Opensearch snap with TLS enabled for transport+rest

Mehdi-Bendriss commented 2 years ago

This PR contains:

Basic setup of the snap
Basic systemd config
self-managed TLS for rest and transport layers
Security indexes initialization
handling of user settings such as init-security and admin-password
Commands for interacting with plugins (listing and installing new plugins)

This still need to be addressed later in another PR:

replace the binaries currently downloaded from S3

jnsgruk commented 2 years ago

find way to pass arguments to the snap service for the following:

admin-passphrase for the admin key

whether to run the security admin script - which needs to be ran once

You can probably do this using snap set and just have the user set those parameters before starting the service. I do similar in my parca-snap

sergiusens commented 2 years ago

On Thu, Sep 1, 2022 at 4:24 AM Jon Seager @.***> wrote:

@.**** commented on this pull request.

In scripts/helpers/set-conf.sh https://github.com/canonical/opensearch-snap/pull/2#discussion_r960306388 :

+function set_yaml_prop () {

key="${2}:"

full_line="${key} ${3}"

if grep -q "^#\?\s*${key}" "${1}";

then

sed -i @.***${key}.@${full_line}@" "${1}"

else

echo "${full_line}" >> "${1}"

fi +}

Yeh, that's maybe better than staging someone else's snap... my main reason for suggesting yq is to avoid carrying python in the snap, but perhaps you could just fetch yq directly from the Gtithub release as a part instead? https://github.com/mikefarah/yq/releases

FWIW, the python plugin is already used, and in the case of core20 and core22, python is part of the base (3.8 snd 3.10 respectively). The snapcraft plugin mostly leverages that and how venvs are created (a symlink to where the working venv is to live) so the python delta is pretty small, more so considering it is already used.

I just check yq itself, it looks like standalone go, so the stage-snap should be fine. Message ID: @.***>

canonical / opensearch-snap

Opensearch snap with TLS enabled for transport+rest #2

@.**** commented on this pull request.