mirror of
https://github.com/bitnami/containers.git
synced 2026-10-19 12:52:06 +02:00
[bitnami/elasticsearch] Release 9.4.1-debian-12-r4 (#94012)
Signed-off-by: Bitnami Bot <bitnami.bot@broadcom.com>
This commit is contained in:
Bitnami Bot
@@ -9,7 +9,7 @@ ARG JAVA_EXTRA_SECURITY_DIR="/bitnami/java/extra-security"
|
||||
ARG TARGETARCH
|
||||
|
||||
LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bookworm" \
|
||||
org.opencontainers.image.created="2026-05-23T09:35:54Z" \
|
||||
org.opencontainers.image.created="2026-05-27T07:14:36Z" \
|
||||
org.opencontainers.image.description="Application packaged by Broadcom, Inc." \
|
||||
org.opencontainers.image.documentation="https://github.com/bitnami/containers/tree/main/bitnami/elasticsearch/README.md" \
|
||||
org.opencontainers.image.source="https://github.com/bitnami/containers/tree/main/bitnami/elasticsearch" \
|
||||
@@ -38,12 +38,12 @@ RUN --mount=type=secret,id=downloads_url,env=SECRET_DOWNLOADS_URL \
|
||||
for COMPONENT in "${COMPONENTS[@]}"; do \
|
||||
if [ ! -f "${COMPONENT}.tar.gz" ]; then \
|
||||
curl -SsLf "https://${DOWNLOADS_URL}/${COMPONENT}.tar.gz" -O ; \
|
||||
curl -SsLf "https://${DOWNLOADS_URL}/${COMPONENT}.tar.gz.sha256" -O ; \
|
||||
fi ; \
|
||||
sha256sum -c "${COMPONENT}.tar.gz.sha256" ; \
|
||||
sha256sum -c "/opt/bitnami/checksums/${COMPONENT}.tar.gz.sha256" ; \
|
||||
tar -zxf "${COMPONENT}.tar.gz" -C /opt/bitnami --strip-components=2 --no-same-owner ; \
|
||||
rm -rf "${COMPONENT}".tar.gz{,.sha256} ; \
|
||||
done
|
||||
rm -rf "${COMPONENT}".tar.gz ; \
|
||||
done ; \
|
||||
rm -rf /opt/bitnami/checksums ;
|
||||
RUN apt-get update && apt-get upgrade -y && \
|
||||
apt-get clean && rm -rf /var/lib/apt/lists /var/cache/apt/archives
|
||||
RUN chmod g+rwX /opt/bitnami
|
||||
@@ -54,7 +54,7 @@ RUN /opt/bitnami/scripts/elasticsearch/postunpack.sh
|
||||
RUN /opt/bitnami/scripts/java/postunpack.sh
|
||||
ENV APP_VERSION="9.4.1" \
|
||||
BITNAMI_APP_NAME="elasticsearch" \
|
||||
IMAGE_REVISION="3" \
|
||||
IMAGE_REVISION="4" \
|
||||
JAVA_HOME="/opt/bitnami/java" \
|
||||
LD_LIBRARY_PATH="/opt/bitnami/elasticsearch/jdk/lib:/opt/bitnami/elasticsearch/jdk/lib/server:$LD_LIBRARY_PATH"
|
||||
|
||||
|
||||
+1
@@ -0,0 +1 @@
|
||||
984705b900956886bd44a9884a3ab8c9ac1b84dc8c0eec1ae50392547f4e3ada elasticsearch-9.4.1-0-linux-amd64-debian-12.tar.gz
|
||||
+1
@@ -0,0 +1 @@
|
||||
2cfdda56c0dc46645770a754d16dbe9d83c3c2a5acd15ca696f71802b5b60815 elasticsearch-9.4.1-0-linux-arm64-debian-12.tar.gz
|
||||
+1
@@ -0,0 +1 @@
|
||||
fa2c3125d94154a3bc67bb7899c3fe231267ed4133d3931d1ce4864f915a6d0f java-21.0.11-11-2-linux-amd64-debian-12.tar.gz
|
||||
+1
@@ -0,0 +1 @@
|
||||
9bc5e94a5934ab91f797a5cb1f1f0bdd8917ae676a21806b4394887a367eb836 java-21.0.11-11-2-linux-arm64-debian-12.tar.gz
|
||||
+1
@@ -0,0 +1 @@
|
||||
b7241b4121e1304b74a5e04db2d4e8d1db6aca71a65987d8c79836e5235cb927 yq-4.53.2-1-linux-amd64-debian-12.tar.gz
|
||||
+1
@@ -0,0 +1 @@
|
||||
ba312982d2ba0a320c116b4db0e0ef2518813be9a948a29bc9c3e05951049da9 yq-4.53.2-1-linux-arm64-debian-12.tar.gz
|
||||
@@ -139,3 +139,40 @@ wait_for_log_entry() {
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
########################
|
||||
# Creates a secure temporary file containing the provided secret
|
||||
# Arguments:
|
||||
# $1 - secret to write to the temporary file
|
||||
# Returns:
|
||||
# String
|
||||
#########################
|
||||
credential_to_temp_file() {
|
||||
local secret="$1"
|
||||
local tmp_file
|
||||
|
||||
# Use mktemp with a specific prefix for easier debugging if something lingers
|
||||
if ! tmp_file=$(mktemp "${TMPDIR:-/tmp}/at.cred.XXXXXXXX"); then
|
||||
echo "Error: Failed to create temp file" >&2
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Restrict permissions before writing the secret
|
||||
chmod 0600 "$tmp_file"
|
||||
# Write secret and ensure it's flushed to disk
|
||||
printf "%s" "$secret" > "$tmp_file"
|
||||
# Output the filename so the caller can capture it
|
||||
echo "$tmp_file"
|
||||
}
|
||||
|
||||
########################
|
||||
# Cleans up temporary files created by credential_to_temp_file
|
||||
# Arguments:
|
||||
# None
|
||||
# Returns:
|
||||
# None
|
||||
#########################
|
||||
cleanup_credentials() {
|
||||
debug "Cleaning up temporary files containing credentials"
|
||||
rm -rf "${TMPDIR:-/tmp}"/at.cred.*
|
||||
}
|
||||
|
||||
@@ -190,7 +190,7 @@ export DB_ACTION_DESTRUCTIVE_REQUIRES_NAME="$ELASTICSEARCH_ACTION_DESTRUCTIVE_RE
|
||||
# Elasticsearch Security configuration
|
||||
export ELASTICSEARCH_ENABLE_SECURITY="${ELASTICSEARCH_ENABLE_SECURITY:-false}"
|
||||
export DB_ENABLE_SECURITY="$ELASTICSEARCH_ENABLE_SECURITY"
|
||||
export ELASTICSEARCH_PASSWORD="${ELASTICSEARCH_PASSWORD:-bitnami}"
|
||||
export ELASTICSEARCH_PASSWORD="${ELASTICSEARCH_PASSWORD:-}"
|
||||
export DB_PASSWORD="$ELASTICSEARCH_PASSWORD"
|
||||
export ELASTICSEARCH_USERNAME="elastic"
|
||||
export DB_USERNAME="$ELASTICSEARCH_USERNAME"
|
||||
|
||||
+2
@@ -15,4 +15,6 @@ set -o pipefail
|
||||
# Load Elasticsearch environment variables
|
||||
. /opt/bitnami/scripts/elasticsearch-env.sh
|
||||
|
||||
# Ensure we clean up temporary files when this script ends
|
||||
trap "cleanup_credentials" EXIT
|
||||
elasticsearch_healthcheck
|
||||
|
||||
+42
-25
@@ -145,7 +145,7 @@ elasticsearch_set_key_value() {
|
||||
|
||||
#!/bin/bash
|
||||
#
|
||||
# Bitnami Elasticsearch/Opensearch common library
|
||||
# Bitnami Elasticsearch/OpenSearch common library
|
||||
|
||||
# shellcheck disable=SC1090,SC1091
|
||||
|
||||
@@ -194,6 +194,7 @@ elasticsearch_conf_write() {
|
||||
;;
|
||||
esac
|
||||
cp "$tempfile" "$DB_CONF_FILE"
|
||||
rm "$tempfile"
|
||||
}
|
||||
|
||||
########################
|
||||
@@ -354,6 +355,11 @@ elasticsearch_validate() {
|
||||
error "$1"
|
||||
error_code=1
|
||||
}
|
||||
check_empty_value() {
|
||||
if is_empty_value "${!1}"; then
|
||||
print_validation_error "${1} must be set"
|
||||
fi
|
||||
}
|
||||
|
||||
validate_node_roles() {
|
||||
if [ -n "$DB_NODE_ROLES" ]; then
|
||||
@@ -376,6 +382,8 @@ elasticsearch_validate() {
|
||||
fi
|
||||
}
|
||||
|
||||
# TODO: these are not simple validations, they actually create users and adapt permissions on the filesystem
|
||||
# so we should move them to a separate function
|
||||
debug "Ensuring expected directories/files exist..."
|
||||
am_i_root && ensure_user_exists "$DB_DAEMON_USER" --group "$DB_DAEMON_GROUP"
|
||||
for dir in "$DB_TMP_DIR" "$DB_LOGS_DIR" "$DB_PLUGINS_DIR" "$DB_BASE_DIR/modules" "$DB_CONF_DIR"; do
|
||||
@@ -392,7 +400,7 @@ elasticsearch_validate() {
|
||||
|
||||
if ! is_boolean_yes "$DB_IS_DEDICATED_NODE"; then
|
||||
warn "Setting ${DB_FLAVOR^^}_IS_DEDICATED_NODE is disabled."
|
||||
warn "${DB_FLAVOR^^}_NODE_ROLES will be ignored and ${DB_FLAVOR^} will asume all different roles."
|
||||
warn "${DB_FLAVOR^^}_NODE_ROLES will be ignored and ${DB_FLAVOR^} will assume all different roles."
|
||||
else
|
||||
validate_node_roles
|
||||
fi
|
||||
@@ -403,17 +411,20 @@ elasticsearch_validate() {
|
||||
|
||||
if is_boolean_yes "$DB_ENABLE_SECURITY"; then
|
||||
if [[ "$DB_FLAVOR" = "opensearch" ]]; then
|
||||
# Validate credentials
|
||||
for var in "DB_PASSWORD" "OPENSEARCH_DASHBOARDS_PASSWORD" "LOGSTASH_PASSWORD"; do
|
||||
check_empty_value "$var"
|
||||
done
|
||||
# Validate certificates
|
||||
if [[ ! -f "$OPENSEARCH_SECURITY_ADMIN_KEY_LOCATION" ]] || [[ ! -f "$OPENSEARCH_SECURITY_ADMIN_CERT_LOCATION" ]]; then
|
||||
print_validation_error "In order to enable Opensearch Security, you must provide a valid admin PEM key and certificate."
|
||||
fi
|
||||
if is_empty_value "$OPENSEARCH_SECURITY_NODES_DN"; then
|
||||
print_validation_error "The variable OPENSEARCH_SECURITY_NODES_DN is required."
|
||||
fi
|
||||
if is_empty_value "$OPENSEARCH_SECURITY_ADMIN_DN"; then
|
||||
print_validation_error "The variable OPENSEARCH_SECURITY_ADMIN_DN is required."
|
||||
print_validation_error "In order to enable OpenSearch Security, you must provide a valid admin PEM key and certificate."
|
||||
fi
|
||||
# Validate DNs
|
||||
for var in "OPENSEARCH_SECURITY_NODES_DN" "OPENSEARCH_SECURITY_ADMIN_DN"; do
|
||||
check_empty_value "$var"
|
||||
done
|
||||
if ! is_boolean_yes "$OPENSEARCH_ENABLE_REST_TLS"; then
|
||||
print_validation_error "Opensearch does not support plaintext conections (HTTP) when Security is enabled."
|
||||
print_validation_error "OpenSearch does not support plaintext connections (HTTP) when Security is enabled."
|
||||
fi
|
||||
fi
|
||||
if ! is_boolean_yes "$DB_SKIP_TRANSPORT_TLS"; then
|
||||
@@ -556,6 +567,7 @@ elasticsearch_custom_configuration() {
|
||||
info "Adding custom configuration"
|
||||
yq eval-all 'select(fileIndex == 0) * select(fileIndex == 1)' "$DB_CONF_FILE" "$custom_conf_file" >"$tempfile"
|
||||
cp "$tempfile" "$DB_CONF_FILE"
|
||||
rm "$tempfile"
|
||||
}
|
||||
|
||||
########################
|
||||
@@ -659,7 +671,7 @@ EOF
|
||||
}
|
||||
|
||||
########################
|
||||
# Configure/initialize Elasticsearch/Opensearch
|
||||
# Configure/initialize Elasticsearch/OpenSearch
|
||||
# Globals:
|
||||
# DB_*
|
||||
# Arguments:
|
||||
@@ -904,21 +916,20 @@ elasticsearch_configure_logging() {
|
||||
}
|
||||
|
||||
########################
|
||||
# Check Elasticsearch/Opensearch health
|
||||
# Check Elasticsearch/OpenSearch health
|
||||
# Globals:
|
||||
# DB_*
|
||||
# Arguments:
|
||||
# None
|
||||
# Returns:
|
||||
# 0 when healthy (or waiting for Opensearch security bootstrap)
|
||||
# 0 when healthy (or waiting for OpenSearch security bootstrap)
|
||||
# 1 when unhealthy
|
||||
#########################
|
||||
elasticsearch_healthcheck() {
|
||||
info "Checking ${DB_FLAVOR^} health..."
|
||||
local -r cmd="curl"
|
||||
local command_args=("--silent" "--write-out" "%{http_code}")
|
||||
local curl_args=("--silent" "--write-out" "%{http_code}")
|
||||
local protocol="http"
|
||||
local host
|
||||
local host output return_code
|
||||
|
||||
host=$(get_elasticsearch_hostname)
|
||||
if validate_ipv6 "$host"; then
|
||||
@@ -926,21 +937,27 @@ elasticsearch_healthcheck() {
|
||||
fi
|
||||
|
||||
if is_boolean_yes "$DB_ENABLE_SECURITY"; then
|
||||
command_args+=("-k" "--user" "${DB_USERNAME}:${DB_PASSWORD}")
|
||||
is_boolean_yes "$DB_ENABLE_REST_TLS" && protocol="https"
|
||||
# Avoid passing credentials as arguments to curl, to avoid leaking them given a local observer with /proc read access can read them
|
||||
local user_file
|
||||
user_file="$(credential_to_temp_file "${DB_USERNAME}:${DB_PASSWORD}")"
|
||||
curl_args+=("--user" "$(<"$user_file")")
|
||||
if is_boolean_yes "$DB_ENABLE_REST_TLS"; then
|
||||
# TODO: use the CA certificate to verify the server certificate
|
||||
# Currently it's not trivial given keystores / truststores are mounted
|
||||
curl_args+=("-k")
|
||||
fi
|
||||
fi
|
||||
|
||||
# Combination of --silent, --output and --write-out allows us to obtain both the status code and the request body
|
||||
output=$(mktemp)
|
||||
command_args+=("-o" "$output" "${protocol}://${host}:${DB_HTTP_PORT_NUMBER}/_cluster/health?local=true")
|
||||
HTTP_CODE=$("$cmd" "${command_args[@]}")
|
||||
curl_args+=("-o" "$output" "${protocol}://${host}:${DB_HTTP_PORT_NUMBER}/_cluster/health?local=true")
|
||||
HTTP_CODE=$(curl "${curl_args[@]}") || true
|
||||
return_code=1
|
||||
if [[ ${HTTP_CODE} -ge 200 && ${HTTP_CODE} -le 299 ]] || ([[ "$DB_FLAVOR" = "opensearch" ]] && [[ ${HTTP_CODE} -eq 503 ]] && grep -q "OpenSearch Security not initialized" "$output" ); then
|
||||
rm "$output"
|
||||
return 0
|
||||
else
|
||||
rm "$output"
|
||||
return 1
|
||||
return_code=0
|
||||
fi
|
||||
rm "$output"
|
||||
return "$return_code"
|
||||
}
|
||||
|
||||
########################
|
||||
|
||||
@@ -115,7 +115,7 @@ The following tables list the main variables you can set.
|
||||
| `ELASTICSEARCH_HTTP_PORT_NUMBER` | Elasticsearch port | `9200` |
|
||||
| `ELASTICSEARCH_ACTION_DESTRUCTIVE_REQUIRES_NAME` | Enable action destructive requires name | `nil` |
|
||||
| `ELASTICSEARCH_ENABLE_SECURITY` | Enable Elasticsearch security settings. | `false` |
|
||||
| `ELASTICSEARCH_PASSWORD` | Password for "elastic" user. | `bitnami` |
|
||||
| `ELASTICSEARCH_PASSWORD` | Password for "elastic" user. | `nil` |
|
||||
| `ELASTICSEARCH_TLS_VERIFICATION_MODE` | Elasticsearch TLS verification mode in transport layer. | `full` |
|
||||
| `ELASTICSEARCH_TLS_USE_PEM` | Configure Security settings using PEM certificates. | `false` |
|
||||
| `ELASTICSEARCH_KEYSTORE_PASSWORD` | Password for the Elasticsearch keystore containing the certificates or password-protected PEM key. | `nil` |
|
||||
|
||||
Reference in New Issue
Block a user