Docker / Helm overwriting custom (certificate) configuration

Security
,
1

This is already the solution for the problem outlined in here.

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
OpenSearch: 2.15.0
Helm Chart: 2.21.0

Describe the issue:
Opensearch Helm chart provides the ability to configure the opensearch.yml that hold configuration values. See helm-charts/charts/opensearch/values.yaml at 4253842c1e4d3ac6d4aee294e905c1f20469adc2 · opensearch-project/helm-charts · GitHub

One would assume that mounting custom keys and certificates anywhere under config/ and changing the opensearch.yml accordingly would make OpenSearch use these files.

Like so

config:
  opensearch.yml: |
    plugins:
      security:
        ssl:
          transport:
            pemcert_filepath: certs/tls.crt
            pemkey_filepath: certs/tls.key
            pemtrustedcas_filepath: certs/ca.crt
            enforce_hostname_verification: false
          http:
            enabled: true
            pemcert_filepath: certs/tls.crt
            pemkey_filepath: certs/tls.key
            pemtrustedcas_filepath: certs/ca.crt
[...]

But looking at the /usr/share/opensearch/config/opensearch.yml inside the container it shows a demo configuration, that gets appended to the contents defined in the helm chart values above. Similar to

    plugins:
      security:
        ssl:
          transport:
            pemcert_filepath: esnode.pem
            pemkey_filepath: esnode-key.pem
            pemtrustedcas_filepath: root-ca.pem
            enforce_hostname_verification: false
          http:
            enabled: true
            pemcert_filepath: esnode.pem
            pemkey_filepath: esnode-key.pem
            pemtrustedcas_filepath: root-ca.pem

This is effectively overwriting all efforts to make opensearch use the custom tls files.

But why?

There is an undocumented environment variable DISABLE_INSTALL_DEMO_CONFIG that is used in the entrypoint.sh of the docker image that appends this demo configuration.

Setting DISABLE_INSTALL_DEMO_CONFIG: true leaves opensearch.yml with only the data you set up in the chart values.

Please document this option! Ideally in the chart and in the image itself.

Configuration:
--

Relevant Logs or Screenshots:
--

2

Hi @M_Schmid, Thanks for sharing your findings here is some info I found on GitHub: Duplicated security config in opensearch.yml · Issue #564 · opensearch-project/helm-charts · GitHub looks like it’s related and might be a work in progress.

best,
mj

1 Like
3

Thanks, you’re absolutely right, that’s the behavior here.

Turns out there is in fact a note about this: helm-charts/README.md at main · opensearch-project/helm-charts · GitHub

But to be honest: WTF? :smiley:

1 Like