Tomas Dvorak
37e32b390e
Datanode provisioning refactored and significantly simplified ( #19558 )
...
* Datanode keystore implementation
* Bind keystore check, remove legacy private key storage
* added license
* code cleanup, better cert signed verification
* added changelog
* code cleanup
* CSR and certificate exchange refactored
* removed jetbrains annotation
* removed jetbrains annotation
* Datanode provisioning refactored and significantly simplified
* Log more certificate info
* fix initial opensearch configuration change event
* Safer datanodes shutdown during the startOver in preflight
* Allow opensearch restarts in the state machine, simplify allowlist events handling
* Replace opensearch configuration provider with service
* Propagate datanode cert validity through periodical pings
* fixed DataNodeEntityTest
* Adapt CertRenewalServiceImpl to new source of datanode cert validity
* Fixed logging and DatanodeKeystore validation caching
* Fix provisioning for inplace migration
* fixed test
---------
Co-authored-by: Matthias Oesterheld <33032967+moesterheld@users.noreply.github.com >
2024-06-12 12:31:02 +02:00
Tomas Dvorak
682aac7e93
Datanode keystore implementation ( #19536 )
...
* Datanode keystore implementation
* Bind keystore check, remove legacy private key storage
* added license
* code cleanup, better cert signed verification
* added changelog
* code cleanup
2024-06-06 07:48:12 +02:00
Dennis Oelkers
9830372bbf
Return better messages for JSON errors in API. ( #18367 )
...
* Return better messages for JSON errors in API.
* Improving structure once again.
* Include more attributes in specialized error class.
* Adding license header.
* Adding changelog snippet.
* Handling missing target type.
* Including reference path if present.
* Fixing up changelog, adding upgrade notes.
* Adding test for JSON parsing error responses.
* Constructing reference path for missing required property.
* Handling JSON parsing error on root level.
* Consolidating `JacksonPropertyExceptionMapper` to handle invalid properties in a structured way.
* Adjusting test.
2024-06-03 08:32:13 +02:00
Tomas Dvorak
e098d672af
Remove basic auth from datanode rest api (jwt only now) ( #19244 )
...
* Remove basic auth from datanode rest api (jwt only now)
* Remove username/password usages from datanode integration tests
* fix tests
* Added changelog
2024-05-06 13:19:05 +02:00
Matthias Oesterheld
91ded55629
Initial refactoring of data node process/state machine ( #19101 )
...
* rename state machine to DataNodeStateMachine to make clear it is not only handling the process anymore
* initial refactoring of packages and classes:
clearly separate processing and opensearch-related classes
* Make ManageableProcess independent from OpensearchStateMachine
2024-04-19 07:23:07 +02:00
Tomas Dvorak
c6040e2cab
replace jetbrains NotNull/Nullable annotations with jakarta ( #19029 )
...
* Configure forbiddenapis for jetbrains annotations
* replace jetbrains NotNull/Nullable annotations with jakarta
* Update pom.xml
Co-authored-by: Othello Maurer <othello@graylog.com >
* Revert "replace jetbrains NotNull/Nullable annotations with jakarta"
This reverts commit 11d8b394d5othello@graylog.com >
2024-04-18 11:42:17 +02:00
Matthias Oesterheld
1c5ebd2742
Fix datanode startup ( #18577 )
...
* reuse executor service to avoid multiple registrations of metrics
* add PREPARED preflight config state
2024-03-12 14:40:38 +01:00
dependabot[bot]
54ff42b6c9
Bump jjwt.version from 0.11.5 to 0.12.5 ( #17075 )
...
* Bump jjwt.version from 0.11.5 to 0.12.3
Bumps `jjwt.version` from 0.11.5 to 0.12.3.
Updates `io.jsonwebtoken:jjwt-api` from 0.11.5 to 0.12.3
- [Release notes](https://github.com/jwtk/jjwt/releases )
- [Changelog](https://github.com/jwtk/jjwt/blob/master/CHANGELOG.md )
- [Commits](https://github.com/jwtk/jjwt/compare/0.11.5...0.12.3 )
Updates `io.jsonwebtoken:jjwt-impl` from 0.11.5 to 0.12.3
- [Release notes](https://github.com/jwtk/jjwt/releases )
- [Changelog](https://github.com/jwtk/jjwt/blob/master/CHANGELOG.md )
- [Commits](https://github.com/jwtk/jjwt/compare/0.11.5...0.12.3 )
Updates `io.jsonwebtoken:jjwt-jackson` from 0.11.5 to 0.12.3
---
updated-dependencies:
- dependency-name: io.jsonwebtoken:jjwt-api
dependency-type: direct:production
update-type: version-update:semver-minor
- dependency-name: io.jsonwebtoken:jjwt-impl
dependency-type: direct:production
update-type: version-update:semver-minor
- dependency-name: io.jsonwebtoken:jjwt-jackson
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
* fixed JwtTokenValidator
* adapt jwt token test for NONE alg
* trim imported licenses in integration tests
* Added changelog
* Added changelog
* code cleanup, removed changelog, added test
* code cleanup
* Update to jjwt 0.12.5
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Tomas Dvorak <tomas.dvorak@graylog.com >
Co-authored-by: Bernd Ahlers <bernd@users.noreply.github.com >
Co-authored-by: Bernd Ahlers <bernd@graylog.com >
2024-02-27 11:53:11 +01:00
Othello Maurer
8ce9b3f532
Transition from javax to jakarta ( #17765 )
...
* Bump jersey version 2.37 -> 3.1.5
* javax.ws.rs:javax.ws.rs-api -> jakarta.ws.rs:jakarta.ws.rs-api
* Ban javax.ws.rs:javax.ws.rs-api dependency
* com.fasterxml.jackson.jaxrs -> com.fasterxml.jackson.jakarta.rs
* javax.validation -> jakarta.validation
* Remove exclusion of hibernate-validator
* jackson-module-jsonSchema -> jackson-module-jsonSchema-jakarta
* Bump hibernate-validator 6.2.5.Final -> 8.0.1.Final
* javax.annotation-api -> jakarta.annotation-api
* Add TODO for banning javax.validation:* dependencies
* Use jakarta.annotation.* where possible
* javax.inject -> jakarta.inject
* Temporarily disable merging master into PR branch when building
* Add javax.persistence to forbidden APIs
* Revert "Temporarily disable merging master into PR branch when building"
This reverts commit dadbeecc0f
2024-01-16 14:07:12 +01:00
Tomas Dvorak
b0afd6206e
Proxy for datanode rest, jwt auth filter for datanode ( #17827 )
...
* Proxy for datanode rest, jwt auth filter for datanode
* fixed test
* fixed test
* Fixed passing request body via datanode proxy
* disable entity capturing for datanode rest proxy calls
* datanode rest proxy refactored to okHttp client
* code cleanup, jwt token and auth filter separation
* Removed unused import
* code cleanup, fixed request body issue
2024-01-09 11:48:03 +01:00
Matthias Oesterheld
c6101f395c
Remove a data node from the cluster ( #17248 )
...
* service, rest & permissions for data node management
* add tests
* add reset data node event
* add states and transitions for node removal
add node removal functionality
* changelog
* add datanode permissions to permission list
* add audit event types to list
* add custom thread factory
* add node removal integration test
refactor rest calls in ITs
* wait for primary shard node availability
* refactor duplicate code
* simplify node retrieval
* add `@OnlyInSecuredNode` annotation and request filter
move delete endpoint to management controller and secure it
adjust IT
change javadoc
* stabilize tests
2023-11-20 13:33:26 +01:00
Tomas Dvorak
42aa1c36ed
add banner for initial datanode start, promoting preflight interface ( #17008 )
2023-10-20 14:44:17 +02:00
Jan Heise
38b9e9066b
DataNode: Simplifying hostname usage Part 2 ( #16741 )
...
* simplifying hostname usage part2
* added suppress message
* removed comment
2023-09-29 08:09:33 +02:00
Tomas Dvorak
70d6edc8a2
basic auth for datanode rest api if security enabled ( #16446 )
...
* basic auth for datanode rest api if security enabled
* added changelog
* adapted to master changes
* configurable rest admin username in datanode
---------
Co-authored-by: Jan Heise <jan.heise@graylog.com >
2023-09-15 20:52:14 +02:00
luk-kaminski
e7025a9da8
Insecure startup of OS in datanode only if explicitly configured ( #16108 )
...
* Insecure startup of OS in datanode only if explicitly configured
* Data node can be started without starting OS, just to be discovered by pre-flight mode
2023-08-07 17:21:08 +02:00
Tomas Dvorak
e39a53ed2d
Refactoring/opensearch security setup ( #16087 )
...
* Start datanode jersey only after ssl configuration resolved, listen to change events
* Adapted DatanodeSecuritySetupIT to work with https version of the datanode interface
* simplify hostnames in DatanodeSecuritySetupIT
* code cleanup
* added changelog
* code cleanup
* disable security plugin and perf analyzer in matrix tests opensearch
* Fixed datanode jersey service
* Fixed opensearch instance env
* Opensearch security setup refactored
* code cleanup
* removed commented out code from datanodes JerseyService
* add fqdn to the http cert in the DatanodeSecuritySetupIT
* configure truststore only if the security is enabled
* code cleanup
* reintroduced root certificate finder
* adjusted class and methods visibility of RootCertificateFinder
2023-08-02 14:33:50 +02:00
Tomas Dvorak
b4c2f1f90c
Start datanode jersey only after ssl configuration resolved, listen to change events ( #16058 )
...
* Start datanode jersey only after ssl configuration resolved, listen to change events
* Adapted DatanodeSecuritySetupIT to work with https version of the datanode interface
* simplify hostnames in DatanodeSecuritySetupIT
* code cleanup
* added changelog
* code cleanup
* disable security plugin and perf analyzer in matrix tests opensearch
* Fixed datanode jersey service
* Fixed opensearch instance env
* add fqdn to the http cert in the DatanodeSecuritySetupIT
2023-08-02 10:46:08 +02:00
Tomas Dvorak
21e55cbcb6
Initial Data Node version PR ( #14417 )
...
Co-authored-by: Jan Heise <jan.heise@graylog.com >
2023-02-27 13:11:24 +01:00
