@@ -129,18 +129,34 @@ func (r *TLSReconciler) handleAdminCertificate() (*ctrl.Result, error) {
129129 return res , nil
130130}
131131
132- func (r * TLSReconciler ) securityChangeVersion ( ) bool {
133- newVersionConstraint , err := semver .NewConstraint (">=2.0.0" )
132+ func (r * TLSReconciler ) checkVersionConstraint ( constraint string , defaultOnError bool , errMsg string ) bool {
133+ versionConstraint , err := semver .NewConstraint (constraint )
134134 if err != nil {
135135 panic (err )
136136 }
137137
138138 version , err := semver .NewVersion (r .instance .Spec .General .Version )
139139 if err != nil {
140- r .logger .Error (err , "unable to parse version, assuming >= 2.0.0" )
141- return true
140+ r .logger .Error (err , errMsg )
141+ return defaultOnError
142142 }
143- return newVersionConstraint .Check (version )
143+ return versionConstraint .Check (version )
144+ }
145+
146+ func (r * TLSReconciler ) securityChangeVersion () bool {
147+ return r .checkVersionConstraint (
148+ ">=2.0.0" ,
149+ true ,
150+ "unable to parse version, assuming >= 2.0.0" ,
151+ )
152+ }
153+
154+ func (r * TLSReconciler ) supportsHotReload () bool {
155+ return r .checkVersionConstraint (
156+ ">=2.19.1" ,
157+ false ,
158+ "unable to parse version for hot reload check, assuming not supported" ,
159+ )
144160}
145161
146162func (r * TLSReconciler ) adminCAName () string {
@@ -488,19 +504,42 @@ func (r *TLSReconciler) handleTransportExistingCerts() error {
488504 // r.recorder.Event(r.instance, "Warning", "Security", "Notice - Not all secrets for transport provided")
489505 return err
490506 }
491- if tlsConfig .CaSecret .Name == "" {
507+
508+ // Implement new mounting logic based on CaSecret.Name configuration
509+ switch name := tlsConfig .CaSecret .Name ; name {
510+ case "" :
511+ // If CaSecret.Name is empty, mount Secret.Name as a directory
492512 mountFolder ("transport" , "certs" , tlsConfig .Secret .Name , r .reconcilerContext )
513+ case tlsConfig .Secret .Name :
514+ // If CaSecret.Name is same as Secret.Name, mount only Secret.Name as a directory
515+ mountFolder ("transport" , "certs" , tlsConfig .Secret .Name , r .reconcilerContext )
516+ default :
517+ // If CaSecret.Name is different from Secret.Name, mount both secrets as directories
518+ // Mount Secret.Name as tls-transport/
519+ mountFolder ("transport" , "certs" , tlsConfig .Secret .Name , r .reconcilerContext )
520+ // Mount CaSecret.Name as tls-transport-ca/
521+ mountFolder ("transport" , "ca" , tlsConfig .CaSecret .Name , r .reconcilerContext )
522+ }
523+
524+ // Extend opensearch.yml with appropriate file paths based on mounting logic
525+ if tlsConfig .CaSecret .Name == "" || tlsConfig .CaSecret .Name == tlsConfig .Secret .Name {
526+ // Single secret mounted as directory
527+ r .reconcilerContext .AddConfig ("plugins.security.ssl.transport.pemcert_filepath" , fmt .Sprintf ("tls-transport/%s" , corev1 .TLSCertKey ))
528+ r .reconcilerContext .AddConfig ("plugins.security.ssl.transport.pemkey_filepath" , fmt .Sprintf ("tls-transport/%s" , corev1 .TLSPrivateKeyKey ))
529+ r .reconcilerContext .AddConfig ("plugins.security.ssl.transport.pemtrustedcas_filepath" , fmt .Sprintf ("tls-transport/%s" , CaCertKey ))
493530 } else {
494- mount ("transport" , "ca" , CaCertKey , tlsConfig .CaSecret .Name , r .reconcilerContext )
495- mount ("transport" , "key" , corev1 .TLSPrivateKeyKey , tlsConfig .Secret .Name , r .reconcilerContext )
496- mount ("transport" , "cert" , corev1 .TLSCertKey , tlsConfig .Secret .Name , r .reconcilerContext )
531+ // Separate secrets mounted as directories
532+ r .reconcilerContext .AddConfig ("plugins.security.ssl.transport.pemcert_filepath" , fmt .Sprintf ("tls-transport/%s" , corev1 .TLSCertKey ))
533+ r .reconcilerContext .AddConfig ("plugins.security.ssl.transport.pemkey_filepath" , fmt .Sprintf ("tls-transport/%s" , corev1 .TLSPrivateKeyKey ))
534+ r .reconcilerContext .AddConfig ("plugins.security.ssl.transport.pemtrustedcas_filepath" , fmt .Sprintf ("tls-transport-ca/%s" , CaCertKey ))
497535 }
498- // Extend opensearch.yml
499- r .reconcilerContext .AddConfig ("plugins.security.ssl.transport.pemcert_filepath" , fmt .Sprintf ("tls-transport/%s" , corev1 .TLSCertKey ))
500- r .reconcilerContext .AddConfig ("plugins.security.ssl.transport.pemkey_filepath" , fmt .Sprintf ("tls-transport/%s" , corev1 .TLSPrivateKeyKey ))
501536 r .reconcilerContext .AddConfig ("plugins.security.ssl.transport.enforce_hostname_verification" , "false" )
537+
538+ // Enable hot reload if configured and version supports it
539+ if tlsConfig .EnableHotReload && r .supportsHotReload () {
540+ r .reconcilerContext .AddConfig ("plugins.security.ssl.certificates_hot_reload.enabled" , "true" )
541+ }
502542 }
503- r .reconcilerContext .AddConfig ("plugins.security.ssl.transport.pemtrustedcas_filepath" , fmt .Sprintf ("tls-transport/%s" , CaCertKey ))
504543 dnList := strings .Join (tlsConfig .NodesDn , "\" ,\" " )
505544 r .reconcilerContext .AddConfig ("plugins.security.nodes_dn" , fmt .Sprintf ("[\" %s\" ]" , dnList ))
506545 return nil
@@ -592,19 +631,43 @@ func (r *TLSReconciler) handleHttp() error {
592631 // r.recorder.Event(r.instance, "Warning", "Security", "Notice - Not all secrets for http provided")
593632 return err
594633 }
595- if tlsConfig .CaSecret .Name == "" {
634+
635+ // Implement new mounting logic based on CaSecret.Name configuration
636+ switch name := tlsConfig .CaSecret .Name ; name {
637+ case "" :
638+ // If CaSecret.Name is empty, mount Secret.Name as a directory
596639 mountFolder ("http" , "certs" , tlsConfig .Secret .Name , r .reconcilerContext )
597- } else {
598- mount ("http" , "ca" , CaCertKey , tlsConfig .CaSecret .Name , r .reconcilerContext )
599- mount ("http" , "key" , corev1 .TLSPrivateKeyKey , tlsConfig .Secret .Name , r .reconcilerContext )
600- mount ("http" , "cert" , corev1 .TLSCertKey , tlsConfig .Secret .Name , r .reconcilerContext )
640+ case tlsConfig .Secret .Name :
641+ // If CaSecret.Name is same as Secret.Name, mount only Secret.Name as a directory
642+ mountFolder ("http" , "certs" , tlsConfig .Secret .Name , r .reconcilerContext )
643+ default :
644+ // If CaSecret.Name is different from Secret.Name, mount both secrets as directories
645+ // Mount Secret.Name as tls-http/
646+ mountFolder ("http" , "certs" , tlsConfig .Secret .Name , r .reconcilerContext )
647+ // Mount CaSecret.Name as tls-http-ca/
648+ mountFolder ("http" , "ca" , tlsConfig .CaSecret .Name , r .reconcilerContext )
601649 }
602650 }
603- // Extend opensearch.yml
651+ // Extend opensearch.yml with appropriate file paths based on mounting logic
604652 r .reconcilerContext .AddConfig ("plugins.security.ssl.http.enabled" , "true" )
605- r .reconcilerContext .AddConfig ("plugins.security.ssl.http.pemcert_filepath" , fmt .Sprintf ("tls-http/%s" , corev1 .TLSCertKey ))
606- r .reconcilerContext .AddConfig ("plugins.security.ssl.http.pemkey_filepath" , fmt .Sprintf ("tls-http/%s" , corev1 .TLSPrivateKeyKey ))
607- r .reconcilerContext .AddConfig ("plugins.security.ssl.http.pemtrustedcas_filepath" , fmt .Sprintf ("tls-http/%s" , CaCertKey ))
653+
654+ // Set certificate file paths based on mounting configuration
655+ if tlsConfig .CaSecret .Name == "" || tlsConfig .CaSecret .Name == tlsConfig .Secret .Name {
656+ // Single secret mounted as directory
657+ r .reconcilerContext .AddConfig ("plugins.security.ssl.http.pemcert_filepath" , fmt .Sprintf ("tls-http/%s" , corev1 .TLSCertKey ))
658+ r .reconcilerContext .AddConfig ("plugins.security.ssl.http.pemkey_filepath" , fmt .Sprintf ("tls-http/%s" , corev1 .TLSPrivateKeyKey ))
659+ r .reconcilerContext .AddConfig ("plugins.security.ssl.http.pemtrustedcas_filepath" , fmt .Sprintf ("tls-http/%s" , CaCertKey ))
660+ } else {
661+ // Separate secrets mounted as directories
662+ r .reconcilerContext .AddConfig ("plugins.security.ssl.http.pemcert_filepath" , fmt .Sprintf ("tls-http/%s" , corev1 .TLSCertKey ))
663+ r .reconcilerContext .AddConfig ("plugins.security.ssl.http.pemkey_filepath" , fmt .Sprintf ("tls-http/%s" , corev1 .TLSPrivateKeyKey ))
664+ r .reconcilerContext .AddConfig ("plugins.security.ssl.http.pemtrustedcas_filepath" , fmt .Sprintf ("tls-http-ca/%s" , CaCertKey ))
665+ }
666+
667+ // Enable hot reload if configured and version supports it
668+ if tlsConfig .EnableHotReload && r .supportsHotReload () {
669+ r .reconcilerContext .AddConfig ("plugins.security.ssl.certificates_hot_reload.enabled" , "true" )
670+ }
608671 return nil
609672}
610673
@@ -625,17 +688,18 @@ func (r *TLSReconciler) providedCaCert(secretName string, namespace string) (tls
625688 return ca , nil
626689}
627690
628- func mount (interfaceName string , name string , filename string , secretName string , reconcilerContext * ReconcilerContext ) {
629- volume := corev1.Volume {Name : interfaceName + "-" + name , VolumeSource : corev1.VolumeSource {Secret : & corev1.SecretVolumeSource {SecretName : secretName }}}
630- reconcilerContext .Volumes = append (reconcilerContext .Volumes , volume )
631- mount := corev1.VolumeMount {Name : interfaceName + "-" + name , MountPath : fmt .Sprintf ("/usr/share/opensearch/config/tls-%s/%s" , interfaceName , filename ), SubPath : filename }
632- reconcilerContext .VolumeMounts = append (reconcilerContext .VolumeMounts , mount )
633- }
634-
635691func mountFolder (interfaceName string , name string , secretName string , reconcilerContext * ReconcilerContext ) {
636692 volume := corev1.Volume {Name : interfaceName + "-" + name , VolumeSource : corev1.VolumeSource {Secret : & corev1.SecretVolumeSource {SecretName : secretName }}}
637693 reconcilerContext .Volumes = append (reconcilerContext .Volumes , volume )
638- mount := corev1.VolumeMount {Name : interfaceName + "-" + name , MountPath : fmt .Sprintf ("/usr/share/opensearch/config/tls-%s" , interfaceName )}
694+
695+ var mountPath string
696+ if name == "ca" {
697+ mountPath = fmt .Sprintf ("/usr/share/opensearch/config/tls-%s-ca" , interfaceName )
698+ } else {
699+ mountPath = fmt .Sprintf ("/usr/share/opensearch/config/tls-%s" , interfaceName )
700+ }
701+
702+ mount := corev1.VolumeMount {Name : interfaceName + "-" + name , MountPath : mountPath }
639703 reconcilerContext .VolumeMounts = append (reconcilerContext .VolumeMounts , mount )
640704}
641705
0 commit comments