feat: TLS support #55

labrenbe · 2025-10-27T14:18:39Z

Description

Add TLS secret operator Volumes & VolumeMounts

Part of #61

Definition of Done Checklist

Not all of these items are applicable to all PRs, the author should update this template to only leave the boxes in that are relevant
Please make sure all these things are done and tick the boxes

Author

Changes are OpenShift compatible
CRD changes approved
- requestedSecretLifetime was already decided in decision: Make autoTls certificate lifetime configurable issues#673.
- SecretClasses: Decision: TLS Support #69
CRD documentation for all fields, following the style guide.
Helm chart can be installed and deployed operator works
Integration tests passed (for non trivial changes)
Changes need to be "offline" compatible
Links to generated (nightly) docs added
Release note snippet added

Reviewer

Code contains useful comments
(Integration-)Test cases added
Documentation added or updated. Follows the style guide.
Changelog updated
Cargo.toml only contains references to git tags (not specific commits or branches)

Acceptance

Feature Tracker has been updated
Proper release label has been added
Links to generated (nightly) docs added
Release note snippet added
Add type/deprecation label & add to the deprecation schedule
Add type/experimental label & add to the experimental features tracker

…n-job

rust/operator-binary/src/crd/mod.rs

rust/operator-binary/src/framework.rs

rust/operator-binary/src/controller/build/role_group_builder.rs

rust/operator-binary/src/controller/validate.rs

rust/operator-binary/src/controller.rs

tests/templates/kuttl/logging/20-install-opensearch.yaml.j2

siegfriedweber

The documentation is missing.
A changelog entry is missing.
If it should be possible to disable TLS on the HTTP port, then an integration test is required for this case.

siegfriedweber · 2025-12-03T10:20:30Z

docs/modules/opensearch/pages/usage-guide/security.adoc

@@ -0,0 +1,55 @@
+= Security
+:description: Configure TLS encryption, authentication, and Open Policy Agent (OPA) authorization for Kafka with the Stackable Operator.


This is OpenSearch, not Kafka.

siegfriedweber · 2025-12-03T10:45:38Z

docs/modules/opensearch/pages/usage-guide/security.adoc

+The internal and client communication at the REST API can be encrypted with TLS. This requires the xref:secret-operator:index.adoc[Secret Operator] to be running in the Kubernetes cluster providing certificates.
+The used certificates can be changed in a cluster-wide config. TLS encryption on the REST API may be disabled, while it is always enabled for the internal communication between nodes using the `transport` port.


Write a single sentence per line.

see https://docs.stackable.tech/home/stable/contributor/docs/style-guide/#_highlights

Please adapt the whole document.

siegfriedweber · 2025-12-03T10:53:19Z

docs/modules/opensearch/pages/usage-guide/security.adoc

+<3> The lifetime for autoTls certificates generated by the secret operator.
+    Only a lifetime up to the `maxCertificateLifetime` setting in the SecretClass is applied.
+
+The `tls` secret is deployed from the xref:secret-operator:index.adoc[Secret Operator] and looks like this:


Suggested change

The `tls` secret is deployed from the xref:secret-operator:index.adoc[Secret Operator] and looks like this:

The `tls` secret is deployed by the xref:secret-operator:index.adoc[Secret Operator] and looks like this:

siegfriedweber · 2025-12-03T10:54:45Z

docs/modules/opensearch/pages/usage-guide/security.adoc

+      maxCertificateLifetime: 15d
+----
+
+You can create your own secrets and reference them e.g. in the `spec.clusterConfig.tls.serverSecretClass` or `spec.clusterConfig.tls.internalSecretClass` to use different certificates.


You cannot just reference the secrets. You have to create a SecretClass which references them and then use the SecretClass in the clusterConfig.

siegfriedweber · 2025-12-03T11:05:28Z

docs/modules/opensearch/pages/usage-guide/security.adoc

+      maxCertificateLifetime: 15d
+----
+
+You can create your own secrets and reference them e.g. in the `spec.clusterConfig.tls.serverSecretClass` or `spec.clusterConfig.tls.internalSecretClass` to use different certificates.


It is important to mention that the operator sets plugins.security.nodes_dn to ["CN=generated certificate for pod"]. That means that the authentication between the nodes is weak. If a user wants to increase the security and use certificates which really identify the OpenSearch nodes, they also must adapt the mentioned setting.

siegfriedweber · 2025-12-03T14:24:40Z

tests/templates/kuttl/metrics/20-install-opensearch.yaml.j2

    pullPolicy: IfNotPresent
-{% if lookup('env', 'VECTOR_AGGREGATOR') %}
  clusterConfig:
+{% if test_scenario['values']['server-use-tls'] == 'false' %}


The metrics test does not depend on server-use-tls (and it also should not).

siegfriedweber · 2025-12-03T14:43:41Z

tests/templates/kuttl/opensearch-dashboards/20_opensearch-dashboards-values.yaml.j2

This file seems to be destroyed by automatic merges. There are two config sections and the integration test does not pass.

siegfriedweber · 2025-12-03T14:47:11Z

tests/templates/kuttl/smoke/10-assert.yaml.j2

 apiVersion: kuttl.dev/v1beta1
 kind: TestAssert
-timeout: 600
+timeout: 120


I also reduce this timeout when testing locally. But when executed on Jenkins, the deployment can take a while and I fear that we introduce test flakiness with this timeout.

siegfriedweber · 2025-12-03T14:58:11Z

tests/templates/kuttl/smoke/20-test-opensearch.yaml.j2

-        use_ssl = True,
-        verify_certs = True,
+        use_ssl = http_use_tls,
+        verify_certs = http_use_tls,


verify_certs can stay True.

Suggested change

verify_certs = http_use_tls,

verify_certs = True,

siegfriedweber · 2025-12-03T15:16:52Z

CHANGELOG.md

 - Add the role group as a node attribute ([#63]).
+- Allow the configuration of TLS for the HTTP and TRANSPORT ports with the operator ([#55]).

 [#63]: https://github.com/stackabletech/opensearch-operator/pull/63


Suggested change

[#63]: https://github.com/stackabletech/opensearch-operator/pull/63

[#55]: https://github.com/stackabletech/opensearch-operator/pull/55

[#63]: https://github.com/stackabletech/opensearch-operator/pull/63

siegfriedweber · 2025-12-03T16:05:21Z

docs/modules/opensearch/pages/usage-guide/security.adoc

This file is not referenced in nav.adoc.

labrenbe added 9 commits August 14, 2025 18:15

wip: add run-securityadmin job

d45f8fb

configure tls on run-securityadmin

c489b44

add tls secret class to crd

ffa0585

Merge remote-tracking branch 'origin/main' into feat/run-securityadmi…

aaa560f

…n-job

add tls volume to sts

4d7496c

add tls config to opensearch.yml

7f805b8

disable security demo install

c6db525

Merge remote-tracking branch 'origin/main' into feat/run-securityadmi…

1c3e672

…n-job

wip amend integration tests

bbbdbb6

labrenbe self-assigned this Oct 27, 2025

labrenbe added this to Stackable Engineering Oct 27, 2025

labrenbe moved this to Ready for Development in Stackable Engineering Oct 27, 2025

labrenbe moved this from Ready for Development to Development: In Progress in Stackable Engineering Oct 27, 2025

Merge remote-tracking branch 'origin/main' into feat/tls-support

1aeb4db

This was referenced Oct 28, 2025

feat: Add TLS support #25

Closed

OpenSearch operator MVP #1

Open

labrenbe added 5 commits October 28, 2025 12:10

fix smoke test

ab42f5a

restore properties file

97681a3

mount tls volume in default directory of official image

815d243

use tls feature in all integration tests

95986a5

use OPENSEARCH_PATH_CONF for tls config

910a58d

labrenbe requested a review from siegfriedweber October 28, 2025 15:26

labrenbe moved this from Development: In Progress to Development: Waiting for Review in Stackable Engineering Oct 28, 2025

labrenbe marked this pull request as ready for review October 28, 2025 15:26

labrenbe added 2 commits October 28, 2025 16:32

Merge remote-tracking branch 'origin/main' into feat/tls-support

9252b06

fix incorrectly resolved merge conflict

beb2aff

siegfriedweber moved this from Development: Waiting for Review to Development: In Review in Stackable Engineering Oct 29, 2025

siegfriedweber mentioned this pull request Oct 30, 2025

Integrate TLS support #61

Open

2 tasks

siegfriedweber requested changes Oct 31, 2025

View reviewed changes

labrenbe added 3 commits November 4, 2025 16:41

Merge remote-tracking branch 'origin/main' into feat/tls-support

383e358

wip: adress feedback on pr

25745d1

Merge remote-tracking branch 'origin/main' into feat/tls-support

bcb5542

labrenbe mentioned this pull request Nov 11, 2025

Decision: TLS Support #69

Closed

labrenbe and others added 6 commits November 13, 2025 16:39

address feedback on PR

8257b95

Merge remote-tracking branch 'origin/main' into feat/tls-support

bd86ebc

add changelog entry

36120a8

rename CRD fields based on decision

0294f91

Merge remote-tracking branch 'origin/main' into feat/tls-support

cb97dee

Merge branch 'main' into feat/tls-support

7c6e1d9

siegfriedweber requested changes Dec 3, 2025

View reviewed changes

siegfriedweber reviewed Dec 3, 2025

View reviewed changes

docs/modules/opensearch/pages/usage-guide/security.adoc

Copy link

Member

siegfriedweber Dec 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This file is not referenced in nav.adoc.

		@@ -0,0 +1,55 @@
		= Security
		:description: Configure TLS encryption, authentication, and Open Policy Agent (OPA) authorization for Kafka with the Stackable Operator.

		The internal and client communication at the REST API can be encrypted with TLS. This requires the xref:secret-operator:index.adoc[Secret Operator] to be running in the Kubernetes cluster providing certificates.
		The used certificates can be changed in a cluster-wide config. TLS encryption on the REST API may be disabled, while it is always enabled for the internal communication between nodes using the `transport` port.

	The `tls` secret is deployed from the xref:secret-operator:index.adoc[Secret Operator] and looks like this:
	The `tls` secret is deployed by the xref:secret-operator:index.adoc[Secret Operator] and looks like this:

	[#63]: https://github.com/stackabletech/opensearch-operator/pull/63
	[#55]: https://github.com/stackabletech/opensearch-operator/pull/55
	[#63]: https://github.com/stackabletech/opensearch-operator/pull/63

Uh oh!

feat: TLS support #55

Are you sure you want to change the base?

feat: TLS support #55

Uh oh!

Conversation

labrenbe commented Oct 27, 2025 • edited by siegfriedweber Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Definition of Done Checklist

Author

Reviewer

Acceptance

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

siegfriedweber left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

labrenbe commented Oct 27, 2025 •

edited by siegfriedweber

Loading

siegfriedweber left a comment •

edited

Loading