diff --git a/bitnami/elasticsearch/9.4/debian-12/Dockerfile b/bitnami/elasticsearch/9.4/debian-12/Dockerfile index fc103792b3d9..598238cb1699 100644 --- a/bitnami/elasticsearch/9.4/debian-12/Dockerfile +++ b/bitnami/elasticsearch/9.4/debian-12/Dockerfile @@ -9,7 +9,7 @@ ARG JAVA_EXTRA_SECURITY_DIR="/bitnami/java/extra-security" ARG TARGETARCH LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bookworm" \ - org.opencontainers.image.created="2026-05-23T09:35:54Z" \ + org.opencontainers.image.created="2026-05-27T07:14:36Z" \ org.opencontainers.image.description="Application packaged by Broadcom, Inc." \ org.opencontainers.image.documentation="https://github.com/bitnami/containers/tree/main/bitnami/elasticsearch/README.md" \ org.opencontainers.image.source="https://github.com/bitnami/containers/tree/main/bitnami/elasticsearch" \ @@ -38,12 +38,12 @@ RUN --mount=type=secret,id=downloads_url,env=SECRET_DOWNLOADS_URL \ for COMPONENT in "${COMPONENTS[@]}"; do \ if [ ! -f "${COMPONENT}.tar.gz" ]; then \ curl -SsLf "https://${DOWNLOADS_URL}/${COMPONENT}.tar.gz" -O ; \ - curl -SsLf "https://${DOWNLOADS_URL}/${COMPONENT}.tar.gz.sha256" -O ; \ fi ; \ - sha256sum -c "${COMPONENT}.tar.gz.sha256" ; \ + sha256sum -c "/opt/bitnami/checksums/${COMPONENT}.tar.gz.sha256" ; \ tar -zxf "${COMPONENT}.tar.gz" -C /opt/bitnami --strip-components=2 --no-same-owner ; \ - rm -rf "${COMPONENT}".tar.gz{,.sha256} ; \ - done + rm -rf "${COMPONENT}".tar.gz ; \ + done ; \ + rm -rf /opt/bitnami/checksums ; RUN apt-get update && apt-get upgrade -y && \ apt-get clean && rm -rf /var/lib/apt/lists /var/cache/apt/archives RUN chmod g+rwX /opt/bitnami @@ -54,7 +54,7 @@ RUN /opt/bitnami/scripts/elasticsearch/postunpack.sh RUN /opt/bitnami/scripts/java/postunpack.sh ENV APP_VERSION="9.4.1" \ BITNAMI_APP_NAME="elasticsearch" \ - IMAGE_REVISION="3" \ + IMAGE_REVISION="4" \ JAVA_HOME="/opt/bitnami/java" \ LD_LIBRARY_PATH="/opt/bitnami/elasticsearch/jdk/lib:/opt/bitnami/elasticsearch/jdk/lib/server:$LD_LIBRARY_PATH" diff --git a/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/elasticsearch-9.4.1-0-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/elasticsearch-9.4.1-0-linux-amd64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..b076685f6e7d --- /dev/null +++ b/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/elasticsearch-9.4.1-0-linux-amd64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +984705b900956886bd44a9884a3ab8c9ac1b84dc8c0eec1ae50392547f4e3ada elasticsearch-9.4.1-0-linux-amd64-debian-12.tar.gz diff --git a/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/elasticsearch-9.4.1-0-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/elasticsearch-9.4.1-0-linux-arm64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..6724269454e0 --- /dev/null +++ b/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/elasticsearch-9.4.1-0-linux-arm64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +2cfdda56c0dc46645770a754d16dbe9d83c3c2a5acd15ca696f71802b5b60815 elasticsearch-9.4.1-0-linux-arm64-debian-12.tar.gz diff --git a/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/java-21.0.11-11-2-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/java-21.0.11-11-2-linux-amd64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..a2d5622b6789 --- /dev/null +++ b/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/java-21.0.11-11-2-linux-amd64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +fa2c3125d94154a3bc67bb7899c3fe231267ed4133d3931d1ce4864f915a6d0f java-21.0.11-11-2-linux-amd64-debian-12.tar.gz diff --git a/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/java-21.0.11-11-2-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/java-21.0.11-11-2-linux-arm64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..7b22e6802aac --- /dev/null +++ b/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/java-21.0.11-11-2-linux-arm64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +9bc5e94a5934ab91f797a5cb1f1f0bdd8917ae676a21806b4394887a367eb836 java-21.0.11-11-2-linux-arm64-debian-12.tar.gz diff --git a/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/yq-4.53.2-1-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/yq-4.53.2-1-linux-amd64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..f2543765be33 --- /dev/null +++ b/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/yq-4.53.2-1-linux-amd64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +b7241b4121e1304b74a5e04db2d4e8d1db6aca71a65987d8c79836e5235cb927 yq-4.53.2-1-linux-amd64-debian-12.tar.gz diff --git a/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/yq-4.53.2-1-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/yq-4.53.2-1-linux-arm64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..fe49d01f636f --- /dev/null +++ b/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/checksums/yq-4.53.2-1-linux-arm64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +ba312982d2ba0a320c116b4db0e0ef2518813be9a948a29bc9c3e05951049da9 yq-4.53.2-1-linux-arm64-debian-12.tar.gz diff --git a/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/scripts/libfile.sh b/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/scripts/libfile.sh index 1c69e0e48a5d..335c1c7c9ef7 100644 --- a/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/scripts/libfile.sh +++ b/bitnami/elasticsearch/9.4/debian-12/prebuildfs/opt/bitnami/scripts/libfile.sh @@ -139,3 +139,40 @@ wait_for_log_entry() { return 1 fi } + +######################## +# Creates a secure temporary file containing the provided secret +# Arguments: +# $1 - secret to write to the temporary file +# Returns: +# String +######################### +credential_to_temp_file() { + local secret="$1" + local tmp_file + + # Use mktemp with a specific prefix for easier debugging if something lingers + if ! tmp_file=$(mktemp "${TMPDIR:-/tmp}/at.cred.XXXXXXXX"); then + echo "Error: Failed to create temp file" >&2 + return 1 + fi + + # Restrict permissions before writing the secret + chmod 0600 "$tmp_file" + # Write secret and ensure it's flushed to disk + printf "%s" "$secret" > "$tmp_file" + # Output the filename so the caller can capture it + echo "$tmp_file" +} + +######################## +# Cleans up temporary files created by credential_to_temp_file +# Arguments: +# None +# Returns: +# None +######################### +cleanup_credentials() { + debug "Cleaning up temporary files containing credentials" + rm -rf "${TMPDIR:-/tmp}"/at.cred.* +} diff --git a/bitnami/elasticsearch/9.4/debian-12/rootfs/opt/bitnami/scripts/elasticsearch-env.sh b/bitnami/elasticsearch/9.4/debian-12/rootfs/opt/bitnami/scripts/elasticsearch-env.sh index 13659c4c7b78..6955b8fc28da 100644 --- a/bitnami/elasticsearch/9.4/debian-12/rootfs/opt/bitnami/scripts/elasticsearch-env.sh +++ b/bitnami/elasticsearch/9.4/debian-12/rootfs/opt/bitnami/scripts/elasticsearch-env.sh @@ -190,7 +190,7 @@ export DB_ACTION_DESTRUCTIVE_REQUIRES_NAME="$ELASTICSEARCH_ACTION_DESTRUCTIVE_RE # Elasticsearch Security configuration export ELASTICSEARCH_ENABLE_SECURITY="${ELASTICSEARCH_ENABLE_SECURITY:-false}" export DB_ENABLE_SECURITY="$ELASTICSEARCH_ENABLE_SECURITY" -export ELASTICSEARCH_PASSWORD="${ELASTICSEARCH_PASSWORD:-bitnami}" +export ELASTICSEARCH_PASSWORD="${ELASTICSEARCH_PASSWORD:-}" export DB_PASSWORD="$ELASTICSEARCH_PASSWORD" export ELASTICSEARCH_USERNAME="elastic" export DB_USERNAME="$ELASTICSEARCH_USERNAME" diff --git a/bitnami/elasticsearch/9.4/debian-12/rootfs/opt/bitnami/scripts/elasticsearch/healthcheck.sh b/bitnami/elasticsearch/9.4/debian-12/rootfs/opt/bitnami/scripts/elasticsearch/healthcheck.sh index ee7f128ec87a..12bd11d0b0dd 100755 --- a/bitnami/elasticsearch/9.4/debian-12/rootfs/opt/bitnami/scripts/elasticsearch/healthcheck.sh +++ b/bitnami/elasticsearch/9.4/debian-12/rootfs/opt/bitnami/scripts/elasticsearch/healthcheck.sh @@ -15,4 +15,6 @@ set -o pipefail # Load Elasticsearch environment variables . /opt/bitnami/scripts/elasticsearch-env.sh +# Ensure we clean up temporary files when this script ends +trap "cleanup_credentials" EXIT elasticsearch_healthcheck diff --git a/bitnami/elasticsearch/9.4/debian-12/rootfs/opt/bitnami/scripts/libelasticsearch.sh b/bitnami/elasticsearch/9.4/debian-12/rootfs/opt/bitnami/scripts/libelasticsearch.sh index d4881b30d015..a5274d5ee2eb 100644 --- a/bitnami/elasticsearch/9.4/debian-12/rootfs/opt/bitnami/scripts/libelasticsearch.sh +++ b/bitnami/elasticsearch/9.4/debian-12/rootfs/opt/bitnami/scripts/libelasticsearch.sh @@ -145,7 +145,7 @@ elasticsearch_set_key_value() { #!/bin/bash # -# Bitnami Elasticsearch/Opensearch common library +# Bitnami Elasticsearch/OpenSearch common library # shellcheck disable=SC1090,SC1091 @@ -194,6 +194,7 @@ elasticsearch_conf_write() { ;; esac cp "$tempfile" "$DB_CONF_FILE" + rm "$tempfile" } ######################## @@ -354,6 +355,11 @@ elasticsearch_validate() { error "$1" error_code=1 } + check_empty_value() { + if is_empty_value "${!1}"; then + print_validation_error "${1} must be set" + fi + } validate_node_roles() { if [ -n "$DB_NODE_ROLES" ]; then @@ -376,6 +382,8 @@ elasticsearch_validate() { fi } + # TODO: these are not simple validations, they actually create users and adapt permissions on the filesystem + # so we should move them to a separate function debug "Ensuring expected directories/files exist..." am_i_root && ensure_user_exists "$DB_DAEMON_USER" --group "$DB_DAEMON_GROUP" for dir in "$DB_TMP_DIR" "$DB_LOGS_DIR" "$DB_PLUGINS_DIR" "$DB_BASE_DIR/modules" "$DB_CONF_DIR"; do @@ -392,7 +400,7 @@ elasticsearch_validate() { if ! is_boolean_yes "$DB_IS_DEDICATED_NODE"; then warn "Setting ${DB_FLAVOR^^}_IS_DEDICATED_NODE is disabled." - warn "${DB_FLAVOR^^}_NODE_ROLES will be ignored and ${DB_FLAVOR^} will asume all different roles." + warn "${DB_FLAVOR^^}_NODE_ROLES will be ignored and ${DB_FLAVOR^} will assume all different roles." else validate_node_roles fi @@ -403,17 +411,20 @@ elasticsearch_validate() { if is_boolean_yes "$DB_ENABLE_SECURITY"; then if [[ "$DB_FLAVOR" = "opensearch" ]]; then + # Validate credentials + for var in "DB_PASSWORD" "OPENSEARCH_DASHBOARDS_PASSWORD" "LOGSTASH_PASSWORD"; do + check_empty_value "$var" + done + # Validate certificates if [[ ! -f "$OPENSEARCH_SECURITY_ADMIN_KEY_LOCATION" ]] || [[ ! -f "$OPENSEARCH_SECURITY_ADMIN_CERT_LOCATION" ]]; then - print_validation_error "In order to enable Opensearch Security, you must provide a valid admin PEM key and certificate." - fi - if is_empty_value "$OPENSEARCH_SECURITY_NODES_DN"; then - print_validation_error "The variable OPENSEARCH_SECURITY_NODES_DN is required." - fi - if is_empty_value "$OPENSEARCH_SECURITY_ADMIN_DN"; then - print_validation_error "The variable OPENSEARCH_SECURITY_ADMIN_DN is required." + print_validation_error "In order to enable OpenSearch Security, you must provide a valid admin PEM key and certificate." fi + # Validate DNs + for var in "OPENSEARCH_SECURITY_NODES_DN" "OPENSEARCH_SECURITY_ADMIN_DN"; do + check_empty_value "$var" + done if ! is_boolean_yes "$OPENSEARCH_ENABLE_REST_TLS"; then - print_validation_error "Opensearch does not support plaintext conections (HTTP) when Security is enabled." + print_validation_error "OpenSearch does not support plaintext connections (HTTP) when Security is enabled." fi fi if ! is_boolean_yes "$DB_SKIP_TRANSPORT_TLS"; then @@ -556,6 +567,7 @@ elasticsearch_custom_configuration() { info "Adding custom configuration" yq eval-all 'select(fileIndex == 0) * select(fileIndex == 1)' "$DB_CONF_FILE" "$custom_conf_file" >"$tempfile" cp "$tempfile" "$DB_CONF_FILE" + rm "$tempfile" } ######################## @@ -659,7 +671,7 @@ EOF } ######################## -# Configure/initialize Elasticsearch/Opensearch +# Configure/initialize Elasticsearch/OpenSearch # Globals: # DB_* # Arguments: @@ -904,21 +916,20 @@ elasticsearch_configure_logging() { } ######################## -# Check Elasticsearch/Opensearch health +# Check Elasticsearch/OpenSearch health # Globals: # DB_* # Arguments: # None # Returns: -# 0 when healthy (or waiting for Opensearch security bootstrap) +# 0 when healthy (or waiting for OpenSearch security bootstrap) # 1 when unhealthy ######################### elasticsearch_healthcheck() { info "Checking ${DB_FLAVOR^} health..." - local -r cmd="curl" - local command_args=("--silent" "--write-out" "%{http_code}") + local curl_args=("--silent" "--write-out" "%{http_code}") local protocol="http" - local host + local host output return_code host=$(get_elasticsearch_hostname) if validate_ipv6 "$host"; then @@ -926,21 +937,27 @@ elasticsearch_healthcheck() { fi if is_boolean_yes "$DB_ENABLE_SECURITY"; then - command_args+=("-k" "--user" "${DB_USERNAME}:${DB_PASSWORD}") - is_boolean_yes "$DB_ENABLE_REST_TLS" && protocol="https" + # Avoid passing credentials as arguments to curl, to avoid leaking them given a local observer with /proc read access can read them + local user_file + user_file="$(credential_to_temp_file "${DB_USERNAME}:${DB_PASSWORD}")" + curl_args+=("--user" "$(<"$user_file")") + if is_boolean_yes "$DB_ENABLE_REST_TLS"; then + # TODO: use the CA certificate to verify the server certificate + # Currently it's not trivial given keystores / truststores are mounted + curl_args+=("-k") + fi fi # Combination of --silent, --output and --write-out allows us to obtain both the status code and the request body output=$(mktemp) - command_args+=("-o" "$output" "${protocol}://${host}:${DB_HTTP_PORT_NUMBER}/_cluster/health?local=true") - HTTP_CODE=$("$cmd" "${command_args[@]}") + curl_args+=("-o" "$output" "${protocol}://${host}:${DB_HTTP_PORT_NUMBER}/_cluster/health?local=true") + HTTP_CODE=$(curl "${curl_args[@]}") || true + return_code=1 if [[ ${HTTP_CODE} -ge 200 && ${HTTP_CODE} -le 299 ]] || ([[ "$DB_FLAVOR" = "opensearch" ]] && [[ ${HTTP_CODE} -eq 503 ]] && grep -q "OpenSearch Security not initialized" "$output" ); then - rm "$output" - return 0 - else - rm "$output" - return 1 + return_code=0 fi + rm "$output" + return "$return_code" } ######################## diff --git a/bitnami/elasticsearch/README.md b/bitnami/elasticsearch/README.md index e094f2b18b0f..d7720a4418a4 100644 --- a/bitnami/elasticsearch/README.md +++ b/bitnami/elasticsearch/README.md @@ -115,7 +115,7 @@ The following tables list the main variables you can set. | `ELASTICSEARCH_HTTP_PORT_NUMBER` | Elasticsearch port | `9200` | | `ELASTICSEARCH_ACTION_DESTRUCTIVE_REQUIRES_NAME` | Enable action destructive requires name | `nil` | | `ELASTICSEARCH_ENABLE_SECURITY` | Enable Elasticsearch security settings. | `false` | -| `ELASTICSEARCH_PASSWORD` | Password for "elastic" user. | `bitnami` | +| `ELASTICSEARCH_PASSWORD` | Password for "elastic" user. | `nil` | | `ELASTICSEARCH_TLS_VERIFICATION_MODE` | Elasticsearch TLS verification mode in transport layer. | `full` | | `ELASTICSEARCH_TLS_USE_PEM` | Configure Security settings using PEM certificates. | `false` | | `ELASTICSEARCH_KEYSTORE_PASSWORD` | Password for the Elasticsearch keystore containing the certificates or password-protected PEM key. | `nil` |