTICSEARCH_PASSWORD ELASTICSEARCH_ENABLE_SECURITY - ELASTICSEARCH_ENABLE_FIPS_MODE + ELASTICSEARCH_PASSWORD ELASTICSEARCH_TLS_VERIFICATION_MODE ELASTICSEARCH_TLS_USE_PEM ELASTICSEARCH_KEYSTORE_PASSWORD @@ -82,6 +78,10 @@ elasticsearch_env_vars=( ELASTICSEARCH_HTTP_TLS_NODE_CERT_LOCATION ELASTICSEARCH_HTTP_TLS_NODE_KEY_LOCATION ELASTICSEARCH_HTTP_TLS_CA_CERT_LOCATION + ELASTICSEARCH_ENABLE_FIPS_MODE + ELASTICSEARCH_KEYS + ELASTICSEARCH_ACTION_DESTRUCTIVE_REQUIRES_NAME + DB_MINIMUM_MANAGER_NODES ) for env_var in "${elasticsearch_env_vars[@]}"; do file_env_var="${env_var}_FILE" @@ -95,86 +95,160 @@ for env_var in "${elasticsearch_env_vars[@]}"; do fi done unset elasticsearch_env_vars +export DB_FLAVOR="elasticsearch" # Paths export ELASTICSEARCH_VOLUME_DIR="/bitnami/elasticsearch" +export DB_VOLUME_DIR="$ELASTICSEARCH_VOLUME_DIR" export ELASTICSEARCH_BASE_DIR="/opt/bitnami/elasticsearch" -export ELASTICSEARCH_CONF_DIR="${ELASTICSEARCH_BASE_DIR}/config" -export ELASTICSEARCH_CERTS_DIR="${ELASTICSEARCH_CERTS_DIR:-${ELASTICSEARCH_CONF_DIR}/certs}" -export ELASTICSEARCH_LOGS_DIR="${ELASTICSEARCH_BASE_DIR}/logs" -export ELASTICSEARCH_PLUGINS_DIR="${ELASTICSEARCH_BASE_DIR}/plugins" -export ELASTICSEARCH_DATA_DIR="${ELASTICSEARCH_VOLUME_DIR}/data" +export DB_BASE_DIR="$ELASTICSEARCH_BASE_DIR" +export ELASTICSEARCH_CONF_DIR="${DB_BASE_DIR}/config" +export DB_CONF_DIR="$ELASTICSEARCH_CONF_DIR" +export ELASTICSEARCH_CERTS_DIR="${ELASTICSEARCH_CERTS_DIR:-${DB_CONF_DIR}/certs}" +export DB_CERTS_DIR="$ELASTICSEARCH_CERTS_DIR" +export ELASTICSEARCH_LOGS_DIR="${DB_BASE_DIR}/logs" +export DB_LOGS_DIR="$ELASTICSEARCH_LOGS_DIR" +export ELASTICSEARCH_PLUGINS_DIR="${DB_BASE_DIR}/plugins" +export DB_PLUGINS_DIR="$ELASTICSEARCH_PLUGINS_DIR" +export ELASTICSEARCH_DATA_DIR="${DB_VOLUME_DIR}/data" +export DB_DATA_DIR="$ELASTICSEARCH_DATA_DIR" export ELASTICSEARCH_DATA_DIR_LIST="${ELASTICSEARCH_DATA_DIR_LIST:-}" -export ELASTICSEARCH_TMP_DIR="${ELASTICSEARCH_BASE_DIR}/tmp" -export ELASTICSEARCH_BIN_DIR="${ELASTICSEARCH_BASE_DIR}/bin" -export ELASTICSEARCH_MOUNTED_PLUGINS_DIR="${ELASTICSEARCH_VOLUME_DIR}/plugins" -export ELASTICSEARCH_CONF_FILE="${ELASTICSEARCH_CONF_DIR}/elasticsearch.yml" -export ELASTICSEARCH_LOG_FILE="${ELASTICSEARCH_LOGS_DIR}/elasticsearch.log" +export DB_DATA_DIR_LIST="$ELASTICSEARCH_DATA_DIR_LIST" +export ELASTICSEARCH_TMP_DIR="${DB_BASE_DIR}/tmp" +export DB_TMP_DIR="$ELASTICSEARCH_TMP_DIR" +export ELASTICSEARCH_BIN_DIR="${DB_BASE_DIR}/bin" +export DB_BIN_DIR="$ELASTICSEARCH_BIN_DIR" +export ELASTICSEARCH_MOUNTED_PLUGINS_DIR="${DB_VOLUME_DIR}/plugins" +export DB_MOUNTED_PLUGINS_DIR="$ELASTICSEARCH_MOUNTED_PLUGINS_DIR" +export ELASTICSEARCH_CONF_FILE="${DB_CONF_DIR}/elasticsearch.yml" +export DB_CONF_FILE="$ELASTICSEARCH_CONF_FILE" +export ELASTICSEARCH_LOG_FILE="${DB_LOGS_DIR}/elasticsearch.log" +export DB_LOG_FILE="$ELASTICSEARCH_LOG_FILE" +export ELASTICSEARCH_PID_FILE="${DB_TMP_DIR}/elasticsearch.pid" +export DB_PID_FILE="$ELASTICSEARCH_PID_FILE" export ELASTICSEARCH_INITSCRIPTS_DIR="/docker-entrypoint-initdb.d" -export PATH="${ELASTICSEARCH_BIN_DIR}:${BITNAMI_ROOT_DIR}/common/bin:$PATH" +export DB_INITSCRIPTS_DIR="$ELASTICSEARCH_INITSCRIPTS_DIR" +export PATH="${DB_BIN_DIR}:${BITNAMI_ROOT_DIR}/common/bin:$PATH" # System users (when running with a privileged user) export ELASTICSEARCH_DAEMON_USER="elasticsearch" +export DB_DAEMON_USER="$ELASTICSEARCH_DAEMON_USER" export ELASTICSEARCH_DAEMON_GROUP="elasticsearch" +export DB_DAEMON_GROUP="$ELASTICSEARCH_DAEMON_GROUP" # Elasticsearch configuration export ELASTICSEARCH_BIND_ADDRESS="${ELASTICSEARCH_BIND_ADDRESS:-}" +export DB_BIND_ADDRESS="$ELASTICSEARCH_BIND_ADDRESS" export ELASTICSEARCH_ADVERTISED_HOSTNAME="${ELASTICSEARCH_ADVERTISED_HOSTNAME:-}" +export DB_ADVERTISED_HOSTNAME="$ELASTICSEARCH_ADVERTISED_HOSTNAME" export ELASTICSEARCH_CLUSTER_HOSTS="${ELASTICSEARCH_CLUSTER_HOSTS:-}" +export DB_CLUSTER_HOSTS="$ELASTICSEARCH_CLUSTER_HOSTS" export ELASTICSEARCH_CLUSTER_MASTER_HOSTS="${ELASTICSEARCH_CLUSTER_MASTER_HOSTS:-}" +export DB_CLUSTER_MASTER_HOSTS="$ELASTICSEARCH_CLUSTER_MASTER_HOSTS" export ELASTICSEARCH_CLUSTER_NAME="${ELASTICSEARCH_CLUSTER_NAME:-}" +export DB_CLUSTER_NAME="$ELASTICSEARCH_CLUSTER_NAME" export ELASTICSEARCH_HEAP_SIZE="${ELASTICSEARCH_HEAP_SIZE:-1024m}" +export DB_HEAP_SIZE="$ELASTICSEARCH_HEAP_SIZE" export ELASTICSEARCH_MAX_ALLOWED_MEMORY_PERCENTAGE="${ELASTICSEARCH_MAX_ALLOWED_MEMORY_PERCENTAGE:-100}" +export DB_MAX_ALLOWED_MEMORY_PERCENTAGE="$ELASTICSEARCH_MAX_ALLOWED_MEMORY_PERCENTAGE" export ELASTICSEARCH_MAX_ALLOWED_MEMORY="${ELASTICSEARCH_MAX_ALLOWED_MEMORY:-}" +export DB_MAX_ALLOWED_MEMORY="$ELASTICSEARCH_MAX_ALLOWED_MEMORY" export ELASTICSEARCH_MAX_TIMEOUT="${ELASTICSEARCH_MAX_TIMEOUT:-60}" +export DB_MAX_TIMEOUT="$ELASTICSEARCH_MAX_TIMEOUT" export ELASTICSEARCH_LOCK_ALL_MEMORY="${ELASTICSEARCH_LOCK_ALL_MEMORY:-no}" +export DB_LOCK_ALL_MEMORY="$ELASTICSEARCH_LOCK_ALL_MEMORY" export ELASTICSEARCH_DISABLE_JVM_HEAP_DUMP="${ELASTICSEARCH_DISABLE_JVM_HEAP_DUMP:-no}" -export ELASTICSEARCH_ACTION_DESTRUCTIVE_REQUIRES_NAME="${ELASTICSEARCH_ACTION_DESTRUCTIVE_REQUIRES_NAME:-}" +export DB_DISABLE_JVM_HEAP_DUMP="$ELASTICSEARCH_DISABLE_JVM_HEAP_DUMP" export ELASTICSEARCH_DISABLE_GC_LOGS="${ELASTICSEARCH_DISABLE_GC_LOGS:-no}" +export DB_DISABLE_GC_LOGS="$ELASTICSEARCH_DISABLE_GC_LOGS" export ELASTICSEARCH_IS_DEDICATED_NODE="${ELASTICSEARCH_IS_DEDICATED_NODE:-no}" +export DB_IS_DEDICATED_NODE="$ELASTICSEARCH_IS_DEDICATED_NODE" +ELASTICSEARCH_MINIMUM_MASTER_NODES="${ELASTICSEARCH_MINIMUM_MASTER_NODES:-"${DB_MINIMUM_MANAGER_NODES:-}"}" export ELASTICSEARCH_MINIMUM_MASTER_NODES="${ELASTICSEARCH_MINIMUM_MASTER_NODES:-}" +export DB_MINIMUM_MASTER_NODES="$ELASTICSEARCH_MINIMUM_MASTER_NODES" export ELASTICSEARCH_NODE_NAME="${ELASTICSEARCH_NODE_NAME:-}" +export DB_NODE_NAME="$ELASTICSEARCH_NODE_NAME" export ELASTICSEARCH_FS_SNAPSHOT_REPO_PATH="${ELASTICSEARCH_FS_SNAPSHOT_REPO_PATH:-}" +export DB_FS_SNAPSHOT_REPO_PATH="$ELASTICSEARCH_FS_SNAPSHOT_REPO_PATH" export ELASTICSEARCH_NODE_ROLES="${ELASTICSEARCH_NODE_ROLES:-}" -export ELASTICSEARCH_NODE_TYPE="${ELASTICSEARCH_NODE_TYPE:-}" +export DB_NODE_ROLES="$ELASTICSEARCH_NODE_ROLES" export ELASTICSEARCH_PLUGINS="${ELASTICSEARCH_PLUGINS:-}" -export ELASTICSEARCH_KEYS="${ELASTICSEARCH_KEYS:-}" +export DB_PLUGINS="$ELASTICSEARCH_PLUGINS" export ELASTICSEARCH_TRANSPORT_PORT_NUMBER="${ELASTICSEARCH_TRANSPORT_PORT_NUMBER:-9300}" +export DB_TRANSPORT_PORT_NUMBER="$ELASTICSEARCH_TRANSPORT_PORT_NUMBER" export ELASTICSEARCH_HTTP_PORT_NUMBER="${ELASTICSEARCH_HTTP_PORT_NUMBER:-9200}" +export DB_HTTP_PORT_NUMBER="$ELASTICSEARCH_HTTP_PORT_NUMBER" # Elasticsearch Security configuration -export ELASTICSEARCH_PASSWORD="${ELASTICSEARCH_PASSWORD:-bitnami}" export ELASTICSEARCH_ENABLE_SECURITY="${ELASTICSEARCH_ENABLE_SECURITY:-false}" -export ELASTICSEARCH_ENABLE_FIPS_MODE="${ELASTICSEARCH_ENABLE_FIPS_MODE:-false}" +export DB_ENABLE_SECURITY="$ELASTICSEARCH_ENABLE_SECURITY" +export ELASTICSEARCH_PASSWORD="${ELASTICSEARCH_PASSWORD:-bitnami}" +export DB_PASSWORD="$ELASTICSEARCH_PASSWORD" +export ELASTICSEARCH_USERNAME="elastic" +export DB_USERNAME="$ELASTICSEARCH_USERNAME" export ELASTICSEARCH_TLS_VERIFICATION_MODE="${ELASTICSEARCH_TLS_VERIFICATION_MODE:-full}" +export DB_TLS_VERIFICATION_MODE="$ELASTICSEARCH_TLS_VERIFICATION_MODE" export ELASTICSEARCH_TLS_USE_PEM="${ELASTICSEARCH_TLS_USE_PEM:-false}" +export DB_TLS_USE_PEM="$ELASTICSEARCH_TLS_USE_PEM" export ELASTICSEARCH_KEYSTORE_PASSWORD="${ELASTICSEARCH_KEYSTORE_PASSWORD:-}" +export DB_KEYSTORE_PASSWORD="$ELASTICSEARCH_KEYSTORE_PASSWORD" export ELASTICSEARCH_TRUSTSTORE_PASSWORD="${ELASTICSEARCH_TRUSTSTORE_PASSWORD:-}" +export DB_TRUSTSTORE_PASSWORD="$ELASTICSEARCH_TRUSTSTORE_PASSWORD" export ELASTICSEARCH_KEY_PASSWORD="${ELASTICSEARCH_KEY_PASSWORD:-}" -export ELASTICSEARCH_KEYSTORE_LOCATION="${ELASTICSEARCH_KEYSTORE_LOCATION:-${ELASTICSEARCH_CERTS_DIR}/elasticsearch.keystore.jks}" -export ELASTICSEARCH_TRUSTSTORE_LOCATION="${ELASTICSEARCH_TRUSTSTORE_LOCATION:-${ELASTICSEARCH_CERTS_DIR}/elasticsearch.truststore.jks}" -export ELASTICSEARCH_NODE_CERT_LOCATION="${ELASTICSEARCH_NODE_CERT_LOCATION:-${ELASTICSEARCH_CERTS_DIR}/tls.crt}" -export ELASTICSEARCH_NODE_KEY_LOCATION="${ELASTICSEARCH_NODE_KEY_LOCATION:-${ELASTICSEARCH_CERTS_DIR}/tls.key}" -export ELASTICSEARCH_CA_CERT_LOCATION="${ELASTICSEARCH_CA_CERT_LOCATION:-${ELASTICSEARCH_CERTS_DIR}/ca.crt}" +export DB_KEY_PASSWORD="$ELASTICSEARCH_KEY_PASSWORD" +export ELASTICSEARCH_KEYSTORE_LOCATION="${ELASTICSEARCH_KEYSTORE_LOCATION:-${DB_CERTS_DIR}/elasticsearch.keystore.jks}" +export DB_KEYSTORE_LOCATION="$ELASTICSEARCH_KEYSTORE_LOCATION" +export ELASTICSEARCH_TRUSTSTORE_LOCATION="${ELASTICSEARCH_TRUSTSTORE_LOCATION:-${DB_CERTS_DIR}/elasticsearch.truststore.jks}" +export DB_TRUSTSTORE_LOCATION="$ELASTICSEARCH_TRUSTSTORE_LOCATION" +export ELASTICSEARCH_NODE_CERT_LOCATION="${ELASTICSEARCH_NODE_CERT_LOCATION:-${DB_CERTS_DIR}/tls.crt}" +export DB_NODE_CERT_LOCATION="$ELASTICSEARCH_NODE_CERT_LOCATION" +export ELASTICSEARCH_NODE_KEY_LOCATION="${ELASTICSEARCH_NODE_KEY_LOCATION:-${DB_CERTS_DIR}/tls.key}" +export DB_NODE_KEY_LOCATION="$ELASTICSEARCH_NODE_KEY_LOCATION" +export ELASTICSEARCH_CA_CERT_LOCATION="${ELASTICSEARCH_CA_CERT_LOCATION:-${DB_CERTS_DIR}/ca.crt}" +export DB_CA_CERT_LOCATION="$ELASTICSEARCH_CA_CERT_LOCATION" export ELASTICSEARCH_SKIP_TRANSPORT_TLS="${ELASTICSEARCH_SKIP_TRANSPORT_TLS:-false}" -export ELASTICSEARCH_TRANSPORT_TLS_USE_PEM="${ELASTICSEARCH_TRANSPORT_TLS_USE_PEM:-$ELASTICSEARCH_TLS_USE_PEM}" -export ELASTICSEARCH_TRANSPORT_TLS_KEYSTORE_PASSWORD="${ELASTICSEARCH_TRANSPORT_TLS_KEYSTORE_PASSWORD:-$ELASTICSEARCH_KEYSTORE_PASSWORD}" -export ELASTICSEARCH_TRANSPORT_TLS_TRUSTSTORE_PASSWORD="${ELASTICSEARCH_TRANSPORT_TLS_TRUSTSTORE_PASSWORD:-$ELASTICSEARCH_TRUSTSTORE_PASSWORD}" -export ELASTICSEARCH_TRANSPORT_TLS_KEY_PASSWORD="${ELASTICSEARCH_TRANSPORT_TLS_KEY_PASSWORD:-$ELASTICSEARCH_KEY_PASSWORD}" -export ELASTICSEARCH_TRANSPORT_TLS_KEYSTORE_LOCATION="${ELASTICSEARCH_TRANSPORT_TLS_KEYSTORE_LOCATION:-$ELASTICSEARCH_KEYSTORE_LOCATION}" -export ELASTICSEARCH_TRANSPORT_TLS_TRUSTSTORE_LOCATION="${ELASTICSEARCH_TRANSPORT_TLS_TRUSTSTORE_LOCATION:-$ELASTICSEARCH_TRUSTSTORE_LOCATION}" -export ELASTICSEARCH_TRANSPORT_TLS_NODE_CERT_LOCATION="${ELASTICSEARCH_TRANSPORT_TLS_NODE_CERT_LOCATION:-$ELASTICSEARCH_NODE_CERT_LOCATION}" -export ELASTICSEARCH_TRANSPORT_TLS_NODE_KEY_LOCATION="${ELASTICSEARCH_TRANSPORT_TLS_NODE_KEY_LOCATION:-$ELASTICSEARCH_NODE_KEY_LOCATION}" -export ELASTICSEARCH_TRANSPORT_TLS_CA_CERT_LOCATION="${ELASTICSEARCH_TRANSPORT_TLS_CA_CERT_LOCATION:-$ELASTICSEARCH_CA_CERT_LOCATION}" -export ELASTICSEARCH_ENABLE_REST_TLS="${ELASTICSEARCH_ENABLE_REST_TLS:-false}" -export ELASTICSEARCH_HTTP_TLS_USE_PEM="${ELASTICSEARCH_HTTP_TLS_USE_PEM:-$ELASTICSEARCH_TLS_USE_PEM}" -export ELASTICSEARCH_HTTP_TLS_KEYSTORE_PASSWORD="${ELASTICSEARCH_HTTP_TLS_KEYSTORE_PASSWORD:-$ELASTICSEARCH_KEYSTORE_PASSWORD}" -export ELASTICSEARCH_HTTP_TLS_TRUSTSTORE_PASSWORD="${ELASTICSEARCH_HTTP_TLS_TRUSTSTORE_PASSWORD:-$ELASTICSEARCH_TRUSTSTORE_PASSWORD}" -export ELASTICSEARCH_HTTP_TLS_KEY_PASSWORD="${ELASTICSEARCH_HTTP_TLS_KEY_PASSWORD:-$ELASTICSEARCH_KEY_PASSWORD}" -export ELASTICSEARCH_HTTP_TLS_KEYSTORE_LOCATION="${ELASTICSEARCH_HTTP_TLS_KEYSTORE_LOCATION:-$ELASTICSEARCH_KEYSTORE_LOCATION}" -export ELASTICSEARCH_HTTP_TLS_TRUSTSTORE_LOCATION="${ELASTICSEARCH_HTTP_TLS_TRUSTSTORE_LOCATION:-$ELASTICSEARCH_TRUSTSTORE_LOCATION}" -export ELASTICSEARCH_HTTP_TLS_NODE_CERT_LOCATION="${ELASTICSEARCH_HTTP_TLS_NODE_CERT_LOCATION:-$ELASTICSEARCH_NODE_CERT_LOCATION}" -export ELASTICSEARCH_HTTP_TLS_NODE_KEY_LOCATION="${ELASTICSEARCH_HTTP_TLS_NODE_KEY_LOCATION:-$ELASTICSEARCH_NODE_KEY_LOCATION}" -export ELASTICSEARCH_HTTP_TLS_CA_CERT_LOCATION="${ELASTICSEARCH_HTTP_TLS_CA_CERT_LOCATION:-$ELASTICSEARCH_CA_CERT_LOCATION}" +export DB_SKIP_TRANSPORT_TLS="$ELASTICSEARCH_SKIP_TRANSPORT_TLS" +export ELASTICSEARCH_TRANSPORT_TLS_USE_PEM="${ELASTICSEARCH_TRANSPORT_TLS_USE_PEM:-$DB_TLS_USE_PEM}" +export DB_TRANSPORT_TLS_USE_PEM="$ELASTICSEARCH_TRANSPORT_TLS_USE_PEM" +export ELASTICSEARCH_TRANSPORT_TLS_KEYSTORE_PASSWORD="${ELASTICSEARCH_TRANSPORT_TLS_KEYSTORE_PASSWORD:-$DB_KEYSTORE_PASSWORD}" +export DB_TRANSPORT_TLS_KEYSTORE_PASSWORD="$ELASTICSEARCH_TRANSPORT_TLS_KEYSTORE_PASSWORD" +export ELASTICSEARCH_TRANSPORT_TLS_TRUSTSTORE_PASSWORD="${ELASTICSEARCH_TRANSPORT_TLS_TRUSTSTORE_PASSWORD:-$DB_TRUSTSTORE_PASSWORD}" +export DB_TRANSPORT_TLS_TRUSTSTORE_PASSWORD="$ELASTICSEARCH_TRANSPORT_TLS_TRUSTSTORE_PASSWORD" +export ELASTICSEARCH_TRANSPORT_TLS_KEY_PASSWORD="${ELASTICSEARCH_TRANSPORT_TLS_KEY_PASSWORD:-$DB_KEY_PASSWORD}" +export DB_TRANSPORT_TLS_KEY_PASSWORD="$ELASTICSEARCH_TRANSPORT_TLS_KEY_PASSWORD" +export ELASTICSEARCH_TRANSPORT_TLS_KEYSTORE_LOCATION="${ELASTICSEARCH_TRANSPORT_TLS_KEYSTORE_LOCATION:-$DB_KEYSTORE_LOCATION}" +export DB_TRANSPORT_TLS_KEYSTORE_LOCATION="$ELASTICSEARCH_TRANSPORT_TLS_KEYSTORE_LOCATION" +export ELASTICSEARCH_TRANSPORT_TLS_TRUSTSTORE_LOCATION="${ELASTICSEARCH_TRANSPORT_TLS_TRUSTSTORE_LOCATION:-$DB_TRUSTSTORE_LOCATION}" +export DB_TRANSPORT_TLS_TRUSTSTORE_LOCATION="$ELASTICSEARCH_TRANSPORT_TLS_TRUSTSTORE_LOCATION" +export ELASTICSEARCH_TRANSPORT_TLS_NODE_CERT_LOCATION="${ELASTICSEARCH_TRANSPORT_TLS_NODE_CERT_LOCATION:-$DB_NODE_CERT_LOCATION}" +export DB_TRANSPORT_TLS_NODE_CERT_LOCATION="$ELASTICSEARCH_TRANSPORT_TLS_NODE_CERT_LOCATION" +export ELASTICSEARCH_TRANSPORT_TLS_NODE_KEY_LOCATION="${ELASTICSEARCH_TRANSPORT_TLS_NODE_KEY_LOCATION:-$DB_NODE_KEY_LOCATION}" +export DB_TRANSPORT_TLS_NODE_KEY_LOCATION="$ELASTICSEARCH_TRANSPORT_TLS_NODE_KEY_LOCATION" +export ELASTICSEARCH_TRANSPORT_TLS_CA_CERT_LOCATION="${ELASTICSEARCH_TRANSPORT_TLS_CA_CERT_LOCATION:-$DB_CA_CERT_LOCATION}" +export DB_TRANSPORT_TLS_CA_CERT_LOCATION="$ELASTICSEARCH_TRANSPORT_TLS_CA_CERT_LOCATION" +export ELASTICSEARCH_ENABLE_REST_TLS="${ELASTICSEARCH_ENABLE_REST_TLS:-true}" +export DB_ENABLE_REST_TLS="$ELASTICSEARCH_ENABLE_REST_TLS" +export ELASTICSEARCH_HTTP_TLS_USE_PEM="${ELASTICSEARCH_HTTP_TLS_USE_PEM:-$DB_TLS_USE_PEM}" +export DB_HTTP_TLS_USE_PEM="$ELASTICSEARCH_HTTP_TLS_USE_PEM" +export ELASTICSEARCH_HTTP_TLS_KEYSTORE_PASSWORD="${ELASTICSEARCH_HTTP_TLS_KEYSTORE_PASSWORD:-$DB_KEYSTORE_PASSWORD}" +export DB_HTTP_TLS_KEYSTORE_PASSWORD="$ELASTICSEARCH_HTTP_TLS_KEYSTORE_PASSWORD" +export ELASTICSEARCH_HTTP_TLS_TRUSTSTORE_PASSWORD="${ELASTICSEARCH_HTTP_TLS_TRUSTSTORE_PASSWORD:-$DB_TRUSTSTORE_PASSWORD}" +export DB_HTTP_TLS_TRUSTSTORE_PASSWORD="$ELASTICSEARCH_HTTP_TLS_TRUSTSTORE_PASSWORD" +export ELASTICSEARCH_HTTP_TLS_KEY_PASSWORD="${ELASTICSEARCH_HTTP_TLS_KEY_PASSWORD:-$DB_KEY_PASSWORD}" +export DB_HTTP_TLS_KEY_PASSWORD="$ELASTICSEARCH_HTTP_TLS_KEY_PASSWORD" +export ELASTICSEARCH_HTTP_TLS_KEYSTORE_LOCATION="${ELASTICSEARCH_HTTP_TLS_KEYSTORE_LOCATION:-$DB_KEYSTORE_LOCATION}" +export DB_HTTP_TLS_KEYSTORE_LOCATION="$ELASTICSEARCH_HTTP_TLS_KEYSTORE_LOCATION" +export ELASTICSEARCH_HTTP_TLS_TRUSTSTORE_LOCATION="${ELASTICSEARCH_HTTP_TLS_TRUSTSTORE_LOCATION:-$DB_TRUSTSTORE_LOCATION}" +export DB_HTTP_TLS_TRUSTSTORE_LOCATION="$ELASTICSEARCH_HTTP_TLS_TRUSTSTORE_LOCATION" +export ELASTICSEARCH_HTTP_TLS_NODE_CERT_LOCATION="${ELASTICSEARCH_HTTP_TLS_NODE_CERT_LOCATION:-$DB_NODE_CERT_LOCATION}" +export DB_HTTP_TLS_NODE_CERT_LOCATION="$ELASTICSEARCH_HTTP_TLS_NODE_CERT_LOCATION" +export ELASTICSEARCH_HTTP_TLS_NODE_KEY_LOCATION="${ELASTICSEARCH_HTTP_TLS_NODE_KEY_LOCATION:-$DB_NODE_KEY_LOCATION}" +export DB_HTTP_TLS_NODE_KEY_LOCATION="$ELASTICSEARCH_HTTP_TLS_NODE_KEY_LOCATION" +export ELASTICSEARCH_HTTP_TLS_CA_CERT_LOCATION="${ELASTICSEARCH_HTTP_TLS_CA_CERT_LOCATION:-$DB_CA_CERT_LOCATION}" +export DB_HTTP_TLS_CA_CERT_LOCATION="$ELASTICSEARCH_HTTP_TLS_CA_CERT_LOCATION" +export ELASTICSEARCH_ENABLE_FIPS_MODE="${ELASTICSEARCH_ENABLE_FIPS_MODE:-false}" +export ELASTICSEARCH_KEYS="${ELASTICSEARCH_KEYS:-}" +export ELASTICSEARCH_ACTION_DESTRUCTIVE_REQUIRES_NAME="${ELASTICSEARCH_ACTION_DESTRUCTIVE_REQUIRES_NAME:-}" +export DB_ACTION_DESTRUCTIVE_REQUIRES_NAME="$ELASTICSEARCH_ACTION_DESTRUCTIVE_REQUIRES_NAME" # Custom environment variables may be defined below diff --git a/bitnami/elasticsearch/8/debian-11/rootfs/opt/bitnami/scripts/elasticsearch/postunpack.sh b/bitnami/elasticsearch/8/debian-11/rootfs/opt/bitnami/scripts/elasticsearch/postunpack.sh index 4d402d8ad18d..9fbf3d00c888 100755 --- a/bitnami/elasticsearch/8/debian-11/rootfs/opt/bitnami/scripts/elasticsearch/postunpack.sh +++ b/bitnami/elasticsearch/8/debian-11/rootfs/opt/bitnami/scripts/elasticsearch/postunpack.sh @@ -11,14 +11,14 @@ # Load environment . /opt/bitnami/scripts/elasticsearch-env.sh -for dir in "$ELASTICSEARCH_TMP_DIR" "$ELASTICSEARCH_DATA_DIR" "$ELASTICSEARCH_LOGS_DIR" "${ELASTICSEARCH_BASE_DIR}/plugins" "${ELASTICSEARCH_BASE_DIR}/modules" "$ELASTICSEARCH_CONF_DIR" "$ELASTICSEARCH_VOLUME_DIR" "$ELASTICSEARCH_INITSCRIPTS_DIR" "$ELASTICSEARCH_MOUNTED_PLUGINS_DIR"; do +for dir in "$DB_TMP_DIR" "$DB_DATA_DIR" "$DB_LOGS_DIR" "${DB_BASE_DIR}/plugins" "${DB_BASE_DIR}/modules" "$DB_CONF_DIR" "$DB_VOLUME_DIR" "$DB_INITSCRIPTS_DIR" "$DB_MOUNTED_PLUGINS_DIR"; do ensure_dir_exists "$dir" chmod -R ug+rwX "$dir" done elasticsearch_configure_logging -for dir in "$ELASTICSEARCH_TMP_DIR" "$ELASTICSEARCH_DATA_DIR" "$ELASTICSEARCH_LOGS_DIR" "${ELASTICSEARCH_BASE_DIR}/plugins" "${ELASTICSEARCH_BASE_DIR}/modules" "$ELASTICSEARCH_CONF_DIR" "$ELASTICSEARCH_VOLUME_DIR" "$ELASTICSEARCH_INITSCRIPTS_DIR" "$ELASTICSEARCH_MOUNTED_PLUGINS_DIR"; do +for dir in "$DB_TMP_DIR" "$DB_DATA_DIR" "$DB_LOGS_DIR" "${DB_BASE_DIR}/plugins" "${DB_BASE_DIR}/modules" "$DB_CONF_DIR" "$DB_VOLUME_DIR" "$DB_INITSCRIPTS_DIR" "$DB_MOUNTED_PLUGINS_DIR"; do # `elasticsearch-plugin install` command complains about being unable to create the a plugin's directory # even when having the proper permissions. # The reason: the code is checking trying to check the permissions by consulting the parent directory owner, diff --git a/bitnami/elasticsearch/8/debian-11/rootfs/opt/bitnami/scripts/elasticsearch/run.sh b/bitnami/elasticsearch/8/debian-11/rootfs/opt/bitnami/scripts/elasticsearch/run.sh index 0da121a6fa0f..531b4cc42f07 100755 --- a/bitnami/elasticsearch/8/debian-11/rootfs/opt/bitnami/scripts/elasticsearch/run.sh +++ b/bitnami/elasticsearch/8/debian-11/rootfs/opt/bitnami/scripts/elasticsearch/run.sh @@ -18,8 +18,8 @@ set -o pipefail # Constants EXEC=$(command -v elasticsearch) -ARGS=("-p" "$ELASTICSEARCH_TMP_DIR/elasticsearch.pid") -[[ -z "${ELASTICSEARCH_EXTRA_FLAGS:-}" ]] || ARGS=("${ARGS[@]}" "${ELASTICSEARCH_EXTRA_FLAGS[@]}") +ARGS=("-p" "$DB_PID_FILE") +[[ -z "${DB_EXTRA_FLAGS:-}" ]] || ARGS=("${ARGS[@]}" "${DB_EXTRA_FLAGS[@]}") # JAVA_HOME to be deprecated, see warning: # warning: usage of JAVA_HOME is deprecated, use ES_JAVA_HOME export JAVA_HOME=/opt/bitnami/java @@ -29,7 +29,7 @@ ARGS+=("$@") info "** Starting Elasticsearch **" if am_i_root; then - exec_as_user "$ELASTICSEARCH_DAEMON_USER" "$EXEC" "${ARGS[@]}" + exec_as_user "$DB_DAEMON_USER" "$EXEC" "${ARGS[@]}" else exec "$EXEC" "${ARGS[@]}" fi diff --git a/bitnami/elasticsearch/8/debian-11/rootfs/opt/bitnami/scripts/elasticsearch/setup.sh b/bitnami/elasticsearch/8/debian-11/rootfs/opt/bitnami/scripts/elasticsearch/setup.sh index 66cf3fb77253..cdea7cf9f84c 100755 --- a/bitnami/elasticsearch/8/debian-11/rootfs/opt/bitnami/scripts/elasticsearch/setup.sh +++ b/bitnami/elasticsearch/8/debian-11/rootfs/opt/bitnami/scripts/elasticsearch/setup.sh @@ -22,7 +22,7 @@ elasticsearch_validate # Ensure Elasticsearch is stopped when this script ends trap "elasticsearch_stop" EXIT # Ensure 'daemon' user exists when running as 'root' -am_i_root && ensure_user_exists "$ELASTICSEARCH_DAEMON_USER" --group "$ELASTICSEARCH_DAEMON_GROUP" +am_i_root && ensure_user_exists "$DB_DAEMON_USER" --group "$DB_DAEMON_GROUP" # Ensure Elasticsearch is initialized elasticsearch_initialize # Ensure kernel settings are valid diff --git a/bitnami/elasticsearch/8/debian-11/rootfs/opt/bitnami/scripts/libelasticsearch.sh b/bitnami/elasticsearch/8/debian-11/rootfs/opt/bitnami/scripts/libelasticsearch.sh index e8591396ee92..86ec01f44132 100644 --- a/bitnami/elasticsearch/8/debian-11/rootfs/opt/bitnami/scripts/libelasticsearch.sh +++ b/bitnami/elasticsearch/8/debian-11/rootfs/opt/bitnami/scripts/libelasticsearch.sh @@ -19,119 +19,7 @@ # Functions ######################## -# Write a configuration setting value -# Globals: -# ELASTICSEARCH_CONF_FILE -# Arguments: -# $1 - key -# $2 - value -# $3 - YAML type (string, int or bool) -# Returns: -# None -######################### -elasticsearch_conf_write() { - local -r key="${1:?Missing key}" - local -r value="${2:-}" - local -r type="${3:-string}" - local -r tempfile=$(mktemp) - - case "$type" in - string) - yq eval "(.${key}) |= \"${value}\"" "$ELASTICSEARCH_CONF_FILE" >"$tempfile" - ;; - int) - yq eval "(.${key}) |= ${value}" "$ELASTICSEARCH_CONF_FILE" >"$tempfile" - ;; - bool) - yq eval "(.${key}) |= (\"${value}\" | test(\"true\"))" "$ELASTICSEARCH_CONF_FILE" >"$tempfile" - ;; - *) - error "Type unknown: ${type}" - return 1 - ;; - esac - cp "$tempfile" "$ELASTICSEARCH_CONF_FILE" -} - -######################## -# Set a configuration setting value -# Globals: -# ELASTICSEARCH_CONF_FILE -# Arguments: -# $1 - key -# $2 - values (array) -# Returns: -# None -######################### -elasticsearch_conf_set() { - local key="${1:?missing key}" - shift - local values=("${@}") - - if [[ "${#values[@]}" -eq 0 ]]; then - stderr_print "missing values" - return 1 - elif [[ "${#values[@]}" -eq 1 ]] && [[ -n "${values[0]}" ]]; then - elasticsearch_conf_write "$key" "${values[0]}" - else - for i in "${!values[@]}"; do - if [[ -n "${values[$i]}" ]]; then - elasticsearch_conf_write "${key}[$i]" "${values[$i]}" - fi - done - fi -} - -######################## -# Check if Elasticsearch is running -# Globals: -# ELASTICSEARCH_TMP_DIR -# Arguments: -# None -# Returns: -# Boolean -######################### -is_elasticsearch_running() { - local pid - pid="$(get_pid_from_file "${ELASTICSEARCH_TMP_DIR}/elasticsearch.pid")" - - if [[ -z "$pid" ]]; then - false - else - is_service_running "$pid" - fi -} - -######################## -# Check if Elasticsearch is not running -# Globals: -# ELASTICSEARCH_TMP_DIR -# Arguments: -# None -# Returns: -# Boolean -######################### -is_elasticsearch_not_running() { - ! is_elasticsearch_running - return "$?" -} -######################## -# Stop Elasticsearch -# Globals: -# ELASTICSEARCH_TMP_DIR -# Arguments: -# None -# Returns: -# None -######################### -elasticsearch_stop() { - ! is_elasticsearch_running && return - debug "Stopping Elasticsearch..." - stop_service_using_pid "$ELASTICSEARCH_TMP_DIR/elasticsearch.pid" -} - -######################## -# Start Elasticsearch and wait until it's ready +# Configure TLS settings # Globals: # ELASTICSEARCH_* # Arguments: @@ -139,500 +27,57 @@ elasticsearch_stop() { # Returns: # None ######################### -elasticsearch_start() { - is_elasticsearch_running && return - - debug "Starting Elasticsearch..." - local command=("${ELASTICSEARCH_BASE_DIR}/bin/elasticsearch" "-d" "-p" "${ELASTICSEARCH_TMP_DIR}/elasticsearch.pid") - am_i_root && command=("run_as_user" "$ELASTICSEARCH_DAEMON_USER" "${command[@]}") - if [[ "$BITNAMI_DEBUG" = true ]]; then - "${command[@]}" & - else - "${command[@]}" >/dev/null 2>&1 & - fi - - local counter=50 - while ! is_elasticsearch_running; do - if [[ "$counter" -ne 0 ]]; then - break - fi - sleep 2 - counter=$((counter - 1)) - done - local log_result="" - local log_counter=30 - while [[ -z "$log_result" ]] && [[ "$log_counter" -ne 0 ]]; do - log_counter=$((log_counter - 1)) - log_result="$(tail -7 "$ELASTICSEARCH_LOG_FILE" | grep -i "Node" | grep -i "started")" - sleep 2 - done -} - -######################## -# Validate kernel settings -# Arguments: -# None -# Returns: -# None -######################### -elasticsearch_validate_kernel() { - # Auxiliary functions - validate_sysctl_key() { - local key="${1:?key is missing}" - local value="${2:?value is missing}" - local current_value - current_value="$(sysctl -n "$key")" - if [[ "$current_value" -lt "$value" ]]; then - error "Invalid kernel settings. Elasticsearch requires at least: $key = $value" - exit 1 - fi - } - - debug "Validating Kernel settings..." - if [[ $(yq eval .index.store.type "$ELASTICSEARCH_CONF_FILE") ]]; then - debug "Custom index.store.type found in the config file. Skipping kernel validation..." - else - validate_sysctl_key "fs.file-max" 65536 - fi - if [[ $(yq eval .node.store.allow_mmap "$ELASTICSEARCH_CONF_FILE") ]]; then - debug "Custom node.store.allow_mmap found in the config file. Skipping kernel validation..." - else - validate_sysctl_key "vm.max_map_count" 262144 - fi -} - -######################## -# Validate settings in ELASTICSEARCH_* env vars -# Globals: -# ELASTICSEARCH_* -# Arguments: -# None -# Returns: -# None -######################### -elasticsearch_validate() { - local error_code=0 - local es_version es_major_version - - # Auxiliary functions - print_validation_error() { - error "$1" - error_code=1 - } - - check_multi_value() { - if [[ " ${2} " != *" ${!1} "* ]]; then - print_validation_error "The allowed values for ${1} are: ${2}" - fi - } - - validate_node_type() { - case "$ELASTICSEARCH_NODE_TYPE" in - coordinating | data | ingest | master) ;; - - *) - print_validation_error "Invalid node type $ELASTICSEARCH_NODE_TYPE. Supported types are 'coordinating/data/ingest/master'" - ;; - esac - } - - validate_node_roles() { - if [ -n "$ELASTICSEARCH_NODE_ROLES" ]; then - read -r -a roles_list <<<"$(tr ',;' ' ' <<<"$ELASTICSEARCH_NODE_ROLES")" - if [[ "${#roles_list[@]}" -le 0 ]]; then - warn "Setting ELASTICSEARCH_NODE_ROLES is empty and ELASTICSEARCH_IS_DEDICATED_NODE is set to true, Elasticsearch will be configured as coordinating-only node." - fi - for role in "${roles_list[@]}"; do - case "$role" in - master | data | data_content | data_hot | data_warm | data_cold | data_frozen | ingest | ml | remote_cluster_client | transform) ;; - - *) - print_validation_error "Invalid node role '$role'. Supported roles are 'master,data,data_content,data_hot,data_warm,data_cold,data_frozen,ingest,ml,remote_cluster_client,transform'" - ;; - esac - done - fi - } - - # Temporary fix until ELASTICSEARCH_NODE_TYPE is removed to ensure the correct permissions to run 'elasticsearch --version' - debug "Ensuring expected directories/files exist..." - am_i_root && ensure_user_exists "$ELASTICSEARCH_DAEMON_USER" --group "$ELASTICSEARCH_DAEMON_GROUP" - for dir in "$ELASTICSEARCH_TMP_DIR" "$ELASTICSEARCH_LOGS_DIR" "$ELASTICSEARCH_PLUGINS_DIR" "$ELASTICSEARCH_BASE_DIR/modules" "$ELASTICSEARCH_CONF_DIR"; do - ensure_dir_exists "$dir" - am_i_root && chown -R "$ELASTICSEARCH_DAEMON_USER:$ELASTICSEARCH_DAEMON_GROUP" "$dir" - done - - es_version="$(elasticsearch_get_version)" - es_major_version="$(get_sematic_version "$es_version" 1)" - - debug "Validating settings in ELASTICSEARCH_* env vars..." - for var in "ELASTICSEARCH_HTTP_PORT_NUMBER" "ELASTICSEARCH_TRANSPORT_PORT_NUMBER"; do - if ! err=$(validate_port "${!var}"); then - print_validation_error "An invalid port was specified in the environment variable $var: $err" - fi - done - - if ! is_boolean_yes "$ELASTICSEARCH_IS_DEDICATED_NODE"; then - warn "Setting ELASTICSEARCH_IS_DEDICATED_NODE is disabled." - warn "ELASTICSEARCH_NODE_ROLES and ELASTICSEARCH_NODE_TYPE will be ignored and Elasticsearch will asume all different roles." - else - # Node types deprecated in Elasticsearch 8 - if [[ -n "$ELASTICSEARCH_NODE_TYPE" ]] && [[ "$es_major_version" -ge 8 ]] ; then - print_validation_error "Setting ELASTICSEARCH_NODE_TYPE is not available when using Elasticsearch 8, use ELASTICSEARCH_NODE_ROLES instead." - fi - - if [[ "$es_major_version" -ge 8 ]]; then - validate_node_roles - elif [[ "$es_major_version" -eq 7 ]]; then - if [[ -n "$ELASTICSEARCH_NODE_TYPE" ]]; then - warn "Setting ELASTICSEARCH_NODE_TYPE will be deprecated soon. We recommend using ELASTICSEARCH_NODE_ROLES instead." - validate_node_type - else - validate_node_roles - fi - fi - fi - - if [[ -n "$ELASTICSEARCH_BIND_ADDRESS" ]] && ! validate_ipv4 "$ELASTICSEARCH_BIND_ADDRESS"; then - print_validation_error "The Bind Address specified in the environment variable ELASTICSEARCH_BIND_ADDRESS is not a valid IPv4" - fi - - if is_boolean_yes "$ELASTICSEARCH_ENABLE_SECURITY"; then - if ! is_boolean_yes "$ELASTICSEARCH_SKIP_TRANSPORT_TLS"; then - check_multi_value "ELASTICSEARCH_TLS_VERIFICATION_MODE" "full certificate none" - if is_boolean_yes "$ELASTICSEARCH_TRANSPORT_TLS_USE_PEM"; then - if [[ ! -f "$ELASTICSEARCH_TRANSPORT_TLS_NODE_CERT_LOCATION" ]] || [[ ! -f "$ELASTICSEARCH_TRANSPORT_TLS_NODE_KEY_LOCATION" ]] || [[ ! -f "$ELASTICSEARCH_TRANSPORT_TLS_CA_CERT_LOCATION" ]]; then - print_validation_error "In order to configure the TLS encryption for Elasticsearch Transport you must provide your node key, certificate and a valid certification_authority certificate." - fi - elif [[ ! -f "$ELASTICSEARCH_TRANSPORT_TLS_KEYSTORE_LOCATION" ]] || [[ ! -f "$ELASTICSEARCH_TRANSPORT_TLS_TRUSTSTORE_LOCATION" ]]; then - print_validation_error "In order to configure the TLS encryption for Elasticsearch Transport with JKS/PKCS12 certs you must mount a valid keystore and truststore." - fi - fi - - if is_boolean_yes "$ELASTICSEARCH_ENABLE_REST_TLS"; then - if is_boolean_yes "$ELASTICSEARCH_HTTP_TLS_USE_PEM"; then - if [[ ! -f "$ELASTICSEARCH_HTTP_TLS_NODE_CERT_LOCATION" ]] || [[ ! -f "$ELASTICSEARCH_HTTP_TLS_NODE_KEY_LOCATION" ]] || [[ ! -f "$ELASTICSEARCH_HTTP_TLS_CA_CERT_LOCATION" ]]; then - print_validation_error "In order to configure the TLS encryption for Elasticsearch you must provide your node key, certificate and a valid certification_authority certificate." - fi - elif [[ ! -f "$ELASTICSEARCH_HTTP_TLS_KEYSTORE_LOCATION" ]] || [[ ! -f "$ELASTICSEARCH_HTTP_TLS_TRUSTSTORE_LOCATION" ]]; then - print_validation_error "In order to configure the TLS encryption for Elasticsearch with JKS/PKCS12 certs you must mount a valid keystore and truststore." - fi - fi - fi - - [[ "$error_code" -eq 0 ]] || exit "$error_code" -} - -######################## -# Determine the hostname by which to contact the locally running mongo daemon -# Returns: -# The value of $ELASTICSEARCH_ADVERTISED_HOSTNAME or the current host address -######################## -get_elasticsearch_hostname() { - if [[ -n "$ELASTICSEARCH_ADVERTISED_HOSTNAME" ]]; then - echo "$ELASTICSEARCH_ADVERTISED_HOSTNAME" - else - get_machine_ip - fi -} - -######################## -# Configure Elasticsearch cluster settings -# Globals: -# ELASTICSEARCH_* -# Arguments: -# None -# Returns: -# None -######################### -elasticsearch_cluster_configuration() { - # Auxiliary functions - bind_address() { - if [[ -n "$ELASTICSEARCH_BIND_ADDRESS" ]]; then - echo "$ELASTICSEARCH_BIND_ADDRESS" - else - echo "0.0.0.0" - fi - } - - is_node_type_master() { - if is_boolean_yes "$ELASTICSEARCH_IS_DEDICATED_NODE"; then - if [[ -n "$ELASTICSEARCH_NODE_TYPE" ]]; then - if [[ "$ELASTICSEARCH_NODE_TYPE" = "master" ]]; then - true - else - false - fi - else - if [ -n "$ELASTICSEARCH_NODE_ROLES" ]; then - read -r -a roles_list <<<"$(tr ',;' ' ' <<<"$ELASTICSEARCH_NODE_ROLES")" - if [[ " ${roles_list[*]} " = *" master "* ]]; then - true - else - false - fi - else - false - fi - fi - else - true - fi - } - - info "Configuring Elasticsearch cluster settings..." - elasticsearch_conf_set network.host "$(get_elasticsearch_hostname)" - elasticsearch_conf_set network.publish_host "$(get_elasticsearch_hostname)" - elasticsearch_conf_set network.bind_host "$(bind_address)" - elasticsearch_conf_set cluster.name "$ELASTICSEARCH_CLUSTER_NAME" - elasticsearch_conf_set node.name "${ELASTICSEARCH_NODE_NAME:-$(hostname)}" - - if [[ -n "$ELASTICSEARCH_CLUSTER_HOSTS" ]]; then - read -r -a host_list <<<"$(tr ',;' ' ' <<<"$ELASTICSEARCH_CLUSTER_HOSTS")" - master_list=("${host_list[@]}") - if [[ -n "$ELASTICSEARCH_CLUSTER_MASTER_HOSTS" ]]; then - read -r -a master_list <<<"$(tr ',;' ' ' <<<"$ELASTICSEARCH_CLUSTER_MASTER_HOSTS")" - fi - es_version="$(elasticsearch_get_version)" - es_major_version="$(get_sematic_version "$es_version" 1)" - elasticsearch_conf_set discovery.seed_hosts "${host_list[@]}" - if is_node_type_master; then - elasticsearch_conf_set cluster.initial_master_nodes "${master_list[@]}" - fi - elasticsearch_conf_set discovery.initial_state_timeout "10m" - else - elasticsearch_conf_set "discovery.type" "single-node" - fi -} - -######################## -# Configure Elasticsearch TLS settings -# Globals: -# ELASTICSEARCH_* -# Arguments: -# None -# Returns: -# None -######################### -elasticsearch_transport_tls_configuration(){ +elasticsearch_transport_tls_configuration() { info "Configuring Elasticsearch Transport TLS settings..." elasticsearch_conf_set xpack.security.transport.ssl.enabled "true" - elasticsearch_conf_set xpack.security.transport.ssl.verification_mode "$ELASTICSEARCH_TLS_VERIFICATION_MODE" + elasticsearch_conf_set xpack.security.transport.ssl.verification_mode "$DB_TLS_VERIFICATION_MODE" - if is_boolean_yes "$ELASTICSEARCH_TRANSPORT_TLS_USE_PEM"; then + if is_boolean_yes "$DB_TRANSPORT_TLS_USE_PEM"; then debug "Configuring Transport Layer TLS settings using PEM certificates..." - ! is_empty_value "$ELASTICSEARCH_TRANSPORT_TLS_KEY_PASSWORD" && elasticsearch_set_key_value "xpack.security.transport.ssl.secure_key_passphrase" "$ELASTICSEARCH_TRANSPORT_TLS_KEY_PASSWORD" - elasticsearch_conf_set xpack.security.transport.ssl.key "$ELASTICSEARCH_TRANSPORT_TLS_NODE_KEY_LOCATION" - elasticsearch_conf_set xpack.security.transport.ssl.certificate "$ELASTICSEARCH_TRANSPORT_TLS_NODE_CERT_LOCATION" - elasticsearch_conf_set xpack.security.transport.ssl.certificate_authorities "$ELASTICSEARCH_TRANSPORT_TLS_CA_CERT_LOCATION" + ! is_empty_value "$DB_TRANSPORT_TLS_KEY_PASSWORD" && elasticsearch_set_key_value "xpack.security.transport.ssl.secure_key_passphrase" "$DB_TRANSPORT_TLS_KEY_PASSWORD" + elasticsearch_conf_set xpack.security.transport.ssl.key "$DB_TRANSPORT_TLS_NODE_KEY_LOCATION" + elasticsearch_conf_set xpack.security.transport.ssl.certificate "$DB_TRANSPORT_TLS_NODE_CERT_LOCATION" + elasticsearch_conf_set xpack.security.transport.ssl.certificate_authorities "$DB_TRANSPORT_TLS_CA_CERT_LOCATION" else debug "Configuring Transport Layer TLS settings using JKS/PKCS certificates..." - ! is_empty_value "$ELASTICSEARCH_TRANSPORT_TLS_KEYSTORE_PASSWORD" && elasticsearch_set_key_value "xpack.security.transport.ssl.keystore.secure_password" "$ELASTICSEARCH_TRANSPORT_TLS_KEYSTORE_PASSWORD" - ! is_empty_value "$ELASTICSEARCH_TRANSPORT_TLS_TRUSTSTORE_PASSWORD" && elasticsearch_set_key_value "xpack.security.transport.ssl.truststore.secure_password" "$ELASTICSEARCH_TRANSPORT_TLS_TRUSTSTORE_PASSWORD" - elasticsearch_conf_set xpack.security.transport.ssl.keystore.path "$ELASTICSEARCH_TRANSPORT_TLS_KEYSTORE_LOCATION" - elasticsearch_conf_set xpack.security.transport.ssl.truststore.path "$ELASTICSEARCH_TRANSPORT_TLS_TRUSTSTORE_LOCATION" + ! is_empty_value "$DB_TRANSPORT_TLS_KEYSTORE_PASSWORD" && elasticsearch_set_key_value "xpack.security.transport.ssl.keystore.secure_password" "$DB_TRANSPORT_TLS_KEYSTORE_PASSWORD" + ! is_empty_value "$DB_TRANSPORT_TLS_TRUSTSTORE_PASSWORD" && elasticsearch_set_key_value "xpack.security.transport.ssl.truststore.secure_password" "$DB_TRANSPORT_TLS_TRUSTSTORE_PASSWORD" + elasticsearch_conf_set xpack.security.transport.ssl.keystore.path "$DB_TRANSPORT_TLS_KEYSTORE_LOCATION" + elasticsearch_conf_set xpack.security.transport.ssl.truststore.path "$DB_TRANSPORT_TLS_TRUSTSTORE_LOCATION" fi } ######################## -# Configure Elasticsearch TLS settings +# Configure TLS settings # Globals: -# ELASTICSEARCH_* +# DB_* # Arguments: # None # Returns: # None ######################### -elasticsearch_http_tls_configuration(){ +elasticsearch_http_tls_configuration() { info "Configuring Elasticsearch HTTP TLS settings..." elasticsearch_conf_set xpack.security.http.ssl.enabled "true" - if is_boolean_yes "$ELASTICSEARCH_HTTP_TLS_USE_PEM"; then + if is_boolean_yes "$DB_HTTP_TLS_USE_PEM"; then debug "Configuring REST API TLS settings using PEM certificates..." - ! is_empty_value "$ELASTICSEARCH_HTTP_TLS_KEY_PASSWORD" && elasticsearch_set_key_value "xpack.security.http.ssl.secure_key_passphrase" "$ELASTICSEARCH_HTTP_TLS_KEY_PASSWORD" - elasticsearch_conf_set xpack.security.http.ssl.key "$ELASTICSEARCH_HTTP_TLS_NODE_KEY_LOCATION" - elasticsearch_conf_set xpack.security.http.ssl.certificate "$ELASTICSEARCH_HTTP_TLS_NODE_CERT_LOCATION" - elasticsearch_conf_set xpack.security.http.ssl.certificate_authorities "$ELASTICSEARCH_HTTP_TLS_CA_CERT_LOCATION" + ! is_empty_value "$DB_HTTP_TLS_KEY_PASSWORD" && elasticsearch_set_key_value "xpack.security.http.ssl.secure_key_passphrase" "$DB_HTTP_TLS_KEY_PASSWORD" + elasticsearch_conf_set xpack.security.http.ssl.key "$DB_HTTP_TLS_NODE_KEY_LOCATION" + elasticsearch_conf_set xpack.security.http.ssl.certificate "$DB_HTTP_TLS_NODE_CERT_LOCATION" + elasticsearch_conf_set xpack.security.http.ssl.certificate_authorities "$DB_HTTP_TLS_CA_CERT_LOCATION" else debug "Configuring REST API TLS settings using JKS/PKCS certificates..." - ! is_empty_value "$ELASTICSEARCH_HTTP_TLS_KEYSTORE_PASSWORD" && elasticsearch_set_key_value "xpack.security.http.ssl.keystore.secure_password" "$ELASTICSEARCH_HTTP_TLS_KEYSTORE_PASSWORD" - ! is_empty_value "$ELASTICSEARCH_HTTP_TLS_TRUSTSTORE_PASSWORD" && elasticsearch_set_key_value "xpack.security.http.ssl.truststore.secure_password" "$ELASTICSEARCH_HTTP_TLS_TRUSTSTORE_PASSWORD" - elasticsearch_conf_set xpack.security.http.ssl.keystore.path "$ELASTICSEARCH_HTTP_TLS_KEYSTORE_LOCATION" - elasticsearch_conf_set xpack.security.http.ssl.truststore.path "$ELASTICSEARCH_HTTP_TLS_TRUSTSTORE_LOCATION" + ! is_empty_value "$DB_HTTP_TLS_KEYSTORE_PASSWORD" && elasticsearch_set_key_value "xpack.security.http.ssl.keystore.secure_password" "$DB_HTTP_TLS_KEYSTORE_PASSWORD" + ! is_empty_value "$DB_HTTP_TLS_TRUSTSTORE_PASSWORD" && elasticsearch_set_key_value "xpack.security.http.ssl.truststore.secure_password" "$DB_HTTP_TLS_TRUSTSTORE_PASSWORD" + elasticsearch_conf_set xpack.security.http.ssl.keystore.path "$DB_HTTP_TLS_KEYSTORE_LOCATION" + elasticsearch_conf_set xpack.security.http.ssl.truststore.path "$DB_HTTP_TLS_TRUSTSTORE_LOCATION" fi } -######################## -# Extend Elasticsearch cluster settings with custom, user-provided config -# Globals: -# ELASTICSEARCH_* -# Arguments: -# None -# Returns: -# None -######################### -elasticsearch_custom_configuration() { - local custom_conf_file="${ELASTICSEARCH_CONF_DIR}/my_elasticsearch.yml" - local -r tempfile=$(mktemp) - [[ ! -s "$custom_conf_file" ]] && return - info "Adding custom configuration" - yq eval-all 'select(fileIndex == 0) * select(fileIndex == 1)' "$ELASTICSEARCH_CONF_FILE" "$custom_conf_file" >"$tempfile" - cp "$tempfile" "$ELASTICSEARCH_CONF_FILE" -} - -######################## -# Configure Elasticsearch node type -# Globals: -# ELASTICSEARCH_* -# Arguments: -# None -# Returns: -# None -######################### -elasticsearch_configure_node_type() { - local is_master="false" - local is_data="false" - local is_ingest="false" - if is_boolean_yes "$ELASTICSEARCH_IS_DEDICATED_NODE"; then - case "$ELASTICSEARCH_NODE_TYPE" in - coordinating) ;; - - data) - is_data="true" - ;; - ingest) - is_ingest="true" - ;; - master) - is_master="true" - ;; - *) - error "Invalid node type '$ELASTICSEARCH_NODE_TYPE'" - exit 1 - ;; - esac - else - is_master="true" - is_data="true" - is_ingest="true" - fi - debug "Configure Elasticsearch Node type..." - elasticsearch_conf_set node.master "$is_master" - elasticsearch_conf_set node.data "$is_data" - elasticsearch_conf_set node.ingest "$is_ingest" - if [[ "$is_data" = "true" || "$is_master" = "true" ]] && [[ -n "$ELASTICSEARCH_FS_SNAPSHOT_REPO_PATH" ]]; then - # Configure path.repo to restore snapshots from system repository - # It must be set on every master an data node - # ref: https://www.elastic.co/guide/en/elasticsearch/reference/current/snapshots-register-repository.html#snapshots-filesystem-repository - elasticsearch_conf_set path.repo "$ELASTICSEARCH_FS_SNAPSHOT_REPO_PATH" - fi -} - -######################## -# Configure Elasticsearch node roles. -# There are 3 scenarios: -# * If ELASTICSEARCH_IS_DEDICATED_NODE is disabled, 'node.roles' is omitted and Elasticsearch assumes all the roles (check docs). -# * Otherwise, 'node.roles' with a list of roles provided with ELASTICSEARCH_NODE_ROLES. -# * In addition, if ELASTICSEARCH_NODE_ROLES is empty, node.roles will be configured empty, meaning that the role is 'coordinating-only'. -# -# Docs ref: https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-node.html -# -# Globals: -# ELASTICSEARCH_* -# Arguments: -# None -# Returns: -# None -######################### -elasticsearch_configure_node_roles() { - debug "Configure Elasticsearch Node roles..." - - local set_repo_path="no" - read -r -a roles_list <<<"$(tr ',;' ' ' <<<"$ELASTICSEARCH_NODE_ROLES")" - if is_boolean_yes "$ELASTICSEARCH_IS_DEDICATED_NODE"; then - if [[ "${#roles_list[@]}" -eq 0 ]]; then - elasticsearch_conf_write node.roles "[]" int - else - elasticsearch_conf_set node.roles "${roles_list[@]}" - for role in "${roles_list[@]}"; do - case "$role" in - master | data | data_content | data_hot | data_warm | data_cold | data_frozen) - set_repo_path="yes" - ;; - *) ;; - esac - done - fi - else - set_repo_path="yes" - fi - - - - if is_boolean_yes "$set_repo_path" && [[ -n "$ELASTICSEARCH_FS_SNAPSHOT_REPO_PATH" ]]; then - # Configure path.repo to restore snapshots from system repository - # It must be set on every master an data node - # ref: https://www.elastic.co/guide/en/elasticsearch/reference/current/snapshots-register-repository.html#snapshots-filesystem-repository - elasticsearch_conf_set path.repo "$ELASTICSEARCH_FS_SNAPSHOT_REPO_PATH" - fi -} - -######################## -# Configure Elasticsearch Heap Size -# Globals: -# ELASTICSEARCH_* -# Arguments: -# None -# Returns: -# None -######################### -elasticsearch_set_heap_size() { - local heap_size - - # Remove heap.options if it already exists - rm -f "${ELASTICSEARCH_CONF_DIR}/jvm.options.d/heap.options" - - if [[ -n "$ELASTICSEARCH_HEAP_SIZE" ]]; then - debug "Using specified values for Xmx and Xms heap options..." - heap_size="$ELASTICSEARCH_HEAP_SIZE" - else - debug "Calculating appropriate Xmx and Xms values..." - local machine_mem="" - machine_mem="$(get_total_memory)" - if [[ "$machine_mem" -lt 65536 ]]; then - local max_allowed_memory - local calculated_heap_size - calculated_heap_size="$((machine_mem / 2))" - max_allowed_memory="$((ELASTICSEARCH_MAX_ALLOWED_MEMORY_PERCENTAGE * machine_mem))" - max_allowed_memory="$((max_allowed_memory / 100))" - # Allow for absolute memory limit when calculating limit from percentage - if [[ -n "$ELASTICSEARCH_MAX_ALLOWED_MEMORY" && "$max_allowed_memory" -gt "$ELASTICSEARCH_MAX_ALLOWED_MEMORY" ]]; then - max_allowed_memory="$ELASTICSEARCH_MAX_ALLOWED_MEMORY" - fi - if [[ "$calculated_heap_size" -gt "$max_allowed_memory" ]]; then - info "Calculated Java heap size of ${calculated_heap_size} will be limited to ${max_allowed_memory}" - calculated_heap_size="$max_allowed_memory" - fi - heap_size="${calculated_heap_size}m" - - else - heap_size=32768m - fi - fi - debug "Setting '-Xmx${heap_size} -Xms${heap_size}' heap options..." - cat >"${ELASTICSEARCH_CONF_DIR}/jvm.options.d/heap.options" <>"$custom_conf_file" cat "$old_custom_conf_file" >>"$custom_conf_file" fi debug "Adapting data to new file structure" - find "${old_data_dir}/data" -maxdepth 1 -mindepth 1 -exec mv {} "$ELASTICSEARCH_DATA_DIR" \; + find "${old_data_dir}/data" -maxdepth 1 -mindepth 1 -exec mv {} "$DB_DATA_DIR" \; debug "Removing data that is not persisted anymore from persisted directory" - rm -rf "$old_data_dir" "${ELASTICSEARCH_DATA_DIR}/java" -} - -######################## -# Configure/initialize Elasticsearch -# Globals: -# ELASTICSEARCH_* -# Arguments: -# None -# Returns: -# None -######################### -elasticsearch_initialize() { - info "Configuring/Initializing Elasticsearch..." - - # This fixes an issue where the trap would kill the entrypoint.sh, if a PID was left over from a previous run - # Exec replaces the process without creating a new one, and when the container is restarted it may have the same PID - rm -f "$ELASTICSEARCH_TMP_DIR/elasticsearch.pid" - - read -r -a data_dirs_list <<<"$(tr ',;' ' ' <<<"$ELASTICSEARCH_DATA_DIR_LIST")" - if [[ "${#data_dirs_list[@]}" -gt 0 ]]; then - info "Multiple data directories specified, ignoring ELASTICSEARCH_DATA_DIR environment variable." - else - data_dirs_list+=("$ELASTICSEARCH_DATA_DIR") - - # Persisted data from old versions - if ! is_dir_empty "$ELASTICSEARCH_DATA_DIR"; then - debug "Detected persisted data from previous deployments" - [[ -d "$ELASTICSEARCH_DATA_DIR/elasticsearch" ]] && [[ -f "$ELASTICSEARCH_DATA_DIR/elasticsearch/.initialized" ]] && migrate_old_data - fi - fi - - debug "Ensuring expected directories/files exist..." - for dir in "$ELASTICSEARCH_TMP_DIR" "$ELASTICSEARCH_LOGS_DIR" "$ELASTICSEARCH_PLUGINS_DIR" "$ELASTICSEARCH_BASE_DIR/modules" "$ELASTICSEARCH_CONF_DIR"; do - ensure_dir_exists "$dir" - am_i_root && chown -R "$ELASTICSEARCH_DAEMON_USER:$ELASTICSEARCH_DAEMON_GROUP" "$dir" - done - for dir in "${data_dirs_list[@]}"; do - ensure_dir_exists "$dir" - am_i_root && is_mounted_dir_empty "$dir" && chown -R "$ELASTICSEARCH_DAEMON_USER:$ELASTICSEARCH_DAEMON_GROUP" "$dir" - done - - if [[ -f "$ELASTICSEARCH_CONF_FILE" ]]; then - info "Custom configuration file detected, using it..." - else - info "Setting default configuration" - touch "$ELASTICSEARCH_CONF_FILE" - elasticsearch_conf_set http.port "$ELASTICSEARCH_HTTP_PORT_NUMBER" - elasticsearch_conf_set path.data "${data_dirs_list[@]}" - elasticsearch_conf_set transport.port "$ELASTICSEARCH_TRANSPORT_PORT_NUMBER" - [[ -n "$ELASTICSEARCH_ACTION_DESTRUCTIVE_REQUIRES_NAME" ]] && elasticsearch_conf_set action.destructive_requires_name "$(is_boolean_yes "$ELASTICSEARCH_ACTION_DESTRUCTIVE_REQUIRES_NAME" && echo "true" || echo "false")" - is_boolean_yes "$ELASTICSEARCH_LOCK_ALL_MEMORY" && elasticsearch_conf_set bootstrap.memory_lock "true" - elasticsearch_cluster_configuration - if [[ -n "$ELASTICSEARCH_NODE_TYPE" ]]; then - elasticsearch_configure_node_type - else - elasticsearch_configure_node_roles - fi - elasticsearch_custom_configuration - # X-Pack settings. - elasticsearch_conf_set xpack.security.enabled "$(is_boolean_yes "$ELASTICSEARCH_ENABLE_SECURITY" && echo "true" || echo "false")" - ! is_empty_value "$ELASTICSEARCH_PASSWORD" && elasticsearch_set_key_value "bootstrap.password" "$ELASTICSEARCH_PASSWORD" - if is_boolean_yes "$ELASTICSEARCH_ENABLE_SECURITY"; then - is_boolean_yes "$ELASTICSEARCH_ENABLE_REST_TLS" && elasticsearch_http_tls_configuration - ! is_boolean_yes "$ELASTICSEARCH_SKIP_TRANSPORT_TLS" && elasticsearch_transport_tls_configuration - if is_boolean_yes "$ELASTICSEARCH_ENABLE_FIPS_MODE"; then - elasticsearch_conf_set xpack.security.fips_mode.enabled "true" - elasticsearch_conf_set xpack.security.authc.password_hashing.algorithm "pbkdf2" - fi - fi - # Latest Elasticseach releases install x-pack-ml by default. Since we have faced some issues with this library on certain platforms, - # currently we are disabling this machine learning module whatsoever by defining "xpack.ml.enabled=false" in the "elasicsearch.yml" file - if is_dir_empty "${ELASTICSEARCH_BASE_DIR}/modules/x-pack-ml/platform/linux-"*; then - elasticsearch_conf_set xpack.ml.enabled "false" - fi - fi - - if is_file_writable "${ELASTICSEARCH_CONF_DIR}/jvm.options" && is_file_writable "${ELASTICSEARCH_CONF_DIR}/jvm.options.d"; then - if is_boolean_yes "$ELASTICSEARCH_DISABLE_JVM_HEAP_DUMP"; then - info "Disabling JVM heap dumps..." - replace_in_file "${ELASTICSEARCH_CONF_DIR}/jvm.options" "-XX:[+]HeapDumpOnOutOfMemoryError" "# -XX:+HeapDumpOnOutOfMemoryError" - fi - if is_boolean_yes "$ELASTICSEARCH_DISABLE_GC_LOGS"; then - info "Disabling JVM GC logs..." - replace_in_file "${ELASTICSEARCH_CONF_DIR}/jvm.options" "(^.*logs[/]gc.log.*$)" "# \1" - fi - elasticsearch_set_heap_size - else - warn "The JVM options configuration files are not writable. Configurations based on environment variables will not be applied" - fi -} - -######################## -# Install Elasticsearch plugins -# Globals: -# ELASTICSEARCH_* -# Arguments: -# None -# Returns: -# None -######################### -elasticsearch_install_plugins() { - read -r -a plugins_list <<<"$(tr ',;' ' ' <<<"$ELASTICSEARCH_PLUGINS")" - local mandatory_plugins="" - - # Helper function for extracting the plugin name from a tarball name - # Examples: - # get_plugin_name plugin -> plugin - # get_plugin_name file://plugin.zip -> plugin - # get_plugin_name http://plugin-0.1.2.zip -> plugin - get_plugin_name() { - local plugin="${1:?missing plugin}" - # Remove any paths, and strip both the .zip extension and the version - basename "$plugin" | sed -E -e 's/.zip$//' -e 's/-[0-9]+\.[0-9]+(\.[0-9]+){0,}$//' - } - - # Collect plugins that should be installed offline - read -r -a mounted_plugins <<<"$(find "$ELASTICSEARCH_MOUNTED_PLUGINS_DIR" -type f -name "*.zip" -print0 | xargs -0)" - if [[ "${#mounted_plugins[@]}" -gt 0 ]]; then - for plugin in "${mounted_plugins[@]}"; do - plugins_list+=("file://${plugin}") - done - fi - - # Skip if there isn't any plugin to install - [[ -z "${plugins_list[*]:-}" ]] && return - - # Install plugins - debug "Installing plugins: ${plugins_list[*]}" - for plugin in "${plugins_list[@]}"; do - plugin_name="$(get_plugin_name "$plugin")" - [[ -n "$mandatory_plugins" ]] && mandatory_plugins="${mandatory_plugins},${plugin_name}" || mandatory_plugins="$plugin_name" - - # Check if the plugin was already installed - if [[ -d "${ELASTICSEARCH_PLUGINS_DIR}/${plugin_name}" ]]; then - debug "Plugin already installed: ${plugin}" - continue - fi - - debug "Installing plugin: ${plugin}" - if [[ "${BITNAMI_DEBUG:-false}" = true ]]; then - elasticsearch-plugin install -b -v "$plugin" - else - elasticsearch-plugin install -b -v "$plugin" >/dev/null 2>&1 - fi - done - - # Mark plugins as mandatory - elasticsearch_conf_set plugin.mandatory "$mandatory_plugins" + rm -rf "$old_data_dir" "${DB_DATA_DIR}/java" } ######################## # Set Elasticsearch keystore values # Globals: -# ELASTICSEARCH_* +# ELASTICSEARCH_KEYS # Arguments: # None # Returns: @@ -841,24 +138,697 @@ elasticsearch_set_key_value() { debug "Storing key: ${key}" elasticsearch-keystore add --stdin --force "$key" <<<"$value" - am_i_root && chown "$ELASTICSEARCH_DAEMON_USER:$ELASTICSEARCH_DAEMON_GROUP" "${ELASTICSEARCH_CONF_DIR}/elasticsearch.keystore" + am_i_root && chown "$DB_DAEMON_USER:$DB_DAEMON_GROUP" "${DB_CONF_DIR}/elasticsearch.keystore" + # Avoid exit code of previous commands to affect the result of this function + true +} + +#!/bin/bash +# +# Bitnami Elasticsearch/Opensearch common library + +# shellcheck disable=SC1090,SC1091 + +# Load Generic Libraries +. /opt/bitnami/scripts/libfs.sh +. /opt/bitnami/scripts/libfile.sh +. /opt/bitnami/scripts/liblog.sh +. /opt/bitnami/scripts/libnet.sh +. /opt/bitnami/scripts/libos.sh +. /opt/bitnami/scripts/libversion.sh +. /opt/bitnami/scripts/libservice.sh +. /opt/bitnami/scripts/libvalidations.sh + +# Functions + +######################## +# Write a configuration setting value +# Globals: +# DB_CONF_FILE +# Arguments: +# $1 - key +# $2 - value +# $3 - YAML type (string, int or bool) +# Returns: +# None +######################### +elasticsearch_conf_write() { + local -r key="${1:?Missing key}" + local -r value="${2:-}" + local -r type="${3:-string}" + local -r tempfile=$(mktemp) + + case "$type" in + string) + yq eval "(.${key}) |= \"${value}\"" "$DB_CONF_FILE" >"$tempfile" + ;; + int) + yq eval "(.${key}) |= ${value}" "$DB_CONF_FILE" >"$tempfile" + ;; + bool) + yq eval "(.${key}) |= (\"${value}\" | test(\"true\"))" "$DB_CONF_FILE" >"$tempfile" + ;; + *) + error "Type unknown: ${type}" + return 1 + ;; + esac + cp "$tempfile" "$DB_CONF_FILE" +} + +######################## +# Set a configuration setting value +# Globals: +# DB_CONF_FILE +# Arguments: +# $1 - key +# $2 - values (array) +# Returns: +# None +######################### +elasticsearch_conf_set() { + local key="${1:?missing key}" + shift + local values=("${@}") + + if [[ "${#values[@]}" -eq 0 ]]; then + stderr_print "$key" + stderr_print "missing values" + return 1 + elif [[ "${#values[@]}" -eq 1 ]] && [[ -n "${values[0]}" ]]; then + elasticsearch_conf_write "$key" "${values[0]}" + else + for i in "${!values[@]}"; do + if [[ -n "${values[$i]}" ]]; then + elasticsearch_conf_write "${key}[$i]" "${values[$i]}" + fi + done + fi +} + +######################## +# Check if Elasticsearch is running +# Globals: +# DB_TMP_DIR +# Arguments: +# None +# Returns: +# Boolean +######################### +is_elasticsearch_running() { + local pid + pid="$(get_pid_from_file "$DB_PID_FILE")" + + if [[ -z "$pid" ]]; then + false + else + is_service_running "$pid" + fi +} + +######################## +# Check if Elasticsearch is not running +# Globals: +# DB_TMP_DIR +# Arguments: +# None +# Returns: +# Boolean +######################### +is_elasticsearch_not_running() { + ! is_elasticsearch_running + return "$?" +} + +######################## +# Stop Elasticsearch +# Globals: +# DB_TMP_DIR +# Arguments: +# None +# Returns: +# None +######################### +elasticsearch_stop() { + ! is_elasticsearch_running && return + debug "Stopping ${DB_FLAVOR^}..." + stop_service_using_pid "$DB_PID_FILE" +} + +######################## +# Start Elasticsearch and wait until it's ready +# Globals: +# DB_* +# Arguments: +# None +# Returns: +# None +######################### +elasticsearch_start() { + is_elasticsearch_running && return + + debug "Starting ${DB_FLAVOR^}..." + local command=("${DB_BASE_DIR}/bin/${DB_FLAVOR}" "-d" "-p" "$DB_PID_FILE") + am_i_root && command=("run_as_user" "$DB_DAEMON_USER" "${command[@]}") + if [[ "$BITNAMI_DEBUG" = true ]]; then + "${command[@]}" & + else + "${command[@]}" >/dev/null 2>&1 & + fi + + local retries=50 + local seconds=2 + # Check the process is running + retry_while "is_elasticsearch_running" "$retries" "$seconds" + # Check Elasticsearch API is reachable + retry_while "elasticsearch_healthcheck" "$retries" "$seconds" +} + +######################## +# Validate kernel settings +# Arguments: +# None +# Returns: +# None +######################### +elasticsearch_validate_kernel() { + # Auxiliary functions + validate_sysctl_key() { + local key="${1:?key is missing}" + local value="${2:?value is missing}" + local current_value + current_value="$(sysctl -n "$key")" + if [[ "$current_value" -lt "$value" ]]; then + error "Invalid kernel settings. ${DB_FLAVOR^} requires at least: $key = $value" + exit 1 + fi + } + + debug "Validating Kernel settings..." + if [[ $(yq eval .index.store.type "$DB_CONF_FILE") ]]; then + debug "Custom index.store.type found in the config file. Skipping kernel validation..." + else + validate_sysctl_key "fs.file-max" 65536 + fi + if [[ $(yq eval .node.store.allow_mmap "$DB_CONF_FILE") ]]; then + debug "Custom node.store.allow_mmap found in the config file. Skipping kernel validation..." + else + validate_sysctl_key "vm.max_map_count" 262144 + fi +} + +######################## +# Validate settings in DB_* env vars +# Globals: +# DB_* +# Arguments: +# None +# Returns: +# None +######################### +elasticsearch_validate() { + local error_code=0 + + # Auxiliary functions + print_validation_error() { + error "$1" + error_code=1 + } + + validate_node_roles() { + if [ -n "$DB_NODE_ROLES" ]; then + read -r -a roles_list <<<"$(get_elasticsearch_roles)" + local master_role="master" + [[ "$DB_FLAVOR" = "opensearch" && "$APP_VERSION" =~ ^2\. ]] && master_role="cluster_manager" + if [[ "${#roles_list[@]}" -le 0 ]]; then + warn "Setting ${DB_FLAVOR^^}_NODE_ROLES is empty and ${DB_FLAVOR^^}_IS_DEDICATED_NODE is set to true, ${DB_FLAVOR^} will be configured as coordinating-only node." + fi + for role in "${roles_list[@]}"; do + case "$role" in + "$master_role" | data | data_content | data_hot | data_warm | data_cold | data_frozen | ingest | ml | remote_cluster_client | transform) ;; + + *) + print_validation_error "Invalid node role '$role'. Supported roles are '${master_role},data,data_content,data_hot,data_warm,data_cold,data_frozen,ingest,ml,remote_cluster_client,transform'" + ;; + esac + done + fi + } + + debug "Ensuring expected directories/files exist..." + am_i_root && ensure_user_exists "$DB_DAEMON_USER" --group "$DB_DAEMON_GROUP" + for dir in "$DB_TMP_DIR" "$DB_LOGS_DIR" "$DB_PLUGINS_DIR" "$DB_BASE_DIR/modules" "$DB_CONF_DIR"; do + ensure_dir_exists "$dir" + am_i_root && chown -R "$DB_DAEMON_USER:$DB_DAEMON_GROUP" "$dir" + done + + debug "Validating settings in DB_* env vars..." + for var in "DB_HTTP_PORT_NUMBER" "DB_TRANSPORT_PORT_NUMBER"; do + if ! err=$(validate_port "${!var}"); then + print_validation_error "An invalid port was specified in the environment variable $var: $err" + fi + done + + if ! is_boolean_yes "$DB_IS_DEDICATED_NODE"; then + warn "Setting ${DB_FLAVOR^^}_IS_DEDICATED_NODE is disabled." + warn "${DB_FLAVOR^^}_NODE_ROLES will be ignored and ${DB_FLAVOR^} will asume all different roles." + else + validate_node_roles + fi + + if [[ -n "$DB_BIND_ADDRESS" ]] && ! validate_ipv4 "$DB_BIND_ADDRESS"; then + print_validation_error "The Bind Address specified in the environment variable ${DB_FLAVOR^^}_BIND_ADDRESS is not a valid IPv4" + fi + + if is_boolean_yes "$DB_ENABLE_SECURITY"; then + if [[ "$DB_FLAVOR" = "opensearch" ]]; then + if [[ ! -f "$OPENSEARCH_SECURITY_ADMIN_KEY_LOCATION" ]] || [[ ! -f "$OPENSEARCH_SECURITY_ADMIN_CERT_LOCATION" ]]; then + print_validation_error "In order to enable Opensearch Security, you must provide a valid admin PEM key and certificate." + fi + if is_empty_value "$OPENSEARCH_SECURITY_NODES_DN"; then + print_validation_error "The variable OPENSEARCH_SECURITY_NODES_DN is required." + fi + if is_empty_value "$OPENSEARCH_SECURITY_ADMIN_DN"; then + print_validation_error "The variable OPENSEARCH_SECURITY_ADMIN_DN is required." + fi + if ! is_boolean_yes "$OPENSEARCH_ENABLE_REST_TLS"; then + print_validation_error "Opensearch does not support plaintext conections (HTTP) when Security is enabled." + fi + fi + if is_boolean_yes "$DB_TRANSPORT_TLS_USE_PEM"; then + if [[ ! -f "$DB_TRANSPORT_TLS_NODE_CERT_LOCATION" ]] || [[ ! -f "$DB_TRANSPORT_TLS_NODE_KEY_LOCATION" ]] || [[ ! -f "$DB_TRANSPORT_TLS_CA_CERT_LOCATION" ]]; then + print_validation_error "In order to configure the TLS encryption for ${DB_FLAVOR^} Transport you must provide your node key, certificate and a valid certification_authority certificate." + fi + elif [[ ! -f "$DB_TRANSPORT_TLS_KEYSTORE_LOCATION" ]] || [[ ! -f "$DB_TRANSPORT_TLS_TRUSTSTORE_LOCATION" ]]; then + print_validation_error "In order to configure the TLS encryption for ${DB_FLAVOR^} Transport with JKS/PKCS12 certs you must mount a valid keystore and truststore." + fi + if is_boolean_yes "$DB_HTTP_TLS_USE_PEM"; then + if [[ ! -f "$DB_HTTP_TLS_NODE_CERT_LOCATION" ]] || [[ ! -f "$DB_HTTP_TLS_NODE_KEY_LOCATION" ]] || [[ ! -f "$DB_HTTP_TLS_CA_CERT_LOCATION" ]]; then + print_validation_error "In order to configure the TLS encryption for ${DB_FLAVOR^} you must provide your node key, certificate and a valid certification_authority certificate." + fi + elif [[ ! -f "$DB_HTTP_TLS_KEYSTORE_LOCATION" ]] || [[ ! -f "$DB_HTTP_TLS_TRUSTSTORE_LOCATION" ]]; then + print_validation_error "In order to configure the TLS encryption for ${DB_FLAVOR^} with JKS/PKCS12 certs you must mount a valid keystore and truststore." + fi + fi + + [[ "$error_code" -eq 0 ]] || exit "$error_code" +} + +######################## +# Determine the hostname by which Elasticsearch can be contacted +# Returns: +# The value of $DB_ADVERTISED_HOSTNAME or the current host address +######################## +get_elasticsearch_hostname() { + if [[ -n "$DB_ADVERTISED_HOSTNAME" ]]; then + echo "$DB_ADVERTISED_HOSTNAME" + else + get_machine_ip + fi +} + +######################## +# Evaluates the env variable DB_NODE_ROLES and replaces master with +# Globals: +# DB_* +# Arguments: +# None +# Returns: +# Array of node roles +######################### +get_elasticsearch_roles() { + read -r -a roles_list_tmp <<<"$(tr ',;' ' ' <<<"$DB_NODE_ROLES")" + roles_list=("${roles_list_tmp[@]}") + for i in "${!roles_list[@]}"; do + if [[ ${roles_list[$i]} == "master" ]] && [[ "$DB_FLAVOR" = "opensearch" && "$APP_VERSION" =~ ^2\. ]]; then + roles_list[i]="cluster_manager" + fi + done + echo "${roles_list[@]}" +} + +######################## +# Configure cluster settings +# Globals: +# DB_* +# Arguments: +# None +# Returns: +# None +######################### +elasticsearch_cluster_configuration() { + # Auxiliary functions + bind_address() { + if [[ -n "$DB_BIND_ADDRESS" ]]; then + echo "$DB_BIND_ADDRESS" + else + echo "0.0.0.0" + fi + } + + is_node_master() { + if is_boolean_yes "$DB_IS_DEDICATED_NODE"; then + if [ -n "$DB_NODE_ROLES" ]; then + read -r -a roles_list <<<"$(get_elasticsearch_roles)" + if [[ " ${roles_list[*]} " = *" master "* ]]; then + true + elif [[ "$DB_FLAVOR" = "opensearch" && " ${roles_list[*]} " = *" cluster_manager "* ]]; then + true + else + false + fi + else + false + fi + else + true + fi + } + + info "Configuring ${DB_FLAVOR^} cluster settings..." + elasticsearch_conf_set network.host "$(get_elasticsearch_hostname)" + elasticsearch_conf_set network.publish_host "$(get_elasticsearch_hostname)" + elasticsearch_conf_set network.bind_host "$(bind_address)" + elasticsearch_conf_set cluster.name "$DB_CLUSTER_NAME" + elasticsearch_conf_set node.name "${DB_NODE_NAME:-$(hostname)}" + + if [[ -n "$DB_CLUSTER_HOSTS" ]]; then + read -r -a host_list <<<"$(tr ',;' ' ' <<<"$DB_CLUSTER_HOSTS")" + master_list=("${host_list[@]}") + if [[ -n "$DB_CLUSTER_MASTER_HOSTS" ]]; then + read -r -a master_list <<<"$(tr ',;' ' ' <<<"$DB_CLUSTER_MASTER_HOSTS")" + fi + elasticsearch_conf_set discovery.seed_hosts "${host_list[@]}" + if is_node_master; then + if [[ "$DB_FLAVOR" = "opensearch" && "$APP_VERSION" =~ ^2\. ]]; then + elasticsearch_conf_set cluster.initial_cluster_manager_nodes "${master_list[@]}" + else + elasticsearch_conf_set cluster.initial_master_nodes "${master_list[@]}" + fi + fi + elasticsearch_conf_set discovery.initial_state_timeout "10m" + else + elasticsearch_conf_set "discovery.type" "single-node" + fi +} + +######################## +# Extend cluster settings with custom, user-provided config +# Globals: +# DB_* +# Arguments: +# None +# Returns: +# None +######################### +elasticsearch_custom_configuration() { + local custom_conf_file="${DB_CONF_DIR}/my_${DB_FLAVOR}.yml" + local -r tempfile=$(mktemp) + [[ ! -s "$custom_conf_file" ]] && return + info "Adding custom configuration" + yq eval-all 'select(fileIndex == 0) * select(fileIndex == 1)' "$DB_CONF_FILE" "$custom_conf_file" >"$tempfile" + cp "$tempfile" "$DB_CONF_FILE" +} + +######################## +# Configure node roles. +# There are 3 scenarios: +# * If DB_IS_DEDICATED_NODE is disabled, 'node.roles' is omitted and assumes all the roles (check docs). +# * Otherwise, 'node.roles' with a list of roles provided with DB_NODE_ROLES. +# * In addition, if DB_NODE_ROLES is empty, node.roles will be configured empty, meaning that the role is 'coordinating-only'. +# +# Docs ref: https://www.elastic.co/guide/en/opensearch/reference/current/modules-node.html +# +# Globals: +# DB_* +# Arguments: +# None +# Returns: +# None +######################### +elasticsearch_configure_node_roles() { + debug "Configure ${DB_FLAVOR^} Node roles..." + + local set_repo_path="no" + if is_boolean_yes "$DB_IS_DEDICATED_NODE"; then + read -r -a roles_list <<<"$(get_elasticsearch_roles)" + if [[ "${#roles_list[@]}" -eq 0 ]]; then + elasticsearch_conf_write node.roles "[]" int + else + elasticsearch_conf_set node.roles "${roles_list[@]}" + for role in "${roles_list[@]}"; do + case "$role" in + cluster_manager | master | data | data_content | data_hot | data_warm | data_cold | data_frozen) + set_repo_path="yes" + ;; + *) ;; + esac + done + fi + else + set_repo_path="yes" + fi + + if is_boolean_yes "$set_repo_path" && [[ -n "$DB_FS_SNAPSHOT_REPO_PATH" ]]; then + # Configure path.repo to restore snapshots from system repository + # It must be set on every cluster_manager an data node + # ref: https://www.elastic.co/guide/en/opensearch/reference/current/snapshots-register-repository.html#snapshots-filesystem-repository + elasticsearch_conf_set path.repo "$DB_FS_SNAPSHOT_REPO_PATH" + fi +} + +######################## +# Configure Heap Size +# Globals: +# DB_* +# Arguments: +# None +# Returns: +# None +######################### +elasticsearch_set_heap_size() { + local heap_size + + # Remove heap.options if it already exists + rm -f "${DB_CONF_DIR}/jvm.options.d/heap.options" + + if [[ -n "$DB_HEAP_SIZE" ]]; then + debug "Using specified values for Xmx and Xms heap options..." + heap_size="$DB_HEAP_SIZE" + else + debug "Calculating appropriate Xmx and Xms values..." + local machine_mem="" + machine_mem="$(get_total_memory)" + if [[ "$machine_mem" -lt 65536 ]]; then + local max_allowed_memory + local calculated_heap_size + calculated_heap_size="$((machine_mem / 2))" + max_allowed_memory="$((DB_MAX_ALLOWED_MEMORY_PERCENTAGE * machine_mem))" + max_allowed_memory="$((max_allowed_memory / 100))" + # Allow for absolute memory limit when calculating limit from percentage + if [[ -n "$DB_MAX_ALLOWED_MEMORY" && "$max_allowed_memory" -gt "$DB_MAX_ALLOWED_MEMORY" ]]; then + max_allowed_memory="$DB_MAX_ALLOWED_MEMORY" + fi + if [[ "$calculated_heap_size" -gt "$max_allowed_memory" ]]; then + info "Calculated Java heap size of ${calculated_heap_size} will be limited to ${max_allowed_memory}" + calculated_heap_size="$max_allowed_memory" + fi + heap_size="${calculated_heap_size}m" + + else + heap_size=32768m + fi + fi + debug "Setting '-Xmx${heap_size} -Xms${heap_size}' heap options..." + cat >"${DB_CONF_DIR}/jvm.options.d/heap.options" < plugin + # get_plugin_name file://plugin.zip -> plugin + # get_plugin_name http://plugin-0.1.2.zip -> plugin + get_plugin_name() { + local plugin="${1:?missing plugin}" + # Remove any paths, and strip both the .zip extension and the version + basename "$plugin" | sed -E -e 's/.zip$//' -e 's/-[0-9]+\.[0-9]+(\.[0-9]+){0,}$//' + } + + # Collect plugins that should be installed offline + read -r -a mounted_plugins <<<"$(find "$DB_MOUNTED_PLUGINS_DIR" -type f -name "*.zip" -print0 | xargs -0)" + if [[ "${#mounted_plugins[@]}" -gt 0 ]]; then + for plugin in "${mounted_plugins[@]}"; do + plugins_list+=("file://${plugin}") + done + fi + + # Skip if there isn't any plugin to install + [[ -z "${plugins_list[*]:-}" ]] && return + + # Install plugins + debug "Installing plugins: ${plugins_list[*]}" + for plugin in "${plugins_list[@]}"; do + plugin_name="$(get_plugin_name "$plugin")" + [[ -n "$mandatory_plugins" ]] && mandatory_plugins="${mandatory_plugins},${plugin_name}" || mandatory_plugins="$plugin_name" + + # Check if the plugin was already installed + if [[ -d "${DB_PLUGINS_DIR}/${plugin_name}" ]]; then + debug "Plugin already installed: ${plugin}" + continue + fi + + debug "Installing plugin: ${plugin}" + if [[ "${BITNAMI_DEBUG:-false}" = true ]]; then + "$cmd" install -b -v "$plugin" + else + "$cmd" install -b -v "$plugin" >/dev/null 2>&1 + fi + done + + # Mark plugins as mandatory + elasticsearch_conf_set plugin.mandatory "$mandatory_plugins" +} + ######################## # Run custom initialization scripts # Globals: -# ELASTICSEARCH_* +# DB_* # Arguments: # None # Returns: # None ######################### elasticsearch_custom_init_scripts() { - read -r -a init_scripts <<<"$(find "$ELASTICSEARCH_INITSCRIPTS_DIR" -type f -name "*.sh" -print0 | xargs -0)" - if [[ "${#init_scripts[@]}" -gt 0 ]] && [[ ! -f "$ELASTICSEARCH_VOLUME_DIR"/.user_scripts_initialized ]]; then - info "Loading user's custom files from $ELASTICSEARCH_INITSCRIPTS_DIR" + read -r -a init_scripts <<<"$(find "$DB_INITSCRIPTS_DIR" -type f -name "*.sh" -print0 | xargs -0)" + if [[ "${#init_scripts[@]}" -gt 0 ]] && [[ ! -f "$DB_VOLUME_DIR"/.user_scripts_initialized ]]; then + info "Loading user's custom files from $DB_INITSCRIPTS_DIR" for f in "${init_scripts[@]}"; do debug "Executing $f" case "$f" in @@ -878,35 +848,14 @@ elasticsearch_custom_init_scripts() { ;; esac done - touch "$ELASTICSEARCH_VOLUME_DIR"/.user_scripts_initialized - fi -} - -######################## -# Get elasticsearch version -# Globals: -# ELASTICSEARCH_* -# Arguments: -# None -# Returns: -# version -######################### -elasticsearch_get_version() { - local -a elasticsearch_cmd=("elasticsearch" "--version") - am_i_root && elasticsearch_cmd=("run_as_user" "$ELASTICSEARCH_DAEMON_USER" "${elasticsearch_cmd[@]}") - if [[ -f "$ELASTICSEARCH_CONF_FILE" ]]; then - ES_JAVA_OPTS="-Xms1m -Xmx20m" "${elasticsearch_cmd[@]}" | grep Version: | awk -F "," '{print $1}' | awk -F ":" '{print $2}' - else - touch "$ELASTICSEARCH_CONF_FILE" - ES_JAVA_OPTS="-Xms1m -Xmx20m" "${elasticsearch_cmd[@]}" | grep Version: | awk -F "," '{print $1}' | awk -F ":" '{print $2}' - rm "$ELASTICSEARCH_CONF_FILE" + touch "$DB_VOLUME_DIR"/.user_scripts_initialized fi } ######################## # Modify log4j2.properties to send events to stdout instead of a logfile # Globals: -# ELASTICSEARCH_* +# DB_* # Arguments: # None # Returns: @@ -914,10 +863,10 @@ elasticsearch_get_version() { ######################### elasticsearch_configure_logging() { # Back up the original file for users who'd like to use logfile logging - cp "${ELASTICSEARCH_CONF_DIR}/log4j2.properties" "${ELASTICSEARCH_CONF_DIR}/log4j2.file.properties" + cp "${DB_CONF_DIR}/log4j2.properties" "${DB_CONF_DIR}/log4j2.file.properties" # Replace RollingFile with Console - replace_in_file "${ELASTICSEARCH_CONF_DIR}/log4j2.properties" "RollingFile" "Console" + replace_in_file "${DB_CONF_DIR}/log4j2.properties" "RollingFile" "Console" local -a delete_patterns=( # Remove RollingFile specific settings @@ -930,39 +879,44 @@ elasticsearch_configure_logging() { "^appender\.rolling" "appenderRef\.rolling" # Remove _old loggers "_old\." + # Remove .filePermissions config + "\.filePermissions" ) for pattern in "${delete_patterns[@]}"; do - remove_in_file "${ELASTICSEARCH_CONF_DIR}/log4j2.properties" "$pattern" + remove_in_file "${DB_CONF_DIR}/log4j2.properties" "$pattern" done } ######################## -# Check Elasticsearch health +# Check Elasticsearch/Opensearch health # Globals: -# ELASTICSEARCH_* +# DB_* # Arguments: # None # Returns: -# 0 when healthy +# 0 when healthy (or waiting for Opensearch security bootstrap) # 1 when unhealthy ######################### elasticsearch_healthcheck() { - info "Checking Elasticsearch health..." - local -r exec="curl" - local command_args=("--silent" "--show-error" "--fail") + info "Checking ${DB_FLAVOR^} health..." + local -r cmd="curl" + local command_args=("--silent" "--write-out" "%{http_code}") local protocol="http" local host host=$(get_elasticsearch_hostname) - is_boolean_yes "$ELASTICSEARCH_ENABLE_REST_TLS" && protocol="https" && command_args+=("-k") - is_boolean_yes "$ELASTICSEARCH_ENABLE_SECURITY" && command_args+=("--user" "elastic:${ELASTICSEARCH_PASSWORD}") + is_boolean_yes "$DB_ENABLE_SECURITY" && is_boolean_yes "$DB_ENABLE_REST_TLS" && protocol="https" && command_args+=("-k" "--user" "${DB_USERNAME}:${DB_PASSWORD}") - command_args+=("${protocol}://${host}:${ELASTICSEARCH_HTTP_PORT_NUMBER}/_cluster/health?local=true") - - if ! "$exec" "${command_args[@]}" >/dev/null; then - return 1 - else + # Combination of --silent, --output and --write-out allows us to obtain both the status code and the request body + output=$(mktemp) + command_args+=("-o" "$output" "${protocol}://${host}:${DB_HTTP_PORT_NUMBER}/_cluster/health?local=true") + HTTP_CODE=$("$cmd" "${command_args[@]}") + if [[ ${HTTP_CODE} -ge 200 && ${HTTP_CODE} -le 299 ]] || ([[ "$DB_FLAVOR" = "opensearch" ]] && [[ ${HTTP_CODE} -eq 503 ]] && grep -q "OpenSearch Security not initialized" "$output" ); then + rm "$output" return 0 + else + rm "$output" + return 1 fi }