From f639f63cfb4a3d357edd80a2961085ffccd69f74 Mon Sep 17 00:00:00 2001 From: Bitnami Bot Date: Wed, 27 May 2026 11:05:49 +0200 Subject: [PATCH] [bitnami/opensearch] Release 3.6.0-debian-12-r6 (#94013) Signed-off-by: Bitnami Bot --- bitnami/opensearch/3/debian-12/Dockerfile | 12 +- ...1-11-1-linux-amd64-debian-12.tar.gz.sha256 | 1 + ...1-11-1-linux-arm64-debian-12.tar.gz.sha256 | 1 + ....6.0-0-linux-amd64-debian-12.tar.gz.sha256 | 1 + ....6.0-0-linux-arm64-debian-12.tar.gz.sha256 | 1 + ...53.2-1-linux-amd64-debian-12.tar.gz.sha256 | 1 + ...53.2-1-linux-arm64-debian-12.tar.gz.sha256 | 1 + .../prebuildfs/opt/bitnami/scripts/libfile.sh | 37 ++++++ .../opt/bitnami/scripts/libopensearch.sh | 116 +++++++++++------- .../opt/bitnami/scripts/opensearch-env.sh | 6 +- .../bitnami/scripts/opensearch/entrypoint.sh | 4 +- .../bitnami/scripts/opensearch/healthcheck.sh | 4 +- .../opt/bitnami/scripts/opensearch/run.sh | 2 +- .../opt/bitnami/scripts/opensearch/setup.sh | 10 +- bitnami/opensearch/README.md | 6 +- 15 files changed, 136 insertions(+), 67 deletions(-) create mode 100644 bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/jre-21.0.11-11-1-linux-amd64-debian-12.tar.gz.sha256 create mode 100644 bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/jre-21.0.11-11-1-linux-arm64-debian-12.tar.gz.sha256 create mode 100644 bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/opensearch-3.6.0-0-linux-amd64-debian-12.tar.gz.sha256 create mode 100644 bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/opensearch-3.6.0-0-linux-arm64-debian-12.tar.gz.sha256 create mode 100644 bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/yq-4.53.2-1-linux-amd64-debian-12.tar.gz.sha256 create mode 100644 bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/yq-4.53.2-1-linux-arm64-debian-12.tar.gz.sha256 diff --git a/bitnami/opensearch/3/debian-12/Dockerfile b/bitnami/opensearch/3/debian-12/Dockerfile index c1144d5753c9..1ac60147b064 100644 --- a/bitnami/opensearch/3/debian-12/Dockerfile +++ b/bitnami/opensearch/3/debian-12/Dockerfile @@ -9,7 +9,7 @@ ARG OPENSEARCH_PLUGINS ARG TARGETARCH LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bookworm" \ - org.opencontainers.image.created="2026-05-23T10:10:30Z" \ + org.opencontainers.image.created="2026-05-27T07:15:47Z" \ org.opencontainers.image.description="Application packaged by Broadcom, Inc." \ org.opencontainers.image.documentation="https://github.com/bitnami/containers/tree/main/bitnami/opensearch/README.md" \ org.opencontainers.image.source="https://github.com/bitnami/containers/tree/main/bitnami/opensearch" \ @@ -38,12 +38,12 @@ RUN --mount=type=secret,id=downloads_url,env=SECRET_DOWNLOADS_URL \ for COMPONENT in "${COMPONENTS[@]}"; do \ if [ ! -f "${COMPONENT}.tar.gz" ]; then \ curl -SsLf "https://${DOWNLOADS_URL}/${COMPONENT}.tar.gz" -O ; \ - curl -SsLf "https://${DOWNLOADS_URL}/${COMPONENT}.tar.gz.sha256" -O ; \ fi ; \ - sha256sum -c "${COMPONENT}.tar.gz.sha256" ; \ + sha256sum -c "/opt/bitnami/checksums/${COMPONENT}.tar.gz.sha256" ; \ tar -zxf "${COMPONENT}.tar.gz" -C /opt/bitnami --strip-components=2 --no-same-owner ; \ - rm -rf "${COMPONENT}".tar.gz{,.sha256} ; \ - done + rm -rf "${COMPONENT}".tar.gz ; \ + done ; \ + rm -rf /opt/bitnami/checksums ; RUN apt-get update && apt-get upgrade -y && \ apt-get clean && rm -rf /var/lib/apt/lists /var/cache/apt/archives RUN chmod g+rwX /opt/bitnami @@ -54,7 +54,7 @@ RUN /opt/bitnami/scripts/opensearch/postunpack.sh RUN /opt/bitnami/scripts/java/postunpack.sh ENV APP_VERSION="3.6.0" \ BITNAMI_APP_NAME="opensearch" \ - IMAGE_REVISION="5" \ + IMAGE_REVISION="6" \ JAVA_HOME="/opt/bitnami/java" \ LD_LIBRARY_PATH="/opt/bitnami/opensearch/plugins/opensearch-knn/lib:$LD_LIBRARY_PATH" \ OPENSEARCH_JAVA_HOME="/opt/bitnami/java" diff --git a/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/jre-21.0.11-11-1-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/jre-21.0.11-11-1-linux-amd64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..f1872279a271 --- /dev/null +++ b/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/jre-21.0.11-11-1-linux-amd64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +190f3814d0362c10bc2373945a5fe00ff46aa2980ac2224528a32c7766a2b72d jre-21.0.11-11-1-linux-amd64-debian-12.tar.gz diff --git a/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/jre-21.0.11-11-1-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/jre-21.0.11-11-1-linux-arm64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..03a5b4115128 --- /dev/null +++ b/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/jre-21.0.11-11-1-linux-arm64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +08f71653cfeafd8e168835acfa95678ad52649c0b8c3512d285cedead2ea0a62 jre-21.0.11-11-1-linux-arm64-debian-12.tar.gz diff --git a/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/opensearch-3.6.0-0-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/opensearch-3.6.0-0-linux-amd64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..63981a0e4175 --- /dev/null +++ b/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/opensearch-3.6.0-0-linux-amd64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +ce2396d7413e5284206c7e2fe252a6730405ffe4756bd83c46d418d53d1176ad opensearch-3.6.0-0-linux-amd64-debian-12.tar.gz diff --git a/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/opensearch-3.6.0-0-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/opensearch-3.6.0-0-linux-arm64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..22e65195046e --- /dev/null +++ b/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/opensearch-3.6.0-0-linux-arm64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +c1f7cd521f2be1d9be4fd736dc66e59d06f3c686b28d228bc40cc303065ceb1c opensearch-3.6.0-0-linux-arm64-debian-12.tar.gz diff --git a/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/yq-4.53.2-1-linux-amd64-debian-12.tar.gz.sha256 b/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/yq-4.53.2-1-linux-amd64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..f2543765be33 --- /dev/null +++ b/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/yq-4.53.2-1-linux-amd64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +b7241b4121e1304b74a5e04db2d4e8d1db6aca71a65987d8c79836e5235cb927 yq-4.53.2-1-linux-amd64-debian-12.tar.gz diff --git a/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/yq-4.53.2-1-linux-arm64-debian-12.tar.gz.sha256 b/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/yq-4.53.2-1-linux-arm64-debian-12.tar.gz.sha256 new file mode 100644 index 000000000000..fe49d01f636f --- /dev/null +++ b/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/yq-4.53.2-1-linux-arm64-debian-12.tar.gz.sha256 @@ -0,0 +1 @@ +ba312982d2ba0a320c116b4db0e0ef2518813be9a948a29bc9c3e05951049da9 yq-4.53.2-1-linux-arm64-debian-12.tar.gz diff --git a/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/scripts/libfile.sh b/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/scripts/libfile.sh index 1c69e0e48a5d..335c1c7c9ef7 100644 --- a/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/scripts/libfile.sh +++ b/bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/scripts/libfile.sh @@ -139,3 +139,40 @@ wait_for_log_entry() { return 1 fi } + +######################## +# Creates a secure temporary file containing the provided secret +# Arguments: +# $1 - secret to write to the temporary file +# Returns: +# String +######################### +credential_to_temp_file() { + local secret="$1" + local tmp_file + + # Use mktemp with a specific prefix for easier debugging if something lingers + if ! tmp_file=$(mktemp "${TMPDIR:-/tmp}/at.cred.XXXXXXXX"); then + echo "Error: Failed to create temp file" >&2 + return 1 + fi + + # Restrict permissions before writing the secret + chmod 0600 "$tmp_file" + # Write secret and ensure it's flushed to disk + printf "%s" "$secret" > "$tmp_file" + # Output the filename so the caller can capture it + echo "$tmp_file" +} + +######################## +# Cleans up temporary files created by credential_to_temp_file +# Arguments: +# None +# Returns: +# None +######################### +cleanup_credentials() { + debug "Cleaning up temporary files containing credentials" + rm -rf "${TMPDIR:-/tmp}"/at.cred.* +} diff --git a/bitnami/opensearch/3/debian-12/rootfs/opt/bitnami/scripts/libopensearch.sh b/bitnami/opensearch/3/debian-12/rootfs/opt/bitnami/scripts/libopensearch.sh index 12a32f4f31c8..30b2b946bd09 100644 --- a/bitnami/opensearch/3/debian-12/rootfs/opt/bitnami/scripts/libopensearch.sh +++ b/bitnami/opensearch/3/debian-12/rootfs/opt/bitnami/scripts/libopensearch.sh @@ -2,7 +2,7 @@ # Copyright Broadcom, Inc. All Rights Reserved. # SPDX-License-Identifier: APACHE-2.0 # -# Bitnami Opensearch library +# Bitnami OpenSearch library # shellcheck disable=SC1090,SC1091 @@ -16,10 +16,10 @@ . /opt/bitnami/scripts/libservice.sh . /opt/bitnami/scripts/libvalidations.sh -# Opensearch Functions +# OpenSearch Functions ######################## -# Bootstrap Opensearch Security by running the securityadmin.sh tool +# Bootstrap OpenSearch Security by running the securityadmin.sh tool # Globals: # DB_* # OPENSEARCH_SECURITY_* @@ -30,18 +30,23 @@ ######################### opensearch_security_bootstrap() { local failure=0 - local cmd=("${OPENSEARCH_SECURITY_DIR}/tools/securityadmin.sh" "-nhnv") - - cmd+=("-cd" "$OPENSEARCH_SECURITY_CONF_DIR") - cmd+=("-cn" "$DB_CLUSTER_NAME") - cmd+=("-h" "$(get_elasticsearch_hostname)") - cmd+=("-cacert" "$DB_CA_CERT_LOCATION") - cmd+=("-cert" "$OPENSEARCH_SECURITY_ADMIN_CERT_LOCATION") - cmd+=("-key" "$OPENSEARCH_SECURITY_ADMIN_KEY_LOCATION") + local cmd=( + "${OPENSEARCH_SECURITY_DIR}/tools/securityadmin.sh" + "-cd" "$OPENSEARCH_SECURITY_CONF_DIR" + "-cn" "$DB_CLUSTER_NAME" + # We want to use 127.0.0.1 to avoid being exposed to a potential DNS/ARP interception attack + "-h" "127.0.0.1" + "-cacert" "$DB_CA_CERT_LOCATION" + "-cert" "$OPENSEARCH_SECURITY_ADMIN_CERT_LOCATION" + "-key" "$OPENSEARCH_SECURITY_ADMIN_KEY_LOCATION" + ) + # Given we're using 127.0.0.1, we need to suppress hostname verification + # when DB_TLS_VERIFICATION_MODE is full (default) to avoid a bootstrap failure + [[ "${DB_TLS_VERIFICATION_MODE:-full}" != "full" ]] && cmd+=("-nhnv") elasticsearch_start - info "Running Opensearch Admin tool..." + info "Running OpenSearch Admin tool..." "${cmd[@]}" || failure=$? elasticsearch_stop @@ -66,9 +71,9 @@ opensearch_security_internal_user_set() { read -r -a attributes <<<"$(tr ',;' ' ' <<<"${5:-}")" local description="${6:-}" - local hash - - hash=$("${OPENSEARCH_SECURITY_DIR}/tools/hash.sh" -p "$password" | sed '/^\*\*/d') + local hash password_file + password_file="$(credential_to_temp_file "$password")" + hash=$("${OPENSEARCH_SECURITY_DIR}/tools/hash.sh" -p "$(<"$password_file")" | sed '/^\*\*/d') yq -i eval ".$username.hash = \"$hash\"" "${OPENSEARCH_SECURITY_CONF_DIR}/internal_users.yml" if [[ -n "${backend_roles[*]:-}" ]]; then @@ -88,7 +93,7 @@ opensearch_security_internal_user_set() { } ######################## -# Configure Opensearch Security built-in users and passwords +# Configure OpenSearch Security built-in users and passwords # Globals: # ELASTICSEARCH_* # OPENSEARCH_SECURITY_* @@ -98,11 +103,11 @@ opensearch_security_internal_user_set() { # None ######################### opensearch_security_configure_users() { - info "Configuring Opensearch security users and roles..." + info "Configuring OpenSearch security users and roles..." # Execute permission for configuration binaries chmod +x "${OPENSEARCH_SECURITY_DIR}/tools/hash.sh" chmod +x "${OPENSEARCH_SECURITY_DIR}/tools/securityadmin.sh" - # Opensearch security configuration + # OpenSearch security configuration if [ ! -f "${OPENSEARCH_SECURITY_DIR}/internal_users.yml" ]; then # Delete content of the demo file echo "" > "${OPENSEARCH_SECURITY_CONF_DIR}/internal_users.yml" @@ -118,7 +123,7 @@ opensearch_security_configure_users() { } ######################## -# Configure Opensearch TLS settings +# Configure OpenSearch TLS settings # Globals: # DB_* # Arguments: @@ -127,9 +132,11 @@ opensearch_security_configure_users() { # None ######################### opensearch_transport_tls_configuration(){ - info "Configuring Opensearch Transport TLS settings..." + info "Configuring OpenSearch Transport TLS settings..." elasticsearch_conf_set plugins.security.ssl.transport.enabled "true" - elasticsearch_conf_write plugins.security.ssl.transport.enforce_hostname_verification "$DB_TLS_VERIFICATION_MODE" bool + local _enforce_hn_verify="false" + [[ "$DB_TLS_VERIFICATION_MODE" = "full" ]] && _enforce_hn_verify="true" + elasticsearch_conf_write plugins.security.ssl.transport.enforce_hostname_verification "$_enforce_hn_verify" bool if is_boolean_yes "$DB_TRANSPORT_TLS_USE_PEM"; then debug "Configuring Transport Layer TLS settings using PEM certificates..." @@ -175,7 +182,7 @@ opensearch_http_tls_configuration(){ #!/bin/bash # -# Bitnami Elasticsearch/Opensearch common library +# Bitnami Elasticsearch/OpenSearch common library # shellcheck disable=SC1090,SC1091 @@ -224,6 +231,7 @@ elasticsearch_conf_write() { ;; esac cp "$tempfile" "$DB_CONF_FILE" + rm "$tempfile" } ######################## @@ -384,6 +392,11 @@ elasticsearch_validate() { error "$1" error_code=1 } + check_empty_value() { + if is_empty_value "${!1}"; then + print_validation_error "${1} must be set" + fi + } validate_node_roles() { if [ -n "$DB_NODE_ROLES" ]; then @@ -406,6 +419,8 @@ elasticsearch_validate() { fi } + # TODO: these are not simple validations, they actually create users and adapt permissions on the filesystem + # so we should move them to a separate function debug "Ensuring expected directories/files exist..." am_i_root && ensure_user_exists "$DB_DAEMON_USER" --group "$DB_DAEMON_GROUP" for dir in "$DB_TMP_DIR" "$DB_LOGS_DIR" "$DB_PLUGINS_DIR" "$DB_BASE_DIR/modules" "$DB_CONF_DIR"; do @@ -422,7 +437,7 @@ elasticsearch_validate() { if ! is_boolean_yes "$DB_IS_DEDICATED_NODE"; then warn "Setting ${DB_FLAVOR^^}_IS_DEDICATED_NODE is disabled." - warn "${DB_FLAVOR^^}_NODE_ROLES will be ignored and ${DB_FLAVOR^} will asume all different roles." + warn "${DB_FLAVOR^^}_NODE_ROLES will be ignored and ${DB_FLAVOR^} will assume all different roles." else validate_node_roles fi @@ -433,17 +448,20 @@ elasticsearch_validate() { if is_boolean_yes "$DB_ENABLE_SECURITY"; then if [[ "$DB_FLAVOR" = "opensearch" ]]; then + # Validate credentials + for var in "DB_PASSWORD" "OPENSEARCH_DASHBOARDS_PASSWORD" "LOGSTASH_PASSWORD"; do + check_empty_value "$var" + done + # Validate certificates if [[ ! -f "$OPENSEARCH_SECURITY_ADMIN_KEY_LOCATION" ]] || [[ ! -f "$OPENSEARCH_SECURITY_ADMIN_CERT_LOCATION" ]]; then - print_validation_error "In order to enable Opensearch Security, you must provide a valid admin PEM key and certificate." - fi - if is_empty_value "$OPENSEARCH_SECURITY_NODES_DN"; then - print_validation_error "The variable OPENSEARCH_SECURITY_NODES_DN is required." - fi - if is_empty_value "$OPENSEARCH_SECURITY_ADMIN_DN"; then - print_validation_error "The variable OPENSEARCH_SECURITY_ADMIN_DN is required." + print_validation_error "In order to enable OpenSearch Security, you must provide a valid admin PEM key and certificate." fi + # Validate DNs + for var in "OPENSEARCH_SECURITY_NODES_DN" "OPENSEARCH_SECURITY_ADMIN_DN"; do + check_empty_value "$var" + done if ! is_boolean_yes "$OPENSEARCH_ENABLE_REST_TLS"; then - print_validation_error "Opensearch does not support plaintext conections (HTTP) when Security is enabled." + print_validation_error "OpenSearch does not support plaintext connections (HTTP) when Security is enabled." fi fi if ! is_boolean_yes "$DB_SKIP_TRANSPORT_TLS"; then @@ -586,6 +604,7 @@ elasticsearch_custom_configuration() { info "Adding custom configuration" yq eval-all 'select(fileIndex == 0) * select(fileIndex == 1)' "$DB_CONF_FILE" "$custom_conf_file" >"$tempfile" cp "$tempfile" "$DB_CONF_FILE" + rm "$tempfile" } ######################## @@ -689,7 +708,7 @@ EOF } ######################## -# Configure/initialize Elasticsearch/Opensearch +# Configure/initialize Elasticsearch/OpenSearch # Globals: # DB_* # Arguments: @@ -934,21 +953,20 @@ elasticsearch_configure_logging() { } ######################## -# Check Elasticsearch/Opensearch health +# Check Elasticsearch/OpenSearch health # Globals: # DB_* # Arguments: # None # Returns: -# 0 when healthy (or waiting for Opensearch security bootstrap) +# 0 when healthy (or waiting for OpenSearch security bootstrap) # 1 when unhealthy ######################### elasticsearch_healthcheck() { info "Checking ${DB_FLAVOR^} health..." - local -r cmd="curl" - local command_args=("--silent" "--write-out" "%{http_code}") + local curl_args=("--silent" "--write-out" "%{http_code}") local protocol="http" - local host + local host output return_code host=$(get_elasticsearch_hostname) if validate_ipv6 "$host"; then @@ -956,21 +974,27 @@ elasticsearch_healthcheck() { fi if is_boolean_yes "$DB_ENABLE_SECURITY"; then - command_args+=("-k" "--user" "${DB_USERNAME}:${DB_PASSWORD}") - is_boolean_yes "$DB_ENABLE_REST_TLS" && protocol="https" + # Avoid passing credentials as arguments to curl, to avoid leaking them given a local observer with /proc read access can read them + local user_file + user_file="$(credential_to_temp_file "${DB_USERNAME}:${DB_PASSWORD}")" + curl_args+=("--user" "$(<"$user_file")") + if is_boolean_yes "$DB_ENABLE_REST_TLS"; then + # TODO: use the CA certificate to verify the server certificate + # Currently it's not trivial given keystores / truststores are mounted + curl_args+=("-k") + fi fi # Combination of --silent, --output and --write-out allows us to obtain both the status code and the request body output=$(mktemp) - command_args+=("-o" "$output" "${protocol}://${host}:${DB_HTTP_PORT_NUMBER}/_cluster/health?local=true") - HTTP_CODE=$("$cmd" "${command_args[@]}") + curl_args+=("-o" "$output" "${protocol}://${host}:${DB_HTTP_PORT_NUMBER}/_cluster/health?local=true") + HTTP_CODE=$(curl "${curl_args[@]}") || true + return_code=1 if [[ ${HTTP_CODE} -ge 200 && ${HTTP_CODE} -le 299 ]] || ([[ "$DB_FLAVOR" = "opensearch" ]] && [[ ${HTTP_CODE} -eq 503 ]] && grep -q "OpenSearch Security not initialized" "$output" ); then - rm "$output" - return 0 - else - rm "$output" - return 1 + return_code=0 fi + rm "$output" + return "$return_code" } ######################## diff --git a/bitnami/opensearch/3/debian-12/rootfs/opt/bitnami/scripts/opensearch-env.sh b/bitnami/opensearch/3/debian-12/rootfs/opt/bitnami/scripts/opensearch-env.sh index bf86d6d1e836..48be3d250b76 100644 --- a/bitnami/opensearch/3/debian-12/rootfs/opt/bitnami/scripts/opensearch-env.sh +++ b/bitnami/opensearch/3/debian-12/rootfs/opt/bitnami/scripts/opensearch-env.sh @@ -197,7 +197,7 @@ export DB_ACTION_DESTRUCTIVE_REQUIRES_NAME="$OPENSEARCH_ACTION_DESTRUCTIVE_REQUI # Opensearch Security configuration export OPENSEARCH_ENABLE_SECURITY="${OPENSEARCH_ENABLE_SECURITY:-false}" export DB_ENABLE_SECURITY="$OPENSEARCH_ENABLE_SECURITY" -export OPENSEARCH_PASSWORD="${OPENSEARCH_PASSWORD:-bitnami}" +export OPENSEARCH_PASSWORD="${OPENSEARCH_PASSWORD:-}" export DB_PASSWORD="$OPENSEARCH_PASSWORD" export OPENSEARCH_USERNAME="admin" export DB_USERNAME="$OPENSEARCH_USERNAME" @@ -264,8 +264,8 @@ export DB_HTTP_TLS_CA_CERT_LOCATION="$OPENSEARCH_HTTP_TLS_CA_CERT_LOCATION" export OPENSEARCH_SECURITY_DIR="${OPENSEARCH_SECURITY_DIR:-${DB_PLUGINS_DIR}/opensearch-security}" export OPENSEARCH_SECURITY_CONF_DIR="${OPENSEARCH_SECURITY_CONF_DIR:-${DB_CONF_DIR}/opensearch-security}" OPENSEARCH_DASHBOARDS_PASSWORD="${OPENSEARCH_DASHBOARDS_PASSWORD:-"${KIBANA_PASSWORD:-}"}" -export OPENSEARCH_DASHBOARDS_PASSWORD="${OPENSEARCH_DASHBOARDS_PASSWORD:-bitnami}" -export LOGSTASH_PASSWORD="${LOGSTASH_PASSWORD:-bitnami}" +export OPENSEARCH_DASHBOARDS_PASSWORD="${OPENSEARCH_DASHBOARDS_PASSWORD:-}" +export LOGSTASH_PASSWORD="${LOGSTASH_PASSWORD:-}" export OPENSEARCH_SET_CGROUP="${OPENSEARCH_SET_CGROUP:-true}" export OPENSEARCH_SECURITY_BOOTSTRAP="${OPENSEARCH_SECURITY_BOOTSTRAP:-false}" export OPENSEARCH_SECURITY_NODES_DN="${OPENSEARCH_SECURITY_NODES_DN:-}" diff --git a/bitnami/opensearch/3/debian-12/rootfs/opt/bitnami/scripts/opensearch/entrypoint.sh b/bitnami/opensearch/3/debian-12/rootfs/opt/bitnami/scripts/opensearch/entrypoint.sh index 32d31d9ded81..7b69be59f480 100755 --- a/bitnami/opensearch/3/debian-12/rootfs/opt/bitnami/scripts/opensearch/entrypoint.sh +++ b/bitnami/opensearch/3/debian-12/rootfs/opt/bitnami/scripts/opensearch/entrypoint.sh @@ -25,9 +25,9 @@ debug "Copying files from $DB_DEFAULT_CONF_DIR to $DB_CONF_DIR" cp -nr "$DB_DEFAULT_CONF_DIR"/. "$DB_CONF_DIR" if [[ "$1" = "/opt/bitnami/scripts/opensearch/run.sh" ]]; then - info "** Starting Opensearch setup **" + info "** Starting OpenSearch setup **" /opt/bitnami/scripts/opensearch/setup.sh - info "** Opensearch setup finished! **" + info "** OpenSearch setup finished! **" fi echo "" diff --git a/bitnami/opensearch/3/debian-12/rootfs/opt/bitnami/scripts/opensearch/healthcheck.sh b/bitnami/opensearch/3/debian-12/rootfs/opt/bitnami/scripts/opensearch/healthcheck.sh index 72da471ea29b..ea62d450b1af 100755 --- a/bitnami/opensearch/3/debian-12/rootfs/opt/bitnami/scripts/opensearch/healthcheck.sh +++ b/bitnami/opensearch/3/debian-12/rootfs/opt/bitnami/scripts/opensearch/healthcheck.sh @@ -12,7 +12,9 @@ set -o pipefail # Load libraries . /opt/bitnami/scripts/libopensearch.sh -# Load Opensearch environment variables +# Load OpenSearch environment variables . /opt/bitnami/scripts/opensearch-env.sh +# Ensure we clean up temporary files when this script ends +trap "cleanup_credentials" EXIT elasticsearch_healthcheck diff --git a/bitnami/opensearch/3/debian-12/rootfs/opt/bitnami/scripts/opensearch/run.sh b/bitnami/opensearch/3/debian-12/rootfs/opt/bitnami/scripts/opensearch/run.sh index f2339f451740..04bc40fae957 100755 --- a/bitnami/opensearch/3/debian-12/rootfs/opt/bitnami/scripts/opensearch/run.sh +++ b/bitnami/opensearch/3/debian-12/rootfs/opt/bitnami/scripts/opensearch/run.sh @@ -32,7 +32,7 @@ fi ARGS+=("$@") -info "** Starting Opensearch **" +info "** Starting OpenSearch **" if am_i_root; then exec_as_user "$DB_DAEMON_USER" "$EXEC" "${ARGS[@]}" else diff --git a/bitnami/opensearch/3/debian-12/rootfs/opt/bitnami/scripts/opensearch/setup.sh b/bitnami/opensearch/3/debian-12/rootfs/opt/bitnami/scripts/opensearch/setup.sh index d762a996823d..1c2335726e4a 100755 --- a/bitnami/opensearch/3/debian-12/rootfs/opt/bitnami/scripts/opensearch/setup.sh +++ b/bitnami/opensearch/3/debian-12/rootfs/opt/bitnami/scripts/opensearch/setup.sh @@ -17,17 +17,17 @@ set -o pipefail # Load environment . /opt/bitnami/scripts/opensearch-env.sh -# Ensure Opensearch environment variables settings are valid +# Ensure OpenSearch environment variables settings are valid elasticsearch_validate -# Ensure Opensearch is stopped when this script ends -trap "elasticsearch_stop" EXIT +# Ensure OpenSearch is stopped when this script ends and we clean up temporary files +trap "elasticsearch_stop; cleanup_credentials" EXIT # Ensure 'daemon' user exists when running as 'root' am_i_root && ensure_user_exists "$DB_DAEMON_USER" --group "$DB_DAEMON_GROUP" -# Ensure Opensearch is initialized +# Ensure OpenSearch is initialized elasticsearch_initialize # Ensure kernel settings are valid elasticsearch_validate_kernel -# Install Opensearch plugins +# Install OpenSearch plugins elasticsearch_install_plugins # Ensure custom initialization scripts are executed elasticsearch_custom_init_scripts diff --git a/bitnami/opensearch/README.md b/bitnami/opensearch/README.md index 3a6804dc5ce8..a2bb7761da97 100644 --- a/bitnami/opensearch/README.md +++ b/bitnami/opensearch/README.md @@ -104,7 +104,7 @@ The following tables list the main variables you can set. | `OPENSEARCH_HTTP_PORT_NUMBER` | Opensearch port | `9200` | | `OPENSEARCH_ACTION_DESTRUCTIVE_REQUIRES_NAME` | Enable action destructive requires name | `nil` | | `OPENSEARCH_ENABLE_SECURITY` | Enable Opensearch security settings. | `false` | -| `OPENSEARCH_PASSWORD` | Password for "admin" user. | `bitnami` | +| `OPENSEARCH_PASSWORD` | Password for "admin" user. | `nil` | | `OPENSEARCH_TLS_VERIFICATION_MODE` | Opensearch TLS verification mode in transport layer. | `full` | | `OPENSEARCH_TLS_USE_PEM` | Configure Security settings using PEM certificates. | `false` | | `OPENSEARCH_KEYSTORE_PASSWORD` | Password for the Opensearch keystore containing the certificates or password-protected PEM key. | `nil` | @@ -137,8 +137,8 @@ The following tables list the main variables you can set. | `OPENSEARCH_HTTP_TLS_CA_CERT_LOCATION` | Path to CA certificate for HTTP TLS. | `$DB_CA_CERT_LOCATION` | | `OPENSEARCH_SECURITY_DIR` | Root directory of the Opensearch Security plugin. | `${DB_PLUGINS_DIR}/opensearch-security` | | `OPENSEARCH_SECURITY_CONF_DIR` | Configuration directory of the Opensearch Security plugin. | `${DB_CONF_DIR}/opensearch-security` | -| `OPENSEARCH_DASHBOARDS_PASSWORD` | Password for the Opensearch-dashboards user. | `bitnami` | -| `LOGSTASH_PASSWORD` | Password for the Logstash user. | `bitnami` | +| `OPENSEARCH_DASHBOARDS_PASSWORD` | Password for the Opensearch-dashboards user. | `nil` | +| `LOGSTASH_PASSWORD` | Password for the Logstash user. | `nil` | | `OPENSEARCH_SET_CGROUP` | Configure Opensearch java opts with cgroup hierarchy override, so cgroup statistics are available in the container. | `true` | | `OPENSEARCH_SECURITY_BOOTSTRAP` | If set to true, this node will be configured with instructions to bootstrap the Opensearch security config. | `false` | | `OPENSEARCH_SECURITY_NODES_DN` | Comma-separated list including the Opensearch nodes allowed TLS DNs. | `nil` |