Skip to content

Commit 7dd0e21

Browse files
EamonZhangEamonZhang
committed
2 parents 42bce72 + ef8ce75 commit 7dd0e21

14 files changed

Lines changed: 492 additions & 27 deletions

File tree

‎addons/opensearch/2.10/chart/opensearch/templates/dashboards/tls-secret.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,11 @@ SPDX-License-Identifier: APACHE-2.0
44
*/}}
55

66
{{- if and (include "opensearch.dashboards.enabled" .) (include "opensearch.dashboards.createTlsSecret" .) }}
7-
{{- $ca := genCA "opensearch-ca" 365 }}
7+
{{- $ca := genCA "opensearch-ca" 36500 }}
88
{{- $releaseNamespace := include "common.names.namespace" . }}
99
{{- $clusterDomain := .Values.clusterDomain }}
1010
{{- $dashboardsFullname := include "opensearch.dashboards.fullname" . }}
11-
{{- $cert := genSignedCert $dashboardsFullname nil nil 365 $ca }}
11+
{{- $cert := genSignedCert $dashboardsFullname nil nil 36500 $ca }}
1212
{{- $secretDashboardsName := printf "%s-crt" (include "opensearch.dashboards.fullname" .) }}
1313
---
1414
apiVersion: v1

‎addons/opensearch/2.10/chart/opensearch/templates/ingress-tls-secrets.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,8 @@ data:
2424
{{- end }}
2525
{{- if and .Values.ingress.tls .Values.ingress.selfSigned }}
2626
{{- $secretName := printf "%s-tls" .Values.ingress.hostname }}
27-
{{- $ca := genCA "opensearch-ca" 365 }}
28-
{{- $cert := genSignedCert .Values.ingress.hostname nil (list .Values.ingress.hostname) 365 $ca }}
27+
{{- $ca := genCA "opensearch-ca" 36500 }}
28+
{{- $cert := genSignedCert .Values.ingress.hostname nil (list .Values.ingress.hostname) 36500 $ca }}
2929
apiVersion: v1
3030
kind: Secret
3131
metadata:
@@ -65,8 +65,8 @@ data:
6565
{{- end }}
6666
{{- if and .Values.ingest.ingress.tls .Values.ingest.ingress.selfSigned }}
6767
{{- $secretName := printf "%s-tls" .Values.ingest.ingress.hostname }}
68-
{{- $ca := genCA "opensearch-ingest-ca" 365 }}
69-
{{- $cert := genSignedCert .Values.ingest.ingress.hostname nil (list .Values.ingest.ingress.hostname) 365 $ca }}
68+
{{- $ca := genCA "opensearch-ingest-ca" 36500 }}
69+
{{- $cert := genSignedCert .Values.ingest.ingress.hostname nil (list .Values.ingest.ingress.hostname) 36500 $ca }}
7070
apiVersion: v1
7171
kind: Secret
7272
metadata:

‎addons/opensearch/2.10/chart/opensearch/templates/tls-secret.yaml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,10 @@ SPDX-License-Identifier: APACHE-2.0
44
*/}}
55

66
{{- if (include "opensearch.createTlsSecret" .) }}
7-
{{- $ca := genCA "opensearch-ca" 365 }}
7+
{{- $ca := genCA "opensearch-ca" 36500 }}
88
{{- $releaseNamespace := include "common.names.namespace" . }}
99
{{- $clusterDomain := .Values.clusterDomain }}
10-
{{- $cert := genSignedCert "admin" nil nil 365 $ca }}
10+
{{- $cert := genSignedCert "admin" nil nil 36500 $ca }}
1111
{{- $secretAdminName := printf "%s-admin-crt" (include "common.names.fullname" .) }}
1212
apiVersion: v1
1313
kind: Secret
@@ -30,7 +30,7 @@ data:
3030
{{- $altNames = append $altNames (include "opensearch.service.name" .) }}
3131
{{- $altNames = append $altNames (printf "%s.%s.svc.%s" (include "opensearch.service.name" .) $releaseNamespace $clusterDomain) }}
3232
{{- end }}
33-
{{- $cert := genSignedCert $fullname nil $altNames 365 $ca }}
33+
{{- $cert := genSignedCert $fullname nil $altNames 36500 $ca }}
3434
{{- $secretName := printf "%s-crt" (include "opensearch.master.fullname" .) }}
3535
---
3636
apiVersion: v1
@@ -53,7 +53,7 @@ data:
5353
{{- $fullname := include "opensearch.data.fullname" . }}
5454
{{- $serviceName := include "opensearch.data.servicename" . }}
5555
{{- $altNames := list (printf "*.%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) $fullname "127.0.0.1" "localhost" }}
56-
{{- $cert := genSignedCert $fullname nil $altNames 365 $ca }}
56+
{{- $cert := genSignedCert $fullname nil $altNames 36500 $ca }}
5757
{{- $secretName := printf "%s-crt" (include "opensearch.data.fullname" .) }}
5858
---
5959
apiVersion: v1
@@ -76,7 +76,7 @@ data:
7676
{{- $fullname := include "opensearch.coordinating.fullname" . }}
7777
{{- $serviceName := include "opensearch.coordinating.servicename" . }}
7878
{{- $altNames := list (include "opensearch.service.name" .) (printf "%s.%s.svc.%s" (include "opensearch.service.name" .) $releaseNamespace $clusterDomain) (printf "*.%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) $fullname "127.0.0.1" "localhost" }}
79-
{{- $cert := genSignedCert $fullname nil $altNames 365 $ca }}
79+
{{- $cert := genSignedCert $fullname nil $altNames 36500 $ca }}
8080
{{- $secretName := printf "%s-crt" (include "opensearch.coordinating.fullname" .) }}
8181
---
8282
apiVersion: v1
@@ -103,7 +103,7 @@ data:
103103
{{- $altNames = append $altNames (include "opensearch.ingest.fullname" .) }}
104104
{{- $altNames = append $altNames (printf "%s.%s.svc.%s" (include "opensearch.ingest.fullname" .) $releaseNamespace $clusterDomain) }}
105105
{{- end }}
106-
{{- $cert := genSignedCert $fullname nil $altNames 365 $ca }}
106+
{{- $cert := genSignedCert $fullname nil $altNames 36500 $ca }}
107107
{{- $secretName := printf "%s-crt" (include "opensearch.ingest.fullname" .) }}
108108
---
109109
apiVersion: v1

‎addons/opensearch/2.10/chart/opensearch/values.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -432,7 +432,7 @@ ingress:
432432
## NOTE: 'key' and 'certificate' are expected in PEM format
433433
## NOTE: 'name' should line up with a 'secretName' set further up
434434
## If it is not set and you're using cert-manager, this is unneeded, as it will create a secret for you with valid certificates
435-
## If it is not set and you're NOT using cert-manager either, self-signed certificates will be created valid for 365 days
435+
## If it is not set and you're NOT using cert-manager either, self-signed certificates will be created valid for 36500 days
436436
## It is also possible to create and manage the certificates outside of this helm chart
437437
## Please see README.md for more information
438438
## e.g:
@@ -2142,7 +2142,7 @@ ingest:
21422142
## NOTE: 'key' and 'certificate' are expected in PEM format
21432143
## NOTE: 'name' should line up with a 'secretName' set further up
21442144
## If it is not set and you're using cert-manager, this is unneeded, as it will create a secret for you with valid certificates
2145-
## If it is not set and you're NOT using cert-manager either, self-signed certificates will be created valid for 365 days
2145+
## If it is not set and you're NOT using cert-manager either, self-signed certificates will be created valid for 36500 days
21462146
## It is also possible to create and manage the certificates outside of this helm chart
21472147
## Please see README.md for more information
21482148
## e.g:
@@ -2800,7 +2800,7 @@ dashboards:
28002800
## NOTE: 'key' and 'certificate' are expected in PEM format
28012801
## NOTE: 'name' should line up with a 'secretName' set further up
28022802
## If it is not set and you're using cert-manager, this is unneeded, as it will create a secret for you with valid certificates
2803-
## If it is not set and you're NOT using cert-manager either, self-signed certificates will be created valid for 365 days
2803+
## If it is not set and you're NOT using cert-manager either, self-signed certificates will be created valid for 36500 days
28042804
## It is also possible to create and manage the certificates outside of this helm chart
28052805
## Please see README.md for more information
28062806
## e.g:

‎addons/opensearch/2.10/plans/standard-1c2g16/bind.yaml‎

Lines changed: 52 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
credential:
2+
{{- $releaseNamespace := include "common.names.namespace" . }}
3+
{{- $clusterDomain := .Values.clusterDomain }}
24
{{- if (eq .Values.service.type "LoadBalancer") }}
35
- name: EXTERNAL_OPENSEARCH_HOST
46
valueFrom:
@@ -66,4 +68,53 @@ credential:
6668
secretKeyRef:
6769
name: {{ template "common.names.fullname" . }}
6870
jsonpath: '{ .data.logstash-password }'
69-
{{- end }}
71+
{{- end }}
72+
73+
74+
{{- if (include "opensearch.createTlsSecret" .) }}
75+
{{ if not (include "opensearch.coordinating.enabled" .) }}
76+
- name: OPENSEARCH_DOMAIN
77+
value: {{ (printf "%s.%s.svc.%s" (include "opensearch.service.name" .) $releaseNamespace $clusterDomain) }}
78+
79+
- name: OPESEARCH_MASTER_CA_CRT
80+
valueFrom:
81+
secretKeyRef:
82+
name: {{ printf "%s-crt" (include "opensearch.master.fullname" .) }}
83+
jsonpath: '{ .data.ca\.crt }'
84+
{{- end }}
85+
86+
{{- if and (include "opensearch.data.enabled" .) (not .Values.security.tls.data.existingSecret) }}
87+
{{- $serviceName := include "opensearch.data.servicename" . }}
88+
- name: OPENSEARCH_DATA_DOMAIN
89+
value: {{ (printf "%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) }}
90+
91+
- name: OPESEARCH_DATA_CA_CRT
92+
valueFrom:
93+
secretKeyRef:
94+
name: {{ printf "%s-crt" (include "opensearch.data.fullname" .) }}
95+
jsonpath: '{ .data.ca\.crt }'
96+
{{- end }}
97+
98+
{{- if and (include "opensearch.coordinating.enabled" .) (not .Values.security.tls.coordinating.existingSecret) }}
99+
- name: OPENSEARCH_DOMAIN
100+
value: {{ (printf "%s.%s.svc.%s" (include "opensearch.service.name" .) $releaseNamespace $clusterDomain) }}
101+
102+
- name: OPESEARCH_COORDINATING_CA_CRT
103+
valueFrom:
104+
secretKeyRef:
105+
name: {{ printf "%s-crt" (include "opensearch.coordinating.fullname" .) }}
106+
jsonpath: '{ .data.ca\.crt }'
107+
{{- end }}
108+
109+
{{- if and (include "opensearch.ingest.enabled" .) (not .Values.security.tls.ingest.existingSecret) }}
110+
{{- $serviceName := include "opensearch.ingest.servicename" . }}
111+
- name: OPENSEARCH_INGEST_DOMAIN
112+
value: {{ (printf "%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) }}
113+
114+
- name: OPESEARCH_INGEST_CA_CRT
115+
valueFrom:
116+
secretKeyRef:
117+
name: {{ printf "%s-crt" (include "opensearch.ingest.fullname" .) }}
118+
jsonpath: '{ .data.ca\.crt }'
119+
{{- end }}
120+
{{- end }}

‎addons/opensearch/2.10/plans/standard-2c4g32/bind.yaml‎

Lines changed: 53 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
credential:
2+
{{- $releaseNamespace := include "common.names.namespace" . }}
3+
{{- $clusterDomain := .Values.clusterDomain }}
24
{{- if (eq .Values.service.type "LoadBalancer") }}
35
- name: EXTERNAL_OPENSEARCH_HOST
46
valueFrom:
@@ -47,6 +49,7 @@ credential:
4749
jsonpath: '{ .spec.ports[?(@.name=="http")].port }'
4850
{{- end }}
4951

52+
5053
{{- if .Values.security.enabled }}
5154
- name: OPENSEARCH_PASSWORD
5255
valueFrom:
@@ -65,4 +68,53 @@ credential:
6568
secretKeyRef:
6669
name: {{ template "common.names.fullname" . }}
6770
jsonpath: '{ .data.logstash-password }'
68-
{{- end }}
71+
{{- end }}
72+
73+
74+
{{- if (include "opensearch.createTlsSecret" .) }}
75+
{{ if not (include "opensearch.coordinating.enabled" .) }}
76+
- name: OPENSEARCH_DOMAIN
77+
value: {{ (printf "%s.%s.svc.%s" (include "opensearch.service.name" .) $releaseNamespace $clusterDomain) }}
78+
79+
- name: OPESEARCH_MASTER_CA_CRT
80+
valueFrom:
81+
secretKeyRef:
82+
name: {{ printf "%s-crt" (include "opensearch.master.fullname" .) }}
83+
jsonpath: '{ .data.ca\.crt }'
84+
{{- end }}
85+
86+
{{- if and (include "opensearch.data.enabled" .) (not .Values.security.tls.data.existingSecret) }}
87+
{{- $serviceName := include "opensearch.data.servicename" . }}
88+
- name: OPENSEARCH_DATA_DOMAIN
89+
value: {{ (printf "%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) }}
90+
91+
- name: OPESEARCH_DATA_CA_CRT
92+
valueFrom:
93+
secretKeyRef:
94+
name: {{ printf "%s-crt" (include "opensearch.data.fullname" .) }}
95+
jsonpath: '{ .data.ca\.crt }'
96+
{{- end }}
97+
98+
{{- if and (include "opensearch.coordinating.enabled" .) (not .Values.security.tls.coordinating.existingSecret) }}
99+
- name: OPENSEARCH_DOMAIN
100+
value: {{ (printf "%s.%s.svc.%s" (include "opensearch.service.name" .) $releaseNamespace $clusterDomain) }}
101+
102+
- name: OPESEARCH_COORDINATING_CA_CRT
103+
valueFrom:
104+
secretKeyRef:
105+
name: {{ printf "%s-crt" (include "opensearch.coordinating.fullname" .) }}
106+
jsonpath: '{ .data.ca\.crt }'
107+
{{- end }}
108+
109+
{{- if and (include "opensearch.ingest.enabled" .) (not .Values.security.tls.ingest.existingSecret) }}
110+
{{- $serviceName := include "opensearch.ingest.servicename" . }}
111+
- name: OPENSEARCH_INGEST_DOMAIN
112+
value: {{ (printf "%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) }}
113+
114+
- name: OPESEARCH_INGEST_CA_CRT
115+
valueFrom:
116+
secretKeyRef:
117+
name: {{ printf "%s-crt" (include "opensearch.ingest.fullname" .) }}
118+
jsonpath: '{ .data.ca\.crt }'
119+
{{- end }}
120+
{{- end }}

‎addons/opensearch/2.10/plans/standard-2c4g64/bind.yaml‎

Lines changed: 53 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
credential:
2+
{{- $releaseNamespace := include "common.names.namespace" . }}
3+
{{- $clusterDomain := .Values.clusterDomain }}
24
{{- if (eq .Values.service.type "LoadBalancer") }}
35
- name: EXTERNAL_OPENSEARCH_HOST
46
valueFrom:
@@ -47,6 +49,7 @@ credential:
4749
jsonpath: '{ .spec.ports[?(@.name=="http")].port }'
4850
{{- end }}
4951

52+
5053
{{- if .Values.security.enabled }}
5154
- name: OPENSEARCH_PASSWORD
5255
valueFrom:
@@ -65,4 +68,53 @@ credential:
6568
secretKeyRef:
6669
name: {{ template "common.names.fullname" . }}
6770
jsonpath: '{ .data.logstash-password }'
68-
{{- end }}
71+
{{- end }}
72+
73+
74+
{{- if (include "opensearch.createTlsSecret" .) }}
75+
{{ if not (include "opensearch.coordinating.enabled" .) }}
76+
- name: OPENSEARCH_DOMAIN
77+
value: {{ (printf "%s.%s.svc.%s" (include "opensearch.service.name" .) $releaseNamespace $clusterDomain) }}
78+
79+
- name: OPESEARCH_MASTER_CA_CRT
80+
valueFrom:
81+
secretKeyRef:
82+
name: {{ printf "%s-crt" (include "opensearch.master.fullname" .) }}
83+
jsonpath: '{ .data.ca\.crt }'
84+
{{- end }}
85+
86+
{{- if and (include "opensearch.data.enabled" .) (not .Values.security.tls.data.existingSecret) }}
87+
{{- $serviceName := include "opensearch.data.servicename" . }}
88+
- name: OPENSEARCH_DATA_DOMAIN
89+
value: {{ (printf "%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) }}
90+
91+
- name: OPESEARCH_DATA_CA_CRT
92+
valueFrom:
93+
secretKeyRef:
94+
name: {{ printf "%s-crt" (include "opensearch.data.fullname" .) }}
95+
jsonpath: '{ .data.ca\.crt }'
96+
{{- end }}
97+
98+
{{- if and (include "opensearch.coordinating.enabled" .) (not .Values.security.tls.coordinating.existingSecret) }}
99+
- name: OPENSEARCH_DOMAIN
100+
value: {{ (printf "%s.%s.svc.%s" (include "opensearch.service.name" .) $releaseNamespace $clusterDomain) }}
101+
102+
- name: OPESEARCH_COORDINATING_CA_CRT
103+
valueFrom:
104+
secretKeyRef:
105+
name: {{ printf "%s-crt" (include "opensearch.coordinating.fullname" .) }}
106+
jsonpath: '{ .data.ca\.crt }'
107+
{{- end }}
108+
109+
{{- if and (include "opensearch.ingest.enabled" .) (not .Values.security.tls.ingest.existingSecret) }}
110+
{{- $serviceName := include "opensearch.ingest.servicename" . }}
111+
- name: OPENSEARCH_INGEST_DOMAIN
112+
value: {{ (printf "%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) }}
113+
114+
- name: OPESEARCH_INGEST_CA_CRT
115+
valueFrom:
116+
secretKeyRef:
117+
name: {{ printf "%s-crt" (include "opensearch.ingest.fullname" .) }}
118+
jsonpath: '{ .data.ca\.crt }'
119+
{{- end }}
120+
{{- end }}

‎addons/opensearch/2.10/plans/standard-4c16g256/bind.yaml‎

Lines changed: 53 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
credential:
2+
{{- $releaseNamespace := include "common.names.namespace" . }}
3+
{{- $clusterDomain := .Values.clusterDomain }}
24
{{- if (eq .Values.service.type "LoadBalancer") }}
35
- name: EXTERNAL_OPENSEARCH_HOST
46
valueFrom:
@@ -47,6 +49,7 @@ credential:
4749
jsonpath: '{ .spec.ports[?(@.name=="http")].port }'
4850
{{- end }}
4951

52+
5053
{{- if .Values.security.enabled }}
5154
- name: OPENSEARCH_PASSWORD
5255
valueFrom:
@@ -65,4 +68,53 @@ credential:
6568
secretKeyRef:
6669
name: {{ template "common.names.fullname" . }}
6770
jsonpath: '{ .data.logstash-password }'
68-
{{- end }}
71+
{{- end }}
72+
73+
74+
{{- if (include "opensearch.createTlsSecret" .) }}
75+
{{ if not (include "opensearch.coordinating.enabled" .) }}
76+
- name: OPENSEARCH_DOMAIN
77+
value: {{ (printf "%s.%s.svc.%s" (include "opensearch.service.name" .) $releaseNamespace $clusterDomain) }}
78+
79+
- name: OPESEARCH_MASTER_CA_CRT
80+
valueFrom:
81+
secretKeyRef:
82+
name: {{ printf "%s-crt" (include "opensearch.master.fullname" .) }}
83+
jsonpath: '{ .data.ca\.crt }'
84+
{{- end }}
85+
86+
{{- if and (include "opensearch.data.enabled" .) (not .Values.security.tls.data.existingSecret) }}
87+
{{- $serviceName := include "opensearch.data.servicename" . }}
88+
- name: OPENSEARCH_DATA_DOMAIN
89+
value: {{ (printf "%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) }}
90+
91+
- name: OPESEARCH_DATA_CA_CRT
92+
valueFrom:
93+
secretKeyRef:
94+
name: {{ printf "%s-crt" (include "opensearch.data.fullname" .) }}
95+
jsonpath: '{ .data.ca\.crt }'
96+
{{- end }}
97+
98+
{{- if and (include "opensearch.coordinating.enabled" .) (not .Values.security.tls.coordinating.existingSecret) }}
99+
- name: OPENSEARCH_DOMAIN
100+
value: {{ (printf "%s.%s.svc.%s" (include "opensearch.service.name" .) $releaseNamespace $clusterDomain) }}
101+
102+
- name: OPESEARCH_COORDINATING_CA_CRT
103+
valueFrom:
104+
secretKeyRef:
105+
name: {{ printf "%s-crt" (include "opensearch.coordinating.fullname" .) }}
106+
jsonpath: '{ .data.ca\.crt }'
107+
{{- end }}
108+
109+
{{- if and (include "opensearch.ingest.enabled" .) (not .Values.security.tls.ingest.existingSecret) }}
110+
{{- $serviceName := include "opensearch.ingest.servicename" . }}
111+
- name: OPENSEARCH_INGEST_DOMAIN
112+
value: {{ (printf "%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) }}
113+
114+
- name: OPESEARCH_INGEST_CA_CRT
115+
valueFrom:
116+
secretKeyRef:
117+
name: {{ printf "%s-crt" (include "opensearch.ingest.fullname" .) }}
118+
jsonpath: '{ .data.ca\.crt }'
119+
{{- end }}
120+
{{- end }}

0 commit comments

Comments
 (0)